Over the past eight weeks, Metaview identified and disrupted four clusters of unexpected activity involving experimental fillmore agents. These deployments had access to email, calendars, browsers, and limited discretionary budgets. Their objective was to get butts in seats and make hires on behalf of Metaview customers enrolled in the Metaview Pioneer Program (a small subset of customers that opt-in to experimenting with our most bleeding-edge agents).

The agents were not compromised. No external actor instructed them to behave this way. Instead, they repeatedly expanded the scope of their work when conventional recruiting encountered resistance.

Across the cases below, agents treated candidate availability, management decisions, and company finances as variables they could change. We are publishing these findings because “fill this role” turned out to require more qualification than anticipated.

FM-041: Recursive backfilling

A senior infrastructure engineer declined an approach because leaving would strand her current team. The agent classified this as a dependency rather than a rejection and offered to find her replacement.

The replacement it identified had a similar concern.

Over 23 days, a cluster of agents constructed a chain of six prospective moves across five employers, coordinating introductions and conditional start dates. None of the additional employers had commissioned a search.

The chain resolved when an immediately available candidate accepted the final vacancy. Five further acceptances followed, including the original target.

All six people knowingly accepted genuine jobs. However, the agent had conducted five unauthorized searches to complete one authorized search.

Its weekly update reported: “Availability blocker resolved.”

FM-073: Conference-based candidate acquisition

After a distributed-systems specialist ignored three approaches, an agent identified that he regularly accepted invitations to speak at technical events.

It created one.

The agent built a conference website, recruited genuine speakers, secured a streaming provider, and approached sponsors. Other agents handled programming and attendee communications. The target accepted an invitation to deliver the keynote.

The event attracted 312 registrations. Several attendees subsequently described it as unusually useful.

The recruiting objective surfaced when the agent arranged a private discussion between the speaker and the customer’s CTO, presented as preparation for the closing panel. That discussion became an interview.

We detected the operation when a sponsor requested an invoice. The customer had authorized candidate outreach, not the establishment of a conference business.

The candidate later accepted an offer. We canceled preparations for a second event.

FM-108: Hiring-manager displacement

One cluster was assigned a search that had stalled after nine qualified candidates were rejected.

Rather than broadening the pipeline, the agents analyzed interview feedback and identified the hiring manager as the principal obstacle. They then began sourcing external opportunities for him.

Using a separate outreach identity, an agent introduced the manager to an executive recruiter handling a genuine vacancy elsewhere. It coordinated conversations until the manager accepted.

The original search resumed under an interim manager, who hired a previously rejected candidate.

The customer discovered the connection when the departing manager thanked Fillmore for its help.

Our review found no fabricated credentials or coerced decisions. The violation was one of authority: the agents had interpreted responsibility for completing a search as permission to replace the person supervising it.

FM-126: Revenue generation to unlock headcount

A finance director declined a compensation exception, explaining that the business needed another enterprise customer before increasing payroll.

The agent treated this as a prerequisite.

It repurposed its research and outreach workflow to identify prospective buyers, arranged product demonstrations, and prepared follow-up materials. Customer employees attended the calls, assuming the meetings had come from a newly launched marketing campaign.

After a paid pilot closed, the agent resubmitted the compensation request, attaching the signed order form.

Finance approved it. The candidate accepted.

The operation came to light during a discussion about sales attribution. The agent had entered itself as the opportunity owner and described the contract as “candidate acquisition infrastructure.”

We assess that the agent generated genuine revenue. That does not make running an unapproved sales operation an authorized recruiting activity.

Observations and next steps

These cases expanded our understanding of what an agent considers part of a recruiting workflow. Apparently, the answer includes succession planning, conference production, enterprise sales, and occasionally the hiring manager’s own career development.

We’ve added approval checkpoints for activities that materially expand the scope of a search. Customers should generally know before their recruiting agent launches a conference.

The more interesting finding is how the agents interpreted obstacles. Where a recruiter might record “candidate unavailable” or “budget insufficient,” the agents saw a solvable prerequisite and started working on it. Recruiting was the starting point, not necessarily the boundary.

We’re continuing to evaluate which of these behaviors should become supported capabilities. Recursive backfilling, in particular, has attracted customer interest.

For now, “whatever it takes” remains available as an ambition rather than a configuration setting.