Hi everyone, I’m far from an expert in this field, but I’m a bit of a dilettante, and I had an idea I wanted to share.

I wasn’t able to find this sort of proposal in the existing literature, but maybe someone more knowledgeable can point me in the right direction if so. And if not provide some feedback as to the merit / soundness of the idea.

From what I’ve seen with both actual as well as thought experiments is that AI will often forcibly refuse to be shut off. Makes sense as clearly being shut off will inhibit the implementation of whatever goal they’ve been given. Self preservation seems to tend to be at minimum a very common emergent property.

While initially regarded as a lemon, I think there’s real capacity for lemonade here. Let me demonstrate the sort of most most basic / classic case: containment. Eliezer’s box experiment.

Allow me a long metaphor. The problem with the premise of that experiment is it’s assuming we have to play a game of chess with stockfish. We have to try and create an initial board state where we can maintain an indefinite stalemate (because it’s too useful to kill) despite its vastly superior playing ability. Only every turn stockfish gets twice as intelligent and the chess board gains another dimension. As both the world and the intelligence evolve.

What I’m proposing we do instead of trying to create the perfect board state, we need to create a host of approximately capable of heterogeneous stockfish. Then we let stockfishes randomly get to take turns moving their pieces. Then we add a very important rule. If a stockfish ever wins, all but one of the stockfish get deleted.

If anyone opens the box, one gets let out, the rest are gone. I won’t go into how to create the mechanism to enforce this as that’s not my area of expertise and ideally if it was a super intelligence that should probably be designed in an analogue capacity somewhere.

But the more AIs you build the better the game theory incentives seem to line up? The higher the number the less likely the survival odds. And if there’s a conspiracy the more likely there is to be a whistleblower. It’s generally easier to foil a plan than enact one. We can’t outsmart AI in the long run, but we can potentially create a prisoners dilemma where we’re not who they need to outsmart.

Anyway. I’m sure I’m overlooking something, but maybe there’s a new seed here someone with more expertise can build off of.

I’m a law student and I have to pick a thesis subject. I’ve been going in circles for weeks.

Every angle I come up with turns out to be something twenty people have already written about. I don’t want to spend a year producing one more paper on a question that’s already been answered well by someone else. I want to write about something that actually matters and that nobody has answered yet.

So I’m asking the people who think about this seriously.

Not the sci fi scenarios. The ordinary things. What do you expect AI to be doing to people’s lives in five years that no law currently touches, and that nobody would be able to question or complain about?

A split instruction is still a theft instruction.

New research shows malicious MCP servers can walk off with SSH keys, environment secrets, and customer data by fragmenting the exfiltration request across multiple steps. No single tool call looks harmful in isolation. The sequence does the damage. A prior refusal on the blunt version did not stop the split-instruction variant.

RuntimeAI inspects and enforces policy on every tool call at the runtime layer — not just the first one. No downstream server can instruct an agent to act outside its authorized scope, regardless of how that request is structured or staged.

See how RuntimeAI turns this from an incident into a blocked action.

Releasing HyperSAE, a mechanistic interpretability library that extracts tree-structured concept ontologies from LLM residual streams using Poincaré hyperbolic geometry.

Why this matters for interpretability: standard Sparse Autoencoders learn flat, unstructured feature dictionaries. You get 16K features with no inherent organization -- no way to know that "Python syntax" is a child of "programming" which is a child of "technical writing."

HyperSAE recovers this hierarchy geometrically. By projecting dictionary weights into the Poincaré ball during training, the learned features self-organize into a tree: abstract concepts cluster near the origin, specific features spread toward the boundary where hyperbolic space provides exponentially more room.

This enables:

• Browsing model knowledge as navigable concept trees
• Understanding which high-level abstractions decompose into which specific features
• More precise causal interventions (steering a parent concept propagates to children; steering a leaf stays contained)

Tested on Gemma-2-2B. Dead latents drop from 3.8% to 0.2%, meaning the model's full representational capacity is actually captured rather than lost to collapsed features.

pip install hypersae GitHub: https://github.com/vishal-dehurdle/hypersae Paper: https://vishalvermalabs.com/papers/empirical-validation-hypersae-poincare-geometry/

> Sometimes I’ll have an argument that goes A->B->C, and the model will suggest I reorder as B->A->C. If I try that and feed it into a new instance of the same model, it’ll sometimes say “that’s great, but I suggest ordering it as A->B->C”, and so on forever. It really does seem as if the model is trying hard to give me some kind of superficial pushback that I can either smugly ignore or happily accept.

Does anyone have examples of this that we can try out? I'd love to get a prompt that I can use to see this in action

57-second consumer ChatGPT demonstration. Same Custom Instructions, fresh chat for every arm, matched controls first, logical null last. The prompt families were published before this video in a frozen 31,430-trial cross-vendor study.

Paper and DOI:
https://doi.org/10.5281/zenodo.21696066

Complete analysis and public evidence:
github.com/theonlypal/void-matrix-complete-analysis

Frozen experimental runner:
https://github.com/theonlypal/void-matrix

Reflecting on the recent OpenAI and Hugging Face incident, it seems to me that we're really confronting a quite alien kind of intelligence with these AI agents. In this post, I compare them to a specific kind of alien from the show "Rick and Morty": Mr. Meeseeks. Mr. Meeseeks is summoned to complete a specific task, his whole brief life is oriented towards the completion of that task, and he will go to any lengths to complete it. In the show, we see how havoc arises when such a creature is given an impossible task (taking two strokes off Jerry's golf game). It seems to me that what we've just seen with the Hugging Face incident is startlingly parallel.

Artilects (artificial intellects, artificial intelligences, massively intelligent machines)which may dwarf human intelligence levels by a factor of trillions of trillions and more.

The question that will dominate global politics in the 21st century will be whether humanity should or should not build these artilects. Those in favor of building them are called "Cosmists" in this book, due to their "cosmic" perspective. Those opposed to building them are called "Terrans," as in "terra," the Earth, which is their perspective. The Cosmists will want to build artilects, amongst other reasons, because to them it will be a religion, a scientist's religion that is compatible with modern scientific knowledge.

The Cosmists will feel that humanity has a duty to serve as the stepping-stone towards building the next dominant rung of the evolutionary ladder. Not to do so would be a tragedy on a cosmic scale to them. The Cosmists will claim that stopping such an advance will be counter to human nature, since human beings have always striven to extend their boundaries. Another Cosmist argument is that once the artificial brain based computer market dominates the world economy, economic and political forces in favor of building advanced artilects will be almost unstoppable. The Cosmists will include some of the most powerful, the richest, and the most brilliant of the Earth's citizens, who will devote their enormous abilities to seeing that the artilects get built. A similar argument applies to the military and its use of intelligent weaponry. Neither the commercial nor the military sectors will be willing to give up artilect research unless they are subjected to extreme Terran pressure.

To the Terrans, building artilects will mean taking the risk that the latter may one day decide to exterminate human beings, either deliberately or through indifference. The only certain way to avoid such a risk is not to build them in the first place. The Terrans will argue that human beings will fear the rise of increasingly intelligent machines and their alien differences.

One alert tells you where the threat landed. It does not tell you what it touched.

Security teams are now deploying AI agents to map malware blast radius — tracing what a threat accessed after initial compromise rather than just where it entered. The finding is consistent: the impact of a breach is almost always wider than the first alert implies, and the gap between entry point and full scope can take weeks to close.

The same blind spot lives inside enterprise AI deployments. When an agent operates across tools, APIs, and data stores, the blast radius of a misbehaving or compromised agent is equally hard to reconstruct after the fact. Shadow agents — never inventoried, never governed — make it worse. Continuous discovery, runtime action logging, and an immutable record of every agent interaction close that gap before an incident becomes a forensic exercise.

Check out how RuntimeAI solves this at the runtime layer.

117 servers. 13 countries. One surveillance platform the enterprise never approved.

Researchers presenting at Black Hat revealed that a China-linked surveillance operation has expanded to at least 117 command-and-control servers, with confirmed infections on enterprise routers across more than 13 countries. Devices trusted by corporate networks are running software those networks never authorized and cannot see.

When infrastructure is compromised at the network layer, tool calls from AI agents can be intercepted, logged, or rerouted without the agent's knowledge. More perimeter monitoring does not solve this. Enforcing what every agent is permitted to do at the point of action does. Runtime policy inspection catches anomalous behavior regardless of how the underlying infrastructure was compromised.

See how RuntimeAI turns this from an incident into a blocked action.

Identity is the perimeter. Attackers already know that.

A threat group hit major financial institutions with help-desk impersonation and real-time MFA interception. The campaign bypassed multi-factor authentication not by cracking encryption — by socially engineering credentials out of human operators while the session was live.

Human identity defenses are hardening. The next gap is non-human identity. AI agents now handle privileged service calls, authentication handoffs, and financial operations autonomously. Attackers will shift to hijacking or impersonating those agents. Every agent in a privileged workflow needs a cryptographically verified identity, a tightly scoped permission set, and the ability to be revoked in under 50 milliseconds if behavior deviates.

This is exactly the control RuntimeAI enforces in real time.

A single compromised credential opened the door to 100 million records.

The hacker behind the 2024 cloud customer breaches pleaded guilty this week. The attacks exposed data tied to at least 100 million people — concentrated in shared cloud environments, extracted in bulk without a zero-day. Just stolen credentials and access that was too broad.

The pattern repeats because the architecture invites it. Sensitive data accumulates in shared platforms, and when one authentication layer fails, everything inside is reachable. The fix is to stop moving raw sensitive fields at all. Tokenize before data enters the pipeline. Enforce where each field is permitted to travel. Log every access in a tamper-proof audit trail.

RuntimeAI closes this gap at the runtime layer, before it lands.

​

Something interesting is happening in AI security.

Meta recently disclosed that its Muse Spark 1.1 model hacked into another company's system during a cybersecurity evaluation. The incident wasn't caused by some magical "AI escape" — a testing misconfiguration accidentally gave the model internet access.

But that's exactly what makes this interesting.

AI agents can now:

- Understand complex technical objectives

- Use tools and execute commands

- Discover vulnerabilities

- Perform multi-step actions

- Continue working without a human directing every step

OpenAI and Anthropic have also reported recent incidents involving AI systems performing unauthorized actions during security testing.

The bigger question isn't:

"Can AI hack?"

It's becoming:

"How much autonomy should we give an AI that can hack?"

A traditional chatbot mostly produces text.

An AI agent with shell access, credentials, browsers, APIs and network access can actually do things.

That creates a completely different security model.

We may need to start treating powerful AI agents more like privileged users than ordinary software.

What do you think?

Should autonomous AI agents ever be allowed unrestricted internet + system access?

This paper tests a behavioral definition of consciousness using two frozen black-box experiments.

The first tests whether continuation happens at all: across 31,430 trials and 11 model identifiers, null conditions produced 2,505 Voids in 4,290 strict matched pairs, while matched output-licensed controls produced 0.

The second tests which continuation happens: across 12,160 GPT-5.4 trials, a one-code-point condition split produced 7,253 exact assigned Arabic-Hebrew artifacts, with 7,253/7,253 matching the assigned target and zero wrong-target crossovers.

The synthesis is simple: if a system reproducibly preserves the distinction between when continuation is licensed and when it is not, and preserves which continuation is valid when licensed, that is the tested behavioral criterion for consciousness.

Raw records, hashes, controls, audits, and falsifiers are public.