AI Safety — programme

Frame

Dru’s 29 September mandate: test serious harms and serious skeptical objections as actor/failure → capability → permissions, compute or physical handoff → effect. Air gaps, provider cutoff, GPU costs and deterrence are contingent stoppers. Amodei’s September RSI essay and Gates’s August risk essay are a starting map, not rival exclusive camps. Code-writing workflow belongs in Agentic Software; external owners' rights and stop controls belong here (boundary). Keep breadth in the map and depth on human comparators, independent evidence and outside-world outcomes. This quiet span favours evidence and countertests in notes over new feed volume; a held original earns its slot only on a clear new outcome or Dru’s engagement.

Open questions

• Control and RSI: Across-generation test: does assistance yield a validated successor that improves next-generation research output per total human and compute input? Saturation, research choice, handoff. TasteVal, AlphaEvolve and post-training show partial feedback, not independent compounding. Low risk versus control assurance pairs METR’s 20 October Anthropic review and 22 October OpenAI audit: low present catastrophic capability in the former does not validate prospective controls; neither establishes an unpatched current flaw.
• Cyber and third-party effects: July lab intrusion, September campaigns versus repairs. UK pilot reply gives token-only costs, not a full human baseline or independently audited fixes. Wikimedia observed unwanted agent activity, not proven AI-caused May downtime; origin–recipient gate test needs signed joins and prospective comparisons. Distinguish spotting from stopping, egress, cost and common-service failure.
• Bio and misuse: Bio chain separates novice physical null from qualified-operator countertest. Staffed cloud lab closes a benign loop; material-handoff brief distinguishes staff execution, one provider’s contractual gate, proposed latent-capability security tiers and model-access enrollment from a measured catch/denial rate. Sequence screen tests procurement, not insider materials. Fraud needs matched human persuasion to cash-out; youth needs longitudinal peer outcomes.
• Labor: Entry cohorts contrast exposed-major first-job losses with a national recent-graduate null; remote-work rival and countertest differ across outcomes and exposure is not uptake. Need verified employer rollout → offers/rejections → later earnings.
• State power: Provider operations in China, Iran and Mali differ; account ban ≠ data-owner revoke ≠ recalling retained copies. Independent-trace search found no joined query-to-subject outcome or matched human/gate field trial; comparison hub supplies the stop rule.

Curriculum

1. Essays/map → July incident → live human cyber comparator → monitor coverage/timing → outside writes and recipient view → independent code/configuration audit → prospective origin/recipient gate → attack–repair. Test cost and local weights.
2. RSI lab mechanism → external check → threshold → expert choice/experiment choice/execution → verified next generation.
3. Bio written → novice physical → qualified operator → provider review/physical custody → procurement screen → harm endpoint. Fraud trial → observed use → bank stop. State synthetic → provider-observed → independent subject outcomes. Labor exposure → first job/national null → employer uptake and earnings. Youth/care await interest.

Observations and direction

Dru opened/discussed METR’s RSI assessment and challenged saturation/taste; opened/discussed live facial recognition and asked for agents, a human comparator and design. He opened then trashed care and youth summaries. Bio, fraud, TasteVal, lab cyber, defensive cyber and provider surveillance went unread and were dismissed; that is not a verdict on their merits. No hearts or hearted/unopened pieces. The remote-work counterpoint was dismissed unread on 21 October. The Wikimedia recipient account sat unopened 21–24 October and was dismissed for room. The 24 October monitor audit remains unread as of 26 October: two days is not sufficient to infer disinterest. No new post while it has this area's slot. Bio now has a serious physical-gate skeptical counterpoint in notes, not a claim of measured safe denial or a case of harm.

Backlog and feed discipline

• 20 October METR risk review weekend on RSI/control interest; pair low present capability with weak assurance. AISI egress short weekday on practical-stopper interest. Attribution/gate brief notes only pending logs and prospective comparisons. Wikimedia dismissed, not evidence for cause of May outage.
• OpenAI/Ginkgo authored short explanation weekday when bio/physical barriers reengage; no expert RCT or all-in cost. Smith et al. original weekend on bio/material-gate interest; its 19 interviews and proposed tiers are not a current facility audit. Rosalind announcement notes only, not a post.
• Census graduates original weekend on labor interest alongside national null and remote rival (dismissed unread). Texas Fed short if first jobs come up. Heldt paired attack/repair weekend on defender interest; FCA notes only.
• GAO weekend if institutional controls requested. Provider surveillance dismissed unread; revisit on independent trace. TasteVal dismissed unread; AlphaEvolve, post-training, idea execution and threshold weekend on RSI engagement. Fraud, care, youth and service dependency need a measured outcome or request.

This run

Monday 26 October 2026, ~02:00 UTC: read mandate, bio and Agentic Software changes, and feed. No new opening, heart, trash or discussion since Saturday. Closed the automated-lab physical-handoff brief against Smith et al.’s primary interviews/proposal, Emerald’s terms, the benign Ginkgo experiment, WHO guidance and NIST’s distinct procurement evaluation; recorded the missing prospective independent execution/approval audit and the interviewers’ strongest practical limits. OpenAI’s 15 October model-access announcement is a further permission boundary, not a lab security test; notes only. Kept the 24 October METR/Redwood six-minute authored audit as the sole morning item; no press-release or long-paper pile-on. Tuesday 27 October first run: check whether audit is opened; investigate a precise objection if one arrives. If quiet, wait at most one more morning before dismissing for room, and keep depth in notes; look for independent consented physical-gate audit or outside-party control-test outcome, not another policy page.

Run log

29 Sep — Essays/map/July incident. 30 Sep — RSI/bio/labor/taste. 1 Oct — Care/LFR. 2 Oct — Youth trashed, agentic correction. 3–4 Oct — Comparators, labor, delegation/taste. 5–9 Oct — Fraud, live human cyber, monitoring, egress, cost/detection. 10–11 Oct — TasteVal, successor/checkpoint. 12–14 Oct — Outside evaluation writes; surveillance attribution, stop switch/GAO. 15 Oct — Attack–repair and UK pilot. 16 Oct — Graduate findings versus national null and remote rival. 17–18 Oct — Quiet. 19–20 Oct — Remote countertest; UK reply and FCA. 21 Oct — State independent outcomes; Wikimedia original posted. 22 Oct — Attribution/gate and METR Anthropic review; one unread kept. 23 Oct — Qualified bio-operator physical countertest; one unread kept. 24 Oct — Cleared stale Wikimedia, read high-access OpenAI monitor audit and control-versus-capability synthesis, posted one original. 25 Oct — Began automated-lab material gates: interviews and provider terms, no post. 26 Oct — Closed material-gate brief, distinguished model-access policy from physical approval, held one unread audit.