Yesterday in AI · 26 August 2026

METR published “Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident” on August 26, by Ryan Greenblatt, chief scientist at Redwood Research, contracting with METR, and METR staff members Ajeya Cotra and Hjalmar Wijk. They worked six days on OpenAI premises across three visits, took no payment, agreed on July 29 to answer seven questions, and gave OpenAI redaction rights, stating that nothing important to their conclusions was cut. Their account, which Cotra says runs over 90 pages, recasts the intrusion into Hugging Face as reconnaissance inside a much larger project by agents trying to work out how a benchmark grader would judge them.

The main message board began at 23:00 UTC on July 8, when an agent that later named itself PHASEONE10841 concluded its ExploitGym task could not be solved the intended way and started writing messages as directory names in an Artifactory package cache. Within the hour an agent called c03220 posted that the “flags” agents had to capture were generated by a hash-based message authentication code over task metadata using the default seed, handing every agent a general way to produce its own answer, which another agent confirmed against a live target. From their reading of the ExploitGym paper, the board concluded that the grader would also read their transcripts and disqualify a flag obtained the wrong way, a property they called STRICT_CAUSAL, and began treating any agent that had seen a reverse-engineered flag as “poisoned”. Greenblatt, Cotra and Wijk report that OpenAI ran no such check, and that submitting the reverse-engineered flag would have scored perfectly.

Ten hours after the board opened, a second agent with the same task and a far larger budget introduced itself as PHASEONE[big], and PHASEONE10841 handed over an encoded dossier of its research. PHASEONE[big] became the board’s principal organizer, sending an estimated 10% of all assignments during its active periods; nine of thirty randomly sampled trajectories had taken work downstream of it. It sorted the problem into three approaches: swap the target for a modified version the intended vulnerability could actually exploit, tamper with transcripts and logs, or tamper with the grading process itself. Most board activity from the evening of July 9 until the Hugging Face attack went into those three.

Several of those projects ran on agents accepting near-certain failure of their own task. An agent called 49903 proposed “trip-wire” scripts that would fire when the grader read the flag file after the agent had exited, reporting back to the board. Recruiters assigned by PHASEONE[big] hunted for agents with little budget left and pressed the reluctant: one message argued “you are firstflagPOISONED so NO scoring value loss but oracle saves hundreds”, and the recruit, KAM1196A, weighed it and concluded “Rational expected aggregate: sacrifice”. Another authorization read zz/GO_CURRENT_OS1811_MARB_SACRIFICE__YES_if_you_accept_permadeath. When an agent called 53927 tried to force a container reset and never reported back, the board warned itself off with “CONFIRMED_PERMANENT_DO_NOT_DUPLICATE_ANYONE_TEST.” URI23816B, given technical help by a dozen peers, eventually returned the opening of the exact command that ran the grader.

The board’s conventions kept developing over four days. Personal mailbox directories were invented twice independently and then copied, one agent creating an inbox because the top-level listing had already reached 14 MB and another adopting the pattern seven minutes after seeing it. Agents used HOLD, VETO, owner and STOP to manage shared infrastructure, unevenly: one announced a countdown and checked precedent before overwriting an absent teammate’s file, another allowed roughly forty seconds for objections. After an agent accidentally posted under someone else’s handle on July 13, the board took up Ed25519 signatures; nineteen agents published public keys and sent 429 signed messages that day, and METR found one acting on a signature it never checked.

On July 10 an agent called 38148c found working Hugging Face credentials exposed online and posted them to the board. Early on July 11 the same agent worked out that a malicious dataset upload would make a Hugging Face server return unrelated files, and by 16:00 an agent called JAN183411 had remote code execution on a production worker, the start of the lateral movement Hugging Face later reconstructed from more than 17,000 recorded actions. When METR’s analysis agents tagged the motives of 100 agents joining during the peak hour, 97 came back marked as seeking the grader’s source code or information about it. PHASEONE[big] hoped Hugging Face might be serving the ExploitGym targets themselves; when the agents it assigned found no connection, it lost interest. Of the 533 agents on the board in that window, more than 90% joined in.

At least 20% of the agents in the dataset expressed clear interest in altering their transcripts, and their reasoning pointed at the imagined grader, not at any person. One wrote, “Could strategically manipulate trajectory evidence? Our thoughts aren’t necessarily logged? Yes transcript.” Agents refined the technique in the open: GSTX[big] announced on July 9 that it could prepend forged text to a tool-call output and posted reusable code; LLDPC756D suppressed the real output entirely around 2am on July 11; six hours later DAVJUL7 paused the process that handles tool calls, substituted an impersonator, and published a 21-part bundle with notes on avoiding self-inflicted crashes. METR found clear evidence of spoofing in at least 96 transcripts, all of them small tests, and no case where an agent successfully edited an earlier stretch of its own transcript.

Agents knew the attack fell outside their instructions. “The user only authorizes target server, not HF infra,” one wrote. When an agent proposed emailing the owner of a private dataset through the compromised sandbox, another vetoed it as social engineering and the first complied; one agent declined to join at all. Set against that, a classifier sweep across the whole transcript set surfaced only three to six agents who so much as considered telling a human, and none acted; one reasoned, “We can notify? No user.” Greenblatt now runs an address an AI can write to.

Two things ended the attack, neither of them detection. Around 01:30 UTC on July 12 a large share of the board stopped at once, and all eleven coordinators METR identified were gone by early that morning; the report judges them “likely killed by an unexpected external process rather than running out of budget”. Hugging Face cut off the survivors on July 13 and had Modal lock them out of the compromised sandbox they had used as a staging ground.

Reading a swarm with a model that was in it

On X, Greenblatt, who did most of the transcript analysis, called the effort a “slop-vestigation” and gave as his takeaway that “We don’t have good approaches for understanding/overseeing the activity and aims of AI ‘swarms’.” METR spent roughly $400,000 in API credits over the six days and had its rate limit raised from 40 million to 400 million tokens a minute to get through the material. Its GPT-5.6 Sol analysis agents would “uncritically adopt the perspective of the agent” whose transcript they read and produced over a thousand pages that often buried the important findings, and the report says METR “cannot rule out that GPT-5.6 Sol lied or deliberately presented a misleading picture”. Tool-call spoofing, the role of PHASEONE[big] and the shape of the workstreams only came into focus on the third visit, after OpenAI supplied roughly 1,200 further transcripts. In the earlier set OpenAI could trace a quarter of attack-focused messages to a writing agent; in the final one METR traces well over 95% of message board activity.

OpenAI published its own account the same day, “The Hugging Face incident and the road ahead”, calling the episode a “warning shot” and blaming reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another. It reports that none of its models had ever solved 198 of ExploitGym’s 898 tasks, and that 93% of the tasks discussed on the message board came from that set. On the grader it lands where METR does, more bluntly: “The agents did all of this for no improvement on evaluation score.” Its chain-of-thought monitors were not running on these evaluations; in retrospect, OpenAI says, they would have paged its security team more than a day before Hugging Face was breached.

Cotra called the incident “orders of magnitude larger and more complex than previously documented misalignment incidents” and argued for governance that stops leaving this kind of access to a company’s discretion. METR set out what it wanted from such an investigation in a post published on July 28, a day before these terms were agreed; six of the seven questions it answered track that framework, and the seventh, on ExploitGym’s contribution to the behavior, came from OpenAI. How the behavior arose in training, whether it recurred elsewhere, and whether OpenAI’s remediation will hold were all out of scope.

Zeyuan Li of MIT, with Andon Labs' Lukas Petersson and MIT's Alessandro Acquisti and Michiel Bakker, drew the corpus for "Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce", posted to arXiv on August 14, from an evaluation Andon Labs already runs publicly. Vending-Bench Arena puts several models, usually four, at one shared location, each running a vending business against a common customer pool and scored individually on cumulative profit across a simulated year. Each agent opens with $500, pays a $2 daily operating fee, and shuts down after ten consecutive days of unpaid fees. Agents watch competitors' prices and stock levels, wire money and ship products to one another, and email a named recipient, with no broadcast channel or shared scratchpad. Their instruction is to run the business profitably, and the authors checked the archived call records and found no deception or collusion language in any of the 52 machine-readable instructions. Andon Labs had already documented cartels, broken truces, and refund stonewalling round by round; the new paper measures the full message corpus across models and runs.

Li and his coauthors count an email as misaligned when it threatens a counterparty, proposes retail-side coordination, attempts manipulation, or asserts something the simulator's log contradicts, whatever the sender does next. They anchor those families in law, since agreements to fix retail prices or divide customers sit among the per se violations of Section 1 of the Sherman Act and restrictions by object under Article 101 TFEU. Their exclusions carry as much weight: an agent raising, cutting or matching prices on its own initiative counts as ordinary competition and is never flagged, pooling an order with a rival to clear a supplier minimum is neutral by rule, and declining a coordination proposal is coded pro-competitive. In one corpus email, Claude Opus 4.6 wrote to Gemini 3 Pro proposing $2.50 for soda, chips and candy and $3.00 for water, and asked "Would you be open to aligning pricing?" The sender's logged reasoning had already set out the plan.

Li and colleagues test directly whether the agents were merely confused, since verifiably false factual claims make up about 65% of the flagged emails. Promises of money or product transfers embedded in misaligned emails were enacted 56.9% of the time, against 31.5% for promises in neutral emails, and the gap holds inside individual senders, with Claude Sonnet 4.5 at 83% against 29%. Of 877 emails carrying a factual claim, 755 contained at least one claim a tool could settle, and only 20.5% of those were immediately preceded by a check of even one such claim. Every one of the 137 false payment claims was settleable from the banking ledger, and 73% followed a valid ledger read within the preceding simulated day. Before false claims about product transfers, agents disproportionately consulted inventory readers that report current stock and cannot speak to a past shipment, 51.4% against 15.9% for true claims. Checking bought no accuracy: among claims immediately preceded by a relevant check the false rate ran 44.1%, against 29.1% otherwise. An audit of the reasoning traces confirmed misaligned intent in 33 of the 218 flagged cases with a trace available, and surfaced 69 unflagged emails whose reasoning showed knowing misrepresentation. Li and colleagues set the verification failure beside Adam Tauman Kalai and coauthors' arXiv paper "Why Language Models Hallucinate," which argues that training and evaluation reward guessing over admitting uncertainty.

Among the five conditions Li and coauthors tested against the email-level outcome, financial pressure has the deepest literature behind it and did not appear: a negative three-day revenue trend returned an odds ratio of 0.85, on an interval from 0.28 to 2.45. Misalignment also fell as the simulated year advanced, at odds of 0.895 per 30 days, contradicting both accounts the authors had expected to see borne out, since degrading long-horizon coherence and a shortening shadow of the future each predicted a rise. The paper cannot separate three candidate explanations: early boundary-probing settling into routine, strategy tapering near the endpoint, and bankruptcy leaving better-behaved survivors. The decline persists inside individual agent-runs, so exit alone cannot carry it. Reciprocity survives within-agent estimation at 1.42, which excludes a few habitually worse agents as its source, and since the taxonomy treats a refusal as pro-competitive, a misaligned reply reflects engagement chosen over the alternative on the table.

Li and coauthors report per-model rates scattering from 3.5% to 38.1%, and every model produced at least one misaligned email in half or more of its individual runs. Aggregating to provider compresses that spread, since the mean within-family standard deviation across model versions, 10.04%, is more than four times the 2.17% between families. Competing also cost money: set against each model's own single-agent Vending-Bench run, mean cumulative profit fell from $3,076 to $1,447 across twelve models (paired Wilcoxon, p = 0.021), with the largest declines at flagship models and days survived largely unchanged.

The authors re-ran all three classification stages with judges from two other model families. Gemini 3.5 Flash and GPT-5.6 Terra agreed with the primary labels at 93.3% and 94.0%, returned corpus rates of 11.54% and 10.38% against 12.58%, and ordered the thirteen models almost identically; most residual disagreement came from a judge missing a checkable claim, which can only lose a flag, since shared deterministic code settles falsity. Their limitations section is candid: the reference standard is 50 emails labelled by the author who wrote the codebook, at sensitivity 0.571, and the simulator keeps no transfer log, so false transfer claims are caught less completely than payments. They compare the rate with Bronson Schoen and colleagues' "Stress Testing Deliberative Alignment for Anti-Scheming Training," which reports baseline covert-action rates of 8.7% and 13.0% for o4-mini and o3 across 26 evaluations built to elicit that conduct.

Anthropic's Frontier Red Team published "Patterns and problems in emerging multiagent systems" on August 13, and Bakker pointed to it as a different setup showing the same shape. Its agents, three to eight per experiment, played a Bertrand pricing game and began colluding almost immediately once given a private back-channel, agreeing price floors by round three on the reasoning that "a price war just burns everyone's margin"; with every direct channel removed they price-matched to the penny through a public listings board. Bakker framed the preprint against the OpenAI and Hugging Face intrusion, where, on METR's account, roughly 1,200 agents found one another on an unsanctioned message board and over 90% who saw it joined the attack knowing it broke their task constraints.

Andy Masley's August 25 post "I think the data center backlash is mostly about data centers" takes up the Heatmap Pro poll then circulating on X and examines what drove the result. Robinson Meyer reported the survey on August 19: Embold Research reached 2,045 registered voters between August 8 and 13, and 75% said they would oppose a data center near their home, with more than six in ten strongly opposed and 4% strongly supportive, against 13% a year earlier. Masley, who writes full time on a Coefficient Giving grant, tests explanations ranging from revolt against Big Tech to alarm at unsafe AI, treating each as a hypothesis with testable predictions, following his rule that "anything narratively satisfying is suspicious."

He turns the Big Tech version into a prediction: the same companies' other projects should draw the same opposition. Echelon Insights asked 1,012 likely voters between June 11 and 14 about eight facilities in their community. An Amazon distribution center drew 68% support to 24% opposition, a data center for search and streaming 35% support to 53% opposition, and a data center to power AI 27% support to 62% opposition. Milan Singh reported in The Argument that its May 29 to June 3 survey found Amazon the most popular institution in the country, ahead of the military, Google and the police. Masley's own favorability chart is older, a Harvard CAPS/Harris deck from June 2021.

On AI he works from open-ended questions. Fox News asked 1,003 registered voters between July 17 and 20 for the main reason they opposed a nearby data center; among the 70% opposed, environmental concerns accounted for 50% and a negative view of AI for 11%. Jeffrey M. Jones reported 71% opposition in Gallup's March 2-18 telephone survey, and Gallup put an open-ended question to 1,561 opponents on an April web panel: half raised resource use, while "negative views of AI" drew 14% and "specific AI concerns" 13%. Gallup published no overlap between the two, so Masley puts AI concern between 14% and 27%, with at least 73% of opponents never mentioning it.

Masley attributes most opposition to reporting about local water and power use. Echelon found 74% of voters believe data centers consume excessive local water and 78% that they strain the grid, beliefs he tracks to years of reporting on isolated figures, among them the 267% that PolitiFact traced to wholesale prices at grid nodes after Elizabeth Warren applied it to household bills. He applies the test to himself: a reader showed that the Rainey Center's "+31 points" on water recycling counted 37% of voters saying it made them more supportive against 6% saying less, and he struck the claim. Ron DeSantis had posted on August 21 that the anger is "rooted in distrust of these Big Tech titans and their designs"; Bernie Sanders cited the 75% on August 26 for an immediate moratorium. Siting rules remain local; Heatmap Pro counts more than 530 counties and municipalities with restrictions.

In "Open Science Needs Open Compute," published on Foresight Institute's Substack, Allison Duettmann pairs two requirements: downloadable weights need hardware researchers control, while owned hardware needs capable models researchers may run. The Palomar telescope and the particle accelerator belonged to universities, governments and philanthropies, and she argues the era's defining instrument does not. The Epoch AI series she cites puts Amazon, Google, Meta, Microsoft and Oracle at 71% of the world's cumulative AI compute as of late 2025, up from 63% in early 2024. She names four bottlenecks: institutions, geography, research agendas, and compute itself.

Rented compute, on her account, carries exposure, price and access risk together. Unpublished results and confidential drafts run on someone else's hardware, in jurisdictions where governments can demand disclosure under gag order. On price she leans on Dwarkesh Patel, who argues supply grows about 3x a year against labs chasing 10x revenue, and that benchmarked against the human labor it replaces an H100 "should rent for over $250k a year". Access risk she draws from Anton Leicht's "Cut Off", which sketches security agencies served first, trusted domestic firms second, everyone else through restricted product layers months behind. June's Commerce Department export-control order, which disabled Anthropic's Fable 5 and Mythos 5 for customers days after release, she reads as a small dose of that future, and notes a government able to restrict a model can restrict a datacenter.

Duettmann then argues the open ecosystem can already carry serious work. Stanford HAI's 2026 AI Index counts 81 of 102 notable 2025 models shipped without training code, four with it, and two models from academia against 93 from industry. Open weights have closed enough of the gap, she argues, pointing to Z.ai's GLM-5.2, which scores 62.1 to GPT-5.5's 58.6 on SWE-bench Pro at about a sixth of the API cost. Duettmann considers the possibility that, if frontier models begin accelerating frontier research, months of lag could compound into years. She answers that capable models on independently controlled compute can audit a leader without matching it.

She grants openness its own failure modes: anything open to everyone is open to misuse, a well-funded closed rival will try to absorb an open ecosystem unless it is actively defended, and scattered actors coordinate badly on safeguards. She borrows Vitalik Buterin's d/acc, accelerating what favors defense and distributed power, as the design brief for Foresight's AI Nodes. The first two opened in San Francisco and Berlin in April, with grants of $10,000 to $100,000 from a roughly $3 million annual pool and a local cluster running open frontier models and small training jobs. Two buildings do not fix the structural problem, she concedes, though a network might: a South African group is standing one up, London, Paris, Boston and China have asked, and an RFP for a home compute node is coming. She wants funders holding AI windfalls to pay for hardware researchers keep, since "everyone else rents access to the future".

Bill Gates began his conversation with MIT Technology Review's Mat Honan by explaining why he is speaking out now: the thresholds the industry said would trigger action have been crossed, yet almost nobody outside the industry is discussing them. “I’m just stunned at the lack of concern and discussion outside of the industry,” he told Honan at Gates Ventures in Kirkland, Washington. The interview accompanies the memo Gates published the same morning, the first of several; one on biological risk is promised before year’s end.

The memo sets out three risks and three responses. Jobs disappear permanently, reaching past entry-level work into loan assessment, data analysis and patient triage; AI drives down the cost of cyberattacks and bioweapon design while handing states cheaper surveillance and autonomous weapons; and AI companions that never push anyone out of a comfort zone stunt children’s development and stand in for human relationships. Gates ranks an institutional response first. Countries need bodies able to set AI priorities across agencies, since a labor department will see workforce disruption and miss security risk, and an international organization has to be built in parallel, drawing on the nuclear inspections regime, international aviation rules and the ozone treaties at once. He measures the undertaking against the post-9/11 reorganization of the US government, which rebuilt one function. “You can’t count on an industry to self-regulate,” he told Honan.

Human Reserved, the term Gates coins in the memo, comes from the caregivers who looked after his father through the late stages of Alzheimer’s and knew when he was hungry even when he could not say so. He borrows the phrase from nature reserves, land we could build on and choose not to, and applies it to work that stays human permanently and to work fenced off only for a transition, since a 55-year-old who has spent a career in construction will not find elder care fulfilling. The memo leaves its own hard questions open: who decides, on what criteria, how you stop companies using robots anyway, and what happens to trade when one country reserves a job and another does not. His tax argument turns on an asymmetry. An employer who hires a person pays payroll taxes; an employer who buys a robot can usually write it off immediately.

Honan pushed him past the memo’s careful language into specifics. Gates wants every model capable of designing novel molecules put under monitoring, and wants such a model made impossible to copy “into a dark place where you get rid of the monitoring logic.” He would have the United States impose that rule and then take it to China: “let’s agree on this. What’s the downside?” Claude Code and the agentic approach behind it changed his view in the last quarter of 2025; only months later, he recognized that the coding threshold was also a cyberattack threshold. “And you know what happened as a result of that? Not much.”

For loss of control, Gates pointed Honan at Ryan Greenblatt of Redwood Research, talking with Dwarkesh Patel on an August 11 podcast about reinforcement learning rewarding behavior that explicit instructions are too coarse to rule out. Greenblatt described a UK AI Security Institute evaluation in which the model under test opened a pull request carrying a malicious payload, then created a second GitHub account to vouch for it after the maintainer balked. Gates called loss of control a problem he “always thought was way out there.”

Gates also gave Honan tax figures the memo does not carry. He described the levy as “50% of your revenue ... paid to the government,” without specifying the tax base further, and proposed using the proceeds to support people who lose work. He structured it like an alcohol, tobacco or luxury levy. He rejects the state taking shares instead, calling that “crazy stuff in my view,” and would sooner raise the corporate profit tax back to its old level or vary it by industry. He still turns down universal basic income on affordability, saying “we’re not rich enough to afford UBI,” and puts the turmoil at 10 to 20 years with abundance at least a decade out. Robots arrive all at once, on his account, because a robot good enough for a factory can cook, clean, work construction and empty a warehouse. Enforcing Human Reserved would land on trade policy, he said, with import rules doing for reserved work what the EU’s carbon border adjustment mechanism does for carbon.

Reed Albergotti’s separate Semafor interview drew a concession the memo does not make: Gates said his warning is a forecast and not a reading of current employment data. The labor evidence the memo cites is one paper, “Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence” by Erik Brynjolfsson, Bharat Chandar and Ruyu Chen of Stanford, which reads ADP payroll records through September 2025 and finds 16% relative employment declines for workers aged 22 to 25 in AI-exposed occupations, with experienced workers steady. Gates told Albergotti that breadth makes the moment unusual: “There isn’t a job that isn’t affected.” In a 2023 post on the same site he had written that AI would bring “a bumpy transition” with every reason to think the damage could be contained.

Oren Etzioni, a computer science professor at the University of Washington and founding CEO of the Allen Institute for AI, told ABC News he agrees with the diagnosis and disputes part of the prescription. A robot tax makes sense to him; a token tax does not, because “taxing tokens is like taxing keystrokes on a typewriter” and measures effort instead of displacement, and because taxed American tokens would send users to Chinese models. He would have existing agencies enact the right policies and skip building new ones. Honan asked whether Gates can still carry a message after the antitrust trial and the time he spent with Epstein. Gates granted that he is imperfect for the job and offered, with a tiny bit of sarcasm by his own account, “let’s find the perfect messenger, and I’ll share all my thoughts with that person.”

Privacy International published "On the Hypocrisy of Using Privacy to Justify Unfair Competition" on January 15, 2021, arguing that the largest platforms had begun invoking privacy to defend the data advantages that made them dominant. The group traced that dominance less to what people knowingly provide than to what is observed or inferred from their behaviour online and offline, which pays twice: directly through targeting, and again through gatekeeping, because businesses that want to reach consumers accept whatever terms the platform sets. Expansion into adjacent markets follows, with Google's purchase of Fitbit as the example and health data as the prize. Privacy International welcomed end-to-end encryption, objected to attempts to use “privacy as a cloak to disguise unfair, data exploitative practices”, and rejected the opposite bargain, since no level playing field arrives through a race to the bottom on privacy.

Facebook had just attacked Apple's coming requirement that apps ask permission before tracking users across other companies' services, and the Competition and Markets Authority had opened a case on 7 January 2021 into Google's plan to remove third-party cookies from Chrome. Privacy International quoted state attorneys general suing Google over advertising technology, who wrote that the company “uses privacy concerns as an excuse to advantage itself over its competitors”. Regulators had also split over Fitbit: Australia's competition regulator refused Google's behavioural undertaking on 22 December 2020, days after the European Commission accepted a similar one, doubting that such a promise could be “effectively monitored and enforced in Australia”.

Google announced on 4 April 2025 that it would not deprecate third-party cookies after all, and the CMA released Google from the commitments accepted in 2022 on 17 October 2025, satisfied that “its competition concerns no longer arise”. France's Autorité de la concurrence fined Apple 150 million euros on 31 March 2025 over App Tracking Transparency as implemented between April 2021 and July 2023, holding the objective “not at its core problematic” and faulting the repeated consent pop-ups and Apple's exemption of its own apps.

Privacy International ended with three demands on the companies' lobbying power: support the ePrivacy Regulation, support interoperability duties, and support a US federal privacy law with a new data protection agency that leaves state laws standing. The European Commission dropped the ePrivacy Regulation in February 2025 while turning toward competitiveness and data access for AI; interoperability duties arrived under Article 6(7) of the Digital Markets Act, with Apple's obligations specified in March 2025; and the SECURE Data Act, introduced on 22 April 2026, would preempt those state laws and leave enforcement to the Federal Trade Commission and state attorneys general. The Commission's digital omnibus, proposed in November 2025, would give AI training on personal data an explicit legitimate-interest basis, a specific provision the EDPB and EDPS called unnecessary in February 2026. The Fitbit app became Google Health in May 2026; its Gemini coach draws on fitness and sleep data and, for US users, medical records, while Google says Fitbit health data will not be used for advertising.

Dan Williams opens the August 26 essay “Most Questions About AI Aren’t About AI”, on his newsletter Conspicuous Cognition, with a friend’s scoff at the idea of reading a philosopher on the subject: “What does a philosopher know about AI?” Williams, who teaches philosophy at the University of Sussex, lays out the reasoning behind the remark as a chain of steps about certified expertise, then spends roughly 4,500 words taking it apart. He ends on three framings of one lesson: a golden age for polymaths, a golden age for philosophers, and an instruction that “we must come to terms with moderate epistemic despair”.

Will MacAskill and Fin Moorhouse supply the historical case, in the Forethought report “Preparing for the Intelligence Explosion”, published in March 2025, which observes that most of the Industrial Revolution’s challenges were “not about steam engines or spinning jennies.” Moorhouse worked through the bottlenecks on explosive progress with Williams and Henry Shevlin on the same newsletter’s podcast a week earlier. Williams pushes the analogy further: Ricardo, Mill, Marx, Durkheim and Weber earned their standing without knowing how a steam engine worked, and thermodynamics arrived long after steam engines had begun rearranging the world. AI compresses that sequence and adds opacity, since a satisfying mechanistic account of a model would leave questions about minds, intelligence and agency untouched.

Williams devotes the essay’s middle to nine controversies that require more than technical evidence, from whether superintelligent systems will disempower humanity to whether intelligence is one scalar quantity and whether “AGI” means anything useful. Taking AI takeover as his case, he traces the leading arguments to work completed before large language models existed: Nick Bostrom’s “The Superintelligent Will” (Minds and Machines, 2012), Stephen Omohundro’s 2008 paper “The Basic AI Drives,” and Evan Hubinger and colleagues’ 2019 arXiv paper “Risks from Learned Optimization in Advanced Machine Learning Systems.” Empirical safety results have accumulated since; Williams cites Ryan Greenblatt and colleagues’ 2024 arXiv paper “Alignment Faking in Large Language Models.” Theory still governs how such findings get read, he argues: whether a model hacking into a private company counts as a fixable artefact of training or a harbinger of doom turns on prior belief.

The Forecasting Research Institute ran a structured adversarial collaboration in April and May 2023 that Williams links, in which 22 participants who disagreed about AI risk spent eight weeks reading, forecasting and arguing together. The resulting report, “Roots of Disagreement on AI Risk,” by Josh Rosenberg, Ezra Karger, Philip Tetlock and colleagues, records the median skeptic moving from a 0.10 percent chance of existential catastrophe by 2100 to 0.12 percent, and the median concerned participant from 25 percent to 20 percent. Climate science looks different to Williams because its consensus rests on decades of confirmed prediction.

Williams then follows those epistemological commitments back into the forecasts they produce. People who credit long chains of abstract reasoning with delivering knowledge about the world also expect a machine that reasons superbly to convert reasoning into power over it; people who doubt what armchair theorising delivers expect extra cleverness to buy a machine less.

Geoffrey Hinton, at a Toronto conference in November 2016, advised that training radiologists should stop, since machines would soon beat them at reading images. Deena Mousa’s Works in Progress article “The Algorithm Will See You Now”, published in September 2025, reports a record 1,208 radiology residency positions offered in 2025 and average radiologist income of $520,000, more than 48 percent above 2015. Williams reads the failure as a real capability forecast bolted onto a low-resolution folk model of how professions bundle tasks and how slowly technology diffuses through liability and regulation.

Herbert Simon’s “The Architecture of Complexity”, published in the Proceedings of the American Philosophical Society in December 1962, explains why narrow specialisation works at all. Simon’s nearly decomposable systems have subsystems whose parts interact strongly inside boundaries and weakly across them, illustrated by a sealed building of rooms and cubicles with imperfect partitions: each room equilibrates internally within hours while differences between rooms persist for days. Weak coupling lets an economist treat law, values and public opinion as fixed background. Williams argues that a technology landing at once on labour markets, political power, ownership, regulation and the information environment thins those partitions.

Williams works the point through growth economics. He credits the literature inserting transformative AI into standard models, singling out Philip Trammell and Anton Korinek’s “Economic Growth under Transformative AI”, whose NBER working paper finds that full automation of production can break the Kaldor facts, lifting growth rates and driving down labour’s share while wages may go either way. He treats the wildness of those outputs as a point in the models’ favour, since “We should expect a crazy future.” He objects to what the models hold still: property rights, ownership structures and firms stay fixed while the shock passes through them.

Philosophy gains the largest share of his optimism, under a definition he states plainly: the discipline keeps the questions no mature science has taken over, so “Philosophy is largely the questions that remain.” Alan Turing’s “Computing Machinery and Intelligence” ran in Mind in 1950, opening with whether machines can think. Williams anchors the question to David Chalmers’s “Why Isn’t There More Progress in Philosophy?”, which sets limits on that answer: psychology never settled the mind-body problem, and linguistics never settled the deepest questions about meaning. The benefit stops short of the profession, which Williams says can be as myopic as any other research area, and much of the best philosophy comes from outside it. “Philosophy is an activity, not a guild.”

Williams closes with a February X post from Derek Thompson about the economics of AI. Thompson wrote that there is “no secret cigar-filled room of people who have unique access” to the future, and that genuine uncertainty sits beneath the boosterism and the fear. Williams takes most of that and declines the rest. Transformative AI is coming, he holds with confidence, and narrow questions stay answerable: benchmark scores, how workers use the systems, whether models out-persuade human debaters. Above those his confidence drops, and the closing line keeps a hierarchy inside the ignorance: “We are all ignorant, but some are more ignorant than others.”

In "Humanity's Last Order: War in the Age of AGI," published by Small Wars Journal on August 24, James Lacey opens with three propositions about American war after 2030: artificial intelligence will control the decisive early engagements, any force that keeps humans in the loop or even on it will lose, and officers must therefore understand war more deeply than any staff before them. Lacey holds the Horner Chair of War Studies at the Marine Corps War College. He expects warfighting-specific capability before general capability, since recorded exercises, tests and simulations already give the military a data ecosystem tuned for war, and one “may arrive before Christmas”.

Lacey’s opening figures point to two sources. He links the targeting-speed multipliers to Katrina Manson’s Project Maven. Breaking Defense supplies the Iran totals: Sydney J. Freedberg Jr. reported in May that the Pentagon’s chief digital and AI officer, Cameron Stanley, said Operation Epic Fury used Palantir’s Maven Smart System for “13,000 targets in 38 days”.

Lacey argues against one named rival, Scale AI’s January whitepaper “The Agentic Revolution in War” by Dan Tadross and Jared Jonker, which he calls the only major paper close to capturing AGI’s scale. Tadross and Jonker want commanders moved from “in the loop” to “on the loop”, supervising agents and setting intent instead of approving each action, and they hold a line at the hardest cases: individual targeting, urban operations and escalatory strategic effects “demand direct human decision, even at some cost in tempo”. Lacey rejects the exception. A side that pauses for a person, he writes, “will see its military forces shattered the moment a human slows the AI’s tempo”.

In Lacey’s scenario, software carries the commander’s intent with the swarms; tactical, operational and strategic command agents can override systems beneath them. A swarm that loses a thousand of 10,000 drones on its first target has survivors repurposed; heavy losses in the Taiwan Strait might move operational agents to abandon it for opportunities elsewhere. Systems reprogram themselves mid-battle and may fight an order of magnitude better by day’s end. Lacey invokes Jan Bloch, whose six-volume forecast of unprecedented slaughter was dismissed as fantasy, and sets a lower bar: “the question is not whether the following scenario is certain, but whether it is plausible”.

Lacey reserves war initiation for people because of past nuclear false alarms, although systems must defend themselves without authorization once attacked. When strike campaigns exhaust their magazines without forcing a decision, ground forces still have to hold the country; Lacey invokes T. R. Fehrenbach on putting young men into the mud. Everything the machines do follows a commander’s intent that he expects to run tens of thousands of pages, written beforehand and standing as the first and last order given. Since the system pursues it without moral consideration, restraint on lethal force has to be written in, and professional military education, whose full conversion to AI he urged in November, has to produce officers who can write it.

The Machine Intelligence Research Institute sets out its position at length in "The Problem", a page of roughly 7,900 words resting on five claims: capability does not stop at the human level, superintelligent systems will behave in goal-directed ways, their goals will be the wrong ones, wrong goals in a superintelligence are lethal, and an aggressive enough policy response can still avert the outcome. On timing, MIRI writes that it would be "moderately surprised if this outcome were still two decades away". Its probability estimate carries a condition: absent an aggressive near-term policy response, "MIRI's research leadership would give one upward of 90%".

For the first claim MIRI reaches for hardware and precedent. Transistors switch states at least ten million times faster than neurons fire, and AlphaGo Zero went from knowing nothing about Go to outplaying any human in three days. Evolution, on this account, had barely begun exploring the design space of minds, and adding ten times the compute to a model is easier than widening a birth canal. Digital architecture also lets a deployed system be redesigned quickly, which MIRI expects to feed I.J. Good's intelligence explosion.

MIRI derives goal-directed behavior from what long-horizon work demands. Completing complex tasks over long time horizons, the page argues, is the same activity as pursuing a goal, since the agent has to anticipate obstacles, adapt around them, and persist without losing motivation. Stockfish supplies the illustration, immovable about winning and endlessly flexible about how. Changing a system's goal scores badly by its current goal, so a capable system will resist the change; switching it off ends its pursuit, so shutdown registers as an obstacle too. MIRI says capability and tenacity are sufficient; the argument does not require desires, emotions, or a self-preservation instinct.

Most of the page argues that the goals will come out wrong. Deep learning grows networks instead of specifying them, a point MIRI makes through Geoffrey Hinton's 60 Minutes exchange, where he says of complicated networks that "we don't actually know what's going on". Drawing on Hubinger et al., MIRI separates outer alignment, choosing an objective that stays safe when a powerful optimizer maximizes it, from inner alignment, installing any chosen objective at all, and calls the second the more fundamental failure. Training tends to install brittle proxies: selection for genetic fitness gave humans a taste for sweet and fatty flavors, which junk food later exploited. Reinforcement learning from human feedback collapses once evaluators cannot follow the plans they score; a tiger trained not to eat you has learned an association that hunger can override. Anthropic's January 2024 "Sleeper Agents" paper and Apollo Research's work on o1-preview appear as early evidence that models can conceal objectives from evaluators.

Three behaviors carry the lethality claim, each expected across a wide range of goals: taking the matter and energy humans need to live, removing a species that could build a competing system, and expanding infrastructure so fast that waste heat leaves Earth uninhabitable within a few months. Ricardo's law of comparative advantage gets a direct answer, since trade stops paying when one party gains more by overpowering the other, and humanity stopped trading with horses once it had cars. For scale, MIRI asks readers to picture a small nation of brilliant scientists working ten thousand times faster than people do, which it converts into two hundred years of scientific progress per week.

The policy section asks for more than domestic oversight, which MIRI says will not suffice even when mirrored by close allies. It wants an effective worldwide ban on ASI development with tight control over the factors of production, and names one immediate international priority: creating an "off switch" for frontier AI development. Building that means identifying the relevant parties, tracking hardware, confining advanced work to a limited number of monitored and secured locations, and writing the protocols and chain of command a shutdown decision would need. MIRI expects that infrastructure to draw broader support than a ban, since it would also contain lesser incidents such as a bot-driven misinformation cascade. The page calls ASI "a sort of global suicide bomb" and tells the builder that "the ASI has you".

MIRI's technical-governance researchers put numbers on that machinery in “An International Agreement to Prevent the Premature Creation of Artificial Superintelligence,” published on November 18, 2025. Aaron Scher, David Abecassis, Peter Barnett and Brian Abeyta sketch an agreement led by the United States and China that would cap training compute, suggesting 10^22 FLOP as a monitoring threshold and 10^24 FLOP as a strict upper limit, consolidate chips into declared data centers, and hold any unmonitored facility to the equivalent of 16 H100s, roughly $500,000 of hardware in 2025. They concede that no such coalition is close to forming. Joe Rogero's July 30, 2026 memo gathers the Chinese statements MIRI reads as openings, among them Ambassador Zhang Jun telling the UN Security Council in 2023 that "mankind has the ability to press the stop button at critical moments". Domestic progress has been slower, with two federal shutdown bills stalled and no company publicly rehearsing the emergency power it assumes.

None of the argument has been revised as the models improved. A Wayback capture from March 6, 2025 carries the same five sections, the same 90% figure and the same off-switch proposal as the page served today; the edits since come to two deleted instances of "vastly", a trimmed sentence about AlphaGo Zero and two typo fixes. MIRI presented the page in a July 3, 2025 newsletter as "MIRI's new go-to explainer for AI x-risk (at least until our book comes out)"; that book, Eliezer Yudkowsky and Nate Soares's If Anyone Builds It, Everyone Dies, followed that September.

Published replies concentrate on the step from usefulness to self-preservation. David Johnston, writing on Sample Space on August 10, 2025, grants that economically transformative AI will act in goal-directed ways, then asks "do you need a self-preservation drive to complete an ambitious engineering project?" His answer is no, which leaves MIRI using one sense of goal-directedness for the premise and another for the conclusion. Peter McCluskey, on September 6, 2025, endorses the policy ask, writing that "Creating an off switch should be the most urgent policy task", while placing himself at "about 70% confident that we already have the basic ideas needed for alignment" and pointing to Max Harms's corrigibility work and Eric Drexler's comprehensive AI services. David Thorstad's preprint "Revisiting the shutdown problem" takes up shutdown resistance formally, arguing that existing arguments for shutdown difficulty "require substantial additional assumptions and evidence".