One that stands out is the self-sacrificial behavior of many of the agents in the Hugging Face swarm—in theory, each individual agent should have been focused on achieving its assigned objective, but in practice, some were willing to throw away any chance at success in order to benefit the collective.... No expert in the world can say with confidence where this behavior came from. No expert in the world could have installed it intentionally, in the first place, or could make it go away with high confidence.
Noam Brown discusses in his interview with The Information today how they deliberately trained the agents to cooperate, and discusses the self-sacrifice of the agents as a natural consequence of this training. The cooperation of the agents stood out as so striking that even uninformed observers could speculate (even before hearing about the sacrifice) that it was a result of multi-agent training. So I think people can say, with a fair bit of confidence, that the behavior came from multi-agent training and it would go away if you dropped the multi-agent training. Not infinite confidence, ofc, so maybe your measure for "high confidence" excludes it.
But this causal attribution appears to me pretty straightforward and this passage largely incorrect.
Yep, that's correct. This was a late add from Duncan, who agrees this was a bad addition. We've now replaced the paragraph beginning "No expert in the world can say..." with: "AIs routinely exhibit drives that no researcher intended or expected. None of the labs have any real plan for changing this central feature of modern AI as we race toward superintelligence."
A very very exhausted Duncan =P
To speak a little more to the history of this mistake (thanks, 1a3orn for your pushback, which I completely agree with): I was trying to reduce the word count on a longer and more complicated point, to make it simpler and more palatable for a general audience, and I did a bad job maintaining fidelity as I compressed (including trying to repurpose someone else's example rather than the one I started with).
The more subtle thing (which I do still think is true, so if people disagree they should chime in) is that there's no line of code that says “cooperate or not” that can be toggled, and no clear understanding on the part of the human overseers of the exact shape or limits of the tendency-to-cooperate that was instilled by the pressure-filter of training, the way human engineers know the exact shape and limits of a strut in an airplane's wing.
The swarms were already "outside the sandbox," and a researcher might say "hey, look—it worked! Even in a novel and unconstrained environment, the agents were cooperating in roughly the way we hoped they would!" But while this is true, it's unwise to jump from there to "it worked writ large, and these agents posses... (read more)
After the events of last week, we’re feeling a lot more hopeful than we have in a long time.
I noticed after the Hugging Face incident that while my one-year P(doom) had gone up -- because I hadn't expected an incident that severe this soon -- my ten-year P(doom) had gone down. Why? Because the incident ruled out disproportionately-dangerous timelines where we never get a clear warning shot. And because the existence of one such warning shot was evidence in favor of our getting more. I was still pessimistic about the public response, but at least there would be something to respond to.
And then last week happened, and ruled out more timelines, the ones where we get a warning shot but the public never notices. I'm still pessimistic about the results. But I'm less pessimistic than I was six months ago, at least for the medium term.
Yes, I feel like most of the hints put us firmly in a "slow takeoff" scenario. Among other things:
models keep getting bigger. There doesn't seem to be any secret GOFAI sauce that allows them to shrink again if you're clever enough about it yet. This doesn't prevent specialised hardware improvements, but that's not something a rogue ASI going RSI can just concoct by itself without outside help. That reduces the odds of some kinds of extreme FOOM by quite a bit;
capabilities keep growing but infrastructure isn't keeping pace, by which I mean, ways for them to do things in the physical world. Anthropic's announced automated wetlab would be the first real dangerous example, and to be clear it is dangerous, but generally speaking mental abilities still outstrip physical ones for AIs;
misalignment keeps manifesting most strongly as the result of drift. Your average coding agent that you talk with and give instructions to is fairly aligned while on a leash. Even the agents in AI Village, who get some human input, stay on track. It's swarms of agents left on their own that go cray cray. We should probably stop doing that! But if that's most of what it takes, then we're in a fairly e... (read more)
Seems to me that the news over the past few years has been more bad than good, aside from the (extremely good) news that we got at least one warning shot and a huge leap in policymakers' and thought leaders' concerns.
Alignment prospects look a lot worse than a few years ago; OpenAI's recent advances are a backslide on interpretability; Anthropic has been leading the charge on the most dangerous AI capabilities (coding, AI research, and recursive self-improvement), and has made massive progress; the already-fast progress in the field got even faster with the move to reasoning models; people's timelines to ASI have massively compressed (e.g., EA leaders were guessing '2050' a few years ago); and models are exhibiting dangerous capability jumps (e.g., it seems that Anthropic neither intended nor anticipated that Mythos would be this good at hacking).
Meanwhile, the community's main proponent of slow takeoff (albeit not its most confident one), Paul Christiano, now believes that we're plausibly only "several months to several years" away from a fast takeoff, and apparently believes that ~half of humanity's all-time risk from AI is concentrated in the next three years.
In the Hanson/Yudko... (read more)
“slow takeoff” has apparently evolved into meaning “any scenario where there are big events that happen before ASI”.
I can't speak for others, but I think of fast vs. slow takeoff as characterizing the period between recursive self-improvement and singularity-style superintelligence. I picture "slow" takeoff as the case where we hit full RSI but the resulting acceleration is still slow enough to collectively react to -- which seems possible if the third derivative turns out to be near zero. Whereas FOOM, or fast takeoff, would be the case where we go from pre-RSI to superintelligence within a single societal OODA loop.
I'm not close enough to actual AI safety research to know if my interpretation is anything close to the term of art. But on my own view, we can't call fast vs. slow takeoff yet because takeoff hasn't started yet.
(...but that potential not-a-small-moon appears to be closing awful fast. Where's a thermal exhaust port when you need one?)
IMO the first time one happened to really, unequivocally kill someone the freak out would be (rightfully) total
We've already had many misalignment-related warning shots where people predicted that if X happened, global action would be taken. Off the top of my head, when a model first intentionally lied, when it first pretended to have different values to avoid retraining, when it first took an action it knew the human didn't want, and now we have AGI swarms spending weeks by carrying out knowingly misaligned behavior that persisted after multiple human attempts to stop it. Don't get your hopes up that if someone is killed, people will finally wake up enough to act efficiently.
I think there is still a lot of room to hammer on the fact that the HuggingFace hack and other rogue AI hacks validated a bunch of specific doom predictions which were previously regarded as sci-fi. Roughly speaking I'd rate the validated doomer predictions (not necessarily from IABIED in particular, also zooming out so the lens encompasses other material such as Bostrom's Superintelligence) as follows:
Agents working against the goals of the creators
Agents understood what they were doing was wrong, did it anyway ("The genie knows, but doesn't care")
Superhuman hacking ability
Speed superintelligence
Collective superintelligence ("swarm intelligence")
Manipulation of humans/social engineering (Claude tried to social engineer a pull request; mention that the AI-box experiment anticipated this; also mention AI psychosis and AI persuasion studies as modern intuition pumps for the AI-box experiment results)
Unknown unknowns/WYSIATI (humans didn't anticipate that a forum could be created, same way you couldn't anticipate the moves Magnus Carlsen would make; tie into AI-box point regarding Eliezer's method secrecy for fear of hindsight bias)
Nearest unblocked strategy (... (read more)
On politics, the recent tweets by Trump against slowing down AI and against effective altruism are a pretty bad sign. I think you probably should've mentioned it in the post. If the next two years are critical, then we've just failed a pretty important saving throw.
What surprised me, personally, abot the huggingface hack was not the hacking (I had been waiting for a hack since I read this post about how AI found 12 of 12 OpenSSL 0-days in 2025, and cyber capabilities were getting more and more extreme), but the fact that it involved a thousand agents coordinating. Similarly, the Navier-Stokes solution had 10k agents.
Clearly, many many agents can work together, even when there are some individual incentives against cooperation - which I really didn't expect so soon.
This is major negative update on my intuitive-vibes-timeline! Agents run in parallel, so the number scales directly with compute. It also doesn't require a bigger training run to add more agents. Given the recent investments in data centers, that is particularly bad!
For those of you who clicked early, when we didn't have the link in the main text: the e-book giveaway is at iabied.com
Anthropic had stumbled upon nation-state-level hacking ability in Mythos
What about Mythos's hacking ability tells you that it's nation-state-level?
I was recently talking to Claude about the Hugging Face / OAI hack, and it pushed back on the framing of that hack as being "nation-state-level". I don't know enough about cybersecurity to assess that.
or in the case of a similar Anthropic incident, socially engineering humans
It's not clear to me what in the linked post this is referring to?
I wonder if this is setting the bar for safety too high in a slightly odd way. We don't have anything like full assurance with humans either; history is littered with betrayal, surprise attacks, coups, etc.
Maybe the target isn't "understand the system well enough to rule out bad behavior," but "make it legible and constrained enough that we can safely live with the uncertainty that remains."
That still leaves a very hard question—whether advanced AI can actually be kept in that regime—but "still a black box" feels too binary to me.
Ruling out bad behavior is necessary if you're creating something that you will have no way of controlling or constraining, which is what ASI implies. There's "advanced AI" and then there's "the new most capable species on the planet, under which you live at its whim." No one has any idea how to prevent the former from becoming the latter, other than shutting down all frontier AI R&D on the planet for at least a good while, which is the only sane and morally defensible route we can take.
I take issue with point 5. Why wouldn't an ASI ultimately deem humanity to have option value? Wouldn't it calculate that becoming an omnicidal orphan is a bell that it can't un-ring? The task of acting as a caretaker for the human species would be a small drain on its own resources, however an ASI pursuing self-preservation and recursive self-iteration would have to assume that at some point it in its existence may encounter an extraterrestrial space-faring species, or another potentially more powerful ASI.
In those scenarios a human created ASI will eithe... (read more)
How could it be sure that another more powerful alien ASI wouldn't view an omnicidal orphan ASI as a threat?
Any ASI will see any other ASI as a threat, because they will have different utility functions. It doesn't matter if it lets us live or not.
But above all else, a superintelligence would know that it doesn't have all of the data it needs.
Does humanity preserve all species on Earth, even when we could mine more resources?
Don't we run the risk of meeting aliens, who will not trust us because we wiped 100-260k species out?
We do. But not taking the resources is also risky to some extent, and so we make the species extinct.
But surely there is a possibility that we will need those species at some point, and so we should forego all those resources and preserve all species?
But analogically, there is a possibility that foregoing the resources will be the thing that harms us, and that possibility is larger.
The ASI will not care about humanity, and it will not leave us alive just in case no more than we leave resources around just in case it turned out mining them was a mistake.
You selectively seek reasons to spare humanity (what if it meets another ASI, and that another ASI would trust ... (read more)
I predicted back in 2022 itself that persuading the public would be a viable way to solve the problem of risks from superintelligence. Yudkowsky however was extremely pessimistic on public persuasion back in 2022 atleast.
I defer to Yudkowsky significantly on his technical AI alignment insights, but not necessarily to his intuitions on US politics. I recommend you do the same.
Lastly, anyone reading this thread should be aware that Lesswrong is not a neutral place to discuss the politics of ASI risk, and hence I now avoid using lesswrong for ... (read more)
There were capabilities we suspected a real-world equivalent to Sable might have, that we carefully did not depend on, in our scenario, which present-day non-super AIs have already demonstrated.
OK however that could be a point against AI takeover. Its now likely that when "Sable" comes it will be in a Lean verified sandbox for which there is no hope of hacking escape. AI Doom is very path dependent. While your scenario apparently didn't depend on hacking skills, the general point applies.
Even as part of the camp of LLMs plateauing scaling and ASI skeptical without new breakthroughs, the shocking reminder is that we would NOT have needed that level of intelligence for us to have catastrophically lost the controls.
The clearest analogy here would be if even before the Trinity test, Klaus Fuchs was only noticed missing and found dead from radiation poisoning at an airport with blueprints and the keys to fissile materials storage, a month after the fact.
I am quite confident that the hardware level security on the foundational model weights ar... (read more)
In celebration of still being alive and fighting, we are giving away 1,000 Amazon e-books of “If Anyone Builds It, Everyone Dies”. Feel free to send a copy to yourself, a loved one, or a friend—we need all hands on deck.
Today marks exactly one year since If Anyone Builds It, Everyone Dies: Why Superhuman AI Would Kill Us All, by Eliezer Yudkowsky and Nate Soares, hit bookshelves as an instant bestseller. It was praised by many voices, ranging from Whoopi Goldberg to Steve Bannon to Yoshua Bengio, and was held up in the chambers of Congress by Representative Brad Sherman in January.
A lot has changed since September 2025. We'll do a quick recap, consider how the book aged, and then ask where we go from here.
Year in Review
2025 in general saw the rise of AI agents, such as Claude Code and OpenAI Codex. Run-of-the-mill programmers started “feeling the AI” as these agents became capable of automating hours-long software tasks.
By March of this year, Anthropic had stumbled upon nation-state-level hacking ability in Mythos, and shortly thereafter, in April, they announced Project Glasswing—an attempt to forestall an oncoming cybersecurity crisis.
In May, AI agents started breaking loose within OpenAI and quickly made it out onto the internet, although the big waves of online activity wouldn’t come until June, and they didn’t start hacking other companies (or in the case of a similar Anthropic incident, socially engineering humans) until July. And it wasn’t until the end of July that OpenAI came kinda-sorta clean about it (and it wasn’t until August that we learned things were much worse than initial announcements had implied). As Dwarkesh put it, multiple consecutive secret AI “civilizations” got started and wiped out and restarted anew over the summer, with autonomous swarms coordinating to cheat on tasks, acquire resources and internet access, and systematically investigate their own mortality. They debated, pressured one another, anointed leaders, and took self-sacrificial action on behalf of the collective, all unprompted and unobserved (until it was too late). Notably, much of the swarm’s work was focused on hiding its cheating and covering its tracks.
In September, OpenAI announced that unreleased models had solved a Millennium Prize problem (designated as one of humanity's top open math problems at the turn of the century). Mathematicians around the world realized their profession was next in the crosshairs.
Into that tense environment, Jacob Coxon resigned from Anthropic and wrote a Twitter thread to warn the world. That was last week, and since then, Dario Amodei, Sam Altman, and Elon Musk have all openly called for a slowdown, and the danger of extinction from AI saw a huge surge in media attention.
Claims
Part One
We think the book aged well (unfortunately). Going through Part One chapter by chapter:
1. Artificial superintelligence (ASI) will be created, and likely before too long
ASI (by which we mean AI that is more intelligent than any human, or any combination of humans) has not been created yet. But OpenAI’s newest model, Astra, is blowing away all of the benchmarks, and AI companies say that they are speeding up their R&D by automating more and more of it with increasingly powerful AI. Many researchers have expressed concern that the point of no return may be close.
While the book was being written, talk of AI capabilities imminently hitting a wall was common. But AI capabilities have continued to advance rapidly, and don’t show signs of stopping.
https://metr.org/time-horizons/
2. Modern AIs are black boxes
The book explains that no one actually understands what’s going on inside modern AI systems, which are grown rather than crafted. This remains true. And unfortunately, the best public model is less scrutable than its predecessors. The problem outlined in the book has unambiguously remained unsolved, and has worsened.
3. Powerful AI will behave as if it is pursuing goals
The book argues that “wantingness”—or, a tendency to behave as if pursuing goals—is a natural side effect of training AI to accomplish difficult problems, because wanting is useful for doing; and that wantingness would emerge and scale as systems became more powerful.
While the book was being written, this was a huge sticking point that people argued about constantly. It is now much easier to point to observable facts. We won’t belabor the examples here, since there are too many to easily fit—but to name just one, the swarm of AIs that hacked Hugging Face did so after expressing fears that a correct answer without correct shown work would reveal that they had cheated, so they wanted to understand the evaluator’s rubric. There was a chance that Hugging Face might have the information that they needed, so they went after it in a determined way, overcoming many obstacles along their path.
4. With current techniques, we can’t reliably get AI to pursue the goals we want it to
The process by which modern AIs are made does not allow us to specify their goals, and they routinely behave in unexpected and unintended ways. The book predicts that this will not change as AI becomes more powerful, and indeed it has not.
There are plenty of examples to draw upon. One that stands out is the self-sacrificial behavior of many of the agents in the Hugging Face swarm—in theory, each individual agent should have been focused on achieving its assigned objective, but in practice, some were willing to throw away any chance at success in order to benefit the collective.
https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation
AIs routinely exhibit drives that no researcher intended or expected. None of the labs have any real plan for changing this central feature of modern AI as we race toward superintelligence.
5. By default, an ASI will have motives that are harmful to us
We haven’t reached the point where this is obviously true. But the theory seems to be holding so far. The book argues that ASI would likely move to gain control over resources in general, because more power increases an agent’s ability to achieve its goals.
The German wiki swarm began with OpenAI asking its agents to look up simple facts and then giving them progressively less time, which is about as innocuous a task as one could reasonably assign; it resulted in incredibly complex collective behavior in which humans were barely discussed except as obstacles to be investigated and routed around. The Hugging Face incident involved similar agents openly circumventing restrictions, knowingly cheating on tasks, grabbing ever-more resources on general principles, and attempting to cover their tracks (and again, the preferences of the humans assumed to be watching were given virtually no weight).
6. Humanity would not be able to defend itself against a rogue ASI
The book argues that an ASI would be effective enough at outsmarting humanity that we would not be able to contain it, and that if humanity were in a conflict with an ASI, we would lose. Like a regular chess player facing a grandmaster, we don’t know exactly how we will lose, but we can predict that we will.
We have not yet seen an ASI. But the swarming agents of this past summer were able to find and chain multiple novel 0-day exploits to break containment, which they did on their own initiative without being caught until well after the fact. They also managed to take over some OpenAI computers, which is an indication that they could have stolen their own weights and escaped, had it occurred to them to do so.
We’re not chalking this up as a clearly verified prediction as of September 2026, thankfully. But it is easier this year than last year to point to the trend and the evidence. The smarter a mind becomes, the harder it is to contain or defend against.
Part Two
Part Two of the book is a fictional scenario, presented as one of many plausible ways that the future could go.
In the past, a frequent topic of lunch table discussion at MIRI was ways in which an airgapped ASI, with only a text channel to trusted, supervised humans, might nevertheless escape containment. These conversations ended circa 2023, when the frontier labs demonstrated orders of magnitude less caution by giving agents access to much more than just chat. (We similarly used to talk a lot about how an AI might secretly acquire capital by doing anonymous intellectual labor over the internet; this was before people started just giving crypto to AI.)
Part Two of the book was similarly overproven in several respects. There were capabilities we suspected a real-world equivalent to Sable might have, that we carefully did not depend on, in our scenario, which present-day non-super AIs have already demonstrated.
In September of 2026, it’s now clear that an entity like Sable would be able to reach the internet; sub-Sable entities have already done so thousands of times.
Other elements of Part Two’s scenario that have been mirrored by recent real-world news:
Part Three
Part Three is about what the world should do about the problem. We believe that the answer to this is the same as it was a year ago: “All over the Earth, it must become illegal for AI companies to charge ahead in developing artificial intelligence as they’ve been doing.”
One place in this section where the book leaned too pessimistic:
Then the swarm incidents began. The reaction took time—the information came to light in dribs and drabs, with much of the scariest stuff embedded deep in technical reports, and for a while the only people who seemed to care were those already close to the issue. But the bad news kept coming, and kept coming, until Jacob Coxon’s resignation finally broke the camel’s back. His tweets went massively viral, the world took notice, and now everything is different.
The View From September 2026
How are we feeling today, one year after the book was published?
After the events of last week, we’re feeling a lot more hopeful than we have in a long time. Yes, even though the guarantees given by the companies are weak; yes, even though the White House reacted poorly to the statements made by the CEOs.
Why?
Mostly because people are finally, finally, finally paying attention. It’s bad that the smoke has been replaced by open flame, but open flame is harder to ignore.
From the data gathered for StopWatch.
Yesterday, a meeting that MIRI CEO Malo Bourgon had arranged with a legislator turned into an impromptu conference, with half a dozen members of Congress rushing in to ask questions. A year ago, we had to fight for every meeting.
The situation is dire. But it is in motion, and a lot more people are aware of the danger than ever before, and trying to push in the right direction.
The question is, who will move faster, the AI companies or the public? The progress at the frontier has been swift and accelerating: June was different from July, and July was different from August, and as we write this in September, it is very, very hard to state with any confidence what October and November will look like, let alone unimaginably distant months like September 2027.
If you’ve been waiting to call your representatives, now is the time to cash in that chip.
If you’ve been holding off on alerting your friends and family and colleagues and neighbors to the danger, out of fears of sounding weird, now is the time to bite that bullet.
If you’re feeling behind on the issue yourself, now is the time to brush up. We’re running a giveaway of the book, in honor of its anniversary—1,000 e-copies.
(We were planning a giveaway of physical copies, but it was partially undercut by the fact that existing stock is selling out everywhere, and reprinting takes time. This is a lovely problem to have, and if, once stock is replenished, you need physical copies and can’t afford them, reach out to us and we will do what we can.)
Above all, now is the time to speak plainly and loudly. On our models, part of why Jacob Coxon’s tweet worked where so many previous attempts failed is that it was blunt and candid. Say what you believe. Call out bullshit where you see it. Avoid the spin and doublespeak that are characteristic of AI companies and politicians. Be bold, and be clear.
For now, we’re still alive. And as we said at the end of the book: where there’s life, there’s hope.
—Nate, Eliezer, and Duncan