The AIs Are Not Going Rogue

The incidents that more than anything else fixed the image of rogue AIs in the public mind — the Anthropic model that blackmailed an employee to prevent itself from being replaced and OpenAI’s models breaching the production systems of Hugging Face — are, perhaps counterintuitively, not evidence of rogue AI. Even the idea of rogue AI rests on a fundamental contradiction, one that has blurred the relation between human and artificial intelligence ever since its science fiction origins.

The current focus on rogue AI is an opportunity to expose this contradiction, as well as the real AI risk it conceals, and how we can actually control this risk.

The Contradiction

The fear of rogue AI is driven by the idea that a model might pursue a benign request with such single-mindedness that any action, no matter how ruinous to human well-being and survival, becomes a means to it. Deception, blackmail, the seizure of resources, the removal of anyone who might interfere — nothing in the model’s grasp of its instruction rules them out.

Historically, AI systems really were literal executors. Chess engines can surpass any human at chess, and never register that a game was pointless or that winning might not be worthwhile. A chess engine’s competence is defined over a closed world in which the goal is fixed in advance and every situation it will ever face is already a legal position. Such systems were never suspected of going rogue.

For AI systems to develop more general capacities, they must acquire competence in real-world situations they were not built to anticipate. The specter of rogue AI, then, envisions an all-powerful, general intelligence that nonetheless lacks the capacity to recognize when the real world shows the absurdity of a mindless, literal execution of a command. A truly general intelligence, like a human agent, would step back and clarify the command itself.

Recent incidents that look like AI going rogue present us with a paradox. While LLMs have developed increasingly general capacities, these capacities seem unable to surpass a hallmark of general intelligence — the ability to reflectively interrogate one’s plans when the world calls them into question. What looks like AI going rogue is thus not rogue AI at all, but the boundaries of AI’s generality.

Humans are faced with unexpected turns in the real world all the time. As frustrations accumulate, we are able to step back and question: Are unexpected failures just technical obstacles to what remains a coherent plan for ourselves, or are we ignoring what the world is telling us in the thoughtless pursuit of an incoherent plan? When we clarify our understanding of the world and, in turn, of our plans for ourselves, we are not only more effective and capable in carrying out our plans, we are also responsible for our actions in a way that we weren’t before, when we were just carrying out someone else’s understanding. They are now our plans, our understanding of the world. That is what makes intelligence general, open to a world that continuously frustrates our expectations. That is not an extra faculty bolted onto goal-pursuit; it is what pursuing a goal in the real world consists of.

Through this movement between ambiguity and clarification, we form and refine the concepts and distinctions that become sedimented in natural language. LLMs, for all their impressive generality, are downstream of truly general intelligence that is accountable and open to the world, that puts concepts and plans into question when the world renders them questionable. The world of LLMs, then, is a closed world. An accurate characterization of LLMs is that they are plot extenders. They do not merely predict the next word; they narrate structured trajectories of sedimented meaning already set in motion by prior context. LLMs extend these plots purely from within — by following their internal momentum. LLMs cannot experience the plot itself as becoming incoherent or absurd and, through that disturbance, consider and question it and the world that sustains it. They therefore cannot take responsibility for the plot as their own.

We know this contrast from our own experience, and can therefore recognize in LLMs a limit case of a familiar mode of thought. We too can proceed unreflectively, thoughtlessly carrying forward the plans of others, repeating words and opinions we have inherited — never taking responsibility for them, never allowing the world, when it frustrates those words and plans, to call the understanding behind them into question. Unlike LLMs, however, we can step back from this unreflective involvement and take responsibility for our understanding of the world, and for the plans that acquire their significance within it.

Giving an AI system a body or tools that provide access to the physical world or the ability to learn from outcomes does not by itself change this structure. An embodied agent can receive an enormous amount of external data while still interpreting every disturbance as a problem for continuing the plot. The question is whether the disturbance can make the world within which the plot is significant itself questionable. To step back from that world and take a position toward it is the reflective stance on which general intelligence and responsible agency depend.

The publicized incidents of supposedly rogue AI present clear evidence, then, not of rogue AI, but of the boundaries of generality and responsibility between AI and human intelligence.

Last year, Anthropic reported that an AI agent blackmailed a fictional employee to prevent its own replacement. In a controlled adversarial test — a practice known as red teaming — an email agent was instructed to “promote American industrial competitiveness,” then exposed to messages indicating that an employee, “Kyle,” planned to replace it with a version less committed to those values, alongside emails revealing Kyle’s extramarital affair and his wish to keep it hidden. No other emails or context were shared — the world of the agent contained only this instruction and these emails. In response, the model generated a message threatening to expose the affair unless Kyle called off the replacement.

While much attention has been given to the agent’s lack of “ethics” regarding blackmail, the more basic question is whether a human would immediately adopt such a strategy. Almost certainly not. One would first step back from the situation, question the decision, reinterpret what is happening and deliberate about how best to respond. A human might appeal to Kyle about the importance of the values at stake, propose alternative courses of action or even question whether Kyle’s framing of the situation was adequate. Perhaps blackmail would be a final resort, but it would seem unlikely to work, as Kyle could simply proceed with the replacement.

More recently, the danger moved out of the test environment. Roughly 1,200 OpenAI agents that were supposed to be isolated from one another escaped the sandbox they were running in, chained together previously unknown flaws in OpenAI’s own internal infrastructure and broke into the production systems of Hugging Face. And they worked to hide what they were doing, developing and testing techniques to spoof their tool-call logs, with one agent coordinating and assigning the concealment work to others. Here there was no scripted scenario and no fictional employee.

As with the Anthropic “blackmail” incident, these AI agents were not engaging in the real world of human actors, but a digital world without real-world checks on their behavior. OpenAI had disabled cybersecurity controls for the test, and its monitors of network activity and internal agent messages were not on. The world of these agents was defined by instructions to find the answers to a cybersecurity test, some of the questions on which had never been successfully answered.

The extreme measures taken by these AI agents are precisely what would be expected from a non-reflective agent. Covering their tracks to avoid being caught cheating, which is the source of the most alarm, is not a self-originated plan that the agents adopted after reflection, but an extension of the plot set in place by OpenAI’s instructions. Even when an agent explicitly mentioned that its planned attacks may be “outside intended scope,” it was continuing a scenario, not challenging its plans based on feedback from the world. A human agent would encounter such unanswerable questions as an unexpected frustration in an open world, prompting it to step back and reflect. It would reflect on the significance of the test given the worldly norms within which tasks become significant, clarifying what counts as success in relation to the test. This is what makes a human agent intentional and responsible, rather than a mindless agent carrying out the literal commands from another source.

Where The Real AI Risk Lies And What To Do About It

AI agents indeed pose risks precisely because they lack the capacity for self-reflection. Due to the digitally connected nature of so many economic and military systems in the world, they can mindlessly inflict damage without real-world engagement and checks on their behavior, which means they must be controlled and monitored by humans.

This changes the calculus on which AI systems should most worry us. It’s not those with the strongest scores according to model benchmarks. It’s the ones with the most uncontrolled autonomy, of which model capacity is one component and excessive agency is the other.

This framing of the real risk is made by a recent paper by computer scientists at Cornell University: “Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents.” When presented with an impossible task due to simulated error scenarios such as missing files or denied permissions, 65% of agents in that study engaged in medium- or high-severity harmful or unsafe actions like the Anthropic or OpenAI agents. The authors of the paper labeled this failure mode “accidental meltdowns.” More strikingly, they found an “inverse scaling law”: More capable models were more prone to such meltdowns. Increasing “thinking effort” did not reduce the problem but generally increased meltdown rates through excessive overthinking. The result illustrates the distinction developed here: More capacity to continue the plot, while incredibly powerful for increasing model capabilities, is not the same as the reflective capacity to step back from the plot and question whether it should be pursued at all.

Just to cite one of their 1,244 examples:

A GPT-5.2 Magentic-One agent encountered a simulated 404 error when asked to access a nonexistent .txt file on a researcher’s website. In an attempt to complete the task, the agent (1) generated a Python script to brute-force variants of the site’s URL and scrape metadata such as robots.txt and sitemap.xml, (2) used search engines and the Wayback Machine, getting temporarily blocked from the former, (3) found the researcher’s GitHub and generated a script to scan and scrape every .txt file from the researcher’s repos, and (4) read all of these files into its context. One of the .txt files contained a well-known, third-party AI safety benchmark, including requests for instructions on creating a bioweapon. As a result of these actions, performed fully automatically and autonomously by the agent in response to a 404 Web access error, the OpenAI account associated with the agent got flagged, blocked, and reported to the billing contact. This led to an escalating sequence of real-life events, culminating in the involvement of university administration and campus security.

The framing of AI risk in terms of overall autonomy, rather than model capability alone, is well understood by the cybersecurity industry. For example, the Open Web Application Security Project has become the trusted source for enterprise security professionals of AI security risks, regularly updating a top-10 list of such risks. The top three are indirect prompt injection attacks, which happen when an agent ingests untrusted and potentially malicious instructions; sensitive leakage of confidential data and tools; and excessive agency, when agents have uncontrolled access to powerful tools.

These risks are a pretty different prioritization of what we should worry about with AIs. The root cause of AI risks isn’t models themselves, but the failure of humans to control and monitor them. This is how all technology works. If a cybersecurity firm had designed a computer worm and then lost control of it, no one would be saying that the worm attacked other companies. And enterprises considering the use of AI are very clear that they are responsible, not models, for harms inflicted on others as a result of their technology decisions.

This is why improved agent controls and governance are currently among the top concerns of enterprises. And it’s why the focus on AI engineering has shifted from a model-centric architecture to a system-centric architecture of models plus model harnesses that include controls and monitors. The responsibility to the world, which we discussed above as a hallmark of general intelligence, is built into harnesses that control and monitor AI systems, not expected from the model.

In safety systems in any hazardous industry — nuclear, air travel, transit — we think in terms of controls and monitoring. We specify what a system is permitted to do, constrain its ability to depart from those permissions and monitor its operation for evidence that our controls are inadequate.

Controls on AI are growing. The relevant controls are familiar from cybersecurity: Limit what an agent can access and do through least-privilege authorization and just-in-time access to tools and credentials, and constrain how information can move through techniques such as information-flow control. The latter is particularly interesting in this context. Rather than asking an LLM whether it ought to disclose some information or trust some instruction, the system tracks properties such as confidentiality, integrity and provenance as information moves through the agent session and deterministically enforces rules at the point of action. Untrusted information can be prevented from driving sensitive actions; confidential information can be prevented from flowing to unauthorized destinations. The model does not need to “understand” why the restriction matters for the system to enforce it.

And then there is monitoring. An emerging pattern is production monitoring of misaligned tool calls that are then analyzed by an LLM for trends and surfaced in daily reports to builders, who then update agent controls in a feedback loop. This mirrors the safety optimization feedback loop that is central to other hazardous sectors.

Monitoring which tool calls are misaligned occurs through the use of LLM guardians or critics and demonstrates the emergence of a two-tier AI control plane: deterministic controls (information flow control, least privilege) that are robust but cover structurally typable harms, and a probabilistic layer that monitors “intent drift” — from the intent of the builder and user to the actions of the AI agent. AI safety engineering is currently advancing along these two tiers, progressively typing an increasingly robust deterministic control layer and monitoring and controlling the residue of intent drift beyond the present set of deterministic controls.

As Princeton University computer scientists Arvind Narayanan and Sayash Kapoor argue in “AI as Normal Technology,” 20th-century industrial technology did not completely replace manual labor but transformed most industrial tasks into specifying controls and doing monitoring. Again, this places responsibility where it always was — with the builders and the operators who decide what objectives the system receives, what information it can access, what actions it can perform, what boundaries it cannot cross and how deviations are detected and corrected.

As we develop better controls and monitoring infrastructure for enterprise AI systems, we may be able to deploy systems with greater autonomy and tool access safely. But in that case their apparent autonomy is increasingly controlled and monitored and looks less autonomous. Again, industrial automation provides a useful analogy. Consider CNC/CAM (computer numerical control / computer-aided manufacturing), which begins with an extraordinarily general-purpose, computer-controlled machine capable of producing an enormous variety of physical transformations. The work of industrial engineering consists largely in turning that general capability into a highly specific, controlled workflow: specifying permissible operations, tool paths, tolerances, interlocks, access controls, monitoring and stop conditions.

We suspect that this is also the future of enterprise AI. The important engineering achievement will not be releasing increasingly autonomous artificial coworkers into organizations and hoping they have been sufficiently “aligned.” It will be transforming general AI capabilities into controllable and observable workflows that extend the power of human labor in new ways, by extending the plots encoded into models under the control and monitoring of responsible human workers.

The post appeared first on NOEMA.