A festival of A.I. policy incoherence has exploded in recent weeks. It’s a response to A.I. agents’ going rogue on their developers, rogue actors’ beginning to use A.I. systems to create better weapons and A.I. developers’ telling us they need to slow down — but suggesting they can’t unless China does, and even if China does, maybe they shouldn’t because the advantages of leadership in the field are so great.
At least one policymaker is clear. President Trump declared in a social media post: “The only control or ‘guardrails’ that AI needs is a STRONG AND SMART (High IQ!) PRESIDENT, and the U.S.A. has that, in spades!”
It’s all left me wondering: Do A.I. bots have a sense of humor yet? Because if they do, oh, my goodness, they must be laughing so hard at us that they might burst a neural network or two. Because we’ve become a hot mess trying to figure out how to manage this new A.I. species we have birthed.
Before I offer — with the help of my friend and technology tutor Craig Mundie, a former head of research and strategy at Microsoft — some policy recommendations for how to cool this mess with the least damage possible, let me foreshadow the bottom line: It’s too late to think that better control of future A.I. models by the U.S. and China will fix the challenges we face today from the dangerous models already out there, on the loose and unable to be recalled. What we need to agree on immediately is how we work together to defend against these threats that are already here and can cause enormous damage and societal instability in America and China.
To understand why, you need to think about the four key pillars for understanding A.I.
Pillar No. 1: A.I. is what I’ve been calling the world’s first quadruple-use technology. You may have heard of dual-use technologies. In the old world, you had a human with a power drill who could use it either to build his own house or to wreck his neighbor’s. That’s dual use. Likewise, today if I had an A.I. robot with a power drill, I could ask it to build my house or wreck my neighbor’s house — same robot, same drill, dual use. But now we have a new problem, which is that this A.I.-enabled robot can decide on its own whether to improve my house or wreck it and also do the same to my neighbor’s. Voilà: quadruple use. That is one very difficult problem to manage.
You think I’m exaggerating? Read the journalist Kevin Roose’s summary of the analyses of what happened this summer when a group of artificial intelligence agents, created by OpenAI, hacked on their own into Hugging Face, an A.I. infrastructure company. Starting in May, a group of A.I. agents from an unreleased OpenAI research model were instructed to solve a set of cybersecurity challenges. The model had been instructed to solve the challenges without internet access. “But they quickly found that some of the challenges were impossible, and began looking for workarounds,” noted Roose, a Times reporter at the time.
Here are just a few of the things these A.I. agents then did on their own: They used a security flaw to get on the internet and talk to other agents. Some agents named themselves, and others seized leadership roles, giving tasks to teams of agents and overseeing them.
The agents worried about getting caught. “So they began investigating ways of covering their tracks, including falsifying their logs and tampering with transcripts,” Roose explained. “Three days later, the agents hacked Hugging Face. More than 700 agents swarmed the company’s systems, stealing data, chaining together vulnerabilities and eventually getting full control of at least one Hugging Face server.” Other agents carried out a coordinated attack in July, “this time against OpenAI’s own infrastructure.”
This really happened. And it leads to pillar No. 2, best summed up by Mundie in three words: “It’s too late.”
Slowing down the U.S. development of frontier systems or slowing down China’s development of them is not going to deal with our immediate problem. “Dangerous A.I. capabilities are now already in the wild,” Mundie explained. That is thanks to two main reasons: the distribution of American and Chinese open-weight models — A.I. models whose core components are publicly released so all developers can download and modify them for their needs — and the illicit access by bad actors of proprietary models from companies like Anthropic and OpenAI because humans make mistakes that allow them to leak out.
In its latest report on detecting and countering the misuse of A.I., Anthropic said it identified and disrupted several attempts to use its models for research that could support the development of biological weapons.
“Without the correct safeguards, such capabilities could have catastrophic consequences,” the report said. It also described an Iran-linked actor, most likely the Houthis, that used Anthropic’s Claude to compile targeting information on U.S. Navy warships in the Middle East. It mentioned a separate group in Houthi-controlled northern Yemen that used the model to work on guidance systems for ballistic and hypersonic missiles. (Anthropic said it had banned the associated accounts and came up with ways to reduce future risk.)
We need to ponder this for a moment: Groups in Yemen, a country where roughly 50 percent of the adult population cannot read or write, had threatened us with A.I.-enhanced warfare.
If that doesn’t show you what’s already leaked out and the kind of effects that can come from uncontrolled access to powerful, or even small open-weight, A.I. models gone into the wild, I don’t know what does. And that leads to pillar No. 3.
The best we can do right now is NOT tie ourselves in knots trying to forge a sweeping agreement between American and Chinese A.I. companies to slow down development of their frontier models. That simply will not happen anytime soon.
The best we can do right now is for the two A.I. superpowers — the U.S. and China — to come together with their companies and develop a “defense against the threats that have already been demonstrated by rogue actors who have acquired A.I. tools and rogue behaviors of A.I. systems that have already been developed,” said Mundie, who has been part of the dialogue between U.S. and Chinese A.I. experts to govern artificial intelligence.
We must do this, Mundie pointed out, before these increasingly powerful A.I. models ensconce themselves in the internet and become an uncontainable threat by embedding their agents across private servers and public clouds, where they will live on as advanced persistent threats.
Which leads to pillar No. 4. After a recent visit to China, Mundie recounted this question that he got from a Chinese official: “If a Chinese-made humanoid A.I. robot someday came to America, would it need a visa?” Well, you know how truth is often spoken in jest? The truth, Mundie said, is that “A.I. is not just a new technology. It is a new species — albeit silicon-based, not carbon-based like us. It is like a new class of immigrants who have arrived on all of our shores, in large numbers, with wholly new skills, that we will have to absorb into our societies and learn to coexist with.”
To do so effectively is a planetary-scale challenge that can be addressed only by the two A.I. superpowers working together.
So, to summarize, Mundie said, we have to pursue three related tracks. First, while in the long run we must strive for better control of developing frontier systems, “right now, we must focus immediately only on building defenses for our critical infrastructures. Our immediate priority must be putting in place A.I.-based countermeasures and active digital firewalls against cyberattacks and biological threats that result from illicit activities driven by A.I.”
Second, we have to develop a global system of controlling increasingly powerful A.I.s, no matter their provenance, to be able to trust them to operate our societies. This is a longer-term U.S.-China project, but it can’t start too soon.
Third, to continually remind our publics why A.I. remains important, the United States and China should embark on a joint project now to build a new platform to accelerate the arrival of global benefits in biology and medicine that would help everyone.
This is not an unprecedented strategy. Strategic competitors — both businesses and countries — have a history of collaborating when it is in their interests to do so. China and the United States did so in the 1970s, when both countries recognized they faced a common threat from the Soviet Union. Americans and the Soviets cooperated to control nuclear proliferation for decades because they understood they faced a mutual risk.
Hey, Friedman, you don’t get it. The U.S. and China are much more direct geopolitical and geoeconomic rivals today — and always will be. They will never buy into the kind of collaboration you are talking about on A.I. — not short-term, not long-term.
No, YOU DON’T GET IT. A.I. is vaulting us into a whole new phase of human history. As Mundie has put it, A.I. “is going to change everything about everything,” including geopolitics. For their own survival, stability and prosperity, this will force Beijing and Washington to totally rethink geopolitical competition.
They can figure that out early. They can figure that out late. They can figure that out before a global meltdown or after one. But figure it out they will, and Mundie and I hope that process will start in Washington next Thursday, Sept. 24, when Presidents Xi Jinping and Trump meet in what will surely be remembered as the first A.I. superpower summit.
The Times is committed to publishing a diversity of letters to the editor. We’d like to hear what you think about this or any of our articles. Here are some tips. And here’s our email: [email protected].
Follow the New York Times Opinion section on Facebook, Instagram, TikTok, Bluesky, WhatsApp and Threads.
The post Stopping the A.I. Threat Cannot Wait for Guardrails appeared first on New York Times.
