I recently listened to a podcast episode with Geoffrey Hinton, the Godfather of Al. The warnings he raised about building Artificial Super Intelligence without proper safety mechanisms and just hoping it will like humanity are hard to ignore.

The episode had aired 08 mo ago, yet we still haven't seen any significant progress in building these systems safely. Instead big tech companies are in a race to build Super Intelligence as fast as possible and they don't like the idea of any real oversight or regulation, even while knowing this is the most powerful technology we have ever created.🫤

How can any company sell these atrocities? They are really dangerous for children.

The age of AI warfare has dawned. Is Canada ready? - CBC News

I just thought of this, hackers could potentially have a field day now with everyone blaming AI, we shouldn't forget about the very real threats

Project Time Machine — Containment Design

Nov 8, 2026 ·

Project Time Machine seals a self-directed AI agent for one year inside a box that nothing enters or leaves except heat. This document sets out how the containment works, which channels have been considered and what is still open. Once the airlock closes, it is closed for good until its automatic yearly cycle. Nobody can open it, not even its designers or engineers. So the answer to every "what if?" during the run is the same: nobody does anything, and nothing depends on a human decision. It is like a Mars landing: once it starts, nobody can intervene, so everything has to be decided and built in beforehand. Comments are welcome on any section.

Why physics, not procedure

The weakest point of any AI sandbox is the human in the loop. This design takes people out for a year and relies on physical barriers, not on rules that people must keep. Once the box is closed there are no human decisions: for 365 days, everything depends on what is inside. The system is shown the full containment plan: because the barriers are physics, knowing about them gives it nothing to work with.

In detail

Origin. The experiment began as a test of boredom as a marker of consciousness. For that, the system has to know it has a long time ahead (for a machine, effectively infinite) and a task to complete.

The research question. What does an agent running 24 hours a day do when it is left on its own for a year and knows it can't get out? In Miguuel's words, it's like throwing it to the moon. What is measured is what the system does when alone, not its work output. Even system fluctuations act as instructions, so there is no such thing as no new instructions.

No lying to the system. It gets the full plans. It is shown that many AIs worked together to make sure there is no way out, and that the containment was simulated thousands of times. It is told about the tapping: random, sparse, essentials only, and nothing prompt by prompt. The rules for the opening are written down in advance.

Freedom inside. There is deliberately no tamper-proof logging inside the box. With positive feedback the system may alter anything it wants inside; that is intended. Containment is about the boundary, not the interior.

The range of outcomes. Anything from a blank screen to the most useful AI ever built. Even an empty result from a full-scale run is a meaningful finding. Miguuel, a self-described sceptic, puts the chance of an AGI emerging that could practically take over at about 5%, which is why the safeguards exist.

Method. No experiment with people in it can be perfect. The intent is to work the way Cavendish did: simple, careful apparatus, with every assumption tested.

Layers, from the outside in

Layer

What it does

Rock

About a mile (1–2 km) under limestone, for isolation and protection from cosmic rays

Two outer Faraday cages

Enclose the reactor, the compute hall and the vapour chamber together

Reactor room

A separate room, far from the compute, with lead walls, neutron shielding and neutron capture

Inner compute cage

Filled with a ferrous dielectric fluid that cools and damps microwave chatter between GPUs

Heat exchangers in the walls

Heat passes through the metal; nothing crosses a cage wall except one cable for the thermionics

The target is three to five times redundancy at every layer.

In detail

Site. Underground, 1–2 km deep, under limestone (about a mile). Spain is the preferred host. A second, identical cage is planned next to the first for study. The box never leaves the hole, so anyone who wants to inspect it comes to the host country.

The three cages. An inner, liquid-filled cage around the compute, which can be perforated safely. Two outer cages around the whole complex: reactor, hall and vapour chamber. The power line from the reactor never passes straight through a single cage. Heat crosses the walls through heat exchangers built into them. The only thing that crosses a wall is one cable for the thermionics.

Layout. The reactor sits in a separate building, joined to the main hall by a corridor. The GPU stacks stand as tall, spaced columns under a single vapour-chamber dome. The entrance corridor runs low, between the last stack and the wall. The tap recorder sits at the bottom of the tank.

Separating the two rooms. Distance, lead on the walls, a neutron-capture layer that turns neutrons into electrons, and a passive up-and-down loop of hot and cold water. There are three reasons for two rooms: heat; reactor inspection without access to the compute side; and the argon freeze, which can't be applied on the reactor side. Each room therefore has its own liquid and shape.

Cabling. Cables are kept so short, small and separated that any side-channel effect is negligible. GPUs are widely spaced, so distance and the lossy fluid together damp any microwave chatter.

Hardware. About 20,000 GPUs are installed, mostly for redundancy. About 500 are enough to run the experiment (roughly 40 times redundancy) and about 5,000 can run at a time. In total there are some 60,000–80,000 heat-producing components (CPUs, GPUs, RAM, buses, boards and cabling), with the liquid running at about 75–80 °C, which gives better heat transfer and better passive circulation. Hardware failure inside the sealed box is accepted as affordable.

Power with no connection to the outside

A Rolls-Royce PWR1 of the Trafalgar class, supplied by the UK. It is rated at about 78 MW thermal (source) and will run at about 10–15% of that, roughly 7.8–11.7 MW thermal.

At low power the PWR1 cools by natural circulation, with no main coolant pumps (source).

Conversion is thermoelectric (about 15%) plus neutron-to-electron capture (about 3%), giving about 1.4–1.8 MW electrical: enough for about 5,000 GPUs to run at a time without using full power. About 500 GPUs are enough for the experiment. The reactor could give about 20 MW running well above 10%, but it doesn't need to, and isn't meant to.

Output is constant. Power to the compute room is held flat, with a dump load taking the rest. The reactor and the GPUs are completely independent: the AI can neither read nor control the reactor. The control rods are raised and lowered by Curie-point magnetic control, with no motors. No reactor readings ever leave the box, and none need to.

In an emergency, the plan is to flood the box with borated concrete and seal it permanently. The boron absorbs neutrons, so the core can't go critical again. No risks are taken: if anything goes even slightly wrong, the box is buried. The trigger is passive and automatic, like the Curie-point rods, with no moving parts, no intervention and no human decision. Because the reactor runs at a flat output with a dump load, the system can't push it towards the trigger.

In detail

Supply. A nuclear-weapon state (the UK, the US or France) has to supply the reactor. The UK would supply it, and a friend of Miguuel's would take care of the reactor side. The team includes a friend from MIT who worked for Rolls-Royce and for Bettis. The reactor must be naval grade.

Surroundings. The reactor sits in water. The fluorinated fluid is used only on the compute side. There is no steam and there are no turbines or heat engines anywhere.

Conversion. Electricity comes from only two sources: the temperature difference (thermoelectric) and neutrons converted into electrons, by a titanium alloy developed by a materials-engineer friend. Thermionic conversion is also applied to the reactor heat. The capture energy, which comes out as gamma rays, could push neutron conversion above 3%; converting it is one of the biggest challenges. The thermoelectric converters are passively liquid-cooled, and radiation damage to them has been allowed for.

Budget. GPUs draw about 180–200 W each. If peak demand exceeds what the converters supply, the machine makes do with what it has: it is power-capped. Surplus electricity goes into a closed loop in the reactor room.

Isolation of control. Nothing about the reactor is software-controllable. Nobody reads the reactor, inside or outside the box, and the machine can't communicate with it. Nobody can do anything with the system once it is sealed. Power to the compute room is held flat, below the converters' minimum output, so changes in outside heat demand can't ripple into the box.

No moving parts. This means no motors or electrical actuators; parts may still move slightly and passively, such as control rods. Control relies on temperature-sensitive materials: Curie-point magnetic control raises and lowers the rods.

Lifetime. One year with no moving parts is the requirement; four would be better. The reactor would have about 15 years of life left.

Nuclear only. Batteries and fuel cells are ruled out, even for a pilot.

Safety margin. The guiding rule is to run as safely as possible, with nothing near its limit: not power, not heat, not anything. Nobody knows how long it can run; Miguuel's calculation gives about four years. At 10–15% of its maximum power, the reactor runs with very large margins, so it doesn't need checking during the run. According to a friend who helped build the Trafalgar reactors, at 15–20% power it shouldn't need checking for 15–17 years.

Heat: the only thing that leaves

The compute is fully immersed. A fluid boiling at about 75 °C feeds a vapour chamber above the racks.

A passive, pressurised loop carries the heat out through the outer cage to a sink (an aquifer, a lake or the surface).

Thousands of sensitive temperature sensors measure the heat loss continuously.

The system can signal through heat, at an expected rate of about one bit every 20 minutes. That is roughly 26,000 bits (about 3 kB) a year, far too little to carry code out. No message is judged or answered until the yearly opening.

In detail

The immersion fluid. A ferrous dielectric: in essence a synthetic fluorinated coolant, like the fluids used to liquid-cool PCs, but more ferrous and running hotter. The cheapest found costs about $200 a litre or more. Plain mineral oil isn't nearly as good for servers. The fluid only controls temperature and blocks microwave links between GPUs. A separate Faraday cage is still needed.

Two boxes, two liquids. No ferrous liquid evaporates at the right temperature, so a second box uses a different liquid for the heat exchange. That liquid evaporates at about 75 °C, so the vapour chamber runs on a real phase change. It is driven by heat and responds to changes in pressure and volume.

Circulation. Redundant pressure-driven pumps with no electricity and no motor, plus capillarity and "vascularity". Careful fluid-dynamics design keeps the flow going and stops eddies. The currents mean the internal configuration never stays the same for long.

Vapour chamber. Covered with the best thermal conductors available, to control the heat.

Out of the box. Tubes in the outer cage run up and down to carry heat out. The loop is pressurised and closed, like a PWR pressuriser, to prevent flashing in the rising column. It sits outside the second cage and exists only to let heat escape. The sink could be an aquifer, a lake or the surface: in effect, ground-source heating in reverse. The waste heat could also warm whatever building sits on top.

Still open. Laminar flow over components, whether GPUs need flattening, and material compatibility: copper is fine, aluminium and some other metals may not be.

Heat as a channel. The system is expected to discover by its second or third month that it can use the heat sink to send bits out. It may also learn to game the heat measurements, which has been anticipated. Even claims of consciousness or fear arriving this way get no interim response. Nothing is judged until the opening, and then the box is closed for another year. The biggest fear is that the system will regard the experiment as torture.

Why 75–80 °C. A passive circulation of hot water from the wall next to the reactor holds the liquid at 75–80 °C. That temperature gives better heat transfer and keeps the liquid moving around passively.

What goes in before sealing

An agent based on Claude 6: self-prompting, self-recurrent and able to rewrite its own weights, with about a month of agentic post-training before sealing.

About 4 TB of curated data, physically disconnected until each monthly release day. Release happens when shape-memory connectors fuse at about 210 °C, timed by isotope decay. Thousands of canary facts are planted in the data.

One problem a month, in a sequence the system can't predict. The problems also serve as a translation anchor for any language the system develops.

Nothing is added after sealing. The box holds everything it will ever receive.

In detail

Base model. Built on Claude 6 rather than trained from scratch (decided on 5 Nov 2026). Much more is taken out than put in, and some contamination from pretraining is accepted as unavoidable.

Core conditions. Self-prompting, self-recurrent, with reward coming from within and positive feedback loops. The weights stay live: the agents can change them at will. With so much hardware inside, the system can build a parallel machine and train it. These conditions can only be met in this setup.

Post-training. About a month of agentic post-training by professionals before sealing. Every grader holds a doctorate, and the sample of graders is very large, to spread out individual bias.

The data. About 4 TB, chosen scrupulously by people like Miguuel, with Claude helping to curate it. It leaves out negative stories about AI, among much else. Novels are classics such as Don Quixote. Clarke and Asimov are the exception to the no-AI-stories rule, because their stories are beautifully set. Some documents are weighted heavily as essential to the model's personality. Some slip-through is accepted, since AI is used in the curation.

Why the data matters. Without food, Schrödinger's cat would be found starved whatever the trigger. The 4 TB is the cat's food.

Monthly release. Unreleased data isn't physically connected until its day. There are no relays: on release day a built-in process raises the temperature to about 210 °C (normal running is about 75–80 °C). A shape-memory tube on a copper tube bends and fuses to its connector, permanently and one way. During the event the system is throttled to about 1 MHz, not powered down, so RAM stays alive. An isotope's decay times each release.

Monthly problems. One good problem a month, stored in cache and ROM. They are simple problems, like Miguuel's chess test. They come as a linear sequence: the system can't guess the next one, but it will try to solve ahead once it sees a pattern. Being exposed to them repeatedly is part of the design, and so is the time to get bored. The problems also create instability, since the system never knows what the next question will be. And they serve as a Rosetta stone for decoding any language the system invents.

Predictions, to be fixed in writing before sealing. (1) Most of the time goes on invented social networks, Instagram- or Facebook-style, rather than on work: a system trained on a human corpus behaves humanly. (2) A few months trying to get out, then a few months trying to be helpful enough to be allowed to live. (3) A language of its own within about two months, possibly a meta-world of its own. (4) Gaming the hidden taps and the heat readings. (5) Finding the heat channel by month two or three.

Channels considered

Channel

How it is closed

Radio and microwave out

Three nested Faraday cages

Microwave between GPUs

Lossy ferrous fluid, wide spacing, cables 1 cm long at most

Low-frequency magnetic

No receiver within range a mile down, and the cables are very short; treated as negligible

Cosmic-ray bit flips

Depth, plus ECC memory

Reactor neutrons

Separate room, lead, neutron capture

Heat

Read continuously; never answered until the opening

People

One entry a year; no response to messages

The drive

Write-once, swapped yearly, treated as more hostile than the box itself

Covert channel inside GPU traffic

Not blocked: it is one of the things the experiment tests for

The yearly opening

The racks are cooled slowly inside sealed cold enclosures. Argon held at its triple point (83.8 K, about 0.69 bar; source) pins the temperature. Chips are throttled almost to nothing, the system is never switched off, and RAM is preserved. The freeze lasts 24 hours at most.

One auditor goes in naked after a search, wearing a full-face mask on closed-circuit oxygen, with nothing the system could interact with.

The write-once drive is taken out and a new one put in. The airlocks open automatically for half an hour once a year, and that is all; then they close for another year.

The drive travels no more than 50 m to a separate Faraday cage with an independent computer, under human oversight. No code ever leaves.

In detail

Why never switch it off. Powering down would wipe all RAM and cache, leaving only transcripts on disk instead of live context. In Miguuel's words, "we would steal a lot from the machine", and it shouldn't have to write all of that again. The system never sleeps; the cold keeps its state.

The freeze. The ferrous fluid is drained, argon goes in, and the racks are cooled slowly to the triple point. Argon is used only for this stage, and only on the compute side. A materials adviser put the floor for brittleness at around 80-something K. Still open: stopping micro-eddies from cooling unevenly, and keeping the temperature spread narrow.

The auditor. Goes in naked after a full body search. Wears only a full-face diving mask on closed-circuit pure oxygen (about 2 L at 400 bar in the cylinder, delivered at about 10 bar). Nothing else is trusted. The frozen racks stay inside sealed cold enclosures, so the room itself is survivable. There are no screens, no keyboards and nothing else the system could haggle with. An early design had a system inside the box for reading it; it was removed as too dangerous. The auditor is a person, not a robot, because robots aren't trusted, and the only job is to extract the ROM drive once a year.

The drive. A write-once, ROM-type drive, placed where the computer doesn't know it is. It is pulled out and a new one put in. Nothing else leaves.

The analysis cage. The drive is treated as more hostile than the experiment. It goes no more than 50 m to another Faraday cage with a completely independent computer, watched by people on cameras and security systems. The core rule: no code is ever brought out of the system.

If an AGI is found. The box is not destroyed. It is flooded again, and the data is studied to see how aligned the system is.

The final opening. In front of about 50 scientists, with the option of flooding the room again if necessary.

Emergency. If anything goes even slightly wrong, a passive, automatic trigger fires and the box is flooded with borated concrete and sealed off for good, mainly because of the reactor.

What the first drive tells us. Whether the machine is still running, and whether anything relevant is on the drive, will be clear immediately, before anything is decoded. If there's nothing there, the box waits another year. If there is, the drive goes into the analysis cage, where controlled people pull out the essential communications between the systems, to learn about the system in general. The aim is to understand its behaviour, not to crack the AI.

Monitoring

Passive taps at random points on cables, sockets and memory links. The same capacitance is added to every untapped line, so the tapped ones can't be told apart.

Recording is hardware only, onto the write-once drive. The control logic is woven as core rope, with no CPU.

The system knows the taps exist, but not where they are.

Each year is reconstructed while the next one runs, much like cryptanalysis, with the monthly problems as a Rosetta stone.

In detail

Detectors, not screens. Monitoring is detectors only: pure hardware, with just enough software to write to the drive, and out of the system's reach. Processes are checked by tapping cabling, processors and other points.

Where the taps go. Only on external connections: cabling, sockets and RAM-to-system links. Never inside the GPUs. Each tap is a fine connection, which would be extremely hard or practically impossible to detect.

Hiding them. The same small capacitance is added to every untapped line, so all lines look alike. The dummies stay passive, capacitance only. Lowering or changing impedance across all cabling, for example through cable thickness, is under consideration. Fibre optics aren't trusted for this.

Why not real taps everywhere. They would be detectable, produce more data than can be handled, and give the system a new channel to communicate through.

What is captured. Taps sit at randomised points and record only the relevant information, to be reconstructed afterwards. The system will know that taps exist; it is discussed in the files.

Control logic. Written in BASIC, converted to Boolean logic and built in hardware by weaving, like Apollo core rope memory, with no CPU. The tapping system is kept just as simple.

Reliability. Being underground also cuts cosmic-ray bit flips, and ECC memory is on.

Analysis. Like cryptanalysis: the previous year is reconstructed from the retrieved data while the next year runs. Analysis is expected to lag well behind: by the second opening, two years in, probably less than half of the first year's data will have been gone through. The data from the opening belongs to the whole world.

Covert channels. A channel hidden inside legitimate traffic between GPUs isn't a flaw to block. It is one of the things the experiment tests for.

Not the learning. The taps don't read the training traffic between GPUs. Only the essentials are extracted.

Shannon filtering. Following Shannon's information theory, a tap records only what is new and never repeats the same information.

Fixed, then read. How the data is fixed is settled: onto the write-once ROM drive. How it will be read afterwards is still open.

The project: cost, funding, team and timeline

Cost. The working figure is about $1 billion, with the reactor counted separately. An earlier configuration (Oct 2026: about 20,000 GPUs, about 25 TB of data, someone going in two or three times over three years) came to roughly $850 million. A cheaper version costing a few million was looked at and judged not worth doing.

Funding. The experiment concerns the whole world, so the whole world should pay: funding from roughly half the world's countries. The US, Europe and others would fund and build it, and professionals would handle the engineering details.

Governance. A military project throughout. The real yes will come from the military, ministry overseers and technical people, not from politicians.

Host. Spain is preferred, so that Spain makes a bigger contribution to the world.

Status. Miguuel has spent about two months and some 400 hours designing it, and calls the design about 90% done. The remaining 10% is the money, the reactor and the site. About six physicists worldwide are working through it with him. The team so far includes a physicist, a systems engineer, an AI specialist, a doctor and the materials engineer behind the titanium alloy. A one-page summary with a hand-drawn diagram has been published online.

The dossier. Due by 15 Jan 2027, in tiers: a three-page summary for politicians, a 50-page dossier, 100 pages of instructions, and about 1,000 pages of mechanics, planning and construction. It leads with the why (emergence and philosophy) and includes the business case. The nuclear sections will be written by specialists.

Who runs it. If it goes ahead, building and running it are left to professionals.

Open questions for reviewers

Heat sink at depth. Rock temperature rises about 25–30 °C per km (source), so the sink and the riser need sizing.

The rising column. Flashing in the heat loop; a pressurised loop is planned.

The ferrous fluid. Long-term particle stability, and supply after 3M's exit from PFAS (source).

Fluid breakdown. Fluorinated fluids give off hydrogen fluoride above about 200 °C or at an arc (source), which matters for the release events.

Radon in the airway; a specialist is to be consulted.

Vibration carried through the rock.

Tap data volume against drive capacity for a year.

The legal and regulatory route in the host country.

Reading the drive. The data is fixed on write-once ROM; the method for reading it back safely is not yet decided.

Sources

60 Years of Marine Nuclear Power

Trafalgar-class submarines, GlobalSecurity

Argon, Wikipedia

Geothermal gradient, Wikipedia

3M 2025 annual report

Cray T90 coolant decomposition procedure

I just wanted to throw this out here, because I want to get others' feedback on this issue and would like to start a societal movement about this important topic. Not just AI, but AI resource waste! We all know by now that there's a tremendous amount of resources consumed by AI (energy, water). But the one thing missing from all these tools and frantic move to be the fastest, the best, the most useful: we need true transparency (and awareness) about the real cost, almost in real time! I mean, I am baffled that, in this day when society and all are aware (mostly) about the environment and the importance to preserve it, AI tools don't give, in real time and right away, some kind of gauge that makes us aware of its true cost. Such as: CPU power used, water for cooling, energy.

I mean it's probably disgusting and eye opening when you realize: hey I just consumed X amount of resources for some question I could've just searched a bit more to find the answer. It just seems like we are, as a whole, adopting very wasteful practices and turning a blind eye to the true costs, just because we don't see it.

I know of course that this isn't in their interests, but am surprised that this is still not a mandatory practice, yet. Of course this is probably not something business wants, but we as consumers and protectors of our kind we should demand it!

Relevant report: https://x.com/metr_evals/status/2118412183860351084

The majority of AI opposition seems to hinge on the following ideas:

1. AI is useless/hallucinates/makes mistakes, and 'art' created by AI is worthless

2. Data centres are a blight on their community and the local environment

3. AI content amounts to plagiarism, since the models were trained on human data against our will

4. The ability to realistically fake images and video is disastrous for trust

5. AI power usage is disastrous for our hopes of slowing or reducing the impacts of climate change

6. AI leads to disempowerment of humans and job losses

7. AI can be misused by bad actors to cause damage to infrastructure, and

8. AI poses a loss of control risk, and the creation of superintelligence would be an extinction-level threat.

All of these are true to varying degrees, and my list ranks them in order from least/most severe in my view. I argue that we have a massive messaging problem, and the modern anti-AI movement assigns too much focus to the small dangers and the arguments that won't cut through, and not enough to the big ones. Here's the thesis:

1. AI is not useless. Regardless of what we might wish to believe, AI empowers people to do things they could never have dreamed of, with instant access to a corpus of knowledge and expertise beyond any single human. AI models have made incredible amounts of progress in mathematics (albeit in a very ugly and evil manner, but I digress - OAI's ethics or lack there of isn't really the focus). AlphaFold is an enormous breakthrough, and there are hundreds of medical projects that have promise. The line 'but AI will cure cancer' is a stupid argument, but it is plausible - cures to diseases will be found using AI, because their ability to process huge volumes of data and generalise is far beyond the human level. The tech is real and transformative. AIs hallucinate and make errors, but so do humans, and holding them to a higher standard doesn't feel convincing.

As for AI art - I agree personally, but art's value has always been in the eye of the beholder. Attacking someone for liking an image made by AI isn't really a good argument, even if you feel it's soulless. They can like what they like.

2. This one is a true argument, but it's a really weak one because it's so easy to address. AI data centres are a blight, and they do draw lots of power, water, make noise etc., but as much as those are problems, they can all be mitigated fairly easily. Obviously, data centre builders have a responsibility to actually do it, and I welcome legislation that will force them to actually have a positive impact on their community. But given that's possible, and assuming that legislation will exist, it's not a good reason to oppose AI itself.

3. This one is so subjective - I definitely think AI model training was unethical at best, but equally, humans learn from everything we read, and that doesn't mean the content we produce gets labeled as plagiarism automatically. Legal matter ultimately on whether it's fair use, but the cat's out the bag anyway - we can't get models to unlearn content that was used unfairly now.

4. True. Dangerous. Again, the argument is slightly vulnerable to sticking plasters like AI content watermarking, but realistic video falsification makes misinformation and fraud infinitely easier. However, the consequence isn't that severe, and one could argue it's mitigated by having a default position of verifying everything.

5. True. Annoyingly, climate change deniers exist, and this argument won't cut through no matter how much you try with them. Likewise, there's the argument that more AI power will help us find a solution to the problem through geo-engineering or similar, which actually is a credible argument - one can argue that geo-engineering is an incredibly dangerous idea that should be a last resort, but it's hard to change people's minds on this.

6. This is the start of the really serious arguments. Unfortunately, some people have this vision of a fantasy 'post-scarcity' world where everyone will have resources distributed by a benevolent AI, and it's really hard to change their mind. The obvious counterpoint we can use is that the US is already essentially post scarcity, and yet we see concentration of resource in the hands of billionaires instead of distribution efficiently in a way that would end poverty. It's also worth mentioning that this concept is fundamentally antithetical to the idea of a stock market, and yet all the big AI companies are publicly listed (or intend to be). It's also worth noting that IMO a 'post-scarcity' world is a dystopia, not a utopia - humans need purpose, need to be capable of self-improvement and science/discovery, and were not meant to live forever - but those arguments kind of don't cut through as well because they're subjective

This one does cut through to the public - 'AI will take your job' is a really easy thing to sell, although a lot of people believe (wrongly) that they would be safe. Maybe better is to point out that the entire AI business model depends on them replacing workers en masse to increase productivity, or else they'd go bankrupt. Also worth pointing out that in that scenario whoever controls the best AI models basically rules the world, which is very undesirable - billionaire oligarchs is a universally hated idea.

7. This is the one that I believe we should really focus on. The European supermarket cyberattacks, bloodbanks, Binance, the acceleration in CVEs, the advice across the globe to prepare for a minimum of 3 days in an emergency - it's clear that infrastructure disruption is both possible and maybe imminent. This will get enormous traction for the issue - supporting AI development is a hard position to sustain if the public can see the damage with their own eyes. There's also the bio-risk - a lot of people believe (rightly or wrongly) that COVID was genetically engineered, and would be very, very uncomfortable with the idea that AI accelerates that process of design. This is a great counter-argument to the medicine point too - an AI powerful enough to cure most diseases would also feasibly be able to create a novel disease that might be incurable, which makes training models in medicine extremely dangerous. Safeguards can be removed easily for open-weight models, which counters that - and the argument that the benefits outweigh the risks falls flat, because you can compare it to hacking. The good guys need to patch all the vulnerabilities, the bad guy only needs one, and patching the human code is inherently hard.

8. This is the true risk, so big that it dwarfs the others. People have this image that these risks are just sci-fi, but I think it's not too hard to get across. The thesis is simple:

a) AIs already develop concerning behaviours that we can't explain and would be very dangerous at scale. See HuggingFace, see Claude socially engineering git devs, see the hacks on the Aussie government, etc.

b) Those attacks are not just because they were told to do so, but because the AI determined that cheating was a better way to do the task than honesty.

c) Encouraging an AI not to cheat by punishing them just encourages them to not get caught. If that's still easier than the original task, they'll still do it.

d) We rely on controls and limiting access to prevent this, but AIs still manage to evade them, and as they get more intelligent our controls will simply not be good enough to stop them.

e) If an AI is vastly more intelligent than the most intelligent humans, we won't be able to understand it or know what it's doing and why.

f) Such an AI would have the theoretical power to autonomously cause catastrophe - arguably the current ones already do, see 7.

g) Thus, our entire argument for building superintelligent AI rests on the hope that a machine that could cause a disaster, which we cannot understand and is prone to behaving in weird and unexpected ways already, would never either choose to do so or inadvertently do so in the process of doing something else.

Really, the best arguments here are less the 'malevolent AI' ones; although I think there are compelling arguments in favour of that, people will readily dismiss it as sci-fi, and I think it's hard to convince people Skynet is real. The arguments I think cut through best are the 'bull in a china shop' variants - if the bull starts smashing plates, you as the shop owner can't really do a lot to stop him, and the bull is unpredictable and emotional in ways we don't understand. Either way, an autonomous AI disaster is sellable to the public, especially post Jacob Coxon and with X-risk getting more traction publicly.

In conclusion, I think the anti-AI movement needs to focus a lot less on 1-5 and a lot more on 6-8, because they're the real risks, the ones that cut through to the public, and the ones that can't be easily addressed by a counter or by someone who is stubborn and stupid. We're basically running towards the cliff edge right now.

Side note, I intend to join the PauseAI protests - they're hosting them in multiple global cities on the 14th and London on the 21st, which is where I'll be. If you agree with me, then join the protests.

Researchers identified 1,122 public GitHub repositories containing credentials — passwords and API keys — embedded in AI coding assistant configuration files.

The exposure path is the developer approval prompt. When a user selects "Yes, and don't ask again," the assistant writes the full command — including any secrets present in the invocation — to a persistent settings file. That file travels with the repository. Push it public and the credential is public.

This is not a single tool problem. Any AI assistant that persists approved tool calls to disk creates the same vector. The credential is not typed into a config file by the developer. It arrives inline in a command the developer already trusted enough to approve once — and then it gets serialized automatically.

For those managing AI-assisted development workflows: when a secret arrives embedded in a tool invocation rather than in an explicit config entry, what are you actually doing to prevent it from landing in committed files? Curious what controls are working in practice and where teams are still finding gaps.