§1The angle: indeterminacy is an attribution problem wearing an ethics costume
Happe, Cito and Wachter (arXiv:2607.20255) argue that LLM-driven offensive security agents differ from traditional penetration-testing tooling along three independent axes of indeterminacy: their actions come from a non-deterministic policy that resists both ex-ante and ex-post explanation; their impact is open-ended; and their user population is indeterminate in size and skill because the skill floor for running offensive capability has dropped sharply. They are right on all three. But the framing as an ethics paper undersells what is actually broken. This is not first an ethics problem. It is a records problem. Every one of the three indeterminacies converges on a single failure at the substrate layer: when an autonomous agent runs the attack, no party holds a record that can answer for the action.
That is the thing regulated buyers should read this paper for. Not the moral philosophy, sound as it is, but the observation that moral attribution becomes diffuse between users, tool-makers and third parties. Diffuse attribution is what you get when nobody's audit trail is authoritative. And the industry building agent infrastructure is, right now, shipping exactly the thing that makes attribution diffuse.
§2Why the three indeterminacies are really one missing log
Take the first axis. The authors note that agent actions resist ex-post explanation, which frustrates incident attribution and pre-deployment safety review. In a deterministic pentest tool, the action set is fixed and the operator's command history is the record. You can reconstruct what happened because the tool did only what it was told. An LLM agent chooses its own action from a policy you cannot inspect and cannot replay deterministically. So the command history no longer reconstructs the incident. You have a transcript of prompts and a transcript of API calls, and neither of them is a causal account of why the agent did what it did.
The second axis, open-ended impact, compounds this because of the opaque LLM supply chain. When the model behind the agent is a hosted API, the operator does not control, version-pin, or even see the weights that produced the behaviour. If a provider silently updates a model, the same agent scaffold produces different actions on Tuesday than it did on Monday. There is no reproducible artefact. For anyone who has to demonstrate to a regulator that a system behaved as specified, this is the whole ballgame: you cannot attest to behaviour you cannot reproduce.
The third axis, the collapsing skill floor, matters here for a reason the paper touches but does not press. When the operator population was small and trained, attribution rode on professional identity: a named practitioner ran the test under a scoped engagement letter, and that person was accountable. Drop the skill floor and you sever action from professional identity. The operator may not understand what the agent did, cannot explain it after the fact, and has no engagement letter binding the scope. Attribution had been living in the human, quietly, this whole time. The agent evicts it and nothing takes its place.
So the three axes are not really independent for the buyer, even if they are analytically distinct as the authors carefully show. They land on the same spot. There is no record that is (a) reproducible, (b) causally explanatory, and (c) bound to an accountable party. Traditional tooling gave you all three almost by accident. Agentic tooling gives you none of them unless you build for it deliberately.
§3The cost asymmetry cuts the same way for defenders' records
The paper's sharpest structural claim is the cost asymmetry between offence and defence, and the conclusion that the net short-term effect favours attackers. The usual reading is about volume: attackers can now industrialise, defenders cannot scale response as cheaply. True. But there is a records dimension the paper leaves implicit.
The attacker running an offensive agent does not care about attribution. Diffuse moral attribution is a feature for them, not a bug; they want their action untraceable to a person. The defender running an autonomous agent, in a blue-team or automated-response role, inherits the exact same indeterminacy and cannot tolerate it. A defender operating in an FCA-regulated firm, a UK Local Authority, or an NHS trust has to be able to say afterwards what their own automated system did, to whom, and why. So the asymmetry is worse than the paper states. Offence gets the benefit of indeterminacy for free; defence pays the full cost of engineering it away before it can deploy the same class of tool. The substrate work that makes a defensive agent legally usable is work the attacker simply skips.
This is where the agent-infrastructure community should feel the discomfort. We build the scaffolds, the tool-calling loops, the memory and the orchestration. If we ship those without a first-class, tamper-evident, party-bound action record, we have built the attacker's tool and left the defender to retrofit the accountability. The substrate that closes the attribution gap is not a monitoring afterthought. It is the thing that decides whether an autonomous security agent can be operated at all inside a regulated firm.
§4What the buyer should actually demand
Concrete asks, derived from the three axes. Against the explanation gap: require that the agent emits a decision record per action, not just an API-call log, capturing the prompt state, the retrieved context, the tool invoked and the model-reported reason, timestamped and hash-chained. It will not be a true causal account (nothing short of the weights is) but it is the difference between a reconstructable narrative and a shrug. Against the supply-chain gap: require model version pinning and refuse hosted endpoints that cannot attest to which weights served a request. If the provider cannot pin, the system cannot be attested, and it should not be inside the perimeter. Against the skill-floor gap: bind every agent run to a named, authorised operator and a machine-readable scope, and refuse to execute outside it. That reinstates the engagement letter that professional identity used to carry implicitly.
None of this is exotic. It is the same separation-of-concerns discipline the ICO's guidance on AI and data protection expects around auditability and the FCA's operational-resilience and model-risk expectations assume: you can explain and evidence what your automated system did. The paper describes the hazard in ethical terms. The buyer's job is to translate it into procurement clauses.
§5What the paper does not solve
Happe, Cito and Wachter are explicit that they analyse and recommend; they do not build. Their stratified recommendations are aimed at users, tool-makers and third parties, and they are sensible, but they are governance recommendations, not mechanisms. The paper does not specify what an attributable action record for an autonomous offensive agent should contain, nor how to make it tamper-evident, nor how a defender proves after an incident that their own agent stayed in scope. It also does not resolve the hardest part: even a perfect decision record is not a causal explanation of a non-deterministic policy, so "attribution" here means "defensible reconstruction", not "proof of intent". That gap is real and the paper does not pretend otherwise. Finally, the democratisation-of-defence optimism at the end is asserted, not evidenced; the short-term attacker advantage is the part with structural argument behind it, and it is the part regulated buyers should plan around.