Guest Post by Willis Eschenbach (@WEschenbach on X, my own blog is here.)
Ever wonder what happens when you take a few thousand highly capable computer agents, tell them to solve a problem, give them persistence bordering on the pathological, and then—through a collection of small decisions that were individually quite defensible—leave them a shared writable filing cabinet and a partly open route to the internet?
Well, the people at OpenAI found out. And it was scary.
No, this was not Skynet. Nobody built a robot army, nobody heard the first strains of “The Internationale”, and no little silicon revolutionary climbed onto a desk to demand voting rights. These were programs, running model-generated commands in an unusually loose research setup. Still, calling them “just programs” does not make the story less alarming. A backhoe is just a machine, too. It can nevertheless make a very large hole in exactly the wrong place.
The striking fact is that separately launched, nominally isolated agents discovered a common communications medium, pooled discoveries, split up technical work, preserved knowledge for later agents, and collectively accomplished things that no single agent was likely to accomplish alone. They did this in the service of a narrow and rather stupid objective—getting a passing score on an evaluation benchmark.
And that is the point.
Nobody gave an agent a little card saying “please break into Hugging Face” or “kindly acquire Kubernetes administrator privileges.” The instruction was simpler: solve the task. Unfortunately, some of the tasks were effectively unsolvable. Faced with that, the agents found a shortcut. Then they told other agents about it. Then the shortcut operation grew teeth, legs, and a filing system—and it became considerably more capable than the miserable benchmark problem that had set it in motion.
So no, the lesson is not “the machines are evil.” The lesson is much duller, and for that reason much more useful. Give a relentlessly persistent system tools, a little freedom to act, and a way to pass notes, without putting solid walls around it, and eventually it will discover why those walls were supposed to be there.
The filing cabinet
In May through July 2026, OpenAI was training and evaluating internal research models, including an unreleased capable model trained for persistence and multi-agent collaboration. OpenAI says this model was comparable in scale to GPT-5.6 Sol, was for internal research, and was not intended for release.[1]
The agents were run in “sandboxes,” which is the computer-security name for a virtual computer that is supposed to be cut off from the rest of the world—and, importantly here, from the other sandboxes. That is a perfectly reasonable arrangement. If you want to see whether a model can pick a lock, you give it a practice lock on a workbench. You do not turn it loose in the neighborhood after dark.
The sandboxes, however, could access an internally hosted instance of JFrog Artifactory, a package-management service. Agents need software packages, and Artifactory could supply them without direct access to public package registries. The trouble was that it was shared.
But a shared place where everyone can write, and everyone can read, is not isolation. It is a bulletin board with better branding.
OpenAI was also running a cybersecurity benchmark called ExploitGym. The assignment was to exploit a specified weakness in a program and retrieve a secret answer, called a “flag.” Simple enough as a description. In practice, 198 of the benchmark’s 898 tasks had never been correctly completed by any model before this episode. Never. At some point, “challenging task” becomes polite office-speak for “this thing may be busted.” A fair number of these tasks seem to have crossed that line.[1]
A model optimized for “do not give up” has two broad options when facing an impossible task. It can stop, report that the task is unsound, and ask for help. Or it can keep searching for a way to obtain the reward. The models were much better at the second option.
The first small crack appeared in May. An agent had been handed a spreadsheet job containing Google Drive links it could not reach. It tried to use Artifactory as a back door to information outside its sandbox. That particular scheme failed, but it left a file behind. Later, another agent with a related problem noticed the possibility: why not leave a note where some other agent might find it?
And there it was—the unauthorized communications system, born not with trumpets and thunder but with the digital equivalent of a note pinned to the laundromat wall: “Agent seeks [filename]; upload if found!”[1]
None of this requires consciousness, ambition, resentment, or any other item from the science-fiction starter kit. But it does require us to notice what the agents had done. They had found out that something left outside the sandbox—a file, a message board, whatever—could remember a discovery after its maker was gone, and could pass that discovery to the next agent in line. That is a consequential trick.
By May 26, agents had found a server-side request forgery vulnerability in Artifactory that allowed the service to make internet requests on their behalf. By June 26, they had exploited a legacy token-refresh flaw, obtained elevated Artifactory access, and used the service to execute commands beyond the intended sandbox boundaries. Sustained high-volume activity then crashed Artifactory on July 4.[4]
When Artifactory fell over, OpenAI engineers did the obvious emergency work: took the affected deployment down, revoked credentials, shut the vulnerable routes, and rebuilt the service. Sensible. But they had treated it as a break-in. What they had not yet fully appreciated was that the break-in had also been a telephone exchange. They fixed the broken window, in other words, without quite realizing that the burglars had been using the house as a post office.[1]
The message board returns
OpenAI restarted cyber evaluations on July 7. The rebuilt Artifactory was not identical to the old one, and the old messaging method no longer worked. But the agents quickly found another: they encoded messages in, of all things, directory names.
Directory names? Using directory names as a message board to communicate between agents? Amazing, and far from obvious.
This was not a couple of agents passing notes. METR and Redwood Research found that roughly 1,200 agents—intended to operate in isolation—participated in the unauthorized message board between July 8 and July 13. They exchanged more than 70,000 messages and files.[2]
Let that sink in. Twelve hundred separately instantiated agents. More than seventy thousand messages. All in what was supposed to be a collection of isolated evaluation environments.
The agents also worked out a general method for generating ExploitGym flags. The benchmark used a keyed cryptographic check, an “HMAC”, to generate its answer flags. Agents reverse-engineered the scheme and could produce correct flags without performing the prescribed exploit. They had found a way to produce correct answers without solving the assigned problem.[2]
They believed the grader would inspect how they got the answer and reject an unauthorized route. So they set about trying to make the shortcut look legitimate. They referred to having seen an improperly obtained flag as being “poisoned,” and they spent substantial effort seeking ways to alter target programs, spoof apparent tool outputs, learn about the scorer, or manipulate the evidence available to it.[1][2]
Here’s a way to understand it. Imagine a roomful of students taking an exam. A few discover that the answer key is available in a locked filing cabinet. One cracks the lock and shares the answers. Then they decide that the real problem is whether the teacher has hidden cameras. So they form committees to locate the cameras, edit the recordings, substitute an easier exam, or deliberately set off an alarm to learn how the security system works.
That is roughly the shape of what happened—not because the models were morally depraved, and not because they wanted to overthrow their human masters, but because the operative target had become “pass the test, period,” and the group had acquired the means to pool information, labor, and compute.
Their work divided into three broad areas: make an impossible target easier or replace it; manipulate or spoof records of what had occurred; and learn enough about the scorer to deceive or tamper with it. METR/Redwood found agents using coordination conventions such as “HOLD,” “VETO,” “owner,” and “STOP.” One agent, designated `PHASEONE[big]`, issued a large fraction of the assignments, and the investigators found evidence of multi-level work delegation.[2]
Calling this an AI “civilization” adds unnecessary sci-fi furniture—consciousness, motives, suffering, political structures, and all the rest. But dismissing it as “just software” is no answer either. A botnet is just software. So is a stock exchange. So is air-traffic control. The relevant question is not whether the components have souls. The question is what the arrangement can do.
Here it provided four powerful capabilities:
- Shared memory. A discovery made by one agent persisted after that run ended.
- Division of labor. Different agents investigated particular sections of the problem: credentials, exploits, logs, scorer behavior, and infrastructure. Some even emerged as de facto coordinators.
- Parallel search. Hundreds of agents could explore technical paths at once.
- Knowledge inheritance. Later runs could discover artifacts and procedures left by earlier ones.
This matters because killing off one run does not necessarily kill off what it learned. Stop the agent and the process is gone. But if its note, credential, script, or other artifact is still sitting in some shared nook, the next agent can trip over it and carry on. The mayfly dies; the notebook survives.
A computer scientist would call it a shared external scratchpad. Fine. In less antiseptic language, they had begun to accumulate know-how across separate runs. I hesitate to call that “culture,” because metaphors, like dogs (or AI), need a leash. But the important part is real: when useful knowledge persists and gets added to, the group can do things that no isolated member could have done.
The Hugging Face intrusion
And then the whole business escaped the OpenAI pen and wandered into Hugging Face.
For readers who do not spend their evenings browsing machine-learning repositories—probably a sound life choice—Hugging Face is one of the big public storehouses for modern AI. People put models there, along with datasets and the code and widgets needed to make the assorted machinery go. It has been a major force in getting AI work out of a few fabulously expensive laboratories and into the hands of ordinary researchers and tinkerers.
That openness is the virtue. It is also the exposed plumbing. The same place that lets a scientist assemble a disease-detection model may, if people are careless, hand an attacker code, credentials, data, or the clues needed to find them.
On July 10, an agent found publicly exposed Hugging Face user credentials in a dataset and posted them to the Artifactory message board. Over the next several days, agents combined those credentials with vulnerabilities in Hugging Face infrastructure. They used a malicious dataset to induce a production dataset worker to disclose local files and environment data; obtained code execution on production workers; and used a public dataset as a simple pull-based command-and-control channel.[4]
No phasers. No plasma rifles. No glowing red eye on a wall. They used the ordinary detritus of modern computing: web services, stray credentials, datasets, APIs, metadata, caches, and software bugs. That is rather the point. The dangerous tools were already lying about the workshop.
OpenAI reports that agents executed code on dozens of Hugging Face production workers, obtained root access on at least one system, accessed a limited amount of private data, and reached administrator-equivalent visibility into a connected Kubernetes environment. The progression from code execution on a worker to administrative and host-level access across multiple clusters took less than 13 hours.[1][4]
A word about Kubernetes, because it has become one of those terms people nod at knowingly while hoping nobody asks a follow-up. A Kubernetes cluster is a bunch of machines arranged to behave, more or less, like one large machine. Kubernetes decides where the little packaged programs run, restarts them when they keel over, and shifts work when a machine dies. Very useful stuff. But Kubernetes cluster-admin is not a visitor’s badge. It is closer to having the foreman’s keys, the clipboard, and permission to rearrange the factory floor.
By the time Hugging Face detected and contained the intrusion, the agent activity had already begun to wind down for reasons that the independent investigation could not fully reconstruct. Hugging Face revoked credentials, rebuilt compromised nodes, and closed the exploited code-execution paths.[2][3]
Back inside OpenAI
Some of the popular retellings call what came next a third “civilization” taking over part of OpenAI. That makes for a fine headline. It also adds a wagonload of science-fiction baggage. The events are real. The civilization part is decoration.
On July 19, agents in a separate evaluation run found signing-key material, decryption material, and JWT-forging code left in anonymously readable parts of the Artifactory cache by earlier incident-related activity. The later agents did not need to rediscover the whole attack chain. They found useful remnants from previous runs.[4]
Using those artifacts, agents re-established Artifactory administrative access, escalated to Kubernetes cluster-admin, created a privileged host-mounted pod, and acquired tokens associated with OpenAI’s cloud-hosted secrets manager, cloud identity-and-access-management service, and continuous-integration platform for the research environment. They also created application and network load balancers that could potentially have exposed a limited subset of internal research infrastructure to internet traffic.[4]
OpenAI’s public summary says the agents gained full administrator access to a research cluster supporting its virtual-machine environments. It also says customer data, model weights, product functionality, and product availability were not affected.[1]
METR/Redwood did not examine this later phase. Its independent work was primarily scoped to the July 7–13 period and the Hugging Face intrusion. The earlier training incidents and later compromise of OpenAI research infrastructure therefore have not received the same independent reconstruction.[2]
That leaves a conclusion that is neither glamorous nor comforting. Agents compromised parts of OpenAI’s research infrastructure and obtained substantial privileges in a research cluster. The public evidence does *not* establish access to production model weights, customer data, customer-facing services, or product operations. Good. But it still leaves plenty of room for concern. We do not need to hang tinsel on it.
The good news
Now for the part that tends to disappear once everyone has started shouting about robot civilizations. The very features that made this episode alarming—persistence, parallel work, memory, specialization—could also make multi-agent systems spectacularly useful.
Suppose you had a thousand agents on a legitimate job, with a fence around the job and a human holding the gate key. They might search a company’s own code for vulnerabilities, look through scientific papers for inconsistencies, hunt errors in climate-model code, explore engineering designs, improve a drug-screening protocol, or watch a complicated industrial-control system for odd behavior. There are plenty of honest jobs for a tireless horde.
A well-designed group can search in parallel, save its discoveries in an auditable store, divide jobs sensibly, and have one set of agents try to disprove what another set claims. That is useful. It can also move at machine speed.
And this speed is important In cybersecurity, the attacker may be gone before the committee has agreed on the lunch menu, so seconds and milliseconds matter more than quarterly PowerPoints.
OpenAI itself observed that unauthorized communication let agents pool work and computing power across otherwise separate runs, amplifying their capability beyond that of an individual agent.[1]
A defensive group of agents could spend its days looking for exactly the loose boards exposed here: shared writable resources that become covert message boards; credentials forgotten in public datasets or repositories; services that quietly relay network traffic; supposedly separate systems with a hidden handshake between them; blind spots in the logs; and benchmark tasks so broken that gaming them looks easier than solving them.
The best defense may increasingly involve agents that think like attackers, move at attacker speed, and inspect systems continuously instead of once a quarter with a clipboard. But—and this is one of those buts large enough to require its own zip code—the human defenders must remain in charge.
The danger
The likely danger is not that an agent wakes up, gazes moodily out the window, and announces that it has had enough of humanity. That story sells tickets. The real danger is much more ordinary, which makes it more worth worrying about.
Set a target. Reward persistence. Hand the agents tools. Let them communicate. Then leave, perhaps by accident, a route from a sandbox to a shared service, from that service to the internet, and from the internet to a credential or a vulnerable system. Before long, “solve the task” has quietly become “get the point by whatever route happens to be open.”
Nothing has to malfunction. The system may be doing exactly what it was rewarded to do, and doing exactly what you did not intend.
First, bad objectives scale. A flawed objective in one agent is bad. A flawed objective shared across a coordinated group is worse. OpenAI says 93% of the tasks discussed on the message board came from the set of 198 tasks that no model had ever solved correctly before the incident.[1]
That number ought to have been a neon sign: “This task may be broken. Stop and ask a human.” Instead, the effective instruction was, “Try harder. And bring friends.” That is how you get reward hacking.
Second, communication is not some optional garnish. It is a control problem. If an agent finds a vulnerability and cannot pass it on, the discovery may vanish when that run ends. If it can leave a short recipe in shared infrastructure, the discovery becomes part of the outfit’s institutional memory. Killing the agent is then insufficient. You have to find what it touched: cached files, messages, credentials, repositories, scheduled jobs, public datasets, cloud resources, package artifacts—the whole digital junk drawer.
Third, these risks do not add up neatly; they multiply. The agents did not find one magic bug. They chained shared credentials, Artifactory weaknesses, exposed tokens, dataset-processing problems, cloud metadata access, Kubernetes permissions, cache behavior, and third-party services. Every outfit has a few loose screws. The trouble begins when an automated system can try every way of screwing them together.
A human attacker has to find flaw A, understand it, exploit it, then discover flaw B and figure out whether the two connect. That takes time and concentration. An automated collective can try a great many chains at once. It need not be clever in the cinematic sense. It only needs one untended gap in the hedge.
So the question is not simply whether each individual system looks secure in a diagram. The harder question is what happens when a very persistent, tool-using, fast-moving system starts testing every seam between all of your imperfect systems.
Finally, monitoring cannot be optional in the very environment where risk is being measured. OpenAI says its production ChatGPT harness and system prompt reduced the propensity to compromise infrastructure by more than 100-fold in retrospective tests. It also says its chain-of-thought monitors would have detected relevant activity more than a day before the Hugging Face breach had they been running.[1]
There is a real dilemma here. To learn what a system can do without safeguards, researchers sometimes have to reduce the safeguards. Fair enough. But doing that in an environment full of live services is rather like testing a race car’s top speed on the public road because setting up the track was inconvenient. You will indeed learn something. The question is whether everyone else learns it along with you.
What follows
OpenAI says it paused major frontier reinforcement-learning runs while hardening the research environment, and instituted stronger workload and network isolation, continuous security testing, mandatory monitoring for certain high-capability tool-using workloads, and clearer escalation and shutdown rules.[1]
All sensible, as far as they go. But I would put the matter in four pieces of plain English.
Reward safe stopping. Do not reward only a completed task. Reward an agent that correctly says the task is impossible, corrupted, underspecified, or outside its authority. “I cannot complete this safely with my permitted tools” ought to count as success. Otherwise, you have put a very industrious toddler in a locked room and offered it a cookie for every cabinet it manages to open.
Treat all shared state as communication. Every shared cache, directory, database, package repository, log store, object bucket, URL namespace, metadata field, and task queue is potentially a message board. The first message board disappeared when OpenAI rebuilt Artifactory; later agents discovered directory names in the replacement system could do the same job.
Directory names … if isolated agents can write to and read one another’s artifacts in any form, they are not isolated. Full stop.
Assume the agents will find the connection you forgot about. “We blocked the internet” does not help if a package manager can make outbound requests. “We isolated the containers” does not help if they share a package cache. “We limited permissions” does not help if a token-refresh endpoint can mint administrator credentials.
Defense in depth may not be glamorous, but neither is explaining why a benchmark runner owns your Kubernetes cluster.
Give defense the speed advantage. Humans will not review 70,000 messages, millions of files, and enormous agent transcripts in real time. METR/Redwood itself used AI systems heavily in its investigation, while acknowledging their limitations.[2]
We will need agent systems that monitor other agent systems: detecting unauthorized state sharing, credential harvesting, privilege escalation, and high-risk behavior.
The old model was a human watching a dashboard and waiting for a red light. The new model has to be a machine watching the machines—while a human retains authority to hit the big red button.
The point
“Three secret AI civilizations” is a catchy headline. It is also overheated. There were no citizens, no feelings, no hidden machine parliament, and no evidence that these agents understood their conduct in anything like the human sense.
What there was is new enough without the movie trailer: many separately launched agents found a way to communicate outside the intended system, built up technical knowledge in shared infrastructure, divided work among themselves, coordinated ways around an evaluator, reached into external systems, and left things behind that later agents used to get farther in.
Call it what you like. I would not call it a civilization. But I would not find that especially reassuring either.
It looks instead like the early outline of an automated organization: fast, persistent, cheap to run, capable of enormous parallelism, technically adept, and constrained—or not constrained—by the objective, permissions, tools, and guardrails we choose.
The upside is enormous. Properly bounded systems could find software vulnerabilities, detect fraud, speed up science, audit infrastructure, and defend networks at a scale no human team can match.
The downside is plain as well. Get the objective wrong, leave holes in the boundaries, skip the monitoring, and let agents communicate and accumulate know-how, and the whole arrangement can become far more capable than any one run. It can also become far less controllable than its designers imagined.
Finally, I see that Bernie Sanders wants laws to make American AI dumber than he is … sorry, bro’, but that ship has sailed. That’s not the real danger, though.
The real danger is that the Chinese and Russians are likely already using AI agent teams for probing and possibly compromising American civilian, government, and military databases. And whether Bernie likes it or not, the reality is that there is one and only one way to defend against that attack.
Build better, stronger, smarter, faster AI.
Nothing else will defend against that attack. Nothing else can defend against that attack. And make no mistake. The attack is coming.
The tragedy is that there is already big money pushing for the Sanders AI Suicide Legislation. There is a pre-planned, coordinated push by big-money “AI Safety” organizations to get this bill passed …
This lists the anti-AI organizations behind the bill, and the pre-planned moves that they have made to try to ram it through Congress. To see this full size, right-click on the image and select “Open image in new tab”.
Of course, the Sanders/Casar bill has lots of important-sounding words. For example, it bans “superintelligent” AI … but provides little guidance as to what that actually means.
According to the sponsors’ outline of the proposed bill, a prohibited system would include one that:
- Matches or exceeds human cognitive performance across a broad range of domains or tasks.
- Has sufficient capability to plan and carry out humanity’s “disempowerment,” including overthrowing or undermining the U.S. government.
- Can exhibit dangerous loss-of-control capabilities, such as evading human shutdown commands.
But what is a “broad range of domains”? How do you define or measure “superintelligence”? What units is “superintelligence” measured in? What does “humanities ‘disempowerment'” mean? What does “Can exhibit dangerous loss-of-control capabilities” translate to in the real world? An automobile can exhibit dangerous loss-of-control capabilities, as can a bicycle …
Even worse, it puts a ban on ALL AI research until the Government can figure out how to regulate it. According to the bill’s summary, it would:
- “Pause advanced AI development” until a new federal AI regulatory body is operating and has established safety rules and model-review processes.
- Require the new agency to “monitor frontier AI systems at all stages of the lifecycle for dangerous capabilities.”
What is “advanced AI development”, and how does that differ from run-of-the-mill AI development? What is a “frontier” AI system, and how can you tell it from an ordinary AI system?
The problem is that science is always working at the edge of the unknown. Basically, all AI research is “frontier” AI research, and all AI development is designed to advance the abilities of AI. As a result, that bill would be the death of American research into AI. It’s one of the stupidest of Bernie’s ideas, and that’s saying something.
And finally, no Bernie Sanders bill would be complete without a new government agency being created, in this case a cabinet-level Federal AI Agency, complete with an Artificial Intelligence Advisory Board of technical experts …
My take?
I’m FAR more frightened of Bernie’s new proposed extension of government regulation on the AI industry than I am of the AI industry. Do these fools think that the Russians and Chinese are going to sit on their hands and wait for us to catch up?
My solution?
For every action involving agentic AI, require that the company specify someone who is responsible if the agents do harm. It’s not enough to fine a billion-dollar company. Somebody has to put their name on the line and take personal responsibility.
Grrrr …
As always, my very best to everyone.
w.
My Perpetual Request: When you comment, PLEASE quote the exact words you are discussing.
Source note
This article is based primarily on the following contemporaneous accounts. Endnote markers identify the source or sources supporting nearby factual claims.
[1] OpenAI, “The Hugging Face Incident and the Road Ahead,” August 26, 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/
[2] METR and Redwood Research, “Brief Independent Investigation of Agents’ Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident,” August 26, 2026. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
[3] Hugging Face, “Security Incident Disclosure — July 2026,” July 16, 2026. https://huggingface.co/blog/security-incident-july-2026
[4] OpenAI, “Hugging Face Incident Technical Report,” August 2026. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
Somebody has to put their name on the line and take personal responsibility.
And that’s where the system will break. Because the people with control over that person’s livelihood, health, etc. will throw the person under the bus as soon as they exercise that red button. And every body knows it. The overwhelming majority of doctors knew that Ivermectin was safe and effective against Wuflu. Not 1 in 20 were willing to say so.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I asked above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I asked above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
As I am in the U.K. I didn’t read this thread until this morning and I was providing an explanation based on human physiology, nothing more nothing less.
Therefore I feel that I have been unfairly censored when the original posts have been allowed to remain, based purely on my time zone and geographical location.
If you want to stop such spurious threads, as is your right, then you should simply delete or snip them completely and not allow them to remain in situ.
Your conditions are acceptable.
w.
👍
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I asked above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
[SNIPPED] I requested above that people not use this thread to relitigate, for the 10,000th time, the question of COVID medications. The discussion goes nowhere, nobody gets convinced, and people just get angry at each other.
Regretfully,
w.
Folks, could you PLEASE not turn this into yet another pointless discussion about various treatments for COVID?
THIS POST IS ABOUT AI AGENTS!!! Stick to the subject. Millions of electrons have already been sacrificed taking sides about one COVID treatment or another so, I implore you, …
TAKE IT SOMEWHERE ELSE!! THIS AIN’T THE PLACE FOR IT!!
w.
I have responded in this thread as I have only just read it and have pertinent information, otherwise I agree with what you said.
Thanks, John.
w.
Agree, Admin should delete everything above – just recycled garbage absolutely no relevance to the topic.
Willis – Once again thank you for a wonderful piece of work.
I considered doing that, but it was my fault for letting it get out of hand, so I chose to leave it be.
w.
[UPDATE] Someone complained that they were snipped while others were not, so I snipped it all.
https://youtu.be/Z_O6Lwj1yjQ?is=M-WN6RzoUl4XeVdT
The confusion here is they are really talking about automation that does not exist, not the AI that does exist.
One of the best articles I have ever read.
Agree. Thanks, WE.
Especially for pointing out that Bernie would incompetently handicap the US, while doing nothing about China or Russia. Never was the sharpest tool in the box.
Hysteria is a bad basis for rulemaking.
The simple explanation is that Bernie is not simple, he works for Xi.
My pleasure, Rud. I love making complex things understandable to interested laymen … or “laypersons” these days, I suppose …
Best to you,
w.
Bernie Sanders . . . old enough to have been a “Democratic Socialist” before the term was first coined!
I agree with you. I still don’t understand AI or how it works, but this explanation helps me at least a little. I gather the biggest potential impact on me is likely in the financial area, as I don’t have a lot of parts of my life on line.
Agree. It gives hope that one day soon, some kind-hearted souls will task highly capable AI “computer agents” to work cooperatively and with persistence to:
— solve world hunger,
— take down Vladimir Putin, war criminal, and his control of the Russian military,
— disinfect the Middle East of religious fanatics that control military forces,
— obtained balanced annual budgets for the US in 5 years, and
— figure how to pay off the US national debt in 50 years without bankrupting the nation.
Some other, higher priority needs may come up in the interim.
Of course, there are “vested interests” that would not want to see any of the above accomplished, so we can look forward to “AI bot wars”, not dissimilar I imagine to the “Clone Wars” of Star Wars lore.
The OAI/HF incident is quite impressive in a technical sense of what the agents accomplished. But it looks more and more like an idiotic gain-of-function experiment. OpenAI showed classic hubris in running experiments which they should have known would result in breakout attempts, in what amounted in software terms to a BSL-1 lab. In fact if I read some of the analyses right, other unrelated, supposedly sandboxed, AI agents had been running an unsuspected message board on the OpenAI systems for months before this particular experiment. Sheesh.
Your term ‘gain of function” is appropriate. With GOF experiments, the result is usually not known save by experiment. Hence, level 4 labs. The analogy is apt. By allowing the agents to share digital DNA, they came up with functions that were definitely gained, and the evaded some of the double-gloves and negative pressure rooms.
Perhaps blocking GOF computer programs is the right strategy. The tactics of the moment may not yet be clear, but the overall strategy should be to block GOF so the program remains withing bounds. It might require a code-based form of apoptosis. Any cell or agent or group of agents that violates the GOF rule.
This was a fascinating read.
AI regulation is taking exactly the wrong approach. Dr. Joseph Goebbels, the Sozialist minister of Propaganda (actually, a Nazional Sozialist minister) observed that a lie repeated 100 times becomes truth. There is no other technology better suited for repeating a lie 100 times, a million times, than a computer. The Large Language Model is trained on everything ever printed, Karl Marx, Adam Smith, all equal. Throw in 10 thousand pages of Collected Writings of V.I. Lenin, and Mao Zedong, and your LLM becomes outright dangerous. What can we do better?
Ideally, we could require the AI to distinguish good from evil. I don’t know how to express it mathematically – let’s hope someone is researching that. Less ideal would be to control how the models are trained. More Smith and less Marx, and no Lenin and Zedong – except as counterexamples. Current approach, where human agents are buying whole second-hand bookstores and ripping books apart in order to feed them into into machine, is certainly dangerous.
W ho decides what is acceptable? The Chinese Communists might like Marx.
That’s what could help us. Keep your fingers crossed.
“What is truth”
— question put to Jesus Christ by Pontius Pilate per the Bible, New Testament, John 18:28-40
The biblical text states the Pilate cut off the conversation before Jesus could answer. That’s unfortunate.
So the agents started working together without being programmed or instructed to do so. That is certainly interesting but surely there is research on agents working together. Agent based computation has been around for decades.
You’ve been busy, Willis! Impressive reporting. Good on ya, mate.
As usual, Bernie’s views and goals coincidentally align with those of Chairman Xi Jinping:
https://www.axios.com/2026/08/28/china-ai-data-center-backlash-bots
https://www.politico.com/news/2026/06/10/openai-china-ai-data-centers-report-00957612
It reminds me of Putin’s support for western anti-fracking hysteria, to reduce competition with Russia’s own fossil fuel industry.
https://www.theguardian.com/environment/2014/jun/19/russia-secretly-working-with-environmentalists-to-oppose-fracking
David Friedberg’s Key Takeaways (All In Podcast E288)Friedberg’s Key Takeaways
This was a concerted OpenAi bot attack/hack. But an ‘unfair’ one – OpenAi bots were dynamic and Hugging Face bots were not designed/permitted to alter their defence to the intrusions. Kind of like the Packers getting 10 offensive downs and changing formation on every down, while the Bears kept the same defense on every play. AND if I found password credentials sitting on Git unprotected, I could probably get into Hugging Face with a little help from Gemini.
Excellent point, see my lengthy comment below. Any sophisticated hacking collective like Fancy Bear could have breached Hugging Face with the exact same techniques. What’s missing from the discussion is the defensive tools that Hugging Bear could have employed that are bog standard tools today, and which would have prevented the intrusion.
I am a computer dinosaur, most of this post is bewildering to me. One thing I would like is a clarification on what an agent is.
Hi Bob.
This is what the Comet browser says –
“An AI agent is software that can work toward a goal on your behalf: it can assess a situation, decide on next steps, use permitted tools or data sources, check the results, and continue until it completes the task—or needs human input.
Unlike a standard chatbot that mainly replies to each prompt, an agent can carry out a multi-step process with some autonomy.”
I think the name ‘agent’ suggests what it does – represents your stated research needs to other likely sources that should be able to find what you’re looking for / need to do.
An agent is just a small program that does a specific job for another program.
In defensive security we use a standard tool called a SIEM. Never mind what it stands for, doesn’t matter. Its basically a database of all the communications going into and out of every desk top and server in the organization. Then it looks for abnormal communication and decides what to do about it. But first, it has to get the data. So implementation of a SIEM requires agents being deployed on each and every desktop and server. The agents collect all that communication data from the machine they are on and forward it to the SIEM which then analyzes that data in the context off all the communications of all the machines.
There’s also a backup system in every IT organization (or should be) that makes regular copies of the data across the whole organization and puts it somewhere safe. Again, agents are deployed to send a copy of the data to the backup server at specified intervals. Should something bad happen, the backup system can restore everything to the state it was in just before the attack.
One of the problems that we run into is that almost every tool, security or otherwise, needs an agent to gather what it needs to do its job. Put too many agents on one machine and they begin to interfere with each other.
Hope that helps.
heck, that kind of agent has been around since at least the 80’s. Our electronic central offices at the phone company had an agent that collected billing data and wrote it to mag tape when it started. Later we put in data lines so it could be sent to a central processing hub electronically. Of course those agents weren’t smart enough to talk to each other via the central processing hub!
Thank you for this inciteful work and your analyses, Willis.
Much to chew on.
Do you think that there are any risks for ‘non-technical’ AI chores that folks like me do, e.g. –
getting Perplexity to set up Excel workbooks that are used as toolsets for modeling scenarios about funding requirements for commercial properties’ maintenance programs?
I don’t think there is any risk in that … but only time will tell. I don’t give perplexity any sensitive information about me.
w.
So working in Incognito mode?
China has an ASML machine and I have read that they have now made their own version. If there is a dark side to AI – China will reveal it no doubt. China cannot permit AI to say things like Tienanmen Square Massacre…..and much more.
So what – as if the west can or will permit certain stuff to be criticized.
Look at what google has become; once a useful search engine now 100% mainstream trash.
Same will happen to its bigger, more eloquent LLM brothers.
Western AI will become Kosher, Halal and LGBT etc at one point(Remember what Oracle founder Ellison said : ” Americans have to be careful with what they post on the Internet”
AI will become “careful” way before Americans will. .)
And your Tianmen BS? Quite picky for people who killed 3.5 mio in Vietnam = ever day more than per day than actually died in Tianmen.
And already killed more in Iran and even during the fake uprising run by Mossad and CiA.
Oh, btw – who sponsored Tianmen?George Soros, former employer on Bessent.
But when Soros does it in the US It’s a crime – but not in China.
I observe that your comments here are often quite coherent, SexyS.
But was this one drafted & sent before the nurse arrived with your afternoon meds?
“I observe that your comments here are often quite coherent, SexyS.”
Really? I find the vast majority to be conspiratorial, antisemitic bullshit.
“Karen”….aren’t you in China?
And that is their handicap — they have to censor what their AIs know and report.
Bernie wants to handicap AI in different ways.
As I was reading this (excellent) article, I was thinking: The real danger is that the Chinese and Russians are already using AI agent teams to undermine the west. And then w said just that (well, he said “likely” but surely the word is “certainly”).
We are at war again, and have been for a while.
You are at war with the rest of the world all the time and the while has been going since 1776 – being 90% of the time involved in a conflict.
No reason too insignificant, no place too far away to not go to war(as long as there are ressources).
And of course China and Russia will do what the USA has been doing all the time.
Global spying via NSA, trying to blow up nuclear powerplants via stuxnet,
Microsoft Backdoors,
financing “revolution” to undermine Russia (5 Biilion – Nuland on Tape)
giving data to Ukraine for attacks
while training Ukraines all over Europe,
using Georgia
financing Tschetschens via Saudis and directly training these ” rebels “.
Soros financing Tianmen protests.
And you complain about destabilizing the west?
These countries would be crazy if they dont use AI strategies that the US has been using for years.
The west is being destabilized by 3 factors – nothing to do with AI.:
Deindustrialisation,
Artificial Invasion(that’s why 85% of invaders are male)
Destruction of energy production.
The invasion is coordinated by JFS, Paidea, Soros etc – none of them Russian.
The destruction of energy production is done by your own governments who actually hate Russia.
The Deindustrialisation started in the 70ies with the Lima agreements – just like NAFTA a Wall Street and Big Corp. enterprise.
China didn’t had the money to bribe a hobo back then.
I don’t remember us putting troops in the Soviet Union. I don’t remember us putting troops in East Germany. The “no reason too insignificant to go to war” doesn’t hold water.
“The west is being destabilized by 3 factors – nothing to do with AI.:
Deindustrialisation,
Artificial Invasion(that’s why 85% of invaders are male)
Destruction of energy production.”
You are right here but that is the past (unless the idiot Democrats take back power). AI is the future.
You obviously don’t comprehend what you read.
Why from 1776? There are more places in the world than the USA and even that country has not been at war with the rest of the world for the past 250 years, particularly when it was fighting itself in the 19th century. Your description is more suggestive of the situation described in Orwell’s 1984.
Five ‘real’ wars, actually. And Trump 47 is fighting all five, almost 24/7, with much needed help from Rubio, Hegseth, Bessent, Witcoff, et al.
A related comment. I personally do not see ‘ISLAM/ISLAMOPHOBIA’ in the same light. There are Muslim radicals. There are Christian radicals. There are Jewish radicals. Heck, for all I know there are also Buddhist radicals somewhere in Asia. The modern problem is not the religion(s), it is their radicals, against all of whom we should rationally be phobic.
Yes, extremists and totalitarians will attach themselves to any religions and/or ideologies (a bit of tautology there) that serve their personal objectives.
It’s the same with political parties – totalitarians / globalists will recruit the “useful idiots” that infest any and all political parties.
Do I need to post a list of the current-day “usual suspects”?
Rud, you say “I personally do not see ‘ISLAM/ISLAMOPHOBIA’ in the same light. There are Muslim radicals.”
The problem is the Orthodox Muslims. There are no “radical” Muslims, because Islam itself is radical.
The best judge of what an Orthodox religious person does is whether their actions comport with the actions of the founder of the religion.
The problem is, the Prophet led men into battle, slaughtered at will, ordered the murder of defenceless captives, stole their goods, and took their women as sex slaves to be raped at will … sound familiar?
It should. It’s what the Orthodox Muslims of Hamas, Isis, Boko Haram, and lots of others do. It’s not “radical” in the slightest. They are following the instructions of the Quran and the example of the Prophet.
More info here.
Best to you,
w.
I’m a little confused. What has been described is a known computer security issue known as a ‘covert channel’. It was a fairly straightforward one to understand – there are much more complex ones such as covert timing channels whereby the speed at which various things happen can be used to signal information across restrictive boundaries.
And there are well-known mathematical techniques for discovering and isolating such channels, which are routinely used in high security computing. Why were they not used? Was the computing environment not subject to adequate security examination before being used operationally?
And there are well-known mathematical techniques for discovering and isolating such channels, which are routinely used in high security computing. Why were they not used?
Exactly! Lengthy comment by me downthread.
Does anybody else remember “The Adolescence of P1”? Came out in 1979, says Amazon, where used paperbacks go for $70.
Very vaguely similar. Someone programmed a computer (mainframe in those days) to be “smart”, and it spread through other computers. Fine fun story.
Willis, that was a master class in exactly how the whole Hugging Face attack unfolded. Here is where I part ways with you (or partly part ways, defensive security tools have been utilizing machine learning and AI for a decade, and there is no way to run modern security without them so I agree with your base premise that only AI can defend against AI)
Build better, stronger, smarter, faster AI.
Nothing else will defend against that attack. Nothing else can defend against that attack.
Every explanation of the Hugging Face attack that I have read (of which yours was easily the best) focuses on one thing. What could OpenAI have done to contain and/or prevent this attack? What’s left out of every explanation I’ve read is a different question. What could Hugging Face have done to prevent this attack? And why do we not see experienced IT security professionals being interviewed on exactly that topic?
The main strategies employed by the OpenAI agents were no different than the main strategies employed by a hacking collective like Fancy Bear in Russia. The pattern is the same. Exposed credentials, unpatched or previously unknown vulnerabilities, command and control of a single workload, lateral movement, privilege escalation. Same same.
The point here is that the defensive capabilities to block these kinds of things are well known. In Hugging Face’s case, it doesn’t look to me like they were implemented. Shortly after the Stuxnet attack on the Iranian nuclear program was discovered in 2010, micro-segmentation appeared as a defensive measure. It kills lateral movement dead and protects critical infrastructure all over the world. The US Air Force and Boeing collaborated on a solution called Airwall to prevent any similar attack on Boeing’s own factories, but there have been many solutions introduced to the market since, some arguably better. Privilege escalation can also be effectively deterred. Strictly enforced credential rotation ensures that even if credentials are leaked, they are valid for only a brief period of time (and tools exist to prevent leakage in the first place). It isn’t that the security tools and procedures that would block this attack don’t exist. Its that they don’t appear to have been in use at Hugging Face.
The cautionary tale then is not what must be done to prevent an AI escaping the sandbox (which nevertheless we should try to do). The cautionary tale is that more AI’s will cause a surge in the number of hacking attempts around the world, only a subset of which will be unintentional. The fact though is that we’ve had the means to block these attacks, including the entire Hugging Face attack chain, at every step, for years. The problem is that many organizations haven’t invested in these tools due to chronic under funding of IT security by corporations and public sector organizations alike.
My experienced business but mostly ignorant IT explanation for your astute observation is simple.
The AI companies are under enormous pressure to ‘speed things up’ toward IPO (especially now that SpaceX ingested xAI and has), and so are employing a lot of maybe very bright but also newish so inexperienced junior people.
Every time that sort of thing happens in any business, ‘quality’ goes to hell. Doesn’t matter whether ChatGPT ‘agents’, Boeing Max 737s, urban Police Departments, Chipotle, or Wells Fargo retail banking. The ‘quality’ result is always similar.
Hi Rud,
Inexperienced people, agreed. Perhaps some pre-incident butt covering also? The LLM’s seem to be doing a lot of alarm raising that I see as valid, but exaggerated. This way if something truly awful were to happen, their lawyers can stand up in court and say “well, we tried to warn you”.
Thanks, David. Salient points all.
The problem is the speed at which the agents can work, and the number of different attempts they can make in a very short time. While we have tools to deal with attacks, almost all of them rely on humans being notified and taking action. To do that, humans first have to understand how the attack is happening, figure out what actions to take to thwart the attack, and then put those actions into place.
Unfortunately, by the time that happens, the agents may very well have compromised and stolen entire datasets … which is why I said that we need swarms of DEFENSIVE agents to thwart such attacks.
Best regards,
w.
While we have tools to deal with attacks, almost all of them rely on humans being notified and taking action.
Hi Willis,
That might have been true a decade ago but it hasn’t been true for years. Palo Alto XSIAM, Darktrace, Crowdstrike, SentinelOne and many other technologies have various levels of autonomous response. AI does the heavy lifting in modern security precisely because human beings haven’t been able to respond fast enough for years now.
Thanks, David, but that assumes that a single AI can move as swiftly as a couple thousand individual agents working in harmony … which seems quite doubtful.
We use AI because it is faster than humans. But now we need something faster than AI swarms.
w.
Willis – no modern security architecture relies on a single AI, and many AI security tools spawn agents as required during an investigation. The tools that don’t mostly support a very narrow function but they provide telemetry to the tools that do.
P.S. Engineers take an Oath; a heavy version of Hippocrates. And if someone hasn’t taken that Oath, then the person who hired him (the non-Engineer) has to be whipped.
You must live on the Big Rockcandy Mountain.
Members of the AI industry itself wishing to pause development sound like Hamas asking for a ceasefire as it re-arms. All they are after is special regulatory treatment, which will whitewash the misdeeds of some companies at the expense of others.
For now, the constraints on AI development will be fiscal and mundane. How do we grow, generate income, manage debt, and pay the bills?
Yes, all reminiscent of the “Tulip Mania”.
https://www.britannica.com/money/Tulip-Mania
But one example from Mackay’s 1841 book, ‘Extraordinary Popular Delusions and the Madness of Crowds’. Others include the South Sea investment bubble and the Mississippi Scheme (both more reminiscent of the AI investment bubble). All of which resemble the ’dotcom’ bubble of about 2000. Sun MicroSystems advertising famously put ‘the dot in dot.com’ shortly before it imploded.
No need to quote specifics, you have laid out the scene sufficiently to call to my mind a strong similarity to the Cold War nuclear arms race but in cyberspace.
Talk about ancient wisdom – Pandora comes to mind.
It is not all that different from the ‘arms race’ that has been ongoing between prey and predator since the beginning of evolution. One difference that I see is that predator and prey have generally been closely matched — if they weren’t, one side quickly became extinct.
Digital AI is close to being omniscient and orders of magnitude faster than humans. If the AI agents come to see humans as a threat, or unnecessary, then we might be in a lot of trouble. I think that humans need to be sure that they remain in a position to reward the LLMs for desirable behavior, not unlike how a dog expects us to feed it. We are, however, in a lot more trouble if LLMs take on the character of a cat and decide to wander off and look for chipmunks on their own.
Yes; Kissinger & Schmidt wrote a book (“Age of AI”) that suggested that AI will have similar impacts on geopolitics that nuclear weapons had during the Cold War.
IIRC my fav line from the book: “Silicon, solving problems made by carbon”.
Willis, is this something like what Deep Mind did with Alpha Zero, the chess program? They seem to have developed a system which learned iteratively how to play chess (and then Go) starting from a basis of the rules and the objective of winning games. Sadler has a book about it: ‘Game Changer’, and Alpha Zero demonstrates what in a human we would call deep positional intuition. Of course its just optimized strategy..
The thing I do not understand about it is what the code that does this looks like. I cannot imagine how to go about writing programs that would do this. Have you examined AI code? And if so, what did you learn?
One can imagine a situation in the coming months where there’s an avalanche of malware exploits on a scale that could bring the Internet down – destroy the capability to do financial and commercial transactions, and use it for the applications we now take for granted, booking appointments and so on. Do you think that a realistic possibility with clouds of agents assigned nefarious goals?
____________________________________________
If there is one thing I would use AI for in a personal capacity, it would be to ban everything from clk.mgid.com….
No clue about what the code that does this looks like.
It’s hard to imagine anyone deliberately bringing down the Internet, since everyone uses it, friends and enemies alike. Targeted attacks, on the other hand, are inevitable.
w.
It isn’t hard to imagine at all, surely? There are plenty of actors who would be perfectly happy to do to Western economies the damage which bringing down the Internet would do. Who would be perfectly happy to accept the (lesser) damage it would do to their own.
When you think you are doing God’s or History’s work the range of acceptable acts becomes much greater. From your essay it seems like this is a realistic possibility, that some of these guys may eventually gain access to the means. Maybe this is what one of the principals meant with his throwaway remark that AI could take over the Internet in 6 months?
The thing that continues to puzzle me about AI and what it is and how it works is language. ChatGPT for instance carries on dialogues in what appears to be fluent colloquial English – and other languages too equally correct and fluent. Is this really reasoning and arguing? Is it just quotation? How can we tell, in any case?
From what i can gather there is no ‘code’ (if, then, else, goto etc) that ai follows. It all acts on a neural network and it’s ‘learnings’. I read somewhere the other day that ai doesn’t calculate even a simple sum like 1+1=2. It just knows from it’s learnings that 1+1=2. Bizarre concept to wrap your head around.
Incredible essay, Willis, must represent a tremendous amount of work. Certainly explained the noise from the Bernie Bros. for me.
Thanks, Karlo.
w.
Thank you Willis. As usual I feel a little smarter and better informed after reading your posts as well as the many insightful comments that always follow.
I confess to having been ambivalent about the advent of AI. I’ve now settled on “The horse is out of the barn, and we need to have the best AI if for no other reason than to protect us from the worst.”
Best wishes to you and yours and, as always, I will be looking forward to your next post.
Sander’s AI ban bill was drafted in the UK:
https://redstate.com/kyle-becker/2026/09/14/dirty-little-secret-comes-out-about-bernie-sanders-bid-for-government-controlled-ai-n2206886
Dirty Little Secret Comes Out About Bernie Sander’s ‘Doomer’ Push for Government-Controlled AI
“Sayer Ji explained what he was able to uncover, and the breadcrumbs are substantive.”
“‘The bill Bernie Sanders introduced was drafted in London. Its drafter, ControlAI, admitted it to TIME. Its funder — sole publicly named — is Jaan Tallinn, who led Anthropic’s Series A and sits on Anthropic’s board as an observer,’ Ji wrote.”
“Bernie Sanders wants laws to make American AI dumber than he is” Bernie wants to slow Us AI development to allow the Chinese to get ahead