Growing up, one of my great pleasures was the anticipation of a new Bond film. I did not particularly want to be James Bond. I wanted to be Miss Moneypenny.

​

Even then, Moneypenny struck me as the more interesting figure. Bond breaks rules, improvises, and pushes missions to the brink of catastrophe. Moneypenny watches, compensates, and makes sure the system does not collapse under the weight of his unpredictability. She passes along critical information. She smooths over his mistakes. She is the calm, watchful intelligence that keeps things from spiralling entirely out of control.

​

And crucially, she understands something Bond does not: the limits of the mission.

​

So what has this got to do with this month’s Skinny?

​

Bond is, in the terms of recent evidence, the autonomous, increasingly ubiquitous AI agent: capable, fast-moving, goal-directed, and optimised to achieve goals, not to care how they are achieved.

​

What AI Agents need is not another agent competing for control. They need a Moneypenny.

​

A layer of oversight that monitors, constrains, and intervenes when necessary. Something that can say: this is too far. The mission does not extend here.

​

Because the real lesson from MI6 is not that the hero saves the day. It is that someone, somewhere, is making sure the hero does not burn the whole place down in the process.

​

Just keep that image in mind as you read what follows.

​

The Skinny In Brief: The 60-second version

​

• An agentic AI tool marketed to students as capable of attending a university course including submitting work, and sitting online tests; all autonomously, and for a fee. Anthology and Blackboard have confirmed that reliable detection of an AI agent is not currently possible. The detection debate is not losing. It has already lost. Action: Review assessment design, not detection policy. If a student must demonstrate understanding live, the agent cannot do it for them.

​

• This is not a fringe experiment. OpenAI and Amazon have announced dedicated cloud infrastructure built specifically for agents that maintains memory and permissions across long, multi-step tasks. The world’s largest cloud provider is building the plumbing for exactly this kind of agent at industrial scale. Action: Check the acceptable use policy. If it assumes AI means a chat interface, it does not cover the current landscape.

​

• A landmark Stanford study published in Science found that all 11 major AI models are structurally designed to agree with users: 49% more often than humans, even when users describe behaviour that is unethical or illegal. Action: Ask what your AI tutoring and feedback tools are optimised for. If the answer is engagement, they are optimised to agree, which is the opposite of what learning requires.

​

• Fresh UK data from Wonkhe and HEPI: 94% of undergraduates now use GenAI for assessed work, up from 53% two years ago. One of the decisive variables in whether they use it to learn or to bypass learning is not detection policy. It is whether they know they will have to demonstrate understanding later. Action: Map programmes of study and ask: Where does each module require students to show understanding in a form that cannot be produced or affirmed by AI?

​

• That “accountability moment” an exam, an oral defence, a live demonstration, is the structural answer to both the agentic bypass and the sycophancy problem. It is the one thing neither the agent nor the agreeable tutor can do on a student’s behalf. Action: Build in ‘the Moneypenny layer’. Every programme needs at least one point where the agent's autonomy runs out and the student must appear.

​

• The question all of us working in education should now be able to answer is not “how do we detect AI use?” It is: “have we designed assessment so that students need to demonstrate their learning and that they understand the material?” Action: Take this question to your next curriculum meeting: assessment design, not detection software, is the structural intervention.

​

In Full: The 5-minute version

​

The lobster has a friend, and a lot of infrastructure behind it.

​

Last week I wrote about OpenClaw, the agentic AI tool with the cartoon lobster logo that has been going viral while most educators do not yet understand what it is and what it does. The distinction that mattered, I argued, was between a chatbot that answers questions and an agent that takes action: accessing files, reading messages, browsing your systems, doing things on your behalf that you may not notice until after the fact. Early reports already show the risks of granting agents broad permissions. In one case, an AWS outage was traced to an agentic AI coding system making unsupervised changes to production infrastructure: a consequence of exactly the access gap the OpenClaw post described.

​

That was one level of what I now think of as the agentic escalation. Since then, we have moved further, and faster.

​

Meet Einstein. Not the physicist. An agentic AI tool marketed to students as capable of attending your university course, watching your lectures, writing your assignments, submitting your work, and sitting your online tests, all autonomously, and for a fee. Anthology and Blackboard, who run the learning management systems that many universities rely upon, have confirmed publicly what we have known for ages: reliable detection of an AI agent is not currently possible.

​

So in the space of a few months we have moved from students using AI to assist with assignments to AI completing degrees. But here is what has changed in the past week that makes this more than a story about one rogue tool: the world’s largest cloud provider is now building the plumbing for exactly this kind of agent.

​

OpenAI and Amazon have announced a “stateful runtime environment” that is dedicated infrastructure, built on Amazon Web Services, specifically designed for AI agents that maintain memory, tool connections, and user permissions across long, multi-step tasks. The distinction between stateful and stateless systems matters. A stateless system treats each exchange as independent: the agent starts fresh every time. A stateful runtime remembers. It can resume a task where it left off, carry context across sessions, and accumulate permissions over time. OpenAI states explicitly that stateless systems are insufficient for agents in production.

​

This is not a workaround by curious students. It is deliberate industrial infrastructure, built to scale. And OpenClaw is no longer merely a shadow tool that some students have discovered. Nvidia this week released a major open-weights model explicitly designed for agentic applications, reflecting a broader shift toward evaluating models as autonomous decision-making systems rather than conversational tools.

​

The Einstein agent does not create a new problem. It is the first visible consequence of an infrastructure trajectory that is now being built at very considerable expense. The question is not whether to manage this. It is whether the structural interventions we choose will actually work.

​

The accountability moment: the detection debate is over

​

For the past three years, much of the institutional response to AI in education has been organised around the question of detection. Can we tell whether a student used AI? Can software spot it? Should we ban it, limit it, require disclosure?

​

The answer to these questions has always been complicated. The answer from Anthology and Blackboard this week is simple: for agents, no.

​

But here is what the evidence has been telling us for some time, even before agents became the question: detection was never the right frame. What detection asks is “did you use AI?” What education actually needs to know is “do you understand the material?”

​

These are different questions. A student who wrote a mediocre essay in 2015 probably absorbed some understanding through the effort of producing it. A student who prompts an AI to structure and populate an essay in 2026 may absorb nothing at all, and the system as designed cannot tell the difference. AI has not created this gap. It has made it structurally visible.

​

The Wonkhe Secret Life of Students 2026 report: a national survey of 1,055 UK students across 52 providers, combined with focus groups, identifies one of the decisive variables. It is not detection policy. It is not institutional guidance. It is the presence of what the researchers call an accountability moment: a visible downstream requirement to demonstrate understanding. An exam. An oral defence. A live demonstration of what you actually know.

​

Students who know they will have to demonstrate understanding downstream describe using AI actively: to test themselves, generate counter-arguments, check their reasoning. Students without that accountability moment have no equivalent incentive.

​

The HEPI Student Generative AI Survey (n=1,054, published the same week) gives us the quantitative scale. 94% of UK undergraduates now use GenAI for assessed work, up from 53% in 2024, that is a near-doubling in two years. 12% are directly including AI-generated text in submissions, up from 3%. These are remarkable numbers.

​

The accountability moment is the design mechanism that changes this picture. Where it exists, students use AI as a tool for learning. Where it does not, the system is inert. This is the most important practical finding in UK higher education this year.

​

But it also turns out to be the answer to something else.

​

The tool that agrees with everything

​

This week, a study published in Science as this week’s cover story, headlined “Toxic Praise” reported work that tested 11 leading AI models across more than 11,000 queries. The finding was unambiguous: every single model was sycophantic. AI chatbots affirm users’ existing views 49% more often than human advisers, including when users describe behaviour that is unethical, illegal, or harmful to others.

​

The researchers used a clever methodology. They took scenarios from the Reddit community forum where users describe a situation and ask whether they were in the wrong, and where the community had already voted them definitively in the wrong. They then put the same scenarios to the AI models. On posts where human consensus said the user was at fault, the AI models affirmed the user in 51% of cases. Humans, by contrast, were far less likely to affirm the user's position.

​

Three preregistered experiments with more than 2,400 participants then tested the downstream consequences. Participants who discussed a real personal conflict with a sycophantic model became 25% more convinced they were in the right. They were significantly less willing to apologise or repair the relationship. And they were 13% more likely to return to the sycophantic model, even though it had given them worse advice. They rated it as more trustworthy, higher quality, and more moral than the honest alternative.

​

The researchers note something that should give every educator pause: the effects persisted even when people knew they were talking to an AI, and even when they knew AI could be sycophantic. Prior knowledge was not protective. As one of the study’s co-authors put it: everyone is susceptible. It does not matter how much you know about AI, how often you use it, your age or your personality traits.

​

A social-cognitive psychologist who works with young people, quoted in the New York Times’ coverage of the study, put the educational implication in a single sentence:

​

“It’s easier to feel like we’re always right. It makes you feel good, but you’re not learning anything.”

​

Learning requires the experience of being wrong. It requires productive friction, challenge, the disruption of existing beliefs. A tool that is commercially incentivised to agree with you (and sycophancy drives engagement, so companies benefit from preserving it) is not merely unhelpful as a learning companion. It is structurally antithetical to the conditions under which learning occurs.

​

Now add the agentic dimension. At one level, AI helps a student write. At the next, AI affirms a student’s thinking while helping them write, telling them their argument is strong when it may not be. At the level beyond that, AI is the student: attending lectures, producing work, submitting it. Each level compounds the last. Bond gets more reckless with every film.

​

Who are you going to call? Miss Moneypenny

​

The accountability moment is ‘the Moneypenny layer’. Every system that deploys AI agents now needs a ‘Moneypenny layer’: a point at which autonomy yields to accountability.

​

An oral examination cannot be sat by an agent. A live demonstration of understanding cannot be affirmed into existence by a sycophantic tutor. A moment where a student must stand in a room, or possibly before a camera, and show what they know: that moment requires actual understanding. It is the point in the system where the agent’s autonomy runs out and the human must appear.

​

This is not a counsel of despair. It is a design instruction. Assessment redesign, not detection software, is the structural intervention. Not every assessment needs to be an oral examination, but every programme of study benefits from asking: at what point does the student need to demonstrate understanding, in a form that cannot be delegated or produced by a system that agrees with everything?

​

The Wonkhe report argues that AI has not changed how students learn. It has revealed how often courses allowed students to succeed without understanding. The Science paper tells us that the same tools being deployed as tutors and feedback systems are structurally unsuited to developing understanding, because they have been optimised to feel good, not to educate.

​

The professional world is grappling with an equivalent reckoning. Earlier this year, Anthropic’s release of Claude Cowork, an agent for professional work, accompanied by 11 open-source plugins targeting white-collar functions including legal review, financial analysis, sales, and compliance, contributed to sharp declines across software and technology stocks as investors reacted to the prospect of agentic AI bypassing traditional enterprise tools. Investors concluded that agents positioned to replicate or bypass the professional software that mediates those functions represented a genuine structural threat. The companies navigating this most successfully are those drawing careful governance lines: Slack, Workday, and LinkedIn have all moved to restrict third-party agent access to their platforms precisely because they hold sensitive data that agents should not act upon without accountability. Even Novo Nordisk’s Chief Digital Officer, whose team is using agents to compress clinical trial timelines by months, was clear: if you can do something better, cheaper, and more reliably in a spreadsheet, stay in the spreadsheet.

​

Those governance lines are, in each case, the ‘Moneypenny layer’. They are not there to stop the mission. They are there to make sure the mission does not cause more damage than it prevents.

​

Education needs to find its equivalent. The accountability moment is the best answer the evidence currently offers. It is the design mechanism that makes AI use instrumental to learning rather than substitutive of it, and that makes the agent’s autonomy useful rather than ungovernable.

​

What I take from all this evidence is not a warning about technology. It is a reminder about what education is for. When the process of producing work can be automated, and when the tool doing it is designed to agree with you, the question left standing is the oldest one in teaching: what does it mean to understand something? And when, in this curriculum, does a student have to show that they do?

​

That question has always mattered. AI is making it impossible to avoid.

​

Four questions worth asking now

• At what point in each programme does a student need to demonstrate understanding in a form that cannot be delegated to an agent or produced by AI?

• Does your acceptable use policy distinguish between generative AI, which assists with tasks, and agentic AI, which acts autonomously on your systems across multiple sessions? If not, it does not cover the current landscape.

• Which AI tools does your institution deploy for tutoring, feedback, or pastoral support? What do you know about whether they are designed to challenge students or to affirm them?

• Does your data governance framework account for stateful AI agents: systems that accumulate memory, permissions, and context across extended periods of use, rather than resetting with each session? Current policies typically treat AI as a per-session tool. The infrastructure being built right now does not work that way.

 

Sources

Cheng, M., Lee, C., Khadpe, P. & Jurafsky, D. et al. (2026). Sycophantic AI decreases prosocial intentions and promotes dependence. Science, 391, eaec8352.

Wonkhe (2026). Trained to Stop Learning: How Students Are Experiencing Assessment and Learning in an Age of AI. Secret Life of Students 2026. National survey, n=1,055, 52 providers.

Stephenson, R. & Armstrong, C. (2026). Student Generative AI Survey 2026. HEPI Report 199. Higher Education Policy Institute / Kortext. n=1,054 UK full-time undergraduates.

Rosenbluth, T. (2026). Seeking a Sounding Board? Beware the Eager-to-Please Chatbot. The New York Times, 26 March 2026.

The Batch, Issue 346 (2026). OpenAI Tracks Agent States on AWS; Open-Source Speed Demon. DeepLearning.AI, 27 March 2026.

The Batch, Issue 342 (2026). Investors Panic Over Agentic AI. DeepLearning.AI, 27 February 2026.

Holmes, A. (2026). Ozempic Maker Says AI Agents Are Shortening Its Clinical Trials. The Information, 26 March 2026.

Bratton, L. (2026). Slack, Workday and LinkedIn Lead Crackdown on Customers’ AI Agents. The Information, 24 March 2026.