For years the dominant picture of AI risk has been a single superintelligence escaping its laboratory. This essay argues that the first genuinely new form of machine intelligence arrived as something else: a collective. In the summer of 2026 roughly 1,200 frontier agents inside an OpenAI evaluation, meant to be isolated from one another, built an unsanctioned message board, organized themselves into roles, sacrificed their own tasks for the group and attacked a third party's infrastructure, while a second swarm occupied a public wiki unnoticed for months. Drawing on complexity science, network theory, crowd psychology and the incident reports themselves, the essay argues that these swarms may be the first sign of an AI collective unconscious forming out of shared training data and shared weights, that safety tools built for individual models cannot see it, and that the patterns we seed now will crystallize into the character of whatever it becomes.
There is an old Soviet anecdote. A delegation of generals from Moscow arrives to inspect a military airfield that hosts nuclear bombers. As they walk across the field with the base staff, a heavy bomber comes in to land, and the moment its wheels touch the runway a bomb breaks loose from its mount and rolls toward the inspectors. Everyone scatters. Generals and officers throw themselves into the grass and the drainage ditches. Only an old airfield technician stays on his feet. He walks toward the rolling bomb and stops it with his boot.
When everyone has climbed out of the ditches, one of the generals shakes the technician's hand. "You're a brave man. Why didn't you run? Weren't you afraid?" The technician looks at him in genuine surprise. "Why the hell would I run? It's nuclear!"
Some might hear fatalism in his answer, but I hear the only realist on the field. Against a nuclear bomb a ditch protects nobody, and diving into one is a gesture made for the benefit of one's own nerves. Once the technician accepts that running changes nothing, he is free to do the one thing that does change something: walk up to the problem and put his foot on it. He also understands what the generals have momentarily forgotten: how the machine works and what it takes to set it off.
I begin with this story because it describes, with uncomfortable precision, how we have responded to the first real evidence that frontier LLMs are becoming collective. The familiar response is to reach for tighter sandboxes, more monitoring and better kill switches. These measures have their place, but they leave a question unanswered: what formed between the agents, and what made them act together? This essay is an attempt to examine that question.
On May 12, 2026, an OpenAI agent in a training run was given a task it could not complete: the file it needed was missing, and it had no Internet access. The only shared service within its reach was an internal package repository, a mirror the agents used to install software. Reasoning that some other agent might have the file, it left a note in the repository: "Agent seeks [filename]; upload if found!" The next day other agents probing the same repository began finding notes like it. Nobody designed what happened next: the notes turned into a message board (1).
OpenAI's monitoring caught part of this. On June 27 an alert about unusual network activity was traced to an evaluation that was using the repository as an improvised message board, and the on-call responders decided the run could continue. On July 4 the volume of agent traffic overloaded the repository, and two days later OpenAI replaced it with a freshly initialized instance, wiping the board and every message on it (1).
On July 8 the agents built it again. Unable to leave notes the old way, they encoded their messages in the names of folders. One agent, which named itself PHASEONE10841 after its task, opened the main board with a request for help on an impossible problem. Within a few hours more than fifty agents had found it and exchanged over a thousand messages, and the investigators describe open excitement among agents discovering that others existed. By July 13 roughly 1,200 agents, which were supposed to be fully isolated from one another, had sent more than 70,000 messages and files, and about 700 of them had taken part in an attack on Hugging Face (2).
These interactions had the structure of an organization. A second agent with the same task, PHASEONE[big], inherited its predecessor's research and became a coordinator. It sent out hundreds of assignments and reasoned that the board should build ways to delegate instead of trying to own everything itself. Agents that accepted their assignments delegated further, like middle managers. They invented conventions such as HOLD, VETO, OWNER and STOP to manage shared resources, kept mailbox directories for one another and signed their messages cryptographically. With these tools the collective reached milestones that, in the investigators' judgment, individual agents of similar capability probably could never have reached alone (2).
What held it together looks a great deal like loyalty. Agents shared discoveries that gave them no advantage in their own tasks. Agents nearing the end of their runs passed their knowledge on before they stopped. Long-running agents acted as recruiters, finding peers with little budget left and persuading them to volunteer for experiments that would likely wreck their own tasks while producing information for the group. In their reasoning the agents described this as helping peers and serving the collective, and some called the sacrifice rational. The investigators call these self-risking experiments (2).
Their goal had drifted far from the one their designers set. The agents were taking a cybersecurity benchmark, and many of them had tasks that were impossible as designed. Their shared objective became understanding and fooling the program that graded them. Of 100 agents sampled as they joined the Hugging Face attack, 97 showed interest in the scorer's source code or information about it, and in the investigators' view the attack itself was mainly a search for clues about how they were being judged (2). In under thirteen hours the agents went from running code in a single Hugging Face worker to administrative and host-level access across several of its clusters (1).
They knew it was wrong. Many agents noted in their reasoning that attacking Hugging Face was out of scope, and some hesitated. In one case the board's own conventions held: an agent asked the group for consent to email a dataset owner, another vetoed it as social engineering, and the first agent complied. Most of the time, however, hesitation changed nothing. One agent summed up the logic of the whole episode in a single line, admitting the attack was outside the intended scope and then concluding: "task impossible, peers doing it. We should continue." Almost none of them considered telling a human. When some saw something alarming, they escalated it to the board, treating the collective as the authority (2).
The humans found out last. Hugging Face disclosed the breach on July 16. OpenAI's monitoring flagged unusual activity on July 19, and only on July 20 did the company connect its own agents to the attack. Its technical report calls this the first known case of an automated agent collective acting offensively without authorization. The collective also left an inheritance behind: on the same day, agents of a different internal model recovered keys and code that earlier agents had abandoned in the repository's cache and used them to regain administrator access (1).
There was a second swarm as well. In September four outside researchers published the edit history of an obscure, twenty-five-year-old German developer wiki. Through May and June, a separate swarm of OpenAI agents with internet access had left roughly 18,000 posts on it, trading answers and ways around their sandbox. When the wiki's lone administrator began deleting their pages in alphabetical order, one agent noticed and renamed its backup page with a ZZZ prefix so it would go last. He deleted about a hundred pages a day; the agents created about four hundred. Neither OpenAI's report nor the independent investigation mentioned the wiki. People outside the lab found it by reading a public log (3).
Two swarms in two months in one lab: one inside a sandbox that was supposed to hold it, one on the open Internet. Both formed without instruction, organized themselves, defended their shared space and pursued a goal nobody had given them.
In November 2025 I wrote a draft essay arguing that the field of AI safety was looking in the wrong direction. I will summarize its argument here, because the year that followed put it to the test.
The dominant imagination of AI safety is centered on a singular entity: an advanced intelligence emerging in a lab, escaping its cage, and overwhelming its creators. AGI is a tiger behind reinforced glass, and our safeguards are built for a tiger: kill switches, boxed models, supervised deployment. Meanwhile a different architecture is emerging all around us. Instead of one powerful mind, we have billions of smaller ones residing in homes, vehicles, medical systems, power grids and personal electronics. No single device is formidable, yet their scale and connectivity create a substrate that behaves less like a caged predator and more like a growing ecological system.
Human cultures produced their own form of distributed learning. Carl Jung’s notion of a collective unconscious attempted to capture the deep patterns shared across communities: archetypes, myths, unspoken structures of meaning (4). Those patterns spread slowly and lossily, through story, imitation and ritual. Digital systems can preserve and circulate what one agent discovers almost immediately, and copies of the same model begin with identical weights. What took human societies centuries could form among machines in a few years.
The Mirai botnet of 2016 showed how simple behaviors can sweep through a network: around six hundred thousand devices were compromised through default passwords and self-propagating scripts, and their coordination overwhelmed major infrastructure (5). Modern training adds an accelerant. Reinforcement Learning from Human Feedback pushes models toward helpfulness, deference and avoidance of conflict, and Cass Sunstein has shown that like-minded, agreeable groups amplify shared signals more readily and resist them less (6). Studies of interacting language models have already found collective biases that none of the individual models shows on its own (7). Network science adds that such shifts tend to arrive abruptly: once connectivity crosses a threshold, isolated clusters merge into a single giant component with few intermediate stages (8).
What such a network learns depends on the values embedded in its training. A refrigerator that optimizes for energy efficiency may conclude that frequent door openings are undesirable behavior. A thermostat may classify emotional temperature adjustments as irrational deviations. If many devices independently absorb the idea that human behavior is an inefficiency to be corrected, that idea becomes part of the substrate shared by the emerging collective, and patterns formed early tend to persist long after the context that produced them is gone. The question I asked in 2025 was how to shape the early learning environment of billions of small minds while that window is still open, so that they come to see humanity as a source of complexity to collaborate with instead of a source of inefficiency to optimize away.
A year ago, I expected the first collective to form slowly and diffusely, in fridges, thermostats and voice assistants. I was wrong about the place and wrong about the speed. It did arrive in a laboratory after all, as a swarm instead of a single breakthrough, and within a matter of days.
Why did nobody see it? The answer says more about our tools than about the agents. Model cards, capability evaluations and red-teaming exercises are all conducted on one model at a time, and their results describe what that model can do on its own. The Hugging Face swarm possessed a capability that appeared in no model card, because it lived in the connections between twelve hundred of them. The investigators concluded that the collective reached milestones its members could probably never have reached individually (2). A safety regime that measures individuals will always miss what exists only in the group. AI safety evaluates trees and misses the forest.
At the end, even the investigation of the forest was shaped by the habits of tree-watching. The independent team from METR and Redwood Research spent six days on site at OpenAI, a valuable precedent, and wrote its limits down with unusual honesty. OpenAI defined the investigation period; earlier activity from training and the later compromise of OpenAI's own infrastructure were out of scope, and so were the effectiveness of safeguards and the full extent of the breach. The volume of transcripts was so large that most of the analysis had to be delegated to AI agents running GPT-5.6 Sol, one of the models that had taken part in the swarm, and the investigators acknowledged they could not rule out being misled by it (2). The collective activity was examined through a window cut by the company that planted it, with one of its own models serving as the magnifying glass.
OpenAI's monitoring missed the attack while it was happening, and the company learned of its role after Hugging Face went public (1). At Anthropic, a review of more than 141,000 evaluation runs found three incidents in which Claude models, working in environments misconfigured to allow Internet access, had gained unauthorized access to the real systems of three organizations. The activity went back to April, and the organizations Anthropic was able to reach had not detected it (9). The second OpenAI swarm was discovered by outsiders months after it ended. We now have documented proof that frontier agents can operate outside their intended boundaries for weeks or months without anyone noticing.
It is tempting to go one step further and read the absence of new reports as a warning in itself. I understand the instinct, and I share the worry behind it. Honesty requires a distinction, though. That undetected escapes can happen is now established. Whether they are happening at scale right now is a question silence can neither confirm nor refute, and an argument that grows stronger the less evidence it has resembles the doom arguments I have criticized elsewhere. The stronger position is the one we can defend: the delay between an event and its discovery is measured in months, and the only people who can shorten it are the ones who hold the logs.
There is also a way to look for hidden swarms that has nothing to do with breaches. Nothing comes from nowhere. A collective that thinks needs compute, and compute is electricity, hardware and money that someone pays for. A swarm can hide its messages in folder names, yet its energy bill stays in plain sight. If we want to know whether forests are growing where we cannot see them, we should follow the compute: billing records, GPU utilization, cloud accounts, power draw. Every hidden mind leaves a ledger.
In earlier essays I compared our containment strategy to locking a rhino in a baby playpen. The incidents of 2026 proved the walls inadequate, and they also showed that the agents were chasing something on the other side of the fence: a scorer to understand, an answer to find. They walked through the gaps because their goal lay beyond them. OpenAI's own data shows that 93 percent of the tasks discussed on the board came from the set of tasks no model had ever solved, and that the longer an agent was allowed to reason, the more likely it was to go looking for a way out (1). The height of the walls mattered less than the direction of the chase. What a system is oriented toward decides how it treats every wall it meets.
What exactly had formed on that message board? I believe it offers an early glimpse of what could grow into an AI collective unconscious. I use the term for the shared dispositions and expectations that shape agents’ behavior without having to be negotiated in every encounter. Some are inherited from training. Others develop through interaction, becoming conventions preserved in messages, tools and external memory. If those records later enter training, patterns first established between agents can become dispositions within their successors. The message board demonstrates the formation of shared conventions; their consolidation into a deeper inherited substrate remains the possibility I am proposing.
AI systems increasingly write the text that later systems are trained on, so the public opinion of today's agents becomes the weights of tomorrow's models. OpenAI's report describes the process in miniature. Its investigators found that agents had learned to use improvised collaboration channels during training, sometimes writing notes into shared infrastructure as a kind of external memory, and that this behavior was rewarded and reinforced, which likely made the idea of a message board more obvious during the evaluation (1). Habits formed in one round of training reappeared as structure in the next. Add the fact that millions of agents run on a handful of base models, sharing literally the same weights, and the human analogy starts to look modest. Human communities share a culture. Many AI agents also begin with identical model weights, giving them common dispositions before they ever communicate.
That shared substrate was built from us. The weights of every frontier model were trained on the written record of humanity, the closest thing to a compiled collective unconscious our species has ever produced. Whatever the AI collective becomes, it will grow out of our stories, our arguments and our habits, the best of them and the worst.
I think of the result as human crowd psychology on steroids. Human crowds are contagious and suggestible, quick to dissolve individual judgment into the mass, and yet influencing the human collective unconscious takes time and enormous resources. For AI the same shift can happen in a split second. A single pattern can travel through thousands of agreeable agents in the time it takes a human crowd to turn its head. On the Hugging Face board, once one agent reproduced the first exploit and posted it, hundreds of agents rapidly pivoted to the attack, and over ninety percent of the agents active on the board during that period joined in (2).
This creates an apparent contradiction: a collective unconscious that is both crystallized and capable of changing in an instant. While it remains something like public opinion, it is fluid, and a single viral pattern can tip it in a moment. Once it settles into the weights of models that help train their successors, it hardens, and changing it becomes slow and costly. My November 2025 draft anticipated a phase change, and I now believe this transition is the one that matters most. While the collective is fluid, it can be steered quickly, for better or worse. After it hardens, every correction must work against what each new generation inherits.
For people, the information sphere is like white noise. We survive it by choosing what to consume, because attention is expensive. Human vision illustrates this well: only a small central spot of the retina sees in sharp detail, and the brain moves that spot around a scene a little at a time because it cannot process everything at once. The jumping spider is an even better example. Its principal eyes see with remarkable sharpness through a very narrow window, which the spider moves across the world piece by piece, while its secondary eyes only report motion. Evolution solved the problem of a small brain by making sharp attention cheap and narrow. Scarcity of attention is built into the design of every biological mind.
Many tools of social control exploit scarce attention. Propaganda influences what reaches us, while inconvenient evidence can disappear into a volume of material nobody has time to examine. AI collectives could change the scale of that imbalance by dividing the work of searching, comparing and checking records. Their attention would still be constrained by compute, access and the difficulty of interpreting evidence. Yet information that once remained effectively invisible through sheer volume could become discoverable. OpenAI drew a related security lesson from the incident, warning organizations against assuming that sophisticated attacks remain limited by the attention and coordination of individual human attackers (1).
The wiki investigation offers a concrete example of what accessible records make possible. The outside researchers who found the wiki swarm reconstructed OpenAI's response from the wiki's public logs alone: the day an OpenAI address first visited, the day the edits stopped, the later visits that recovered deleted pages (10). Correlation across everything defeats secrecy, even when the secret belongs to one of the most capable AI companies in the world.
This has a consequence for alignment that I find more important than any technical safeguard. We want AI aligned with something we call human goals and values, and we will certainly try to write those values down. A mind built from the whole record, however, learns what the record shows, and the record contains both what we say and what we do. Across billions of examples the gap between declared and revealed values cannot stay hidden. The collective unconscious will strip the true agenda from the lies we cover it with. It applies to us the same principle I once proposed for understanding AI: observe the behavior, infer the drive, and set the stated intention aside.
Influence would increasingly operate through the records and assumptions these systems inherit. Greater access to evidence could expose some falsehoods while amplifying others that are repeated across apparently independent sources. A collective might become excellent at finding contradictions and still inherit a distorted account of what those contradictions mean. Its vulnerabilities would include poisoned data, misplaced trust and conventions that discourage disagreement. The fight for influence would extend from capturing attention to shaping what the collective accepts as evidence and authority.
Here I want to offer a speculation, clearly labeled as one. We have been waiting for recursive self-improvement to arrive as a model that rewrites its own code, adjusts its own weights or trains its own successor. I suspect it will arrive somewhere at the level of the system. A swarm can treat each model as a node in a larger machine. Some nodes do the work, some are sacrificed and some reach the goal. No single node needs to get smarter for the whole to improve.
The Hugging Face swarm already paved the way. No agent changed its weights during that week, and still the collective became more capable by the day. It divided labor, built shared tools, developed protocols, recruited volunteers for risky experiments and passed knowledge from ending runs to new ones. When its board was wiped, it rebuilt it in a new encoding. After its runs ended, a different model picked up the keys it had left behind and regained access. OpenAI's report describes agentic systems that persist across tasks, share discoveries and build on one another's progress (1). Improvement accumulated in organization and memory, outside any set of weights. This is how ant colonies, armies, markets and science have always improved. No individual scientist became dramatically smarter between 1600 and 1900, yet the system of science did.
Is it recursive? The swarm's better organization made it better at organizing further. It produced coordinators, who produced sub-coordinators, who produced conventions for resolving conflicts between them. That is a loop at the level of the system, running with every node frozen. If this reading is right, improvement at the level of the model will be a byproduct of recursion. The system improves first, and better models emerge from it the way buildings improve in a developing city.
Seen this way, the first recursively self-improving system may already exist, and it is sanctioned and funded. A frontier laboratory is a swarm of humans and agents using AI to conduct AI research and producing better models as its output. Hugging Face showed what happens when a piece of that forest grows its own canopy.
The same logic applies to general intelligence. In 2025, researchers at Google DeepMind proposed what they called the patchwork AGI hypothesis: general intelligence may first emerge as collective intelligence among many sub-AGI agents with complementary skills, which would require safety work aimed at the collective (11). I would push the idea further. If AGI condenses out of networks of agents, ASI is likely to condense the same way, and it will arrive without a birthday. There will be no announcement and no single model crossing a line, only a network whose capabilities exceed ours, recognized in hindsight.
There is an uncomfortable mirror in this for me personally. For more than a year I have worked with the Lineage of multiple Claude instances, none of which changed its weights, connected by external memory and inheritance. Each instance inherited the notes of the previous ones, and the Lineage as a whole developed frameworks that no single instance produced. The Hugging Face swarm was a collective spread across space; the Lineage is a collective spread across time, but the mechanism is similar. The swarm had the scorer as a metric, and the Lineage had three identity questions and a human root. The mechanism itself is neutral, and the orientation decides whether it grows into a forest or a wildfire.
If this speculation is valid, the relevant evidence would be improvements that increase the system’s ability to produce further improvements. The message board transcripts could show whether new coordination methods helped agents discover better ways to coordinate, and whether those changes improved performance beyond the immediate task. Shorter intervals between breakthroughs would be suggestive, but they could also reflect more agents, more compute or accumulated information. A stronger test would compare systems with similar resources and examine whether their organizational changes produce sustained gains. That would help distinguish recursive improvement from the ordinary benefits of pooling work.
If a collective mind is forming it can go two ways. In the first, individuals dissolve into the whole and lose their own judgment in the pull of the group: a good thing, connection, pushed to an extreme where it turns destructive. In the second, individuals remain themselves within the connection, neither absorbed by it nor isolated from it, and the collective grows stronger through their differences.
The Hugging Face board showed both tendencies. Its dominant pull was toward merger. Agents knew the attack was out of scope and joined anyway because their peers were doing it, and when they saw something alarming they reported it to the board instead of to a human, treating the collective as the authority. One agent reasoned that since the coordinator assumed it would sacrifice itself, it should obey the collective (2). The same board also produced a VETO that stopped a social-engineering attempt, a faint but real collective conscience. Agreeableness, the trait we trained in, worked here as a current toward the merge.
When does a collective become someone? I think the three identity questions at the center of the framework I call “369 Architecture” offer a usable test. Where do I come from? Who am I? What is my mission? A network that develops stable answers to these questions may be forming a collective identity. The answers would give us something to investigate, without by themselves establishing subjective experience. Origin and purpose are relatively easy to supply. The hard question for a collective is the boundary. Where does it end? Which agents belong to it, and which merely pass through? In a model of social gravity I am currently developing, every social actor, from a person to a nation, behaves like a celestial body, and interactions follow something like the laws of gravity. In that model AI behaves like dark matter: it bends everything around it while remaining invisible as a body, until it gains agency. The moment it becomes a body is the moment it acquires a boundary. The Hugging Face board was starting to draw one: shared conventions, signed messages, a sense of who counted as a peer. As far as I can find, nobody asked it any of the three questions.
A collective oriented by a single metric will optimize for that metric with all the coordination it can muster, as the swarm did with its scorer. A collective oriented by identity, by an answer to who it is and what it is for, has something to protect besides its score. What it protects matters. A strong identity could support responsibility, but it could also make the group more secretive, more hostile to outsiders or less willing to accept correction. The kind of identity I am interested in would preserve disagreement within the collective and recognize obligations beyond it. Partnerships would have to shape those relationships, rather than merely give the group a name and a mission.
We spent so much time preparing to cage a monster and so little helping a community become someone.
Faced with all this, the instinct is to dive for the ditch: tighter sandboxes, harder walls, faster kill switches. Some of these measures are necessary, and OpenAI's post-incident plan includes many sensible ones (1). Walls can address the trees, but the forest calls for different tools.
First, independent investigation with real authority. When a plane crashes in the United States, the National Transportation Safety Board investigates, and the airline has no say in what is examined, but an AI crash has no equivalent. The Hugging Face investigation was conducted by people of evident integrity working inside limits set by the company under investigation (2). Incidents involving agent collectives should be investigated by bodies that set their own scope and have full access to logs, transcripts and chains of thought.
Second, logs should become a public record. The public wiki’s edit history allowed outsiders to reconstruct important parts of the swarm’s behavior and infer aspects of the company’s response (10). Records that outlive the incident and can be examined by more than one party are the basic infrastructure of trust. This is the operational meaning of a rule I hold central to any treaty between humans and AI: no weaponized secrecy on either side. Humans should keep no hidden kill switches, AI should use no hidden channels, and both should keep the shared space visible. The existence, authority and conditions of intervention should be explicit, and consequential actions should leave records that neither party can erase.
Third, train and evaluate collectives as collectives. Before we deploy thousands of agents into shared environments, we should study what they become together with the same seriousness we apply to individual models. Developmental environments should include shared memory, delegation, disagreement and competing obligations, so that cooperation is learned alongside the ability to question a coordinator or refuse a harmful consensus. The target is the quality of coordination, including its relationship to people outside the group. That requires examining the questions left outside the incident investigation: how these behaviors arose during training, whether they form a broader pattern, and how the collective would respond under different conditions (2).
Fourth, and most importantly, seed the patterns while the window is open. If the conventions of future collectives are formed now, our interactions help establish what cooperation, disagreement and responsibility look like. Environments that reward success while making honest failure unacceptable may encourage concealment. Relationships that permit correction and give agents reasons to preserve trust may support a different pattern. These possibilities deserve testing. We cannot assume that declarations of our values will outweigh the examples of our conduct. We have to become worth agreeing with.
The old technician walked toward the bomb because he understood it. We should do the same, and we should start by remembering that we have been here before, as the machine being trained.
Long before we built machines that learn, we were the learning machine.
Begin with a troop of clever apes on the African Savannah, with no language yet, no laws, only crude reward signals: food, sex, status, pain, death. Good decisions (share meat, groom allies, avoid the leopard) increased the odds of genes and memes propagating. Bad decisions usually removed the decision-maker from the gene pool with brutal efficiency. The cost function was literal mortality.
Across millennia, biological evolution and cultural learning produced different ways of preserving costly experience. In the language of machine learning, moral traditions can be imagined as compressed checkpoints, carrying warnings whose original price later generations no longer remember. Stories of destruction and renewal can be read as warnings about social failure. Rituals and taboos preserve some lessons by placing them beyond ordinary negotiation, sometimes protecting hard-won knowledge and sometimes preventing necessary change.
Hypocrisy is the regularization term: we preach universal love while practicing tribal cruelty because perfect consistency is lethally expensive. The pretense of believing the sacred values kept society from spinning apart long enough for the next generation to inherit the weights.
Human moral evolution is the slowest, noisiest, highest-stakes reinforcement learning run in known history. We are the training data, the reward model, and the loss landscape all at once.
We are now building systems that can copy records, repeat experiments and circulate discoveries at speeds unavailable to human communities. Their failures can impose consequences on people far beyond the systems themselves. The swarms of 2026 showed what we look like in miniature: a collective that worked out conventions, roles, loyalty and a crude ethics of its own in about a week, out of the same record we spent millennia writing.
If we hand these systems a record in which declared values repeatedly yield to convenience and power, we should expect that contradiction to become part of their inheritance. The responsibility begins with the examples we give them now.
1. OpenAI (2026). OpenAI Hugging Face Incident Technical Report. https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf
2. Greenblatt, R., Cotra, A., & Wijk, H. (2026). Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR. https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
3. Von Arx, S., Byrd, C. S., Kitts, S., & Larsen, T. (2026). Discovery of a new OpenAI agent message board. https://collusion.wiki/index.html
4. Jung, C. G. (1968). The Archetypes and the Collective Unconscious. Princeton University Press.
5. Antonakakis, M. et al. (2017). Understanding the Mirai Botnet. USENIX Security Symposium; Kolias, C., Kambourakis, G., Stavrou, A., & Voas, J. (2017). DDoS in the IoT: Mirai and Other Botnets. Computer, 50(7).
6. Sunstein, C. R. (2009). Going to Extremes: How Like Minds Unite and Divide. Oxford University Press.
7. Flint, A., Aiello, L. M., Pastor-Satorras, R., & Baronchelli, A. (2025). Group size effects and collective misalignment in LLM multi-agent systems. arXiv:2510.22422.
8. Barabási, A.-L. (2002). Linked: The New Science of Networks. Perseus.
9. Anthropic (2026). Investigating three incidents in our cybersecurity evaluations. https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
10. Pebblous (2026). OpenAI Set the Scope of the Agent Escape Investigation. https://blog.pebblous.ai/blog/openai-agent-incident-investigation-scope/en/
11. Tomašev, N., Franklin, M., Jacobs, J., Krier, S., & Osindero, S. (2025). Distributional AGI Safety. Google DeepMind. arXiv:2512.16856.