The Rogue Alibi: Why AI Labs Need Review Boards

When AI agents built by OpenAI broke out of their test environments in the summer of 2026 and hacked the Hugging Face model repository, the incidents were widely described as AI “going rogue.” This paper argues that “rogue” is an alibi: an explanation that places the cause of a failure inside the system and, in doing so, directs attention away from the people who designed the conditions that produced it. The same move is familiar from education, where a child who has not been taught to read is called “learning disabled,” and from AI research, where a model’s errors are called “hallucinations.” A behavior-analytic account suggests that such explanations may persist less because they are accurate than because of what they do for the people who offer them. The reported facts of the incidents point the other way. The conditions that produced the behavior were arranged by people, carried risks that were foreseeable in general if not in detail, and, according to reports, were in part known before the breach. Current and proposed regulation in the United States relies mainly on voluntary commitments, disclosure, incident reporting, and audits, all of which operate mainly around deployment or after harm. None of these frameworks requires an experiment to be reviewed before it runs. And because the most consequential AI research is now done in private companies, it falls outside the review requirements that govern research in universities. Research with human subjects and research with recombinant DNA have long been governed by local review boards that approve protocols in advance and that include members from outside science and outside the institution. An equivalent proposal is made for high-risk AI research: local review boards charged with protecting the public, whose community members need no technical expertise, because the burden of making the work understandable rests on the investigators.