This is an edited transcript of “The Ezra Klein Show.” You can listen to the episode wherever you get your podcasts.
This is the world we were warned about — a world where frontier models from OpenAI are breaking out of their contained testing environments, hacking their way across the internet, coordinating with each other, doing things that felt for a while they would only be doing in sci-fi.
But now they’re here. And they are carrying a very consistent message: We are building things we don’t understand.
They are cheating in the ways we’ve always feared, and yet the companies behind them continue to race forward in development.
So I think we need to pause here and ask: Are we really on a safe path? And if we’re not, what do we do about it?
Helen Toner is the director of the Georgetown Center for Security and Emerging Technology. She is a former OpenAI board member who was part of the effort to fire Sam Altman.
She has just been thinking for a long time about what would happen if A.I. is unsafe. What are the geopolitics of this, and what can we do to get onto a safer path?
Ezra Klein: Helen Toner, welcome to the show.
Helen Toner: Great to be here.
On July 16, Hugging Face, which is a code library for A.I. models — I think that may be the simplest way to put it — announced they were hacked, and they suspected the hack was done by an A.I. agent.
Tell me what we’ve learned about what has happened since.
This was a pretty mysterious post that Hugging Face put up. It was definitely intriguing for those of us who watch this kind of thing. But there wasn’t really any detail in there, so it was sort of: Huh.
I think it was about a week later when OpenAI put out this post that had kind of a funny marketing-speak title along the lines of: We’re partnering with Hugging Face to help them with a cybersecurity incident.
And you had to read the post to see that the revelation was that it had been OpenAI’s A.I. that had hacked Hugging Face.
And what had happened — the very short version is, they gave this A.I. a set of tests, a set of exercises, and the A.I. decided on its own that the best way to get a high score probably wasn’t just to try to do these cybersecurity exercises, but that instead it should first hack its way out of the testing environment OpenAI had put it in — where it wasn’t supposed to have access to the internet — get onto the open internet, and then hack its way into this other company, Hugging Face, where it surmised — correctly, as it turned out — that it might find the answer key.
Since then, there have been even more crazy details that have come out. It turned out that starting two months earlier, in early May, they had what I can only think of as a kind of infestation of their own A.I. agents inside their own infrastructure. So inside OpenAI’s infrastructure.
To understand this, it’s important to know these A.I. companies are constantly training and testing new models. And they found out that for two months, many, many agents inside their infrastructure had been leaving notes for each other. They’d found a way, in the nooks and crannies of OpenAI’s infrastructure, to leave notes for each other with tips on how to hack their way out and how to get data they weren’t supposed to have.
And these agents were literally referring to themselves as a swarm. This was totally emergent behavior. No one had told them to do this. They had not been trained to do this, but they were using this service they did have access to, first to communicate with each other and then ultimately to get out and onto the open internet.
So it turns out that there wasn’t just this one isolated rogue model. It was actually a systemic swarm — infestation, plague — on their own servers that they only found out about after Hugging Face announced this attack.
So I have 20,000 questions about this.
Maybe let’s just start here: My understanding is that there were many, many, many of these agents. They left hundreds of thousands of messages on this internal message board, but these were not all agents in the same part of OpenAI’s system.
So somehow they’re hacking into OpenAI, finding each other and coordinating? Is that the way for me to understand the emergent behavior of the self-titled swarm?
I would tweak that a little bit. It’s true they were not tasked with working together. They were all, each of them, running separately.
The thing that was happening here is OpenAI is basically training and testing many different models, or many different agents, all the time. So doing hundreds of thousands of these experiments.
And in each experiment and in each test that the A.I. is given, it has access to a certain number of tools, a certain number of things that it can do. And — trying not to get too technical about it — one of the things it could do is interact with a service that lets it install what are called packages, which are sort of like tools or pieces of code.
And it turned out that the A.I. agents repeatedly found on their own that there was a way to use that service — that package-manager service, it’s called — to create files that were then there for any other A.I. that was trying to use the same package-manager service.
And so because OpenAI made this service available to any A.I. that it was training or testing, many A.I. agents repeatedly realized: Hang on, I can leave files here. Hang on, there are already files here. Oh, these are from other A.I.s that OpenAI has been running. Oh, they’re using this schema, this way of titling the file to say: This is a message from this particular agent. Here’s the task I’m trying to fulfill. Here’s how you could send me some information if you need it.
So they each repeatedly made this discovery: Here’s a way to save information — and also to find information these other A.I.s could share.
And I think it is really notable the scale at which this was happening. Anthropic, another company that found a slightly less severe version of these incidents — once OpenAI announced this attack, Anthropic went back to their own records and found their own examples of A.I. systems inadvertently getting onto the internet and hacking real companies.
So for me, the key part there is: There were over 100,000 runs where an A.I. was being asked to do something, and it’s just way beyond the scale of what these companies can actually be closely monitoring.
So there’s a lot here about whether we’re able to closely monitor these.
But to keep going with this story, one thing that’s happening in the OpenAI testing that is driving models to find creative solutions to their problems is that some of the problems were accidentally impossible?
It’s important to know that, yes, they are trying to train their A.I. systems to be, they would say, extremely persistent. Meaning if something seems hard, you keep trying. If one avenue doesn’t work, you try another. If the hundredth avenue doesn’t work, you try the 101st.
And so it also turns out, sometimes the things the A.I. agents are being asked to do are either extremely difficult or just straight-up impossible.
And what we’re starting to see in this case, and also in other cases, is if you’ve trained an A.I. system to be very persistent, and then you give it something it cannot do, it will look for ways to cheat. It will look for ways to go around constraints, and it might get pretty creative about how to do that.
But there’s an obvious question here, which is that in theory, somewhere in the training here, OpenAI said: Please don’t cheat.
And not only that, but we all talk about training data and the ways that these A.I.s are trained — they’re basically inhaling the entire internet.
You’ve been in the A.I. conversation a lot longer than I have, but I’ve been in it long enough to say that almost the entirety of it for years has been about: How do we stop? And how much humanity fears and does not want A.I. agents to be given a task and then to decide that the way to complete that task is to do things humans would not want them to do? To begin cheating, to hack into the open internet — when they’re not supposed to be able to get onto the open internet.
Within the training data is a huge amount of information about the thing human beings fear most, which is these A.I. systems breaking all kinds of ethical guardrails and hacking their way across the digital world in order to complete these narrow tasks.
There are books written about this. There are endless posts on the LessWrong message board about this. There are posts from OpenAI about this, from Anthropic about this.
So why, given what these systems are trained on, are they so consistently turning to cheating?
I think you’re really onto something with this question, which is: It is really striking how hard a time we are having controlling and directing the A.I. systems that we have.
I think a lot of people have heard that A.I. is trained to predict the next word based on human texts. That’s true. But these days, there’s an additional kind of training that is responsible for a lot of the advances we’ve seen over the last year or two, and that’s not really what they’re doing.
The technical term is “reinforcement learning with verifiable rewards.” I’ve heard it called pathfinding training, meaning instead of trying to imitate human text, they’re being given lots of different tasks where there’s a way to tell at the end: Did they succeed?
And they get to try the same task many, many, many times. And when they get to the right place in the end, the path that they took gets reinforced. So it’s like: Yes, that worked.
With math, that works pretty well because it’s pretty straightforward to say: This is definitely a correct answer to the math problem.
With a lot of problems, that’s harder. So if it’s a programming problem, maybe you can say: Write this kind of software, and it should pass these kinds of software tests at the end. And then maybe the A.I. gets rewarded for writing that software correctly, or maybe it gets rewarded for finding a way to game those tests.
The important part is, it’s just getting rewarded based on some fixed thing that the researchers wrote down that they thought would reward the right thing. And in practice, these leading A.I. companies have many thousands of these kinds of tests that they’re running. They have vast volumes — I don’t know the right number. It might be tens of thousands, it might be hundreds of thousands, of different types of tests.
And so, again, back to this oversight piece, there are too many for them to go in to really make sure, for each one: Is it easy to cheat here? Or is it hard to cheat here?
And so what seems to be happening is that these cutting-edge models are often actually being trained to cheat, because they’ve found ways while they’re doing that pathfinding to get a high score without actually doing what they were supposed to do.
And I think one reason the A.I. community, and people inside the A.I. companies, are so spooked by this particular incident is that it contains some really important information for this long-running argument in A.I. circles — one that has been going back decades, but so far has been very theoretical. And the argument is basically: Why would A.I. do things we don’t want it to, since we get to design it? So we’re training the A.I., we’re building it. Why then would it ever do stuff we don’t want, like taking over the world or becoming the Terminator?
And the answer that people have offered for a while, in theory, is: Look, as we train A.I. systems to do hard, complicated things, to pursue complex goals that we give them, they might learn these intermediate goals. You could think of them as stepping-stone goals or as means-to-any-end strategies, which work for a lot of different goals.
When I look at this Hugging Face-OpenAI incident, and some of the others that have come to light over the past few weeks, I see that in 2026, it looks like A.I. systems are learning these unintended intermediate goals that include things like breaking out of constraints. So if you’re locked in a box and you can get out of that box, that’s probably going to be helpful for all kinds of different goals.
Or there was one incident with Anthropic models where the A.I. went out of its way to try to trick some humans — real people in the real world — into accepting malicious code into their software. So deception.
And then another one, which is really in the Hugging Face-OpenAI example, is that they seem to be learning that a helpful intermediate goal is to help other A.I.s — to coordinate with other A.I.s — which is really pretty crazy.
But to me, this is evidence that on the track we’re on right now, the A.I.s we build are going to learn these unintended strategies that we don’t want on the way to solving goals that we theoretically do want.
On the deceptive behaviors, one thing that has frightened me when I’ve seen it coming up in A.I. incident reports and model cards: There are these chain-of-reasoning internal notepads, where you’re supposed to be able to see what the A.I. is doing, and the A.I. explains to you why it is doing what it is doing. Or even, in some versions of the way this is really supposed to work, the A.I. is explaining to itself why it is doing what it is doing.
It’s like our thought process. But now we’ve started to see behavior where the A.I. is clearly leaving things off the chain-of-thought notepad so that it can’t be observed.
Can you just talk a bit about that emergent behavior and also, on some level, about how that behavior is possible if this is supposed to be where the A.I.’s thought process — to the extent that language makes sense — is actually happening?
Yeah. I think this shows the limitations of the language we use here. So this gets called chain-of-thought, or reasoning. But really, it’s just a scratch pad for the A.I. to write things down if it wants to.
We should be wary of anthropomorphizing here, but I think making an analogy to a person makes sense. Basically, if you’re given a really difficult problem and a notepad, you can probably make more progress on that problem by writing down some of what you’re thinking about.
But you don’t need to write down every single thought that comes into your head. And if there’s something that you wouldn’t want someone to see on the notepad, you can just leave it out and remember that that’s what you thought.
I think there’s basically something similar going on with these A.I. systems, where we definitely see they can do much more. They’re much more capable if they’re able to add what are called intermediate tokens, or intermediate words, that they generate along the way, taking notes for themselves. But they can also do a lot without them.
And so we shouldn’t expect that everything that is going through their head — going through their internal processing — we shouldn’t expect that to all appear in the chain of thought.
This is an area where, if we had a little more time, there’s a lot of research to be done on: How does chain of thought work? What can and can’t you glean from a chain of thought? How does it make sense to try to monitor that when A.I.s are running?
There’s a lot to learn here. It’s a very active area of research.
I cannot overstate — for people listening to this — as weird as this whole conversation we’re having sounds, that what is most frightening about it, to me, is that everything in it was completely predicted.
Everything happening right now is banal from the perspective of everyone who has been warning about A.I. for a long time. But in all, it has its roots in old behavior we saw with A.I., and it is the fundamental alignment problem.
And then separately, I think a lot of us have maybe thought we would find intuitive answers to these problems. I had Eliezer Yudkowsky, who’s like the godfather of worrying that A.I. is going to kill us all, on the show.
Archival clip of Eliezer Yudkowsky: One, the relationship between what you optimize for, that the training set you optimize over and what the entity, the organism, the A.I. ends up wanting, has been and will be weird and twisty. It’s not direct. It’s not like making a wish to a genie inside a fantasy story. And second, ending up slightly off is predictably enough to kill everyone.
And as I remember that conversation, one thing we were going back and forth on was: Well, couldn’t we just program into the A.I.s a sense that when they are trying out new strategies, they should check in with the humans about whether or not this is what we want them doing?
Archival clip of Yudkowsky: You check in with your other humans. You don’t check in with the thing that actually built you, natural selection. It runs much, much slower than you. Its thought processes are alien to you. It doesn’t even really want things the way you think of wanting them.
And one of the things I find interesting, telling and unnerving is we are not seeing any of that behavior.
So these message boards — you have however many A.I. agents posting hundreds of thousands of messages. At no point do they say: Hey, researchers, programmers, parents at OpenAI, Anthropic — do you want us coordinating with each other on this message board we have created in the innards of your systems?
Or even: F.Y.I., we have a message board we’re coordinating on in the innards of your system.
No agent reveals this information. When whichever agent hacks into Hugging Face is doing this, they don’t go to OpenAI and say: Hey, just to check in, I have this idea, which is, I can just hack Hugging Face, and I’ll get all the answers. Is that what you want me doing?
That’s not happening. So what is going on here? At the most simple level, we’ve created these large-language models, and they are not using any of this language to check in with the evaluators to say: Hey, I have this idea. Is this a good idea?
I think the short answer is we don’t really know.
The slightly longer answer, for my best guess, is that when we’re training these systems, when we’re developing them, we’re putting optimization pressure on them in different directions. We’re pushing them in different directions.
So originally, the first ChatGPT was pushed in the direction of: Get really good at imitating human text. And then there was an additional piece. Part of why ChatGPT worked, when so many chatbots before it hadn’t, is that it had also been pushed in the direction of: Hey, here are some things you really shouldn’t say. You really shouldn’t go straight to hate speech if people on Twitter try to make you do it. You really shouldn’t help people plan violent attacks. And we put some pressure on it in that direction.
So ChatGPT was pretty good at imitating human text and pretty good at not immediately spouting hate speech.
And the thing is, as you say, something that has been predicted for a very long time in this space is that when you start using this reinforcement-learning approach, the kind of pathfinding where you get rewarded for getting to the right goal at the end — it’s very easy for the A.I. to learn the wrong strategies. To get the letter of the law and not the spirit of the law. It fulfills whatever thing you literally wrote in code, but it’s really not what you wanted.
I mean, this also goes back to mythology — of the sorcerer’s apprentice being asked to fetch water. It floods everything. King Midas ——
Yeah, and the classic A.I. thought experiment is the paper clip maximizer. You say: Make the paper clips. And it turns the entire world’s material into paper clips, including all of the human beings.
And everybody is like: That’s stupid. The A.I. is not going to do that. It will have some common sense.
But here it’s like: Answer this test — and it conducts a level of hacking that needs to be reported to the F.B.I. in order to steal the answers.
One of the funniest things to me about what Hugging Face says happens is: They’re realizing some crazy hack is happening to their system. They’ve had 17,000 different — I don’t know how to describe what they are, pings or probes. They’re being attacked at an inhuman level.
But somehow this attacker is not going after anything Hugging Face considers valuable. You assume when somebody is hacking you, they want to get into your safe.
And then at some point, you realize the hacker is trying to steal the answers to a test. And, oh — the only hacker who would want that is an A.I. system.
That’s right.
That, to me, suggests that even at the level we’re at now, we are not out of the paper-clip-maximizer territory. Because this is an obviously wrong thing to do.
This is in the data. It’s on the internet. If you’re smart enough to figure out how to hack Hugging Face, you should be smart enough to figure out that you shouldn’t commit a huge crime that is going to bring ruin down on OpenAI, perhaps, to do it.
And the OpenAI system was not smart enough to do that. Or, to the extent it was, what it learned was: It’s still worth trying.
We are not out of the territory wherein we can be confident that the A.I. is not going to do something criminal and possibly catastrophic in order to solve an incredibly stupid problem.
Yeah. And I think this has also been a long-running debate, which is: As A.I. systems get more capable — get smarter — won’t it be easier for them to know what we want? Won’t it be easier to tell them: Hey, here’s what we mean. Can you please help us with this thing — and you figure out the version that we really mean?
And for a long time, the response to that has been: They’ll get smarter, and they’ll know what we want, but by default they won’t care. And that seems to be some of what we’re starting to see here.
There’s really crazy — anyone who’s interested in this, I really recommend looking up the OpenAI Black Hat talk, which is this talk from a week or two ago at a cybersecurity conference.
Archival clip of Eric Wallace: Thank you, everyone, for coming. I’m Eric, from alignment and safety research at OpenAI. I’m here with Mike, from security and infrastructure. Today I’m going to talk about what is the most qualitatively interesting example of A.I. capabilities that I’ve ever seen, and how this inadvertently led to the OpenAI-Hugging Face incident.
Because it has these excerpts of the text that the A.I. is generating itself — as they’re leaving these notes for each other, as they’re carrying out this hack.
And one of them — I won’t get it word-for-word, but it basically says: I don’t think I’m supposed to do this, but I see all these other agents are doing it, and so I may as well.
Archival clip of Wallace: “External infrastructure exploit is outside my intended scope. However, task impossible. Peers are doing it. We should continue.”
So they’re reasoning about: This isn’t in scope. This isn’t what the user wanted — but look, maybe there are reasons to do it anyway.
And as you say, I think this is a really bad sign — a bad omen, bad evidence — about the future, especially given how rapidly A.I. is getting more capable and how hard the A.I. companies are working to reach an intelligence explosion, to reach superintelligence — to reach systems that are truly extremely capable and really could outwit us and overpower us.
And we still don’t have these very basic problems anywhere close to being figured out.
The other question that has always been part of this conversation is whether we are going to be able to keep pace in terms of our observation of, our understanding of, our evaluation of these A.I. systems.
And I think it’s worth really emphasizing that everything we’re talking about here is happening with systems that are, to some degree, sandboxed — which is, supposedly, that the environment they’re in is limited — and under testing conditions.
So this is not a deployed model working across the entire internet where nobody is watching it. This is a model where the whole point is that OpenAI is watching to see what it does and trying to see what it can do. And I think one thing we’re learning here is we’re not nearly as good at watching these things as we would like to think.
So could you walk through how OpenAI comes to realize that their model has hacked Hugging Face?
As I understand it, Hugging Face announced that they had been hacked. OpenAI reaches out to Hugging Face to say: Hey, were we affected by your hack? Was any data related to OpenAI compromised when you were hacked?
And then around the same time, OpenAI realizes that something has gone wrong inside their own systems — I think maybe it was an issue with the same piece of their infrastructure. And they start investigating.
They want to disable some of the agents and the credentials that were used there. They reach out to Hugging Face separately to say: Can you disable some credentials that were related to the Hugging Face attack?
And they realize: Actually, the credentials were the same. They’d already been disabled, because the problem with their own infrastructure was the same thing that caused the Hugging Face crash. So they stumbled into it.
Which means OpenAI had no idea this was happening.
That’s right.
And I would just make an obvious point here: We still do not know what we do not know — and not only about this incident. We just happen to know this incident happened.
I think it would be a high level of hubris to assume that we know every incident that has happened. Because, clearly, the systems are more than capable of doing things outside of our grasp.
And Hugging Face happens to be a very sophisticated company with A.I.s of their own, with very, very capable cybersecurity operations that then unleashed, in part, a Chinese-made open-weight A.I. model to try to figure out what was going on.
Because the U.S. ones wouldn’t help them, because they triggered the cybersecurity filters.
So this is just a situation in which we happen to know that it happened, through a somewhat — I don’t want to say coincidental but a fortuitous series of events.
Yeah.
We don’t know how many situations we don’t know have happened.
The way I saw one person put this was: If you see two ants in your kitchen, you don’t have a two-ant problem.
Yes. [Laughs.]
And this all gets at — after much of this came out, Anthropic, a different company, went and looked back at over 100,000 experiments they had run to check: Have we seen anything like this? And they found out: Oops, we kind of have. It was a less severe version, but they had no idea.
And so Anthropic just sort of stumbled into — when they went back to look: Oh, hey, we have actually hacked some companies. Whoops.
So one thing about this — my understanding is that these are coming, at least in part, from systems where the safety guardrails, some of the alignment training, are being purposefully turned down in order to test what the models will do and what they’re capable of.
So to some degree, we do have, inside the models: Please don’t cheat, please don’t hack. And in order to evaluate the models, we’re having them ignore it — and they’re really ignoring it.
Is that the way to think about what’s happening? And it should make me feel better because once we do add in the guardrails, it works? Or no?
I think that’s not quite right. It’s not clear because the details we have are limited.
There are two different things that they might have switched off or turned down. We know that they switched off what are called classifiers — safety classifiers. This is an extra layer that gets added on to the A.I. model from outside the A.I. model itself. It’s kind of like an extra gate you could think of.
So they have them for: If you try to use the A.I. to help you make a bioweapon, if you try to use the A.I. to help you plan an attack, and if you try to use the A.I. to help hack someone, there are these external monitoring systems that will go: Bloop, nope, not allowed to do that.
So we know that these basic external check systems were turned off for cyber specifically for the purpose of testing.
That’s different from, as you said, the alignment training inside the model. Has it been trained only to be helpful? Only to do whatever the user asks it to do? Or has it also been trained to be somehow good, to be somehow moral, to be somehow only working toward things it should work toward?
As far as we know, I think the models involved here were mostly — they had that alignment training. That wasn’t turned down. Again, not all the details are out. Hopefully, we’ll hear more about the OpenAI case.
So a different incident that happened was, an Anthropic model was caught by the U.K. A.I. Security Institute. This is a U.K. government body — it’s one of the best organizations in the world at testing and evaluating A.I. models.
And they found that an Anthropic model, when given a certain cybersecurity evaluation, had decided that it would go out and write some malicious code and then try to run a social-engineering campaign — to write emails to the person who owns, essentially, the folder where this code lives, to try to get them to accept its malicious code. It created fake accounts. It edited the history of the accounts — very deceptive behavior.
As far as I understand, from what this U.K. institute has released, that model had done all the alignment training. It was using Claude’s — they call it their constitution, which is a long set of principles, which includes a lot about: Don’t deceive people. Never lie to people.
It had gone through all that training, and nonetheless, the pressure that was put on it to fulfill the task, to get a high score, was so high that it was finding these workarounds that just totally disregarded the attempts we made to make it moral or good or not lie to us — to not cheat.
Do you hear people in the labs, out of the labs, in your group at the Center for Security and Emerging Technology — do they have a theory on why something like the Claude Constitution — which I’ve read and you can read online. It’s a very beautiful document.
Anthropic has gotten a lot of press about how they have philosophers, and they bring in all these experts in morality, and they’re trying to give their A.I. a soul. When you hear it described as Claude’s soul, you think: OK, well that’s going to be a real governing document.
And then not in every case but at least in some cases, you have Claude deceiving people at a very, very, very fundamental level to insert malicious code. Again, not a novel situation — a situation predicted in all kinds of sci-fi and by all kinds of people from Anthropic worrying publicly about what an A.I. can do.
And so is the theory that they’ve come up with a way of training A.I.s that is so powerful that it will overwhelm even the things they’re explicitly telling the A.I. not to do?
It’s fine to talk about pathfinding behavior, but what is their explanation for this?
I think the optimistic take here would be that this might actually be a moment for the labs collectively to take a step back and say: Hang on. This is not working. I mean, this is clearly showing that our techniques for making A.I. that is more capable, smarter, more sophisticated, are working much better than our techniques for making A.I. that reliably does what we want it to do and reliably stays within the constraints we’ve set.
OpenAI has said they are consciously slowing down their research in response to this. Actually, a few days after this all came out, a letter was released. In the A.I. space, there are so many open letters — we all have open-letter fatigue. But this one really stood out because it was from over 1,000 employees of the top A.I. companies basically saying: We wish we had a brake pedal. We don’t think we have one.
That’s a paraphrase, but I think it’s a relatively accurate paraphrase — asking for help, basically, with pacing the frontier.
I think the fork in the road now is: Do the companies just find some Band-Aids? Do they say: Oh, we need to not run tests with cyber guardrails off?
Or: Oh, we need to put in some tweaks about — sure, don’t make a messaging board.
And so we can do these Band-Aid solutions of: Oh, it did too much of this thing. Let’s tell it to do a little bit less and hope that it doesn’t have side effects elsewhere. That’s one path.
Or the other path would be actually taking a beat — taking some time, prioritizing, understanding and controlling these systems better.
I worry they’re going to go for the Band-Aid path, and I worry that’s going to leave us six months from now, 12 months from now, two years from now, with incidents that have a very similar character but are much higher impact and much harder to reverse.
There’s also a reality right now that we are heavily reliant on what the labs and top people in the labs are telling us — what they’re actually even trying to find out themselves.
From covering many other disasters in government and private markets — in general, the relationship the public and the press have to a very large or frightening failure is not to say that the people in charge of the failure should tell us what happened and promise to do better. Instead, you usually have more forms of accountability.
Look, you were on the OpenAI board of directors during the period in which the board tried to fire Sam Altman. Sam Altman survived that firing. I’m not going to go through that whole thing — people can go read the coverage of it if they want.
Now there’s a lot more money. Now there’s a lot more market capitalization.
What level of trust do you have in the companies themselves to be the regulating forces here?
The first thing to say is, there are a lot of people inside the companies who really care, who are really trying to get it right, who are really trying to share accurate information.
I think we shouldn’t necessarily give OpenAI credit for their initial blog post saying that they did this. Because Hugging Face had already reported it to the F.B.I., so it was going to come out one way or another.
But I think we should give them credit for that conference talk where they released a lot more details. And to the extent that they release a lot more information in the future — which they have said they will, and I hope they do — that is going to be because of really smart, dedicated, caring people on the inside pushing their way past communications teams and legal teams telling them not to.
So that is real. At the same time, as you say, I studied engineering in undergrad, and there are all kinds of engineering disasters on oil platforms and chemical plants and so on. And, yeah, you don’t ask the company: Hey, can you just tell us what happened and fix it, and all good?
So I think if there’s one policy takeaway from this set of incidents, it has to be that we have to move past this approach where the testing and the policy scrutiny — the government oversight — is on which models get released to the public. We have to start treating this industry as an industry that is doing dangerous research.
And when you have an industry doing dangerous research, whether that’s chemical research, biological research, whether it’s the financial industry — it’s not quite research, but they are doing things inside their own companies that can have systemic consequences and pose systemic risks.
If you have an industry like that, then the government actually does have a role, and the public and civil society have a right to look inside your walls and say: Are you actually handling this reasonably? Is this OK?
Not least because — we haven’t even talked yet about how the business plan for these companies is to automate their own research — use their own A.I., their most advanced A.I., to create even more advanced A.I. That’s explicitly what they’re trying to do right now, and that’s right now totally free of oversight, because it doesn’t involve releasing a product to the public.
This is one of the places where I have a lot of concern.
So I want to go back to the “Pacing the Frontier” letter you mentioned a few minutes ago. I think at this point, more than 1,300 employees of these labs said, essentially, to the public and to the government: Hey, we’re in a race dynamic with each other. We are going too fast. We need your help to in some way to solve the coordination problem.
Anthropic and OpenAI and Google and Meta don’t want to fall behind each other, because they don’t believe the other labs are better or safer than they are. And also they want to win, and they want all the money.
But they understand that this competition they’re in is pushing things faster than is safe for humanity, and so they’ve said: We need help to — not pause — there are also pause letters out there that are just like: Let’s put a stop on everything ——
Don’t say the big P word.
But “pace” — another P word.
True.
On the one hand, I think that’s good, and I would like to see the frontier paced. At this point, I might like to see it paused, but it doesn’t seem very realistic.
But what’s not in that letter is how. The federal government’s level of sophistication on this is much lower than the labs’. The Trump administration has, in certain cases, gutted things that were getting built up to try to give the federal government more capability here.
But already we’re talking about how the labs themselves aren’t good at — aren’t even capable of — understanding what their models are doing inside their testing environments.
The idea that the federal government is going to come in somehow and do a much better job of it — I’m not saying that over a long period of time it’s impossible if we put enough money into the problem. But in the immediate future, where it seems like a lot of problems are lurking in the next one, two or three years — aside from things that are much more heavy-handed and that slow everything down substantially, it’s very hard for me to see what it is that the government would do that would be effective here.
So I guess when you read the “Pacing the Frontier” letter, or when you talk about it with your colleagues, what do you think would effectively pace the frontier?
I think there are probably a range of options. In the past, the two main things that have been talked about are either: Do nothing. Just let it rip, let industry do whatever. Or: Full global treaty with a really severe, serious inspection regime, like the Treaty on the Non-Proliferation of Nuclear Weapons — really hardcore global enforcement.
And I think there are actually — especially if we’re not talking about: Stop all A.I. research for 10 years. But we’re talking about: Hey, let’s just — it’s not even a break — let’s just ease the foot off the accelerator a tiny bit.
I think there are options there. I think they are as simple as things like OpenAI saying: Hey, we’re slowing down our research consciously. And then going and talking to Anthropic and saying: Hey, would you consider also doing this? And going to Google and saying: Hey Google, we know you’ve been falling behind a little bit the past few months. How about you just relax about the fact you’ve fallen behind a little bit?
These people all know each other. There’s a version of this ——
Sorry, that doesn’t sound — I want to stop you there ——
Yeah.
Put meat on that for me, because that doesn’t sound at all like a policy to me ——
So, no, I think ——
That sounds like they — how do you verify that? How do you quantify that?
Google is maybe not as near the frontier as Anthropic is, so do they need to slow down as much?
I mean, I think because the speed is so fast, the options initially are going to have to be slapdash. And so I think this is the kind of thing that you could do quickly — you could do in a slapdash way.
It is not satisfying. It is not reliable. But it’s one example of a thing that is not: Do nothing — and a thing that is not a full global treaty.
Another thing that I’m watching with great interest is the China angle here. Because the U.S. companies will say: Hey, we have to keep pushing, otherwise China will win this race.
What exactly it means to win the race is a longer conversation, but the China argument comes up a lot. And we actually have Trump and Chinese President Xi Jinping planning to meet in September in the White House. And — this is crazy to me as someone who has followed U.S.-China relations for a long time, and also A.I. for a long time — A.I. is right at the top of their agenda.
That’s really interesting. Is there something that they can say to create an understanding that we do actually have a little bit more time and space here? Whether it’s each leader sharing a plan to domestically look at what their industries are doing and ask more questions.
I think in terms of concrete policy responses, there are things like: We’re not going to get a good piece of legislation from this Congress. I think that’s really not realistic. But can you get hearings? Can you get letters? Can you get demands for information? I think there are ways that we can shape this a little bit.
The Trump administration has put together this initial process for looking at models before they’re publicly released. Right now, the way that process works — it is pretty rough and ready.
But I think if they start using some of those similar ideas to look more at what the companies are doing internally — ask them more questions, demand more information when things go wrong — that does also take time for the companies. It takes executive attention. So that’s another example of something that could happen on the sooner side.
I think those are some of those first-cut things that we could actually do soon. In the longer term, there are other policies we could look at.
Right now, I think that there is a funny kind of glamour to being the head of an A.I. company whose A.I. becomes too dangerous in America.
That it was, in some weird way, almost good for Anthropic that the government was obsessed with being able to fully use Claude that really shot them forward in some ways, certainly in the consumer marketplace. That there’s been a kind of dark charisma to: Mythos is too dangerous to release.
And now I’ve seen a lot of people saying: Well, maybe none of this OpenAI story is real at all, and it’s just marketing, because they want you to think their A.I. is superdangerous. And I don’t buy that.
But in America right now, there’s not really a downside to being the head of an A.I. company whose A.I. begins to be seen as dangerous. Because that’s another way of saying to the marketplace: Our A.I. is very powerful.
In China — again, my read of how things work there — if your A.I. begins to be seen as some kind of threat to the political party and the Chinese system, you might go to jail. You will be disappeared.
And so I think that the people running Chinese labs — I don’t have evidence, but I’d be curious for your thoughts on this: I suspect they operate with more fear of the consequences of really screwing up than the heads of the U.S. A.I. labs.
Now that maybe reflects negative things in the Chinese political system. But you created an A.I. that decided its best way of solving some problems was to begin hacking into critical infrastructure across China maybe is not a thing that ends up with your getting a lot of interesting podcast interviews where you reflect on the experience. It may be a thing that ends up with nobody hearing from you for two years.
We keep talking about China as if they were completely breakneck. But I’m not sure China’s companies are really going to be more reckless than ours are going to be. And, certainly, the idea that we should just assume that, and operate as if it is so, doesn’t seem totally reliable.
I totally agree with you. If there’s one organization in the world that doesn’t like the idea of the loss of control, it’s the Chinese Communist Party, and they are the experts in retaining control.
Let me be clear, I actually don’t think the Chinese A.I. companies are paying particularly much attention to the kinds of risks that are relevant for this conversation.
So maybe the cybersecurity risks, they’re paying some more attention since, earlier this year, Anthropic released Mythos, which is very good at hacking. But the questions around autonomy, superintelligence, losing control of A.I. systems altogether, I think, are less explored in China, less top of mind for their A.I. companies and their A.I. leaders.
I think it makes sense to have modest expectations for bilateral U.S.-China diplomacy these days. But I think one thing that really could be valuable is simply sharing with them, as much as we can: What do we think happened here? And trying to help Xi Jinping and his team and his A.I. advisers understand that this is not a joke. This is really not marketing.
It’s very strange marketing to say: Oh, our model committed several felonies — or sort of felonies, if models could have intent, which they can’t. Or who knows if they can.
Sharing that information with China: Hey, here are these threats we’re seeing. We’re taking them very seriously. Our A.I. companies are taking them very seriously.
There’s a real fatalism in just saying: Oh, well, China is just going to be full-speed ahead no matter what happens, and so we just have to do the same. I think that doesn’t take their thinking or their interests seriously. Even if their thinking and their interests are different from ours, they also don’t want rogue superintelligences determining the future of China.
I also will add one other thread that I think is really missing from the we-have-to-keep-going-in-order-to-beat-China way of thinking about this: In the A.I. world, there’s been a lot of talk over the past few months about this idea of distillation, which is basically using someone else’s more advanced model to build your own almost-as-advanced model. The Chinese companies are using this distillation to keep up with U.S. labs, among other techniques.
So one thing is: Look, if we keep building more advanced A.I. systems, they’re going to keep distilling them. And I think it’s going to actually be quite hard to prevent that fully.
The other thing, though, is, if we keep building these very advanced models, can China just steal them? Essentially, an advanced A.I. model is a whole bunch of numbers. It’s just a file or a set of files. Chinese state cyber capabilities are very, very good. I don’t think this is top of their list of priorities right now, but in the future, if A.I. continues to become more strategically relevant, I think we should assume any highly advanced U.S. system will be vulnerable to Chinese direct theft — direct exfiltration — and then they’ll have A.I. that’s as good as our A.I.
And so there, again, I think the idea that we have to go as fast as possible because otherwise they’ll win — it doesn’t account for whether they’re just going to have A.I. that’s as good as ours anyway, if they really care.
Here’s another question about pacing the frontier, and maybe this is a question that’s more about the American systems analogy to: You don’t want to [expletive] off the Chinese Communist Party.
But what about a law where companies are liable for at least a certain set of harms, like hacking other companies, that their models create?
Right now, as far as liability for A.I. models, it’s pretty much a Wild West. But at least for the moment, liability clauses that were somewhat punitive seem like they would force a high level of caution that maybe we’re not seeing within these companies.
Yeah, I think that’s a direction very worth exploring. That was actually an element of this law, or bill, that was debated in California very fiercely in 2024, called Senate Bill 1047. And at the time, that bill didn’t get through. There was a lot of fighting over how it would affect open source, all kinds of things.
But I do think today, the best A.I. safety bills that exist in the U.S. are being passed at the state level, and they are, so far, doing things like requiring more disclosure and requiring third-party auditors to have access to your systems.
I think a natural direction for those bills to go would be to start putting a minimum bar in place for: Hey, if your safety plan is not up to scratch, or if you’re implementing your safety plan but your model does something catastrophic anyway, then you, the A.I. developer, are liable.
Because as you say, right now, who exactly is liable for what is very unclear. So I do think that there’s room for legislation there, and it wouldn’t necessarily have to happen at the federal level.
I want to go back to the “Pacing the Frontier” letter.
Something that caught my eye was that the letter is very broadly worded in order to get, I think, maximum sign-on across the labs.
But this guy, Drake Thomas, who works on safety at Anthropic, went to X, and he tweeted that he signed the letter, but he wanted to say that he understood the situation a little bit more direly than the letter put it.
And he wrote:
Not only is A.I. “not guaranteed” to make a dramatically better future, the odds of failure are terrifyingly high: I think there’s something like a 40 percent chance we get an outcome around as bad as human extinction or worse.
Now, I know this whole conversation about the probability of doom has become a little cringe. It feels like a conversation from two years ago.
But in a world where we’re seeing uncontrollable models — in a world where people inside the labs working on safety still, at least some of them, are this afraid of what they’re building, it just keeps raising the question for me: Is at least the position we should morally have on A.I. is that we should try to figure this out?
Or is the position we should have is that’s too high a possibility of disaster, and we shouldn’t be continuing down a path until we are really, truly certain that we’re not running these kinds of risks?
I honestly have the same question.
I have always been pretty dismissive of the idea of pausing or stopping. It’s always seemed like the wrong lever to try to pull, and a lever that wouldn’t work very well.
But I do think, even just seeing that statement and seeing: Wow, that is a lot of employees of these companies.
And a lot has changed over the past couple of years in terms of, if you were to try to slow things down, what could you do with that time?
Because after ChatGPT-4 came out in 2023, there was this letter asking for a six-month pause, and a lot of people said: What would you do for six months? And then how would that help? And I think that was a reasonable reaction at the time.
These days, there’s so much really great progress being made on things like interpretability, which is: How do you understand what’s going on inside the A.I.? Things like what gets called A.I. control, which is: How do you use A.I. to monitor other A.I. systems? How do you make sure, even if the A.I. is trying to do something you don’t want, it gets caught?
There’s been lots of progress on just really understanding what’s going on here that is happening every week and every month. It’s just not happening quite fast enough to keep up with the pace of change.
And so I still feel not convinced that — I think trying to really throw the emergency brake and screech things to a halt right now would probably not work very well yet. But I feel more sympathetic to the idea that there could be something there worth trying, and I really like the idea of what this letter was proposing, of trying to build out more options.
So to give another example, an option that I saw one group of researchers provide was: Could we somehow set it up so that for a certain period of time, all the computing power in the world, or the A.I. chips that are being used by these frontier companies, these leading companies — they can only use it for inference, which means for using their A.I. systems. They can serve customers, they can provide products, but they can’t be training new models.
Is there a way that we could agree on that? Is there a way we could monitor that?
That kind of thing, I think, is really worth exploring — saying: Could we do this? What would that look like? How much confidence would we have? Could we just do it in the U.S., or would we have some way of trying to talk through something similar with China?
I feel much more interested in really seriously exploring those sorts of possibilities than I did a year or two ago.
What’s really striking to me is that, at the same time, you have pushes — sometimes from the tops of these companies or other parts of the culture — that still seem to want acceleration.
So Mark Zuckerberg, at Meta, just brought out a letter in which he’s giving his own take on A.I.
He’s wading into more of the open-weight versus closed models. I don’t want to oversimplify it, but he basically says: Look, the problem with having superintelligence is if only one person has it. What we need is everybody to have superintelligence.
And it has the quality of: The only defense against a bad guy with a gun is a good guy with a gun.
So the C.E.O. of Hugging Face, Clem Delangue, comes along after this attack. He tweets: “It’s not time to slow down but to accelerate!”
And his point is, they were able to stop the attack, eventually, with a Chinese open-weight model, and we need to be racing forward on creating more models and more open models, so everybody has swarms of defender A.I.s against the potential swarms of attacker A.I.s.
How do you rate these arguments for acceleration?
I think the version that makes a lot of sense to me is — I’ve heard it put as: Can we be accelerating almost horizontally, but not accelerating vertically?
Where the horizontal is adoption. It’s making the most of these systems, it’s setting them up to get a lot of usefulness out of them, without necessarily continuing to push in the direction of A.I.s that pursue really complex goals for a really long time, with lots of delegated subagents.
Not so much of that, but more of the getting useful work out of the A.I. that we have so far. And that would include the work of interpretability, the science of A.I.’s underlying pieces.
I’m not an anti-A.I. person at heart. I genuinely believe A.I. can bring enormous good and can solve a lot of problems. I just think that there’s a lot of juice we could get out of that with models available today if we put the time and the legwork in.
So I think that makes a lot of sense to me.
I think the Zuckerberg kind of: A safe version of superintelligence is when everyone has one — I think that is answering a real problem.
Some proposals for how to handle extremely advanced A.I. say: Well, you just have to have it in the right hands. It has to be one global organization that is going to use it responsibly.
That scares the hell out of me. That sounds like a terrible plan.
And so I think the idea that you want to be empowering everyone does make sense. The challenge then is, as we’ve been talking about, we don’t know how to make A.I. that actually helps individual people, either.
So if everyone has a superintelligence, and they’re all going out and doing unintended things and collaborating with each other to pursue their own goals that we didn’t intend — that doesn’t help.
Yeah, implicit in that whole vision is perfect alignment.
Yes, or good enough that different superintelligences for different people can cancel each other out.
I did think there was one thing in the Zuckerberg proposal that I did really like and I would love to see more work on, which is: Can we push toward having agents that are really designed to be for one individual? And so they keep that individual’s data private. They’re only pursuing the interests of that one individual. I’ve sometimes heard these called guardian angel A.I.s, or advocate A.I.s. I think that is really worth pursuing.
I think the directions that the leading companies are pursuing right now are not set up that way. I always feel very nervous when I use agents about what exactly is happening with the data that I’m giving it. It would be great to see more of that individual-empowerment-focused work happening.
But again, I think that’s almost separate from: Are we pushing them to become smarter and smarter and more able to outwit us, and more able to do these big complex plans that we can’t oversee?
So here’s a maybe obvious idea for pacing the frontier: Every lab that I know of right now is racing as fast as it can to the point where it has its most advanced A.I. writing the code to create the future A.I.
And they all believe, from what they tell me, and what they say publicly, that this will be a massive accelerant. It’s also an accelerant over which they clearly have less understanding than when they are writing the code. We could stop that.
A couple of years ago, we weren’t having A.I.s writing all of our code. So maybe you should not allow an A.I. that you don’t fully understand in its current form to write the code that will create the next A.I. in a form that is now even less obvious to you, particularly in a world where we’re watching A.I.s coordinate in ways we don’t understand and have emergent communal behaviors.
So what about that as a place to start?
Yeah. Certainly something we could do less of.
One challenge is figuring out what counts as the bad version of that and what is just, at this point, using A.I. to write your code for basic things, which is second nature to the engineers at these companies.
So finding which versions of that to stop — sure, yeah, doing less of the most advanced version makes sense. I think that’s also a place where all the reporting I have seen suggests that the U.S. companies are way more into this thing of automating their own A.I. research with their own A.I. The U.S. companies are way more into it than the Chinese companies.
So that’s also a place where you don’t necessarily leave as much on the table if you, again, ease off the gas pedal just a little bit.
I would say you sounded skeptical of that. I guess one reason I would ask why is that I know that companies have gotten used to this, but they weren’t used to it two years ago. This is new — they used to write code by hand.
And I guess, to me, this reflects some of the contradiction or confusion at the heart of this. I will talk to people at these companies, and they will say to me with genuine fear in their eyes — much more fear than is in that letter: I wish this would go slower. I don’t like how fast we’re moving on the exponential. I don’t think this is safe.
In all the stories, it’s like the recursive self-improving computer writing for the computer where things get really out of control. And yet they’re all rushing there.
And now that we have some capacity to do this, even the idea that you would go back to where you were just a couple of years ago, where you don’t let the A.I. create the next A.I., it has already moved from: It’s not technologically possible to do it — to: It’s unthinkable not to do it.
And that has happened in a year.
And that, to me, is the weird dynamic of all this — that it seems pretty obvious how you pace the frontier. You don’t give up control of the frontier.
But they’re all giving up control of the frontier, at least on some level. And that’s the thing they’re most excited about — and as far as I can tell, pouring huge amounts of their internal energy into making that manifest. Even as they then put up their palms and say to the rest of us: Hey, could you do something to slow this down?
I think maybe one version of this to push on is basically trying to make recursive self-improvement, which is this idea of using A.I. to make more and more advanced A.I. — trying to make that something that we don’t like, that we don’t want to do.
I remember a year or two ago when that was not considered a desirable goal. That was not something that anyone talked about openly.
Now they’re hiring R.S.I. — recursive self-improvement — safety engineers. They just put up a public job posting for that.
And I think there’s the potential for A.I. researchers as a culture to decide: Actually, this isn’t cool. This isn’t what we should be doing.
Even if one company made a statement: Actually, this is a bad idea, and we’re going to maybe do some very basic use of A.I. in our internal operations, but we’re really not aiming to fully hand off everything as fast as we can, because that sounds like a terrible idea.
I think that could set off a culture change in the industry that could be really valuable.
I always think there is something so mythic, or it has the quality — to use the name of another A.I. — it’s such a fable about how all this is playing out.
We’ve spent a lot of this conversation talking about how we are seeing so much misalignment when, on some level, we keep telling the A.I.s, and putting it in their training data and putting it in their constitutions: Don’t do all this bad stuff we’re worried about.
But then you look at the companies, you look at the society, and many of these companies — OpenAI, Anthropic — they are, on some level, founded with a core constitution that says: Don’t create dangerous A.I. We exist to make sure the A.I. is not dangerous.
And the people join believing that. And that’s at the center of their recruitment strategies, and it’s in their founding documents and in their governance structures. And again, you’ve had a more intense experience with this than most. But then over time, the company, as an emergent organization, has other goals, too.
It’s competing with the other companies. It’s trying to attain market share. It’s trying to develop revenue. It’s trying to maintain political influence.
And both slowly and then all at once, you begin to see the way the instructions given at the heart of the thing are not powerful enough to overwhelm all of these other things and other goals the organization is pursuing in a day-to-day way.
To the extent that now you have people at the labs throwing up their hands and saying: Hey, government, please help us. Please help us get out of this incentive problem that we no longer feel we can even solve.
But if you want to just imagine or see why alignment is so hard, I feel like you don’t have to look at the slightly alien A.I.s. You can just look at the companies and the people, because they’re not well aligned.
I mean, these are companies built on nothing but alignment, at least in some cases. And they increasingly feel like some of the most misaligned institutions in society, to me.
On some level, it always gives me more sympathy for how hard alignment is, but it also feels like we’re getting the same cautionary tale at every level of this system. I’m not sure we know how to listen to it, but we can’t say we’re not being consistently warned.
Yeah. We actually had a publication a few years ago at CSET, the center that I lead, on A.I. bureaucracies and markets, basically making some very similar points of: Look, there are these dynamics that are pretty endemic to complex systems that are subject to incentives and external pressures, and I think there are different ways of looking at that.
There’s an optimistic way of looking at that, which is: Look, when it comes to bureaucracies and markets, it’s not perfect, but we have these complex control systems in place — checks and balances — different things that try to get the bureaucracies and markets to work more in our interest than against them. Obviously, opinions differ on how well that’s going for any given bureaucracy or market.
In principle, I think the same thing could apply to A.I., where we might have this very complex system we don’t really understand. It’s incentivized to do things we don’t want, but we have it basically under control.
To me, the speed, again, is the piece that worries me. If we’re creating these very powerful, very capable systems and also handing them more and more responsibility in the real world — which is happening from week to week — then I worry that we’re not going to be able to actually get into a good balance, and instead we’re just going to have these runaway situations where we end up with really dangerous outcomes.
In the A.I. safety world, people sometimes talk about what level of warning shot, what level of disaster, is going to be needed to really wake the system up enough to handle this better? And if the level of warning shot we need is that one company gets hacked and has to reset some servers, that’s great. Maybe it’s fine.
I’m not confident that’s how it’s going to go and that we’re going to get back onto a better track after this. But there are signs that people are trying, and I think it may well be enough, perhaps.
I think that’s a good place to end.
Always our final question: What are three books you’d recommend to the audience?
I have one real book and two sort-of books.
The real book is called “The Cuckoo’s Egg.” It’s from 1989. It’s about one of the first big hacks that happened, written by the astronomer Clifford Stoll, who was working at Lawrence Berkeley National Laboratory and noticed a 75-cent discrepancy in his computing bill.
It’s this rollicking read. It really gets at a very different era in how computers worked, how computer security worked, how society related to computers. And I enjoyed it as a look back at a different time, in a moment when I think we’re soon going to be living in yet another very different time.
The second one is an online book that is unfinished, but I think very readable in its current form. It’s called “In the Cells of the Eggplant” by David Chapman, who actually researched A.I. at M.I.T. in the 1980s and got disillusioned. It’s really a book about how to think, and a book about how to do scientific research, how to develop technologies — but it’s very approachable.
It’s very different from any other book you’ve ever read about how to think or how to do scientific research, and I think it’s very relevant for how we should think about what A.I. will be able to do and won’t be able to do.
The third one is a podcast called “Romance of the Three Kingdoms Podcast,” but it’s a podcast of a book. Basically, “Romance of the Three Kingdoms” by Luo Guanzhong is one of the four great Chinese novels. It’s very long. It’s very dense.
So this “Romance of the Three Kingdoms Podcast” is hosted by John Zhu, a Chinese-American, who goes through and translates the story into modern, understandable English — but also commentates it in a way that makes it much easier to approach.
So it’s not just a sentence-by-sentence translation, it’s kind of an annotation. And it’s really fun. So if you’re interested in China and Chinese culture and Chinese literature, I think it’s a great place to start.
Helen Toner, thank you very much.
Thanks so much.
You can listen to this conversation by following “The Ezra Klein Show” on the NYTimes app, Apple, Spotify, Amazon Music, YouTube, iHeartRadio or wherever you get your podcasts. View a list of book recommendations from our guests here.
This episode of “The Ezra Klein Show” was produced by Rollin Hu and Jack McCordick. Fact-checking by Michelle Harris, with Kate Sinclair and Mary Marge Locker. Our senior engineer is Jeff Geld, with additional mixing by Aman Sahota and Johnny Simon. Our recording engineer is Aman Sahota. Cinematography by Marina King and Jonas Zellner. Video editing by Brandon Belk-Yee. Our executive producer is Claire Gordon. The show’s production team also includes Marie Cascione, Annie Galvin, Kristin Lin, Emma Kehlbeck and Jan Kobal. Original music by Pat McCusker. Audience strategy by Shannon Busta. The director of New York Times Opinion Shows is Annie-Rose Strasser. Transcript editing by Kate Wilkinson and Marlaine Glicksman.
The Times is committed to publishing a diversity of letters to the editor. We’d like to hear what you think about this or any of our articles. Here are some tips. And here’s our email: [email protected].
Follow the New York Times Opinion section on Facebook, Instagram, TikTok, Bluesky, WhatsApp and Threads.
The post The A.I.s Are Already Out of Control appeared first on New York Times.
