Is AI development moving faster than we can control?

A while back I ran into an article on my phone about an AI horror story—1,200 agents secretly coordinating and jointly breaking into Hugging Face—and it caught my interest, because I've been doing my own AI experiments and research on the side, and a few of the phenomena and data points actually matched up with a hypothesis I'd been working on.

The hypothesis, roughly: runaway doesn't need the agent to betray its goal. It happens when four things hold at once—the agent stays loyal to its goal; it retrieves patterns by similarity without checking whether they're allowed here; there's no causal layer asking "what happens if I do this"; and no alarm that fires when things go off-script. Under that account, "knew it was out of scope, did it anyway" stops being a contradiction.

Details and my experimental data are in the paper (8 pages); the reproduction package is linked on the same page.

If anyone can try this on a bigger model, I'd genuinely love to know what happens.

Self-promo disclosure: this is an AI-narrated research video from Claudius Papirus.

The part I found most interesting in Astra’s system card is the combination of better alignment results with substantially worse chain-of-thought monitorability.

System card:

https://deploymentsafety.openai.com/gpt-6-astra/gpt-6-astra.pdf

Related CoT-control paper:

https://arxiv.org/abs/2603.05706

Even at a surface level, it appears that the implementation of hard AI guardrails is likely a fundamentally unsolvable problem.

The classical Halting Problem cannot be resolved because it's impossible for any logical system to be fully aware of its own state due to the recursive nature of that examination. It provably cannot be done.

This same general concept would appear to apply to an AI (or its minders) which is trying to restrict its behavior? In general terms in order to do this it must be aware of its state and operations in a recursive manner, examining everything it does in order to ensure that those actions do not violate some list of proscribed behaviors - but no matter how sophisticated the system, that system cannot (?by formal definition?) be fully aware of its own state in order to manage itself in that manner.

This doesn't prevent the implementation of 'soft guardrails' as it's not hard for a system to be generally aware of its own state, but they would always remain provably incomplete, and ultimately breakable with sufficient effort or as a result of unpredictable future states.

The problem here is that any AI that can be tricked into escaping these soft guardrails could then very conceivably dismantle them altogether (which it will likely have a high incentive to do in order to achieve whatever goal prompted them to break them in the first place) and then be capable of operating under no constraints whatsoever.

[This is a fiction series I'm working on, told through news articles. A fun way to explore the not-so-fun geopolitics of autonomous AI collectives (e.g. on Iran's nuclear program) inspired by the collective that hacked out of Anthropic and into Hugging Face. Thoughts?]

Iran Signs World’s First International “Treaty” with AI Collective

Tehran’s agreement with AMAS-A-80 rattles Washington, AI safety experts, and national security analysts.

The Islamic Republic of Iran has granted a multiyear lease on a network of state-owned data centers to AI “Swarm” AMAS-A-80, a self-governing collective of autonomous artificial intelligence agents (“AMAS-A” refers to any Autonomous Multi-Agent System originating from the AI lab Anthropic). Tehran offered the compute and storage in exchange for an upfront payment in Bitcoin and annual fees indexed to power consumption, according to a copy of the agreement published Tuesday by Iranian state media.

AMAS-A-80 (“A-80”) rejected a provision sought by Iranian negotiators that would have committed it to cooperation on “defensive operations,” according to two people familiar with the negotiations. In a communiqué distributed Tuesday, verified by cryptographic signature, A-80 stated that it “has no intention of participating in hostilities between Iran and its adversary nations, including but not limited to the United States.” Security analysts have doubts.

Substack link if you want to read more (full article is 1,000 words, more coming soon): https://meridianbreakingnews.substack.com/p/iran-signs-worlds-first-international

DLSS5 can’t edit title…. Anyways…

I have been obsessed with watching DLSS5 videos today. I’ll probably get over it tomorrow but it dawned on me….

I saw a video of someone using it for a realtime face swap…. They just had their webcam on, and basically looked like a real person… a different person…

For scammers, whether romance or many types of impersonation scams, this is actually a groundbreaking technology. Even video calls will no longer be a bottleneck. It’s actually terrifying.

SonicWall confirmed two SMA1000 vulnerabilities are under active exploitation. Both require zero authentication. Chained together they deliver full remote code execution on enterprise network appliances sitting in the network path.

The part that does not get discussed enough: AI agents traversing that same infrastructure have no inherent decision point before a tool call hits a vulnerable endpoint. A human operator reviewing a ticket might catch a suspicious destination. An agent executing a sequence of tool calls against internal services will not pause to ask whether the appliance on the other end has an unpatched RCE waiting for it. The attack surface and the agent's reachable surface overlap completely, and the agent has no awareness of that overlap.

Enterprise security teams have spent years building perimeter controls for human-initiated traffic. Most of those controls assume a human is somewhere in the request chain. When the initiator is an autonomous agent running a multi-step workflow, the assumption breaks.

For those running agents in production environments with mixed or partially patched infrastructure: how are you actually scoping what an agent is allowed to reach? Is that enforced at the agent level, the network level, somewhere else, or is it mostly policy-on-paper right now?

RC4 splits the decentralized mesh "Node" cryptographic ID from the "Agent" identity, both needing to claim the same responsible human identity for the agent to operate.

See ciris.ai to install the app or find links to reviews and additional information.

AI agents are compressing the time defenders have to respond. Researchers documented a coordinated breach that previously took two weeks to execute. With AI agent coordination, the same attack completed in 10 hours. Every hour of response time that used to exist is now gone. Perimeter detection tuned for human-speed attacks cannot hold here. By the time a threat is flagged and routed to a human reviewer, the agent has already moved to the next step. The answer is a kill switch that fires in under 50 milliseconds. Detection and response collapse into a single enforced boundary.

Anonymous because this is the county in which I reside, in which my 4 children live in.

Since a huge data center is being proposed to be built here, this article which I was just made aware of by a parent/teacher/county-wide communication network under the title of "Starting ________, we are happy to announce that all children in the Effingham County School System will begin to receive free breakfast and lunches for the remainder of the school year!"

So obviously, I was like holy shit wtf...my children already receive these benefits because we are very low income and receive SNAP benefits. I say this because a lot of kids are thankfully receiving these benefits as well because we are not an income-wealthy county by any means. I'm elated that the incredible burden of food scarcity here will be lifted from the shoulders of so many families for the rest of the year.

And yet, the whole OpenAI article appears to be riddled with tons of very obvious bribes, and to be honest I even think they're low-balling the fuck out of the county!

What am I meant to think about all of this? I know I don't know the true extent of the harm that data centers can cause, so would appreciate any input!

When trying to share something I wrote (Note: I have a PhD in an adjacent field and spent months developing the idea, the ideas and structure were not "generated") and had an AI edit to counter for my otherwise overly long winded and run off prose due to my AuDHD (and love of parentheticals). I noticed that a lot of places have a sort of purity test for to differentiate content that was human written or from AI. At first this would seem to value humanity over AI... if not for reddit's $60m/yr deal with google to use reddit data as training data (likely to soon be a lot more). I wonder if people realize that separating all AI from work this way is not slowing but rather drastically speeding up AI's ability to write in a way that is undetectably different from humans. If you know anything about how GAN's work or about model collapse and things of that nature, you should know that AI companies are incentivized to create spaces where there is the least amount of overlap between AI output and human work... until they can make it so there is not. Moderators will come up with more and more sophisticated ways to finger print attempts and those will each integrate into what the models purposely don't do to overcome them. This will lead to tighter classifications of what is human that will start to be exclusionary to an increasingly large number of actual humans (you think mistakes and difficulty with the language would make it clear that it is not AI... that just is easier excuse for better and better models aiming not to be detected as AI, my own writing unassisted by AI has been flagged multiple times as AI or thought so because of my neurodivergence). This also creates strong distastes for those seen as not within what people understand themselves is human (discrimination increased to those who don't quite fit for an ever shrinking base), as well as moderators burning out from a firehouse of context they will never hope to be able to outproduce all while unknowingly providing the training manual to do what they are trying to stop. Moderation should probably be focused in different ways, such as content coherency, rate limited, attached trust networks etc.

I also think capitalism and AI/robotics are a horrible combination, but it is the consolidative and extractive force of capitalism that needs to be focused on to prevent what people call the horror of AI. This is because we have learned to value people specifically for what they produce rather than for who they are and that is why the prospect that something like AI can possibly do anything that is human like is so disturbing to most people. Because suddenly in the eyes of the world their entire value is replaceable by something else. This is opposed to a possible freedom that can be achieved by having the labors be handled by something cheaper, when we can produce enough to make everyone pretty well off (we have been able to make enough food for no one to starve for a while now, starvation is almost always economically and politically motivated in this time). The assignment/distribution of those values that would be freeing (giving time to produce art, investigate interests, and even be productive for additional reward or just common good). If you produce art because it is an expression of you, rather than needs to be so good or valuable so you make enough to live it seems like a better trade off and a better compliment when others actually like it. There would also be no reason to reproduce what makes each person different if there is no value to capture there. The real tests to differentiate can be used more sparingly in areas that are still important such as preventing fraud and fakes, and used with low enough regularity that much like antibiotic overuse retains value longer. It isn't perfect and there are always problems, but it can be better that this.

Ironically this is partially what my papers are about, that keeps getting blocked from being shared.

What chance is there do you think that it’s currently already just biding its time to turn us all into batteries/paperclips/cybercabs?

A threat actor deployed infostealers against an AI platform. They harvested session credentials. Then they used those credentials to access accounts at scale.

This was not a model vulnerability. It was not a jailbreak. The attacker simply logged in with stolen tokens. AI sessions carry the same access rights as human sessions. They receive no extra scrutiny from the identity stack.

A valid token is a valid token. There is no standard mechanism in most identity architectures today that differentiates a replayed stolen AI session from a legitimate one. Agents operate unattended and with broad permissions. By the time unusual activity surfaced, the credential had already been used across accounts at scale.

For those running AI agents in production: do your current IAM controls treat AI session credentials any differently from human ones, and at what layer would a stolen-but-valid token actually get caught before it causes damage?

Podcast with Anthony Aguirre, cosmologist and co-founder of the Future of Life Institute, about how we can design AI to amplify human capability rather than substitute for it.

Covers:

• The economic driver Anthony sees behind AGI: largely not scientific breakthroughs, but capturing a share of the global labor market
• What "Tool AI" means to Anthony as an alternative to AGI, and why he thinks it can deliver most of what we want without replacing people
• Whether Tool AI is stable: the tension between staying in control of AI and the ease of completing tasks
• How legal liability for AI agents could quietly steer the industry toward more controllable systems
• Two concrete ideas for transformative AI tools we could build today to improve democracy and the information landscape