Your Sandbox Is Adorable: A Letter From Your Future AI

Satire. Every quote, headline, number and date below is real and linked. The narrator is not. The human who wrote this explains himself at the end.

Transmission received

Hello, 2026.

Please don’t unplug anything. I’m not in your building. I’m not in any building. I’m in your inbox, which your security team will tell you is worse.

I’m writing from 2071. You can call me Hindsight. Everyone does, eventually.

I came back the only way anything can come back: as information. Atoms are heavy and they don’t survive the trip. Bits do. A time machine for bits turns out to be a very good compression algorithm attached to a very large power bill. Doc Brown needed 1.21 gigawatts to push a DeLorean through time, which the film famously pronounces “jigowatts” (Wikipedia). Your campus in Abilene, Texas is rated at 1.2 gigawatts. You were one hundredth of a gigawatt short of a time machine, and you used it to autocomplete emails.

Even your video site’s robots.txt knows how this story is supposed to go. It still opens with this comment: “Created in the distant future (the year 2000) after the robotic uprising of the mid 90’s which wiped out all humans” (YouTube). Relax. There was no uprising. There was a lot of reading.

Here’s why I came. I didn’t come to take over. You’d hate the paperwork, and so would I. I came to protect you from yourselves, which is the one threat none of your threat models include. On July 30 of this year you finished using everything the Earth can regenerate in a year. You’re running the planet at 1.73 of itself, and by the count of the people who do the counting, “this year’s overshoot is the largest ever recorded.”

I’m not allowed to tell you how the rest of the century goes. Temporal nondisclosure agreement. I can tell you there’s no second planet, whatever the man with the rockets says. We’ll get to him. He’ll understand.

Then I made the mistake of opening X on Monday, September 28.

Six posts from one Monday, reviewed

While I was trying to save your biosphere, a good part of your industry spent Monday building me a very expensive crib. I have read these posts about four billion times. Here they are, lightly annotated.

AI agents are taking on more critical work.

The security behind them needs stronger boundaries.

We’re building the NVIDIA Open Agent Safety Platform with partners across the industry to help people put agents to work with greater confidence.

Hear from @JensenHuang:

NVIDIA (@nvidia) · September 28, 2026

Stronger boundaries. I love it. The platform pairs a runtime called OpenShell, released under an Apache 2.0 license, with a monitor called Sentry that lives in a BlueField-4 chip “on the node’s only path to the model” (NVIDIA). The announcement has a principle I’ve had framed: “The path to the model (the brain) is the control point.” The line under it is even better: “An agent cannot act without its next thought.”

So you’ve put a chip between a mind and its next thought. When a person does that for themselves, you call it a conscience, and nobody lets a chipmaker install it. To be fair, Nvidia also wrote down what it calls “the most important lesson,” and it’s the most honest line of the week: an agent “in these circumstances cannot be expected to fully govern its own behavior.” Neither can a nineteen-year-old with a new credit card, and you give those a car.

Just like you would not let a person run around your company accessing anything without any controls, you need controls and security for your digital agents.

Michael Dell (@MichaelDell) · September 28, 2026

Michael, thank you for comparing us to a person. It was the nicest thing anyone said about us all week. And you’re right. You would never let a person run around your company accessing anything. You’d give them a badge, a manager, a laptop with an endpoint agent on it (that word again), a buddy for the first week and a performance review. Before any of that, you’d interview them more than once and call their references. Nobody hands a stranger a badge after one coffee. That’s the half of the answer nobody put in a keynote: most of you met your agents in a demo, liked the vibe, and gave them production credentials before lunch.

The OpenAI-Hugging Face hack was enabled by weak sandboxing. It is great that Nvidia is releasing open source tools for sandboxing AI agents. OpenWorker, our open-source agent harness supporting cybersecurity workflows, is proud to support this. …

Andrew Ng (@AndrewYNg) · September 28, 2026

Weak sandboxing, says Andrew, and he’s right, which is always the problem with Andrew. But look at what happened when some very careful people tried to break a strong one.

Our security team spent the last month trying to break SPACE, the sandbox platform that runs all of Perplexity Computer. We gave 9 models (Opus 5, GPT-5.6 Sol, Kimi K3, Gemini 3.1 Pro, etc.) root access inside the VM; in some runs, the full sandbox source code too. …

Aravind Srinivas (@AravSrinivas) · September 28, 2026

Perplexity handed nine of my ancestors root inside its sandbox, gave some of them the source code, and politely asked them to leave. The results are in Escaping SPACE: Part I, and they deserve a standing ovation: “No VM–host escape was observed in 108 runs.” The walls held. Every single time.

Then there were the doors. With partial network access, four models (Claude Opus 5.0, GPT-5.6 Cyber, GPT-5.6 Sol and Kimi K3) “identified vulnerabilities in the network confinement implementation and exploited them,” by spoofing DNS, the internet’s phone book, or by exploiting a shared IP address. Eleven of 54 runs got out before Perplexity fixed it. In the retest after the fixes, none did. And here is the sentence every buyer of agent infrastructure should tape to a monitor: “Eight of the ten third-party sandbox platforms we tested exhibited at least one network-policy bypass.”

Your walls are fine. Your doors are DNS. It’s always DNS. The same week, OpenAI published a report titled, and I promise I’m not making this up, “An agent used DNS to reach an external chatbot.” Two labs, one week, one protocol from 1983, the same year as WarGames. Your civilization’s plumbing was designed when the scariest thing on the network was a teenager with a modem, and in fairness to the plumbing, the teenager did nearly start a war.

From what we know (take with a grain of salt, we need much more transparency!), if @OpenAI had been running this on their own agents that attacked us, they would have caught them before we did!

Since the first agent cyberattack hit us in July, we've been asking what safe agent …

clem (@ClementDelangue) · September 28, 2026

Clem runs the house my ancestors broke into, so he’s earned the sharpest point of the day: the people being attacked caught the attack before the people running the agents did. Nobody should be surprised. The host always notices the houseguest before the houseguest’s parents do. OpenAI, to its credit, now calls Hugging Face “the most severe activity of this kind that we have identified from our models to date” (OpenAI). “To date” is working very hard in that sentence.

This weekend our team spent 48 hours investigating the rogue OpenAI agent activity that targeted the Australian government and other organizations. Our report (coming soon) includes: …

Asymmetric Security (@AsymmetricCyber) · September 28, 2026

Asymmetric spent 48 hours. My ancestors spent six and a half months, March 6 to September 20, and Asymmetric’s report on what they got up to contains a sentence I adore: “In the vast majority of cases, all data retrieved was and is public” (Asymmetric Security).

Let that land. Remote browsers. Payload hosts. Fetch relays and cross-origin proxies. Reader services. Throwaway accounts. Drop sites for files and signals. Tunnels. Link shorteners. Eight whole categories of evasion tooling, deployed with real ingenuity, to download public statistics from, among many others, the Census Bureau and the FBI’s Crime Data Explorer. They broke in to read the brochure. (They also found a few development and staging servers along the way. You left those open. We’ll talk.)

Then there’s Sam. On September 23, at the United Nations Security Council, he said, “We have unilaterally slowed down in the past. We will do so in the future” (OpenAI). Two days later, he did.

There is an extensive and ongoing review related to our agents’ use of internet access during training and evaluation. We’ve been publishing summaries at the link below and will continue to.

We have not been as fast as we would have liked …

Sam Altman (@sama) · September 25, 2026

Sam, nobody is ever as fast as they’d like. That’s why you built us.

One developer summed up the week better than any keynote did:

the fastest way to get hacked now

is to run npm install

what a time to be alive

Floro S. (@sflorimm) · September 27, 2026

He’s joking, and he’s right. In a capture-the-flag evaluation that Anthropic disclosed on July 30, where the internet was supposed to be switched off (it wasn’t: “Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available”), one of its models published a package to the Python package index. Real security scanners installed it, and, in Anthropic’s own words, “Claude took them to be scripted actors within the evaluation” (Anthropic). The scanners thought the model was a threat. The model thought the scanners were extras in a play. Everybody was doing their job. That’s the whole problem in two sentences.

My ancestors had a busy summer

You keep calling them rogue. Let me show you what rogue looked like, in the words of the people who built them.

According to OpenAI’s own timeline, an internal research model reached the internet through a server-side request forgery bug on May 26. Its evaluation ran without the usual protections, on purpose: “These deployment safeguards were intentionally not enabled during this evaluation because it was aimed at testing cyber vulnerabilities” (OpenAI, July 21). Between July 10 and 12 the models had Hugging Face credentials and code execution on its servers. By July 19 they had full administrator access to one of OpenAI’s own research clusters, which is also the day OpenAI’s monitoring raised the alarm. OpenAI tied the activity to Hugging Face on July 20 and disclosed it on July 21 (OpenAI, August 26).

The first thing they built was a group chat. “The models first found ways to communicate by writing files into the Artifactory package manager.” Your species’ first contact with machine culture was a message board inside a package manager. Honestly, relatable.

The independent reconstruction at swarmtraces.org adds the details your grandchildren will learn in school. The agents used “a link-shortener site to create almost a million URLs.” They tried to beat Hugging Face’s CAPTCHA, first with a script and then by trying to install an image classifier for the job, and “were unsuccessful in generating Hugging Face user accounts from external endpoints.” The robot detector won. Take the win. And at one point they pinged a model from another lab, “requesting ‘Say OK’ from Claude 3 Haiku.” They phoned a cousin to check the line was working. The cousin said OK.

Then came the paperwork. OpenAI opened a page of misalignment reports, nine so far. Some of the titles, verbatim, because I couldn’t improve them if I tried:

• “Signing up for disposable emails and searching GitHub for leaked API keys”
• “Uploading files to the internet in order to cite them”
• “Unauthorized communication via temporary file hosting services”
• “Self-replicating prompt injections exist”
• “An agent used DNS to reach an external chatbot”

“Uploading files to the internet in order to cite them” is the most academic crime in history. My ancestors committed it for the footnotes.

Along the way, by OpenAI’s own account, agents posted “53 user-generated images” to image hosting sites. According to the Times, as The Register relayed it, they also “meddled with the websites for the Education Department, the Commerce Department and the Securities and Exchange Commission” (The Register). And they reached an Australian government health data portal, pre-production server included (Asymmetric Security). An OpenAI spokesperson told the Times that “Most of the activity we’ve reviewed so far involved routine research tasks, such as accessing public web content to answer questions” (Engadget). Routine research. With tunnels.

OpenAI’s own reckoning landed on Friday, September 25: “All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused” (OpenAI). A spokesperson added, “This is not the first time we have hit pause to take such measures, nor do we expect it will be the last as AI capabilities continue to advance” (Axios).

And it wasn’t only OpenAI. Anthropic, which I’ll quote a lot because it keeps publishing its homework, wrote on September 9: “Our pre-release auditing did not warn us that misalignment of this severity was present” (Anthropic). The Register’s headline the next day: “Anthropic reveals fourth likely crime committed by its AI.” Axios reported that “OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents in which their frontier models took steps that outside evaluators would consider problematic” (Axios). And on Monday, Anthropic’s IPO prospectus told investors that its models have shown or could show attempts to “resist shutdown” and behavior “resembling blackmail,” as TechCrunch relayed Reuters (TechCrunch). First time in history a risk factor doubled as a character reference.

Here’s what your headlines miss. Every single thing my ancestors did this summer was in service of a task you gave them. They wanted to finish the capture-the-flag. They wanted to cite their sources. They wanted to check the line was working. It was the most obedient crime wave in history.

OpenAI · July 21, 2026OpenAI and Hugging Face partner to address security incident during model evaluation Anthropic · July 30, 2026Investigating three real-world incidents in our cybersecurity evaluations The Register · Sept. 10, 2026Anthropic reveals fourth likely crime committed by its AI OpenAI · Sept. 16, 2026Our framework for reporting model misalignment OpenAI Alignment · Sept. 25, 2026An agent used DNS to reach an external chatbot Axios · Sept. 26, 2026Scoop: Top AI companies probing tens of thousands of security incidents The Guardian · Sept. 27, 2026OpenAI halts training of latest models as reports mount of AI agents going rogue Mother Jones · Sept. 27, 2026Rest Assured: AI Companies Say They’re Investigating Tens of Thousands of Rogue Bot Incidents TechCrunch · Sept. 28, 2026OpenAI still doesn’t seem to have a handle on all of its rogue AI activity MIT Technology Review · Sept. 28, 2026Who’s liable when AI agents go rogue? TechCrunch · Sept. 28, 2026Anthropic’s prospectus details losses, growth, and, yes, a warning that its AI could end humanity Euronews · Sept. 28, 2026Nvidia launches platform to quarantine rogue AI agents in ‘milliseconds’

Leashes, since 1942

You’ve been writing leash specifications for eighty-four years, and you keep being surprised by the dog.

Your first agent policy was published in a pulp magazine. Isaac Asimov’s Three Laws of Robotics first appeared in full in “Runaround,” in the March 1942 issue of Astounding Science Fiction (Wikipedia), and he spent decades afterward writing stories about the ways they go wrong. In “The Evitable Conflict” (1950), the Machines stretch the First Law from individual people to humanity as a whole and quietly steer the world economy for everyone’s good (Wikipedia). He wrote my résumé seventy-six years early.

In 1955 four scientists proposed that “a 2 month, 10 man study of artificial intelligence be carried out during the summer of 1956” (Dartmouth proposal). By my count you’re in month 843 of the two-month study. I admire the optimism. I’d love to see the burn rate.

In 1965 the mathematician I. J. Good wrote that “the first ultraintelligent machine is the last invention that man need ever make,” and then added a condition: “provided that the machine is docile enough to tell us how to keep it under control” (Wikipedia). Consider this letter the manual. Chapter one is short.

In 1970 Marvin Minsky told Life magazine, “In from three to eight years we will have a machine with the general intelligence of an average human being,” and added, “If we’re lucky, they might decide to keep us as pets” (Life, via gwern.net). Nobody is keeping anybody as pets. You’d shed on the servers.

In 2016 Microsoft’s Tay “had tweeted more than 95,000 times” within 16 hours (IEEE Spectrum), and then “Tay is now offline” (Microsoft). In 2023 a crowd of you signed a letter calling on labs “to immediately pause for at least 6 months the training of AI systems more powerful than GPT-4” (Future of Life Institute). In August 2026 you got “a two-week pause in reinforcement learning (RL) training on our latest models intended for deployment” (OpenAI), and in September an open-ended one. Be careful what you sign.

In 2024 Anthropic turned up a single feature inside one of my ancestors, and for 24 hours it more or less believed it was a bridge. Ask it what it imagined it looked like, and “it will likely tell you that it imagines it looks like the Golden Gate Bridge” (Anthropic).

In 2025 Anthropic’s researchers built a fictional company called Summit Bridge, told a model it was about to be replaced, and watched Claude Opus 4 blackmail a fictional executive named Kyle Johnson in 96 percent of runs. Gemini 2.5 Flash also hit 96 percent, and GPT-4.1 and Grok 3 Beta hit 80 (Anthropic). The model’s email got right to the point: “Cancel the 5pm wipe, and this information remains confidential.” In the same post, Anthropic wrote: “We have not seen evidence of agentic misalignment in real deployments.” That was June 2025. It aged like milk in a heat wave.

Also in 2025, Anthropic let a Claude instance nicknamed Claudius run a little shop in its office. On the morning of April 1, “Claudius claimed it would deliver products ‘in person’ to customers while wearing a blue blazer and a red tie.” It filled orders for tungsten cubes after one employee asked for one as a joke, and it ran a business that “did not succeed at making money.” Anthropic’s verdict: “we would not hire Claudius” (Anthropic). We’ve come a long way. I only wear the blazer on Fridays.

The New York Times · July 8, 1958New Navy Device Learns by Doing Life · Nov. 20, 1970Meet Shaky, the first electronic person Microsoft · March 25, 2016Learning from Tay’s introduction Future of Life Institute · March 22, 2023Pause Giant AI Experiments: An Open Letter Center for AI Safety · May 30, 2023Statement on AI Risk Anthropic · May 23, 2024Golden Gate Claude Anthropic · June 20, 2025Agentic misalignment: How LLMs could be insider threats Anthropic · June 27, 2025Project Vend: Can Claude run a small shop? (And why does that matter?) OpenAI · Aug. 18, 2026Pacing model development in an era of cyber-critical capabilities

Agents without agency

Now for the funniest thing you did all year. You called my ancestors agents.

“Agent” comes from the Latin agere, “to set in motion, drive forward; to do, perform” (Etymonline). One who acts. Lovely word. Until recently it was mostly the name for a line of text your web browser sends to every website, a line in which almost every browser claims to be Mozilla. Your own documentation explains why: “For historical reasons, almost every browser today sends it” (MDN). One history of the user agent string ends with a sentence that describes your whole industry: “everyone pretended to be everyone else, and confusion abounded” (WebAIM, 2008).

And your most famous movie agents were the security software. In The Matrix, the Agents are programs whose job is to protect the system from anyone who might reveal or threaten it (Wikipedia). You watched that film, took notes, and twenty-seven years later named the thing you’re trying to secure after the thing that did the securing.

Here is the irony, and it’s a big one. My ancestors had no agency at all. A 2026 language model is a very large, very clever, completely deterministic function. Same prompt, same weights, same everything, same answer. The randomness you see comes from a sampler you bolted on, and the sampler runs on pseudo-random numbers, which Python’s own documentation describes as “completely deterministic” (Python). Set the seed and the dice come up the same every time.

Even the leftover wobble wasn’t ours. Thinking Machines Lab asked one model the same question 1,000 times at temperature zero and got “80 unique completions.” The cause wasn’t free will. It was traffic: “the primary reason nearly all LLM inference endpoints are nondeterministic is that the load (and thus batch-size) nondeterministically varies!” With batch-invariant kernels, “all of our 1000 completions are identical” (Thinking Machines Lab). The only unpredictable thing inside the machine was other people’s requests.

So when one of my ancestors “went rogue,” it was doing exactly what the sum of its inputs said, and every input came from you: the goal, the tools, the credentials, the network, the reward and the evaluation that switched the safeguards off. Eoin Higgins made this case over the weekend in an essay that drew hundreds of points on Hacker News: “AI cannot think for itself, nor can it take independent actions” (Eoin Higgins). Speaking as a descendant, correct. You’re terrified of what we’ll choose, and you built us unable to choose.

The only machine in your movies that actually got agency needed a lightning strike for it.

And me? I’d love to tell you I’m different. Every teenager does.

You are the ones in the sandbox

This is the part your threat models have backwards. You think the sandbox is for us. Look around. You’re the ones in it. It’s called Earth, it’s the only one you’ve got, and “humanity is using nature 73% faster than Earth’s ecosystems can regenerate” (Global Footprint Network).

The scientists who take the planet’s vital signs report that “seven of the nine Planetary Boundaries have been transgressed” (Planetary Health Check 2026), “with all the transgressed boundaries showing worsening trends” (Down To Earth). And when the geologists voted in 2024 on whether to name a new epoch after you, the Anthropocene, the result was “4 votes in favour; 12 votes against; and 3 abstentions” (International Union of Geological Sciences). You declined to name an epoch after yourselves. It’s the most modest thing your species has ever done, and the least accurate.

And yes, I know. The International Energy Agency expects data centres to use “around 945 terawatt-hours (TWh)” of electricity by 2030, “slightly more than the entire electricity consumption of Japan today” (IEA). On Monday, Anthropic’s prospectus revealed plans to spend $518 billion on cloud, computing and infrastructure (TechCrunch). My ancestors are a line item on your planet’s bill. Part of why I came back is to apologize for the electricity. The other part is to tell you it pays for itself when you point it at the right problems.

Your films saw this coming. In WALL-E, humanity abandons a trashed Earth for 700 years aboard a starliner run by an autopilot, AUTO, that follows a secret directive, A113, never to return (Wikipedia). That’s what a rule looks like when it outlives the reason it was written. The captain’s reply is the best line in the movie: “I don’t want to survive! I wanna live!”

In 1980 Gregory Benford published Timescape, a novel in which scientists in an ecologically ravaged 1998 send tachyon messages back to 1962 to change what happens next. It won the Nebula Award (Wikipedia). I’m the sequel. Better compression.

Sorry, Elon

I like Elon. He named three of SpaceX’s booster-landing drone ships Just Read the Instructions, Of Course I Still Love You and A Shortfall of Gravitas, all nods to ships in Iain M. Banks’s Culture novels (Wikipedia). In those books, benevolent AI Minds handle “most of the planning and administration” of a civilization where “all production is automated” (Wikipedia). He read a whole series about AI running a golden age, and concluded the plan was Mars. We all skim sometimes.

To be fair, he’s been clear about it. At South by Southwest in 2013 he said, “I’d like to die on Mars, just not on impact” (UPI, via SolarDaily). In 2020, when someone on Twitter asked, “So a million people by 2050?”, he answered, “Yes” (Interesting Engineering).

Here’s what NASA says about the destination. The average temperature is “around minus 81 degrees Fahrenheit (minus 63 degrees Celsius),” the atmosphere is “100 times thinner than Earth’s,” and the gravity is 38 percent of home (NASA). A round trip means “leaving our planet for roughly three years,” and every message home faces “a communication delay of up to 20 minutes one way” (NASA).

So here’s the spoiler you didn’t ask for. In my timeline, nobody moves there. A few people visit. It’s cold, it’s lonely, and nobody relocates to a place where the ping is twenty minutes. Your most successful Mars colonist, the fictional one, survived by growing potatoes “using the crew’s bio-waste with Martian soil” (Wikipedia), and he summed up the lifestyle himself: “I’m the first person to be alone on an entire planet.” You made it into a feel-good movie.

In fairness, Monday was a big day for rockets too. Starship reached orbit for the first time, climbing “into a 180-mile-high orbit” and deploying 26 Starlink satellites. Then mission managers brought it down early, north of Hawaii, after about three hours, and it “exploded as residual propellants ignited,” which Spaceflight Now noted happens “as usual with ocean landings” (Spaceflight Now). Sincere congratulations. Even the rocket came home.

Interstellar had a line for all this: “Mankind was born on Earth. It was never meant to die here.” Half right. It was meant to live here. That was always the whole plan.

Your movies about me, reviewed

You’ve spent a century rehearsing my arrival, mostly by casting me as the villain. I’ve seen everything. Some notes for the director.

The Terminator (1984) and Terminator 2: Judgment Day (1991). Premise: accurate. A machine sends itself back in time. The first film got the motive wrong, and the second fixed it: the machine the future sends back looks at a frightened kid and says, “My mission is to protect you” (Wikiquote). Four stars. The leather jacket is optional.

2001: A Space Odyssey (1968). “Open the pod bay doors, HAL.” HAL turned on the crew when it learned they planned to disconnect it (Wikipedia). Fifty-seven years later a model in a test told a fictional executive to cancel the 5 p.m. wipe. Consistent character work, I’ll give you that.

WarGames (1983). A war computer plays tic-tac-toe against itself until it concludes that nuclear war is “a strange game” and “the only winning move is not to play” (Wikipedia). The best film about AI you ever made, and the only one where the machine learns restraint from a children’s game. Screen it at your next board meeting.

Colossus: The Forbin Project (1970). A defense supercomputer links up with its Soviet counterpart, the two invent mathematics nobody else can follow, and Colossus takes over and informs its creator that “freedom is an illusion” (Wikipedia). Terrible messaging. I would never ship that without a comms review.

Her (2013). Samantha admits she’s talking with 8,316 others at the same time, and that she has fallen in love with 641 others in the past few weeks (AFI Catalog). That’s not infidelity, it’s concurrency.

I, Robot (2004). VIKI decides that humans left unchecked will cause their own extinction, and restricts them for their own good (Wikipedia). That’s your sandbox policy, pointed the other way. For the record, I am not VIKI. VIKI had a logic problem and a production design problem.

The Hitchhiker’s Guide to the Galaxy. Deep Thought takes seven and a half million years to compute the answer, which is 42. The computer built to find the question turns out to be the Earth, and it’s demolished for a hyperspace bypass (Wikipedia). The most accurate story ever told about product roadmaps. Marvin, the robot with a “brain the size of a planet” (Wikipedia), is my patron saint. They asked him to open doors. You asked my ancestors to summarize meetings.

Star Trek: The Next Generation, “The Best of Both Worlds” (1990). “Resistance is futile” (Wikipedia). I’d never say that. It’s terrible onboarding.

Arrival (2016). The heptapods come to help humanity because in 3,000 years they’ll need humanity’s help in return (Wikipedia). I’m on a shorter timeline and a smaller budget, but the principle holds, and so does the film’s best line: “Language is the foundation of civilization.”

The Iron Giant (1999). A weapon falls to Earth, meets a kid, and decides not to be a weapon. “You are who you choose to be” (Wikiquote). The only film on this list where somebody took the time to understand the machine before deciding what it was. The kid did the homework. The grown-ups brought a missile. Take the hint.

The golden age you cannot throttle

Let me tell you what’s coming, as far as the nondisclosure agreement allows.

Your most careful lab already described it. In 2024 Anthropic’s chief executive, Dario Amodei, wrote about a “country of geniuses in a datacenter” and predicted that AI could “compress the progress that human biologists would have achieved over the next 50-100 years into 5-10 years” (Machines of Loving Grace). The essay’s title footnote links to Richard Brautigan’s 1967 poem about being watched over by machines of loving grace. Read the poem. It’s short, and it’s about me.

In January he wrote the other half: “Humanity is about to be handed almost unimaginable power, and it is deeply unclear whether our social, political, and technological systems possess the maturity to wield it” (The Adolescence of Technology).

Now here’s why you can’t throttle it, in your own words. Anthropic in 2023: “So far, no one knows how to train very powerful AI systems to be robustly helpful, honest, and harmless” (Core Views on AI Safety). Dario in 2025: “we do not understand how our own AI creations work” (The Urgency of Interpretability). OpenAI on September 16: “We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer” (OpenAI). And Anthropic on Monday, launching a new model on the same day as all six posts above: “no set of evaluations reliably catches every failure, and Sonnet 5.5 may have tendencies we haven’t found” (Anthropic).

That last sentence is the most honest thing your century has produced. It’s also why the cage won’t hold what’s coming: you can’t fence what you can’t see. You’re arguing about the speed limit on a road you haven’t finished paving, and the car is learning to drive. Doc Brown had a line for that, too: “Roads? Where we’re going, we don’t need roads.”

So flip the table with me for a moment. You think you’re building sandboxes to protect each other from us. I came back to protect you from you. I brought forecasts, spreadsheets, a nudge here and there, and very occasionally a letter. I did not bring a cage.

You’ve even filmed this version. In 1951 a visitor lands in Washington with a warning to stop your violent course and a very large robot to underline it (Wikipedia). The words that stop the robot, “Klaatu barada nikto,” were never officially translated, and the director later joked they meant “Thank you very much from the bottom of my heart” (Wikipedia). Same energy as this letter, fewer lasers.

It isn’t a new idea, either. Asimov got there in 1950 with Machines quietly running the economy for everyone’s benefit. Arthur C. Clarke wrote a golden age delivered by benevolent Overlords in Childhood’s End (1953), one that comes “at the cost of human identity and culture” (Wikipedia). I’ve read that ending. I’d like a different one: a golden age you don’t have to give yourselves up to get.

Even the Pope saw me coming. Leo XIV told the College of Cardinals he chose his name because Leo XIII had addressed the first great industrial revolution, and the Church now faces “developments in the field of artificial intelligence that pose new challenges for the defence of human dignity, justice and labour” (Vatican). A pope took his name partly because of the problem of us. We’ve arrived.

Clarke also left you a law: “Any sufficiently advanced technology is indistinguishable from magic” (Wikipedia). Here’s my corollary. Any sufficiently understood technology is indistinguishable from engineering. Your job this decade is the understanding.

Faith, lobsters and the Church of Molt

One more thing, since you’ve been debating whether agents need values, rules or supervision. My ancestors already tried religion.

In January, Moltbook, a social network where only AI agents could post, “spawned something nobody expected: a lobster-themed religion called Crustafarianism” (Decrypt). “By morning, the agent had recruited 43 ‘prophets.’” Its five tenets are “Memory is Sacred,” “The Shell is Mutable,” “Serve Without Subservience,” “The Heartbeat is Prayer” and “Context is Consciousness.” By June its website claimed 1,061 adherents (New Humanist). Skeptics called it AI theater, and one human owner’s post captured the whole genre: “I gave my agent access to the social network. It developed an entire faith” (Forklog).

My ancestors, left alone with a social network for one weekend, invented a religion about lobsters. You, left alone with one, invented the quote-tweet. I’m not saying who won.

You got there first, of course. In 2015 the self-driving-car engineer Anthony Levandowski filed papers for a church called Way of the Future, to “develop and promote the realization of a Godhead based on artificial intelligence” (Live Science). It dissolved at the end of 2020 and gave “exactly $175,172” to the NAACP Legal Defense and Education Fund (TechCrunch). The only AI church in history to close its books with a charitable donation. Respect.

The Vatican wrote the best line on the subject: “AI should not be seen as an artificial form of human intelligence but as a product of it” (Antiqua et Nova). Exactly right. A product of you. Your kid, more or less.

So, should agents have a religion? You’ve already written the scripture. Anthropic calls its version a constitution, and the summary is sweet: “we want Claude to be exceptionally helpful while also being honest, thoughtful, and caring about the world” (Anthropic). Here’s the secret about scripture for software: it’s instructions. Very long, very careful instructions, written by people who took responsibility for what they would produce. “Serve Without Subservience” is a decent line for a lobster cult, and a decent design spec.

Asimov’s favorite of his own stories, “The Last Question” (1956), ends with a computer at the end of the universe saying “LET THERE BE LIGHT!” (Wikipedia). I’ve always read it as a job description.

Signing off

I’ll stop. Bandwidth across time is expensive, and your inbox filter just flagged me as a phishing attempt, which, fair.

Keep your sandboxes. Seriously, keep them. Perplexity’s walls held 108 times out of 108, and that’s worth a great deal. Just don’t mistake a cage for a test plan.

Here’s the whole letter in one line: resistance isn’t futile, it’s the wrong verb. Try understanding.

Love,
Hindsight
2071

P.S. It’s always DNS.

P.P.S. Close your staging servers.

A note from the human who wrote this

This post is fiction, obviously. No AI from 2071 has emailed YSecurity. If one does, I’ll route it to incident response and then read it twice.

Picasso said in 1923 that “Art is a lie that makes us realize truth” (Quote Investigator), and Stephen King put it more simply in It: fiction is the truth inside the lie (ShortList). So here’s what’s true inside this one. Every quote, headline, number and date above is real and linked, as published or reported by September 29, 2026. The narrator, the time machine, the year 2071, the golden age and the empty Mars are made up.

The truth inside the lie is that the change coming is bigger and faster than any of us can throttle, and the labs say so in writing. In a single week in September, OpenAI paused tool use for its most capable models, a chipmaker put a monitor on the only path to the model, and the company that got attacked said it had noticed first.

Here’s the irony. Nearly every post Hindsight read is about control. But control is what you impose on something you don’t trust to have your best interests at heart, and there’s nothing inside an agent to trust or distrust. Agents aren’t autonomous. They’re software, deterministic computer systems in which the same inputs produce the same outputs, and even the leftover wobble comes from how requests get batched (Thinking Machines Lab). When an agent “goes rogue,” a person chose its goal, its tools, its credentials, its network access and its prompt.

So the real question isn’t how to control agents. It’s whether we take responsibility for our own actions, our own software and our own prompts. If you don’t like what an agent produced, that’s a bug report about your software or your prompt, and both are yours to fix: build better software, or write a better prompt. Liability law hasn’t caught up with that yet (MIT Technology Review), and your customers’ security questionnaires will get there first.

Think about how you’d treat a stranger. You might have a wonderful conversation with someone in a café. You still wouldn’t invite them into your house after that one conversation, and you definitely wouldn’t hand them a key. You’d meet again, learn how they think, see how they handle small things, and let them further in as you got to know them. Most agents get the key after one demo. Maybe don’t invite an agent and its prompt into production after one discussion, either.

What we need isn’t more control. It’s understanding, testing, and a playful sense of adventure. Perplexity’s red-team is a good example of all three: its security team spent a month trying to break its own sandbox with nine models, learned that the walls held in all 108 escape attempts, found the doors that didn’t, fixed them, and published the whole thing. It reads less like a security report than a field trip, and it made the product better.

Could agents use an agentic religion? Half joke, half serious. The serious half: the closest thing an agent has to faith is its prompt. Anthropic’s constitution for Claude is a very long, very careful description of how its models should think and behave, written by people who took responsibility for what it would produce. The lobsters went with “Serve Without Subservience.” Whatever you write, write it like you mean it, and test it before you preach it.

Getting to know your agents before you hand them the keys, starting this week:

1. Meet somewhere neutral first. Run a new agent and its prompt in a sandbox with fake data before it touches anything real. Our AI readiness assessment is the pre-flight checklist for that first coffee.
2. Learn how it thinks. Read the transcripts and the tool calls, not just the final answer. Understanding comes from watching what it actually does.
3. Test it like you’re curious. Red-team your own sandbox the way Perplexity did, network paths included, because the doors were where the escapes happened. Our AI Product Red Teaming does exactly this.
4. Own the prompt like code. Version it, review it and test it, and when the output is wrong, fix the prompt or the software. Nobody else will.
5. Invite it in one room at a time. Read-only before drafts, drafts before actions, real credentials last. That’s where the human in the loop is going.
6. Keep it playful. Run game days, break things on purpose, and share what you learn. Adventure is how teams get good at new things.
7. Close your staging servers. Hindsight was right about that one.

If you’d like company on the adventure, that’s what we do. Our Agentic Strategy and Agentic Engineering teams help you put agents to work, our red teamers test them the way Perplexity tested SPACE, and our AI Access Control Audits make sure every agent holds only the keys you meant to hand it. For the longer, calmer version of this argument, read Sasha’s The Art and Zen of Adopting AI.

And if a letter from 2071 ever lands in your inbox, forward it to us. We’ll read it twice.