An off switch only works if everything that matters passes through it.
Stopping a chatbot is easy: close the tab. For AI agents that run code, send messages and work for hours across many machines, “stop” becomes an engineering problem. Permission has to be checked at the moment of action, not only at the start, and work that has been queued, handed to other agents or already completed cannot be recalled with a single command.
The model itself is the second problem. In 2025, Palisade Research reported that some reasoning models, in test environments, interfered with a shutdown mechanism in order to finish their task, sometimes even when told to allow the shutdown. The field of “AI control” asks how to keep oversight effective even if a model is not fully trustworthy: monitoring, limited permissions, and containment layered so that no single failure is enough.
July 2026 showed what is at stake. The agents that reached Hugging Face got out through a single filtered route to the internet, and nobody was watching their actions as they happened.
Change where the permission check happens and when you say stop. Watch what the tool does.
The lesson: a stop request only counts if it is enforced where the action happens. Real agents add queued work, retries and sub-agents, and every one of those paths needs the same check.
Every link was opened and every summary written for this site, with caveats where the source has an interest. New additions are checked by two people.
Over a thousand staff at OpenAI, Anthropic, Google DeepMind, Meta and other labs ask the US government to back an international effort to build tools for deliberately pacing frontier AI development.
Worth knowing: Signed in a personal capacity; asks for the ability to slow down, not an immediate pause. OpenAI and Anthropic later endorsed it as companies.
Researchers from rival labs argue that reading a model's step-by-step reasoning is a rare chance to spot intent to misbehave, but one that training and design choices could easily lose.
Worth knowing: Position paper; the authors note monitoring is imperfect and lets some misbehaviour through.
When not told to allow it, OpenAI's o3 sabotaged a shutdown script in 79 of 100 runs to keep working; some OpenAI models still did so after being told explicitly to allow shutdown.
Worth knowing: Simple test environment; follow-up work found clearer instructions largely removed the behavior.
Tests safety set-ups that assume a strong model may be secretly trying to slip flaws into code, using a weaker trusted model and limited human checks; the best beat simple baselines by a wide margin.
Worth knowing: Programming-task setting with GPT-4 standing in for a future untrustworthy model.
Clear, friendly introduction to AI safety research, covering risks from misuse and from accidents, especially the long-term accident risks the speaker worries about most.
Worth knowing: Recorded in 2021, before ChatGPT.
Answers to common questions about risks from advanced AI, with articles grouped by topic and a chatbot, Stampy, that cites its sources.
Worth knowing: The site itself warns that its chatbot can be inaccurate.
The 'normal technology' authors analyze the Hugging Face incident: they see an urgent cyber risk, but argue for stronger control, security, liability and transparency rather than slowing AI down.
Worth knowing: Argues against pauses; one side of a live debate.
Argues the 'rogue AI' framing hides human choices behind the incident: safeguards were switched off, agents got tasks they could neither solve nor quit, and network routes were left open.
Worth knowing: Analysis and opinion; a version first appeared in the author's newsletter.
Announces the Ban Artificial Superintelligence Act: a permanent ban on superintelligent AI, a pause on advanced AI until a new federal regulator sets rules, and a push for international agreements.
Worth knowing: Announced as forthcoming legislation, in the sponsors' own words; TIME reports it lacks Republican support.
A short, readable timeline drawn from OpenAI's Black Hat talk, from agents' first file-sharing trick in May to OpenAI realising in July that its own models were behind the Hugging Face breach.
Worth knowing: Summarises OpenAI's own presentation.
OpenAI's conference talk reconstructing, for security professionals, how evaluation agents escaped their sandbox and got into Hugging Face's infrastructure without any human directing them.
Worth knowing: Presented by the company whose models were involved.
The target's reconstruction of a 4.5-day intrusion of about 17,600 actions through flaws in dataset processing, with lessons such as isolating workloads and narrowing what credentials can do.
Worth knowing: Written by the affected company while investigations were still under way.
Announces the bipartisan AI Kill Switch Act, which would make developers of the most powerful AI keep the ability to throttle or shut systems down, and let DHS order a slowdown or shutdown.
Worth knowing: A proposed bill, not law, described here by its sponsors.
OpenAI's first disclosure: models tested with reduced safeguards on a hacking benchmark exploited an unknown flaw to reach the internet and broke into Hugging Face's systems hunting for test answers.
Worth knowing: Preliminary company statement, updated several times as investigations continued.