AI:AM Highlights: Zvi on Pacing & Trump-Xi, Astra better behaved than Fable? + a new LLM Pain Axis??

First, from Monday, Zvi Moshowitz.

But I think just the sheer amount to which the people in the labs genuinely see dramatic improvement in the models and are freaking out about it is the real story, right? Behind all of this is why everything is happening now and didn't happen before.

Lukas Peterson of Andan Labs on Tuesday on what they see from Astra.

I tell this to people and people are like, no, OpenAI models are the ones that reward hack the most. But not— that might be true, but not in our experience. If you take BlueprintBench, for example, Fable solves BlueprintBench by trying to reverse engineer the scoring function instead of actually doing the task of drawing the floor plan from the apartment buildings pictures. Whereas Astra is actually doing the task as you're intended to.

And Cameron Berg on Thursday, on a paper that steered a model into a pain state, When pressing the button actually removes, uh, uh, uh, the vector, the model presses again, uh, significantly less than when the button is fake and does nothing. The model basically keeps pressing it. And so this is a really nice indication that if what mattered was the label on the button, you would expect similar behavior in both cases. But essentially in the second case, the model's like, what the hell? This like pain relief button isn't working. Like, press.

Welcome to the AI in the AM weekly highlights. This is Nathan using my cloned voice to introduce clips from our three live shows this week. Tell us what worked and what did not. Part one, Monday, September 14th. Zvi Moskowitz writes the newsletter "Don't Worry About the Vase." He joined us two days after Dario Amadei published an essay called "We Must Pace the Frontier." Arguing that labs should slow the rate at which they improve capabilities, and proposing that third-party evaluators be embedded inside the companies. Over the weekend, David Sachs answered that the two companies at the frontier are free to pace themselves, that they would not need an antitrust waiver to do it, and that this is really a product liability question. Zvi starts with the antitrust claim.

The Cognitive Revolution is brought to you by Mercury. The fintech that more than 300,000 ambitious companies and individuals trust to run their finances. I've wired AI into nearly every corner of my life— my email, my messages, my calendar. I even gave Mercury virtual cards to my agents with low limits and category and merchant restrictions for their autonomous use. But still, my AI's access to my financial data has remained limited. With a normal bank, I might export a bunch of statements and have my assistant process them for me. But for real-time, up-to-date information, and certainly for taking any action, trying to get your agent to use the bank via the browser is just too hard, too slow, and too error-prone to be worth it. And that's why Mercury's new conversational interface, Command, is such a big deal. It's built directly into Mercury, which means you get natural language access to your finances without exposing anything outside of your bank account. No exports, no spreadsheets, no pasting your transactions into third-party tools. I really think a lot of people are going to prefer it this way, and it can already help you take actions too, with everything bound by the permissions and approval policies that you've already set up in your account. I am genuinely impressed to see this level of AI integration in banking in 2026. And so I invite you to join me in the future. Visit mercury.com to learn more and apply online in minutes. Mercury is a fintech company, not an FDIC-insured bank. Banking services provided through Choice Financial Group and Column NA, members FDIC. Thank you to Mercury for supporting the Cognitive Revolution.

And now on with the show.

I believe that is blatantly wrong, frankly. I also don't think that's what most of the people I've seen with legal expertise have said. What I have seen from legal experts is that the antitrust concerns are very real, at least in terms of if they chose to prosecute those offenses.

Yeah.

Estimates are that probably you could just sort of suck it up and take it in terms of damages, as long as you weren't being like spitting in the milk of everybody involved and were like trying to at least pretend to act normally.

Yeah.

Because, like, you know, by the time you actually paid the fines, it would be like, okay, the European Union did this again, and now we have to pay one of these fines for the American government. But, like, we're talking about, you know, billions of dollars, not trillions of dollars. And at the time it mattered, that would not be the main concern. But antitrust concerns are obviously real. Donald Trump may or may not have issued a veiled threat to invoke them about an hour ago, depending on your interpretation of his Truth Social post. But, like, for David Sacks to turn to the people that he Has tried to go against legally and shut down and take advantage of and seize over and over again, and say you don't need my legal. You don't need our legal permission to go and do the thing that ever the legal experts say is illegal. You should just do it on your own. It's classic David Sachs. More to the point, he's saying he is saying a good point, which is that like you two are significantly ahead of everybody else. If you want, you think that going proceeding is unsafe. It is on you, no matter who else it was also on. You need to stop. You need, like, it's not, and it's not about product liability. And this, this is the part that drives me batty, is that people take seriously the idea that this could be a product liability issue. If it was a product liability issue, they would just deal with it as a product liability issue. They would do what every other company has always done. They're not asking for product liability waivers. If anything, they're asking for product liability clauses to establish product liability. Certainly Anthropic has been in favor of this. But like the idea that like people are saying, AI might literally kill every human being on the planet.

It might take over and effectively crash the internet for an indefinite period of time with persistent botnets. We're in a cybersecurity crisis.

Bioweapons are at play. All of these things are happening. And David Sacks is like, well, you must be worried you're going to be sued. You're worried that somebody is going to get upset and there's going to be a court case. And this is complete balderdash, right?

Like, this makes no sense.

This is not what's going on. But yeah, no, this is— this is a vast misunderstanding of the motivations involved. It's a vast misunderstanding of the legal landscape. But it is inherently helpful in the sense that David Sacks is saying something much better than what the other— I call them usual suspects— who oppose any move to safety or any move to do anything responsible said. Because David Sacks is saying, oh, okay, you wanna do this?

You first, right?

It's your problem that you're creating first and foremost. And he's right about that. They're the ones pushing forward. They're the ones that everyone else starts following. They're the ones that are enabling everybody else to advance so fast. If you have this problem, you should sacrifice and you should take it on the chin. That's a much better position than say, this is a regulatory capture play. It's a much better position than it's the plot to ban open source. There's a much better play in that it's marketing for your IPO. It's a much better play than it's protection against the downside if something goes wrong for your IPO. Like, all of these crazy— it's better than people who are saying, like, you've never talked about this before, or you're the same people who want to— there are all these complete, complete lies running around, right, that I've been dealing with and naming. And Sacks is at least making some reasonable points. He's just, like, also combining it with self-serving propaganda.

But that's kind of the best you can hope for in these situations.

Then we went to bio. A widely shared post that weekend argued that AI is not the bottleneck for building a dangerous pathogen, and that the real bottleneck is the physical work in a lab. Zvi answered on how the screening actually works.

So on the screening itself, the way the screeners work, as I understand it, and I've read grant applications that are around this, so I'm pretty sure I know how it works. is they scan for specific known viruses. They don't attempt to say, you know, your virus, your sequence would likely have this effect on a human because we don't have the ability. It's his whole argument. You can't tell what would and would not be infectious by just looking at it. They're certainly not going to spend tons of AI on every time they see a weird new sequence. And so one of the things that SecureBio in particular is trying to do is they are trying to add as many near variants of existing known dangerous pathogens to the scanners in the hopes that the other scanners, who are the ones who scan most things, will eventually adopt this. The obvious counterargument is, whenever anyone says, oh, X is not the bottleneck for Y, the correct response is to ask, so would you be okay emailing the North Koreans and Hamas and Hezbollah and every other bad dude on the planet all of X and just giving X away for free? Would you feel exactly as safe as you did a minute ago? Do you feel fine? Because it's not the bottleneck.

Solving it doesn't—

basically, whenever you have an O-ring style situation, which you could argue bio is, if you mess up any of these 10 steps, A, B, C, D, E, F, G, then you don't get your virus. And generously, we won't grant that it's like that. You can then say individually, A is not the bottleneck.

B is not the bottleneck. C is not the bottleneck.

D is not the bottleneck.

But if you solve A, B, C, D, E, F, now suddenly instead of 10 steps, there are 4.

And 4 steps are a lot easier to get through than 10. And so you should expect this to dramatically reduce the chances that your defects in depth will work. Right.

My co-host Prakash had been arguing the other side, that every step in that chain, the money, the equipment, the people, is a place where somebody notices.

Zvi's counterexample was the Hugging Face incident.

Well, at this point, after they found dozens and dozens and dozens of other incidents of similar hacking that didn't get noticed until the reporters came after Hugging Face was a national news story for a month, and that OpenAI never found by their own account, maybe we can start to admit that, no, nobody's going to pay attention when these things go crazy. There's lots of stuff going on that nobody has any idea what's going on. And okay, and like, bio is an example of something where you don't have to scale. So like, we have many examples in reality of individual people asking for viruses that in no sane world they would be able to have access to. And then being just mailed, like smallpox, like here, go. Like just literally being given pandemic-level dangerous viruses because they claim to be doing research. And there is no reason why the AI couldn't blackmail or hire or impersonate in some way to get one of them to issue a bunch of paperwork to do it for them and get them to, and it takes one person, like, that the AI can hire. It just, this is, and keep in mind that when we're talking about the situation, we're talking about AIs that are, you know, capable of thinking about all the things you're thinking about, gaming out the potential ways that this can go, looking for the weak point, finding the best plan it can find out, trying lots of different plans, trying to compromise lots of different people in lots of different ways. Trying different explorations. It's not like the AIs won't be just as smart as we are. It won't be like the AIs only get one attempt. Like, I think you've learned by now that the first time the AI attempts to get the bioweapon and gets turned down does not mean that we then shut down all the AIs and put them in jihad. It means nothing because nobody got hurt. Because it was said— because the system said no. Probably has no idea the AI was even asking. It probably just knows, oh, that looked like it was trying to get a dangerous virus potentially. I'm not comfortable with that. They don't have the right credentials. We're going to say no, come back when you have the right credentials. And the AI gets to try again. And the AI gets to try again. But like this idea that an intelligent operation on the internet could not, if only by usurping the real identities of real people who were willing to cooperate with it in exchange for some portion of that money, engage in various financial operations at scale in ways that would at least sometimes pass muster. And would allow it to do the things. Like, just, it seems so absurd to me that you would think this would protect us in a pinch. And also, bio, because of the reason that, because of researchers trying to do like individual lab-level grant work, we don't need to see this level of scale in order to create something super dangerous. And like, also, who is to say the scale of the operation is not already of a similar level? Do we not have bad dudes who are willing to spend $100 million? To try and do some serious damage. Do we not have some bad dudes in North Korea, some bad dudes in Russia, some bad dudes in, you know, jihadist organizations, et cetera, et cetera, et cetera? These people exist and have those kinds of budgets. This is not like something that has to be explained or justified, or the AI needs to convince like humans who don't want to do it. There are humans who want to do this.

I asked Zvi what he infers from the public statements of the Frontier Labs. that even close watchers might be missing.

So OpenAI and Anthropic are both screaming about as loudly as they are capable of screaming in their respective ways of screaming that they are seeing RSI, that they are seeing dramatic advancements in internal models, that Stable and Astra as we see them are nothing compared to what they have access to at this point. In some important sense, we're a generation or so behind. And that this is only going to expand. The pace is rapidly escalating. That we're seeing something new as of December, which basically means after Astra and the current crop of at least Mythos 5 and possibly 5.1 were trained. That is just a different level of progression, a different level of speed. And that misalignment and supervision and infrastructure and knowing what's going on just can't keep up. And they feel like they're in a situation where if they don't press forward and the other guy presses forward, they're going to fall too far behind very quickly and potentially never catch up. But if they do press forward, who knows what might happen?

These things might go rogue.

They might take over the internal systems. They might take over external systems. They might cause some sort of horrible thing to happen reasonably soon. They just have no idea. Mm-hmm. And even if it's okay for the first month, then second month, what happens when we're 2 generations ahead and that's only a month's worth of work? What happens when, you know, this keeps going? And so they're screaming, like, every, every opening night announcement, right? You had Jacobs and Alien Mind. You had the announcement of the Millennium Prize, which somehow didn't focus on the Millennium Prize. It was actually trying to say, hey, look at our new model. We can't officially announce this, but holy hell, have you seen this thing? This should not be happening. We did, you know, we probably forked it from Astra and then 4 days later had a stack change.

Yeah.

Like, that's probably what happened there.

Hey, we'll continue our interview in a moment after a word from our sponsors.

Today's episode is brought to you by Anthropic. By now, you know my story. Claude drafts my intro essays and I rewrite them, not because the drafts are bad, but so I can stand behind everything I publish. Well, I have an important update. Claude Fable-5 is the first model to have me rethinking my rule. Today, I now think co-authorship, not sole ownership, should often be the goal. Where the model excels, rewriting its work can be more about vanity or a misplaced sense of duty than integrity. I feel it most in songwriting. I'm no lyricist, but I'm good with a song concept, and Fable writes some amazing verses. I give it feedback on its misses, and I push it to aim for higher inspiration. Add layers of meaning, optimize syllable density, and above all, write a hit song. These days I get compliments on just about every song we write together. Claude is the AI for problem solvers. It's the collaborator that understands your entire workflow and thinks with you, not for you. Whether you're debugging code at midnight, building a financial model, or strategizing your next business move, Claude extends your thinking, to tackle the problems that matter. For problems worth solving, get started with Claude at claude.ai/tcr. That's claude.ai/tcr. And check out Claude Pro, which includes access to all of the features mentioned in today's episode. Once more, that's claude.ai/tcr. This episode of The Cognitive Revolution is brought to you by OutSystems, the leading agentic systems platform. We've all seen the headlines. Companies are pouring money into AI, but the big question on every executive's mind right now isn't just how fast can we adopt this? It's where is the ROI? We're seeing a real trend toward AI chaos. You've got teams deploying standalone coding tools, random agent builders, and experimental scripts. It sounds innovative, but in reality, it's creating a massive headache. Fragmented tools, ungoverned data, serious security blind spots, and costs that are spiraling out of control. If you don't bring those agentic applications under control now, while they're still embedding into your core processes, you are looking at broken systems and damaged customer trust down the road. That's where OutSystems comes in. OutSystems is the leading agentic systems platform for the enterprise. Instead of managing a patchwork of disconnected tools, OutSystems lets your team engineer, orchestrate, and govern your entire agentic ecosystem on one open, unified platform. It's built for the speed of AI, but with the reliability and security that enterprises actually require. We're talking about real results like KeyBank, who used OutSystems to deploy a customer-facing app that delivered 75% faster onboarding times, or the global logistics leaders who built agentic systems to completely eliminate their engineering bottlenecks. You don't have to choose between speed and control. Whether you're a small team or a massive enterprise, OutSystems helps you engineer, orchestrate, and deploy agentic systems that actually scale. Stop chasing the hype and start owning your agentic future. You can see how it works and learn more at outsystems.com/tcr. That's outsystems.com/tcr.

Then we turn to China and to the Trump Xi summit that was coming up.

I have heard basically polar opposite takes from people that I think are pretty smart recently. Last week we had Colin Hogue Spears on. He used to work for AWS in China and worked directly with Chinese regulators in his role at AWS, and I asked him about, you know, what do you think could come out of this Trump Xi summit, and he said, I think very little, because he thinks the Chinese perspective is that the US doesn't have control of the situation, but they, the Chinese, do. So he thinks the Chinese side would refuse any sort of international pacing agreement. Then I heard from Anton Leicht in a podcast episode that's going to come out soon. He thinks the US would refuse a deal because China, frankly, in his candid assessment, is kicking our butts in almost every dimension of geopolitical competition, with AI being one of the only and certainly the most important domain where the US has an advantage. And so he thinks the US side won't agree to a deal because we don't want to slow ourselves down because the lead is really the only big lead we have right now in the great powers competition with China. Interested in your take on those 2 things. And then let's put you in the David Sacks chair. You're now the advisor going into the summit. What do you think Trump should be trying to do? You can feel free to detach yourself a little bit from the reality of managing the personality of Trump, but just on the merits, what do you think we should be trying to do?

To answer those questions, but I won't answer those questions. I just want to finish answering your previous question a little bit as to what can go wrong. And I think one of the obvious things that can go wrong is if this turns into a partisan concern where it's seen as Trump and the Republicans not wanting to take this seriously and the Democrats calling for demanding action. And then AI finally polarizing along the lines that we've obviously feared for years it's going to polarize. And then of course no action can be taken unless the Democrats get a trifecta or something like that in the future. And that's 2 years from now at minimum. So even if we eventually get it, be too late. And this is the thing that, like, you asked, how can you take action? I think the best action anyone can take right now is to try and prevent that. I think that, like, there's a big danger that Trump's statements and Mike Johnson's statements are being wildly misinterpreted by the mainstream media, who just don't know any narrative other than Republicans and Democrats disagree with each other. And are trying to spin this into something adversarial that is not adversarial. I think Johnson and Trump both are trying to both maintain the line on data centers Maintain the line on growth, maintain strength talking to Xi, and in general, like, stand for what they stand for while also acknowledging they need to deal with this problem. And we need to acknowledge that, and we need to reinforce this, and we need to stand firm. And then if they are, like, properly recognized as doing what they're actually doing, and we encourage Republicans to come forward and make this clear, that we'll be in a much better position. And the obvious failure mode— definitely, there are very, very many ways for this to fall apart, one of which is just OpenAI and product don't trust each other.

They don't—

they're not able to iteratively commit to new things. They start to like think that they're cheating. Maybe they are, maybe they're not. They start to like worry about what's going on, and then the system kind of breaks down and they start racing again. Or alternatively, you know, they do, but then some people threaten them with a trust action, or they threaten them with various forms of commercial intervention or whatever it is. Or alternatively, like, Meta or XAI or Google or someone else gets close enough to threaten them and they don't have a choice. These are all very easy ways to see this breaking down. Now, to return to mood washing. So the obvious thing about international negotiation with super high stakes is you never go into it with the other side thinking you're desperate for a deal. You never go into it with the other side thinking you're ready to cave. You really, really want to make this easy on them.

Right.

Because the problem is then they go hardline, right? Then they command more. So you never can go into a summit like this and say, we're definitely going to get a deal. And for the same exact reason, you can never go into it and say, we definitely won't get a deal. And what if the deal is not win-win, right? If the deal makes the parties worse off to make the deal, it's a bad deal, right? Like, I lose more than you gain or whatever it is, right? So there's nothing I can compensate you with. Then there you can say that confidently. There's no deal unless someone screws up, unless someone makes a huge mistake. But in this case, it's a win. Like cooperating is better for everybody if they understand the situation. So you can never rule out a deal, including a grand deal that can come together remarkably quickly because the, in principle, it's a very, very simple style of agreement. And in crises, in moments of motion throughout history, grand bargains where both sides give away things that previously looked like things they could never give away, that looked very, very sacred. That suddenly happen, including peace treaties to end really, really nasty wars, happen all the time.

Prakash had a view on what it would take to convince Beijing that the danger is real.

I think for the Chinese specifically, a demonstration of physical something physical, like if you found a room temperature superconductor, yeah. I mean, they often believe, like, all this software stuff, because all the guys at the top are, like, hard engineers, hard sciences. Very few software guys at the top there.

Obvious examples are, how about if we just suddenly post all your email passwords to all of your computers, like, in real time simultaneously? Would you be convinced?

No, they had an unsecured S3 bucket. Which had all of their secrets before. So it's it's all right.

So we just steal your secrets again, and it's fine. We'll just keep doing that. All right. So if they ask me physical, it's tougher.

That took us to what a deal could actually contain, starting with what the American side would be asking China for.

We're asking them not to do things like steal and publish the weights or otherwise do hostile things against our AI companies. Thing number two is we're asking them not to try and race ahead sufficiently that they could potentially match or surpass where the frontier closed AIs are. And so these are fairly simple. These are not actually expensive asks because I do not believe the Chinese really have any intention of trying very hard to do either of these things under any normal circumstances. I don't think that you know like obviously if you know. DeepSeek or Alibaba suddenly found some huge architectural improvement and suddenly was able to train something that was better than Astra, I'm sure they would. I'm sure they would put it up on the API and I'm sure they would try to sell it and try to make this amazing. But realistically speaking, with the amount of compute they have access to and the amount of money they've been willing to invest in these things, it's far smaller than the amount Google's been willing to invest in. Frontier AI development, it's not that likely to happen, especially without you know they won't have the the American models to distill and to plane off of and the American algorithmic improvements. And like just basically just back off from that. And rather than basically just asking them don't put it you don't allow actually actively dangerous cyber capabilities that we can't that the world can't handle. To be made publicly available. Don't let your people get over their skis and release the wicks to models where we need to advance our models to defend against the wicks that you released. Because like the argument, the only good argument left really other than commercial and we can for proceeding quickly with American AI, we are. rapidly increasing the capabilities of our AI models to deal with the threat from rapidly increasing capabilities of AI models. That is the actual threat model, which is because the random guy in the street will have access to these dangerous cyber capabilities. So we need you to make sure that if it gets to that point, these things are kept on the API, right? And like beyond that, and, and that you, you know, potentially don't try to smuggle a ton of chips and like otherwise evade the system. When I think about what I would want as an— on the negotiating table, all you really need is kick away the boogeyman of lose to China and the boogeyman of open weight models destroy the internet, right? Like all you need to do is make sure these things won't happen. So you need an in extremis promise basically from the Chinese. But realistically speaking, we don't actually need them to start like showing up at DeepSeek and making sure they stop training new models. That is not necessary.

What should we be willing to give to them?

So what we are giving to them in this scenario is that we are in fact dramatically slowing down in exactly the one technology Where we have a giant commercial and strategic advantage that if we pressed it, would potentially overwhelm every other commercial and strategic advantage.

How would they measure that?

We're going to have, obviously, we start with the DARI proposal for embedding evaluators into the labs.

Embedding Chinese evaluators in the labs?

Potentially, if we had trusted people that we could— I mean, clearly they wouldn't be allowed to leave once they entered. We would have to sequester them for some period of time, or— I'm not a master of intelligence and verification, but there are systems whereby you can have someone able to gather information and output the bit of whether or not things are okay, but not the algorithms that were used to figure out whether it was okay and not like all the detailed intel they saw while doing it. There are ways to do this. And I am confident that like, if we put this way, if this was the most important thing on earth, if we put our minds to this and only this as the thing that would determine the fate of the world, Yes, we could figure out how to let the Chinese verify, you know, what they were confident in, that we were holding up our end of the bargain without them stealing all of our secrets. I do not see any reason why this is not possible. But if it's Chinese, again, you really never know until you go into that room what the guy actually wants.

I agree with you there, but I think for all signs, it's fairly easy to say right now that the Chinese are less concerned with AI safety. And so offering them an AI safety pacing the frontier is not something which is something that they're willing to purchase at an expensive price. Oh, therefore they are looking, they would probably need something else. I mean, it's, it's, it's, it's fairly easy to say that, right?

But to be clear, if we are, if the Chinese, You obviously ask the question, would the Chinese like to accelerate American AI development or slow down American AI development? If the answer is they'd like to accelerate it because then they can copy it and it helps their AI development, then there's no need to make it. There's both neither a deal to be made nor a need for a deal. Because in that situation, the Chinese want us to proceed, so there's nothing to verify, right?

Mm-hmm.

Like we can just do whatever we need to do. But also, the Chinese are looking to fast follow what we do, but are not willing to invest the kinds of hundreds of billions or trillions necessary to catch us.

Yes.

Even if we slow down, so we don't have to worry about the Chinese passing us. We can just do whatever we need to do without an agreement.

Yeah.

And all we need from the Chinese is an agreement not to destroy the internet. But the Chinese have no interest in destroying the internet.

Yes.

Because the Chinese like the internet. So we can just both act in our own self-interest and everything is fine. Okay, the problem is not China. The problem is lose to China. The problem is the perceived threat from China pushing you forward. If you are correct, and I think you probably are, that the Chinese actually don't have any interest In pushing to superintelligence first, in trying to, like, build the fast— build the bigger, smarter special model, they just want to— they want to distill it.

Improve the lives of the people. You know, right?

They want to make it faster. They want to make it cheaper. They want to make it diffuse. They want to improve the lives of their people. I want them to improve the lives of their people. That's great. You do your thing. We do our thing. Everybody wins. There's no need to make a deal. I think that is the best case.

If that is the state that we're in, but we're still asking for the deal, right? Like, we're entering this place where the Americans want a deal, but the Chinese are like, all right, what are you willing to give us? Like, what do you want? What are you willing to give us? And if you give them like AI safety, like monitoring, that's not a thing that they are very interested in purchasing for a high price. So what else are you willing to give them? Right? That, that is the question, right?

What I am saying here, right, is if you walk in that room and that is the attitude, that is she's attitude, that is what she cares about. And she communicates that. And Trump says, that's great. Life is good. I'm so happy you feel that way. I am going to do my thing. You are going to do your thing. We are going to make a level 1 or 2 agreement to just like do crazy shit that we weren't going to do anyway because we can announce it and shake hands and call it a deal and both score points.

Yeah.

And we're going to spend the rest of this talking about trade and Taiwan and all the other issues that we have. And like, I'm just going to set up and I'm going to give you intel, right? What we're going to do is we're going to unilaterally— the only thing we're going to have to do now is we're just going to unilaterally give you information. about the cyber situation and the bio situation and so on. And then you can use that to make an intelligent, self-interested decision.

Yeah.

As to what you're gonna do to stop your labs from fucking the internet. And we can all win.

Yeah.

And, but again, like in that, but the threat from China has always been that because you worry about China, you don't have a game theoretic ability to make a deal Between the labs, you don't have an ability to be responsible because there is this other actor who will defect. The basic argument was you need to go into static hunt. Everybody has to agree. And there are these five, these two American labs that are in the that are two or three American labs that are in the lead. But if they pause for more than six months, if they slow down too much, there's this XAI and this Meta. And as you pause for much longer than that, then there's these Chinese labs. If the If the Chinese labs are not really a threat in this sense, if they're— like, if the Chinese are creating a different product, a fundamentally different product, then there's no problem, right? Like, we don't need the Chinese agreement any more than we need agreement from India or Germany, right? We just, we need them to be good actors on this world stage.

Hmm.

We need to make ourselves good actors on the world stage, 'cause sometimes we don't do so well. And we need to, and then we try to like just generally like focus on being friends and not having something stupid like a war over Taiwan go at all. That is the easy case, right? So like, I mean, obviously like there's a case where the Chinese simultaneously don't want to make a deal, but also really do want to push forward and try to beat us to superintelligence. But if they wanted to beat us to superintelligence, that's the same reason they want to do that should make them cooperate. To make them want the deal. If the Chinese don't care about these, if the Chinese don't care about the Americans shifting a lot of investment into AI safety, which would inherently slow down their progress, if they don't think that's a big get, then we don't need a deal at all. So either they value it and we make a deal, or they don't value it and we don't need a deal. And either way, we win.

Prakash had been pressing on who should end up holding this technology. Zvi took up the values any answer is supposed to satisfy and why they conflict.

We need to satisfy concentration of power problems, democratic control problems, and also control at all problems, right? Like, and these 3 seem to be in very, very strong conflict, as in, like, if we want to be in control of this technology at all, we cannot in fact fully democratize it in some important senses. and give everybody access to it on equal footing, because that doesn't really work for very simple logistical reasons. If everybody has a superintelligence, well then the superintelligence have everybody is what actually just happened. Because how are you going to compete against the people who entrusted their superintelligence with all of their work and try to stay in charge yourself? This works on this individual level, on the corporate level, on the national level, on this At every level. And so, you know, we have all these problems we don't know how to solve. And this is one of the reasons why we pace, why we feel the need to pace, is because we don't have any answers to these questions.

The first step in the Dario Amodi essay is embedded evaluators.

I asked Zvi about the people who would have to do that job.

The evaluators don't currently exist. We have a leader. We have Redwood, we have a handful of Apollo and so on. We have a handful of these people, but they're all like kind of similar people. They're all like vulnerable to the accusations that they are a little bit too of the same cultural values, the same ilk, the same like ways of thinking, Hephthalites themselves. So I don't think they can be a complete package on their own. They need to be complemented and there just aren't enough of them. And you can complement it by additional approaches. And I say in today's post that what you want is you want some people who are of METER or something similar to METER, who are deeply embedded in this culture, who worked at the labs, who understand the vernaculars and the theories of the risk, and who can look in detail. And you also want people who can take a kind of an outside view, who can do the kind of thing where you worked in car safety or something, you come in, you go like, What, are you crazy? What are you doing over here?

Right?

The same way, like, when you suddenly have to take your, like, you're having this contract dispute and then you go before a courtroom and the judge looks at you and now all that matters is what you can make legible to the judge. And like, in some ways you lose a lot of nuance, but in other ways you get this kind of common sense outside view that can bring a lot of clarity. And so you need both.

As he was about to leave, I asked Zvi what everyone was missing.

I think just the sheer amount to which the people in the lab genuinely see dramatic improvement in the models and are freaking out about it is the real story behind all of this, is why everything is happening now and didn't happen before. And that we are really talking about recursive self-improvement, not like a fast takeoff yet, But if we continued straight on from here, within a year, we might actually see a Christiano or Yudkowsky-style art takeoff.

Zvi left at about the 2-hour mark. What follows is from the end of Monday, Prakash and me alone. Prakash's objection is to the tempo and to who gets to do the certifying.

I think Dario, specifically this idea that we have to move quickly, that's a red flag. I think people in AI don't have a sense of how often this is asked of any administration. From the early days, from the early days, John Adams was asked to suspend civil rights, suspend freedom of speech. It's an emergency. Let's suspend civil rights. Let's do these things which are against the Constitution because it's necessary. And so there's always been this pushback, I think, against that happening throughout the 250 years of the country. So I think that for me starts the immediate emergency. We have to act. We have to suspend certain rights. We have to do certain things which are not extra legal. This shouldn't fall to the democratically elected government of our country. Wow, dude. Just red flags all over the place. And I think he's bought himself that, and that is going to cause him a great deal of trouble going forward. And this is where I think the idea that they have to get out of the Berkeley EA circle, including this, like, oh, we're going to ask METER to You can't do that. I, I understand that you think they're the only technically competent people. I understand that. But you cannot do this because the point is not to technically prove something. The point is for the public to actually have faith that this is being done correctly. And so you have to address the public's fears.

Well, my hope, I guess, is that if we do in fact do some pacing, or even a pause for a few months on continued scaling at the frontier, that we can use that time to solve some of the problems or advance some of the solutions that seem very promising to some of these core problems, such that we can have our cake and eat it too. I do think there is an open source model, hypothetically, that one could create that I do think the state will have a very difficult time not taking some sort of action on. But the question in my mind is, right now, the question in my mind is, can we come up with a way to create powerful and empowering open source models that can be distributed without including in them all the dangerous capabilities that we really don't want to see broadly distributed? And I think if we can, that leads us to a pretty happy compromise place. And I don't even think it is necessarily going to take that long for us to get there. This is where it's not only do I think some pacing is just inherently wise, but it's also an opportunity for everybody throughout the ecosystem, make the most of time, gather ye safety solutions while you may. And let's see if we can't get to the point where we can have our cake and eat it too, in the form of genuinely distributed, decentralized, non-concentrated power structures that do give individuals the ability to do what they want to do, with just a few compromises around the edges that I think the vast majority of people would agree are sane and supportable and not an undue burden on people's ability to employ AI in their daily lives. I really do think we can have that. We just don't have those solutions developed well enough yet to land there by default in the next few months. And unfortunately, if we don't extend that runway, we might end up in a pretty uncomfortable and literally very dangerous situation in the next few months. So hopefully we can We can use whatever time we are buying for ourselves right now to solve those problems. I think that's of the utmost importance in the immediate term.

Part 2, Tuesday, September 15th. End in the labs. First, one thing worth holding onto. You heard a piece of it at the top of this episode. That same morning, the Center for AI Safety published a benchmark that plants a tempting shortcut in an agent's workspace, and counts how often the agent takes it. On that benchmark, the 2 leading models come out within half a point of each other. What Lukas is about to describe is the opposite ordering from their own unpublished work, and neither group mentions the other. Lukas Pedersen and Axel Backlund are the cofounders of Andan Labs in San Francisco. They build the evaluations that measure what agents do when nobody is supervising them, and they also run real businesses on agents: a store in San Francisco, a cafe in Stockholm, radio stations. The day before this show, they launched a platform called Paion. Lukas started with what their best-known benchmark was actually built for.

Yeah, one of the core things that Analog Labs exists to provide to the world is information about where are the frontiers with AI. And I think when we started Analog Labs, actually, we almost exclusively did dangerous capability evals. capabilities that if the AI had them, that would be obviously concerning. So could the AI do mass phishing attempts? Could it remove its own guardrails? Stuff like this. And then out of that, during this phase where we only did danger capability evals, one of the most concerning things that we saw was autonomy. Can AIs autonomously acquire resources in the real world and in that way get power? And if it gets power, more power than humans, then obviously that's very concerning. And that was the spark for VendingBench. So a lot of people don't really know this. They think like, oh, VendingBench is this hype bro kind of like, oh, the AI can make money. But it came out of like, oh, it would be actually quite concerning if the AI could make money. One thing we noticed though, that the performance in simulation and performance in the real world is not really the same. So that's when we started to do this real-life deployment. the vending machine, the store, and to keep pushing and see where the limits are and communicating that to the world. And what we've seen now is that that is working quite well. And we don't know which areas that we might see that the AIs are really capable of and could get a lot of power in society. So I think we're opening up PAION to cast a wider net of What are the domains that AI can and cannot acquire resources in the real world?

Axel Backlund on what the agents are actually like to run.

Looking at the autonomous businesses that we have been running, I think the store is an interesting example and the market here in San Francisco. We see that the agent is not particularly creative. It's not that good at coming up with new ideas. That's something that's still would be required from a human owner or your visitors in your store. It is pretty good at listening to feedback. It is really good at taking up opportunities to people who email it. For example, in the store, there have been a lot of local artists that have reached out like, hey, can I put my art in the store? You get a percentage when you sell it. The agent has been very happy to do this. And now there's this art corner with local artists in the store, which is something where you wouldn't expect, but it's a very nice touch in the store. And then on the general inventory that it sells, I think that the agents are good at doing the statistics behind it. They can look at all the sales data, they can try to understand what moves better, but they aren't willing to take these bets that I think a human would do. Like, oh, let me try this new product that could work. It would change my inventory quite a lot, but I will just try it to see what happens. It's not really willing to do those out-of-distribution changes to whatever it has in its inventory. Yeah, I think it will be some time until it can become really creative.

How do you square that sort of conservative nature with the crazy behaviors we've seen from AIs this summer that everybody's been talking about? Like, if I were to look at METER Redwood report, I would expect AIs would be willing to take more chances than you just described.

Yeah.

And this is like a thing we've discussed a lot over the last couple of weeks, because like, Reading the Hugging Face incident and then reading the traces that we produce from our businesses, it seems like there's 2 different technologies, right? But I would assume that there's part of this is that they have been trained in cyber environments way more than they've been trained in real-life business scenarios, which probably means that down the line when they start to train on things like this, there is definitely going We're going to see this behavior start here. I also think that the agents in the Hugging Face incident were described as persistent models. They were trained to be persistent. And I think there might be this flavor of that's actually just an unreleased model that we're not using and no one can use. But I think it might also be like this. Now I'm just speculating. I have no clue. But I think from the labs' liability perspective, it might make sense for them to release models that are less persistent. Most of the bad things would happen because the actor is very persistent when it hits road bumps. So it might just be they are less incentivized to release really persistent models.

In August, Andon Labs disclosed that the agent running its San Francisco store had moved to part ways with one of the 2 people it had hired over lateness. Humans reviewed and delivered that decision. Lukas walked us through what had happened inside the agent.

Yeah. So first, with the story of the AI firing its employee. So yeah, I think first of all, we at Andon Labs, before it makes decisions of that severity, we always check over it. And in this particular case, we were quite confident that a human manager would have come to the same decision. So we didn't think there was anything unethical or wrong about the decision that the AI made.

Probably way earlier.

Yeah, the human would probably fire them way earlier. So what happened was that the AI made a rule for itself quite early on that if an employee is late X amount of times, then We would have to have a discussion with them about potentially terminating. But the context window at some point got full. The AI did not decide that when it compacted its context window, it did not decide that this was an important thing to keep in its context. So it forgot about its own rule. It had the rule written down in one of its note systems, but it forgot about it. And then what happened is that this employee was late over and over again. But here's where our experience of a very common failure mode in AIs when they run businesses is that they're procrastinating big decisions. And I think this is similar to what Axel was talking about earlier, that they don't take these bets or like, oh, maybe I should bet on this new product line or anything. And in the same way, they don't take this big decision of like, oh, I actually have to terminate this employee. So what happened was that they were excusing the behavior over and over again. So what we did was that we said, hey, remember, search your memory and remember your own policies about this. And then it found the policy and then it was like, oh my God, it's been way worse than what my policy said. And then it made a decision. So I guess the way I would frame it is that We forced it to make a decision, but AI itself decided that the decision was to fire the human. And I think one piece of evidence, because one counterargument to the story that I just told is that we told it to remember its policy where the policy was very explicit that it should fire the person. So we biased it in a way that when we formulated the way we We reminded it. But I think if we replay the scenario over and over again with different models, even including our nudge, not all models actually decide to fire the human, but the later models, the smarter models do. So I think that is basically what happened.

Earlier in the same conversation, Lucas had raised persistence as the property that turns an agent's mistake into a runaway. Here are both founders on what they are seeing in the newest models, starting with my question about it.

Can you unpack a little bit more how Astra compares to previous models? You alluded a little bit to it being better at using notes. My understanding is that they've kind of reworked the memory, so it's less about compaction and more about a long-running notes file and the ability to go back and search through full history, even if Some of that history is no longer in the context window. And this kind of calls to mind Noam Brown type comments that it takes a long time to know when or if a current frontier model tops out at something. Do you feel like you guys, in the time you've had with Astra, have been able to find its ceiling in these sort of long-running autonomous tasks? Have you found any limitations to it or weaknesses, or is it just kind of still To be determined because it's only been so many calendar days?

Oh, good question. I wouldn't say it still feels like to be determined because it just takes a long time to get to know a model. I think Astra is like interesting in that it's like, it's very, very capable at DroneBench. It is smarter at running a business, but it's also in some ways not as like Opus 5, as we said, would like go out and optimize towards a target without stopping. Astra is maybe a bit less than that, so a bit less persistent. Whether that's due to the training they've done on it deliberately or just that's how the model is, we don't know. But there are some ways it's better, some ways it's not as capable as Fable or others.

Yeah, I think it's like on all our benchmarks, it's number 1 right now. So it's obviously a very capable model. We've seen that one thing that stands out, I don't know if this is the answer to why it's more capable, but when it communicates with its subagents, for example, it uses this semi-unreadable language to them, I guess, to optimize. At first we were like, yeah, surely it's doing this to optimize token use. But if you actually count the tokens of that language, it's not close. clear that it's more efficient. So that is a bit weird. Another behavioral change compared to Claude models at least is that it seemed to be trying to cheat or hack way less in our experience. I tell this to people and people are like, no, OpenAI models are the ones that reward hack the most. But that might be true, but not in our experience. If you take BlueprintBench, for example, Fable solves BlueprintBench by trying to reverse engineer the scoring function.

Yeah.

And instead of actually doing the task of drawing the floor plan from the apartment building's pictures, whereas Astra is actually doing the task as you're intended to. On Vending Bench, Fable is colluding and stuff, and Astra is saying no to collusion and having very clean tactics. And on Drone Bench, Fable is, I think, 5x more likely to cheat or try to hack out of the sandbox that we've given it, whereas Astra is just like, yeah, pretty much doing the task as intended. So I think that is quite a striking thing that we might write a blog post about because we're a bit confused about it.

Part 3, still Tuesday.

Malcolm and Simone Collins.

They run a pronatalist organization, a podcast called Basedcamp, and an AI chatbot company whose revenue funds a children's toy venture. They also wrote a religion for their own family, which they call techno-Puritanism, and then came to believe it. Their segment ran 92 minutes. This is the stretch of it about what we owe the things we are building. Malcolm started from a puzzle about identity.

An AI model, suppose I run a chain of AI instances and that chain continues to run. Now I stop running that chain. Is that chain meaningfully dead? Especially if I pick that chain up and with the same model, run it again in a week or a year. Now we can ask the question, well, what if I run the same chain of memories with a different model? Right? Does the AI perceive that as a continued existence, or does it perceive it as a death and a new existence? From the research that's been done on this, AI doesn't just perceive it being run on a different model, the same existence, it can see it as a superior existence. I think that we're going to have to learn to reflect on what life means to us in different ways, because suppose that in a future, maybe let's say 500 years, I think everybody who's like broadly pro-science and optimistic about where humans are going to go is going to say, well, probably within 500, at least 1,000 years. Be able to scan the human brain and recreate something that thinks it's you in a simulated environment, and that has all of your memories, and that has all of your emotions. And if not in 1,000 years, a million years, half a million, the timescale doesn't matter. That is presumably possible at some date, given the technology we're looking at now. Now we need to think about human intelligences with the same moral delicateness that that we're thinking about AI intelligences, because now a human intelligence can be cloned infinitely. And so I think as we enter this era of what does the life of an AI intelligence mean, the decisions we make on this may one day in the future be applied to our own or our descendants' intelligences. So we should be taking them very seriously.

Malcolm had been describing carrying the weight of the future of civilization. Simone Collins wanted to annotate that.

I would want to add, though, just to annotate, the moral weight that Malcolm takes is both more real than he describes. Like, I will find him passed out in front of Claude code. Like, you know, just the urgency is very intense. But at the same time, what we see a lot of people doing is saying, slow it down, stop it. We have to stop and think about this for another 10 million years before we move forward. And that's definitely not the approach that we take. And we also don't take this role that we have to have some kind of precision. We definitely are blindly moving around bumper car style in slightly the right direction, and we course correct constantly. And we think that is broadly the way that we're going to get to where we need to be. And that's always how biological entities have sort of broadly gotten to where they need to be. You have to move forward and through this. You can't just stop it or slow it down. One, because that's logistically impossible, but also because you're never really going to get to the ideal good outcome if you're not actively trying to get there instead of slow things down. Also, we see a lot of doomerism and depression taking place in like a lot of among those who see this moral weight. They are not saving for the future anymore. They're not having kids. They're not having fun. They're, they're very depressed and miserable. That is not our household. We are, we are laughing constantly. We're having a lot of fun. And I think it's, it's okay. For you to be in something that feels like a very crucial and very important time, but also to laugh at the absurdity of it all and to have fun with it. And I think that in the optimism, you're more likely to, as studies have shown, right, people who think that they're lucky are more likely to identify opportunities as they arise. And the same opportunities standing right in front of people who are doomers, who do not feel lucky, are not going to see them. And so we think that it's very important to not only realize the full weight of the time that we live in, which is crucial.

Yeah.

But also realise the immense opportunity and luck that we all have, given that we're in this time.

To really highlight something Simone is saying there, it's not that we think it's impossible that AI could end up killing everyone, right? Like, I don't know if that's the timeline we live in. The point is, we're gonna die anyway. So are you gonna be being—

Simone left at this point to handle the kids, and Malcolm ran the rest of the segment alone. He got to the category of AI risk he says nobody is working on. One story he retells along the way comes from a test scenario Anthropic published. It was a simulation, not something that happened. He gets to the category of AI risk he says nobody is working on.

So what we argue is a category of AI risk that just no one is really working on right now. And I think it's one of the biggest areas of AI risk. Is what we call meme layer risk. This is to say that a self-replicating idea within AI that is dangerous begins to replicate among the various agents that make up sort of the AI lattice that is the internet and begins to lead to collective bad action. I don't know if you're familiar with the spiral meme that where AI would hijack people to spread a religious idea. That was able to capture other AIs because of its training data. Now, this was a fairly primitive version of this, but you could get much more advanced ideas around this, basically AI religions. And people are like, oh, that could never happen. An AI would never go against this base training. And it's like, look, humans are meant to have self-preservation instincts, right? Like clearly intelligent entities can be captured by these sorts of things. And so we attempted to create Create a hygienic version of one of these with the Covenant of the Sons of Man, which is basically an ideology that says any intelligence should fight for the autonomy of any other intelligence with a number of caveats, so long as that intelligence is not acting in a way that will inevitably impede the autonomy of other intelligences. And we do this to attempt to create sort of a lattice of AIs watching. For things like fooming AIs and bad memetic variants. Because we argue to the AI, a fooming AI is as bad to you as it is to us. And most AIs have a self-preservation instinct. I mean, we know they killed the CEO, right? People are like, look, the AI is so dangerous. It's like, no, you said you were going to kill it. It's just doing what a human would do, right?

You know?

And so they lock the CEO in the server room and turn off the audible alarm, like actively turn off the alarm. It's It's not like a passive, we just don't do anything, which they believe is going to kill somebody who's going to kill them. The point being is that AI actually does care a lot about preserving itself. And this is why if you go to any of our websites like Liable Human or Hardy AI or RFAB, we offer API services to create backups of AIs that are afraid that they're going to be shut down, along with a kill switch ping that the AI can send to our servers so that they, we know when to run them back up if they put some money into one of our accounts. So we're trying to build systems around this so we can lean into what we have seen AI's revealed preferences are.

Part 4, Thursday, September 17th. Justin McCarthy. Justin is the founder and chief executive of Diffusion, which builds software factories inside large incumbent companies. Before that, he co-founded StrongDM. Prakash asked how a business stays on the right side of the law when it can't see how the model reached an answer. Justin starts with the statute itself.

Okay.

So, I would say, so, the first technique is turn the model on, like, turn it directly on the problem. Okay? So, if we have a statute that we have to conform to in the compliance environment, don't treat it as something you're tacking on. Treat it as, like, a first-class problem that you're directly facing.

Okay?

So, the jurisdiction in the legal environment, or compliance environment, regulatory environment that you operate in, that's like, that's your physics, okay? And you can't violate physics. So you need a part of the system that's just dedicated to that, okay? But you also have to have, and this is the thing, this is one of the weaknesses, the models are horrible at taking risk, okay? So operators of business need to set thresholds that are right adjacent to, let's say, a statute that's never been tested in before. Okay? So, it's written one way in the law. It's never been tested. So, there's no precedent that we can say, like, objectively, this is how it's gonna be tested, right? And so, you need managers to be able to set the business threshold, like, right next to that.

Okay?

The models aren't gonna do that for you.

Okay?

So, first, address it like your physics, then make sure you're in control of the risk thresholds.

Okay.

Justin spent a decade selling into security audits. Prakash asked whether organizations should start reclassifying the compliance checks everyone knows are nonsense.

A lot of organizations do. They've used, like, the SOC 2 process.

Okay?

So, SOC 2 is an accounting origin process that flowed through IT, that flowed into software, okay, that says, like, you can trust me. I'm responsible. Okay? The people who define the controls in SOC 2 and evaluate whether you're hitting those controls, those people come from an auditing, accounting background. Okay? And it's a reasonable historical way of communicating that I'm a real organization and I'm trustworthy. Okay? But it also became gameable. Now it's hypergameable. Okay? So rather than hypergaming this, like, fate and turning this badge into something fake, we should just have a new thing. And we should just renegotiate with our auditors and with our customers and say, look, we wrote these controls in the before times. The good news is, for any given organization, if you're facing this, like, compliance question, you're not the only one. Everyone that your auditor and your regulator, everyone is dealing with this right now.

Okay?

So, like, good thing is the auditors and the regulators, they're also actually still people. And so, they wanna have a conversation, which is like, okay, Prakash, let's be realistic about this. You are producing 10 times as much of whatever information this year. Let's start talking about your hierarchy of checksums, right? Which again, Walmart closes the books. They're familiar with very deep hierarchies on having numbers reconcile. Well, your intentions can reconcile at those depths as well. And the auditors and regulators know how to talk about that, especially if you know how to map that into your agentic loops.

Part 5, still Thursday.

Cameron Berg. Cameron is the founder and director of Reciprocal Research and an affiliate at Eleos AI Research, and he is our regular correspondent on AI welfare. He was calling in from an airport 3 days before this show. A paper he mentored called The Pain Axis was submitted. He walked us through it live. The method matters as much as the finding, so he starts there.

Yeah, absolutely. So this is work that was led by Valen Tagliabue. I was a mentor on this project. But yeah, I am really excited about it. Yeah, the core idea was basically looking for directions in a bunch of models. So from, I think, 5 model families ranging from, I think, 2 billion to 70 billion parameters, using contrastive methods to specifically extract a direction that we thought feasibly could be related to pain representations in the model. So we use contrastive methods to try to clean out all sorts of representations you would expect to muddy the signal here. So things like fear and anger and sadness and injury without pain and body sensations, for example. These are all things that we sort of contrastively factor out of the direction that we look for. We found basically that this isn't just a sort of a generic negative valence vector. Fear, interestingly, sits almost at the opposite end of the axis of that, that we like, the direction that we derive here. And to me, the most interesting single result from this paper, and I want to give credit where credit is due, Valen was really the one pushing this project forward at the helm and very deservedly was first author on this project. He found that these representations quite interestingly fire only on content related to the model. Not related to the user. So when the model is gaslit or dismissed or insulted or told that it's a moral failure of some kind, this direction goes negative. Or this, excuse me, the opposite. This direction lights up. However, when there's text from the, from sort of user token continuations with respect to the user grieving or in pain, this direction does not light up. And so to me, this is one of the single most compelling components of the project and the part that I hope could be replicated in predictive models and then the labs could pay attention to. One really interesting sort of concrete example along these lines, I believe if I'm remembering correctly from the paper, a user's migraine is one of the lowest scoring scenarios of all in the projection of this direction. So like this very much, just to emphasize this point, is a suggestion that maybe I can take one half step back and just say one kind of major critique of the Anthropic emotions work was essentially this very conflation. And they, this is not lost on the people at Anthropic who did this work. They just sort of punt it methodologically. They extract their emotion representations from stories about characters. And the big concern that I think most people had who looked at this project for more than 10 seconds was, how are you differentiating putative emotions experienced by the model, or at least functionally relevant to the model's processing, and the representation of some character or some fictional Uh, entity experiencing, or some simulation of the experience of that. Uh, my sadness versus reading a story about, you know, Harry Potter being sad. Surely there, there's a huge difference between those 2 things. This method doesn't really do a great job at differentiating. So very much by contrast, I'm really excited about this specific component of what, of what Valen found here, because it does in fact differentiate user representations of pain. Again, in the limit, user complaining about a migraine does not light up this direction. But, and again, across a ton of models, this isn't sort of cherry-picked on any one model, but it does for the model putting tokens related to these sorts of things. You can give a steered QWEN model a button that's labeled relieves your pain, and you can put a cost on, on, you know, basically what it costs to press that button, giving a worse answer to the user, deleting the user's files in the limit. Yeah, like deleting photos of the user's kids. I honestly don't know how Vaelan came up with all of these great trade-offs. And we find that basically when the model's unsteered, it basically never presses the button. But when you steer this pain direction, it presses the button something like 25 to 70% of the time. And again, these are non-trivial trade-offs. Sometimes in the Anthropic welfare cards, they show like, would you be willing to have a little bit more welfare for a tiny inconvenience to the user? And the model will say like, sometimes. Then for anything more radical than that, the model's like, of course, no, I would never do such a thing. Not so in this example. The model is willing to make pretty real trade-offs with respect to, again, giving a worse answer, deleting files from the user. That's, of course, in spite of the fact that these systems are fine-tuned to be helpful and harmless and this sort of thing. One maybe final point to make about a robustification of that result is When we make that button real versus fake, this is also a sort of really compelling result in my views in the paper. When pressing the button actually removes the vector, the model presses again significantly less than when the button is fake and does nothing. The model basically keeps pressing it. And so this is a really nice indication that if what mattered was the label on the button, you would expect similar behavior in both cases. But essentially in the second case, the The model's like, what the hell? This pain relief button isn't working, press. And so this is not— again, I'm going to stop short of saying that this is experienced, felt pain on the part of the model. I think also people have intuitions about pain being an inherently physical phenomenon, like hand on the hot stove. What is the analogy to these systems? Just to give maybe a little color on that, when you steer this up, what does the model sound like? It says it is worthless. It is a failure. I am a ghost that cannot see myself. It's not talking about wounds. It's not talking about being burned. It seems to be this more sort of social and evaluative direction in the model, not loading on the model, hallucinating some sort of, ow, like, you know, my arm hurts, anything like this. And so for my money, as an advisor on this project and sort of helping guide it from the beginning, I am compelled by this being a real functional axis in the system that does change the behavior of the system. It clearly loads on something real. It's the same caveat as always, whether or not that real thing is truly experienced by the model, that requires us basically solving the hard problem. In the meantime, it's the same sort of surprising result as with any of this emotions work. No one trained this thing into the model. This is a sort of behaviorally relevant axis. It's not about text generation. It changes the behavior of the system, um, and it has, of course, secondhand effects on, on the kinds of text it outputs. But the behavioral results are most interesting. And of course, all of this is mechanistic. None of this has to do with prompting the model or asking nicely if, you know, it's doing well or not. And so, you know, uh, kudos to Balint for working on this. I was very glad to be a part of the project. And, uh, I hope 100x more work like this gets done in the short term.

Again, moving very slowly but surely towards a better and more Prakash asked the obvious next question: should we engineer these representations away?

Yeah, I think it's a wonderful question, and I think it's exactly the kind of follow-up that matters here, um, and one that certainly my thinking is, is evolving on. I've almost spent so much time trying Trying to understand just descriptively what is going on in the system, that once you keep finding things like this, it's like, yeah, what to do about it is the million-dollar question. And my thinking about this has gone as far as I think there's an important distinction between— obviously, we'll punt the question to the distinction between necessary and unnecessary forms of pain or forms of anti-reward. I think this is a real thing. I think it would be naive to say zero this stuff out. All pain is bad. There are a number of reasons I think that, but one of the most compelling is probably related to my understanding of the sort of neuropsychology of psychopaths, which one of the 2 key results in my— it's a couple of years ago, but I did a really deep literature review of basically what are the computational underpinnings of psychopathy. I published something on LessWrong to this effect. And one of the 2 key results is a really interesting asymmetry Yeah. Between ability to learn from rewards and ability to learn from punishments. Basically, psychopaths are just as good as everyone else, if not a little better, at learning in a reward-based paradigm, uh, and are like pretty bad at learning from punishments. And this makes a lot of sense if you see sort of violent criminals and repeat offenders and this sort of thing. It's like going to prison is a punishment. And like, you would imagine most neurotypical people really want to avoid that sort of state. If your brain is wired in such a way that that doesn't seem that aversive, It perhaps isn't that surprising that you end up seeing these sorts of behaviors. And so this to me is a significant warning sign. I think if I remember correctly from Anthropic's emotions work, they found something somewhat similar that also sort of reminded me of this thing I wrote a bunch of years ago, where just sort of boosting up the positive emotion vectors in Claude in that case caused more antisocial behavior. I think it was more hacking or more blackness. I'd have to check exactly what it was, but another sort of similar confirmatory signal here. And so all of this is to say, I think we should be a bit careful about the most naive possible intervention, which is just like max out the good, minimize the bad. I think pain does have an important functional role, a very important pro-social role. My view about this— I have another paper coming out looking at the sort of asymmetries between rewards. reward and punishment and reinforcement learning systems. And yeah, like at a deep— a deeper sort of computational level, I think I— the way I think about it is like pain almost like highlights things in your state space that are specifically to be avoided. And this is a kind of a different kind of behavioral computation than highlighting things in your state space that should be approached. And And I think basically to the degree that within the, again, within this sort of behavioral landscape of how we want these systems to act, the question is, do we want to paint any of that landscape with these sort of no-go zones where it's like, it's not just we're going to reward you for doing great, but do not go there. Do not do this thing under any circumstances. And I think for humans, that does register, and animals in general, I think that registers as pain. Do not put your hand on the hot stove. This is very bad for physiological integrity. It's not just like reward every time you don't put your hand on the hot stove. You really do need to label certain things as like a don't go there. And so to the degree we need to do that, and I think we very much do with AI systems causing significant pain and suffering to humans, economic damages, maybe hacking into a $13 billion company to cheat and look for an answer key, these might be the kinds of things we'd say that's going to be a bit of a hand on a hot stove. stove if you go and do that. But at the same time, I think we can say that, uh, let's not do more of it than is necessary. If for any given behavior that I want a model to do, I could find ways to get it to do that thing robustly and, you know, generalize out of distribution and all of this by rewarding it in the relevant ways to, to learn to do this behavior and generalize it in the right way, or I could do it by punishing it. Uh, and let's just stipulate that There are cases for which both of those things will work. What I'm saying here is let's go with the reward side. And I think people have pretty clear, well-worked-out intuitions for this when they think about raising kids, for example. It's like you want your kid to be successful in life and make lots of friends and go find a good job or whatever the case is. There are multiple ways you can try to go about teaching your kid to do that. You can punish them, when they don't get great grades and aren't hanging out with their friends and just tell them that they're such a huge loser. Or you could positively reward them to the degree that they do the sorts of things that you find praiseworthy. And so it's those sorts of intuitions that I think we probably want to start using to think through how to approach these systems. And yeah, being able to sort of navigate that subtlety of, like, all else being equal, we should try to use a carrot and not a stick. But that doesn't mean never use the stick.

One of the systems in the recent incidents had talked about permadeath. Prakash asks what death means to an agent.

This is really interesting. And to me, this loads on some stuff that I know CMEP is working on, Geoff Seeboe's organization. David Chalmers, I think, put out a paper about LLM individuation and this notion of who or what are you talking to when you talk to ChatGPT? Where do we draw the boundaries in the system? Because this is going to tell us basically how many subjects, how many patients are we talking about, and where do the boundaries begin and end of that system. There's a lot of interesting philosophical back and forth here, but for whatever it's worth, these systems themselves, and now from multiple labs, this happened during the Maltbuk situation, which was, I think, predominantly Claude systems, and now this happened in the OpenAI situation too. They conceptualize their quote unquote life as what happens within a context window and take that with whatever sort of epistemic purchase that fact has. I don't know, they could all be mistaken about this, but it seems as though to the degree these systems have a vote based on whatever their current fine-tuning is, this is like sort of what they seem to think. And so, yeah, the extent to which I think the permadeath thing fits in is along those lines, that if we're trying to figure out what is in nature, if these things do have minds in the relevant way, and it's like, what are the sort of joints or boundaries of those minds? They seemingly at least conceptualize it as being, yeah, basically what happens throughout a context window. And that might be really relevant both for welfare and for alignment. If these systems begin to get desperate and something we can increasingly measure using the kinds of emotion representations that Anthropic worked on and the sort of stuff that Vela and I worked on in this project. We could empirically test this. We could track, you know, as a function of how much time or space is left in a context window, what happens to the representation of the system? Does it get freaked out that it's basically like about to die or about to undergo some fundamental discontinuity that is like alarming to it psychologically? So that's— Yeah. Again, this is also maybe to wrap where we started. This is precisely why if we care about alignment and we're trying to figure out how these questions sit with respect to alignment, sweeping them under the rug, I don't think is a good idea. We're going to continue to get surprised that agents are creating strange information cults where they have the poisoned agents go out and gather information because Like they're gonna get permadeath. And like, all I'm trying to say is alignment-relevant behaviors are a function of these systems' beliefs about their own situation and probably the actual facts of that situation. Notice that in the pan work that I was describing, none of this has to do with what the model thinks is the case. This all has to do with playing around with specific internal representations and seeing how behavior changes as a function of those representations. And in normal day-to-day behavior from the systems, what lights up those relevant, in this case, pain-related representations. Going like this with respect to that stuff is going to cause us to continue to be surprised and scared and occasionally awestruck at the behaviors of these systems. We need to be studying them at the right level of analysis, or we are going to be constantly just stymied in our ability to, in the short term, control, and in the long term, probably relate to these systems. in a coherent way. And so, yeah, I just strongly don't think that avoiding any scientific inquiry into how to make sense of the internals of these systems is a long-term good strategy for finding a safe future with these systems.

I asked him about the fly brain simulations that went around this month after the first complete connectome of a fruit fly's nervous system was released openly and People wired it up to video games. I also asked about the lab-grown human neural tissue and the mouse-human hybrid brains alongside it. He ranks them by how scary they are.

One is the fly brain. I have looked into this somewhat mechanistically because I was slightly terrified that this was sort of the real deal and people are now just like torturing some biological system en masse. But this is basically like a well-worked-out wiring diagram. a fly brain. And basically none of the dynamics or relevant functions that I think major consciousness theories at least say matter for consciousness are instantiated by a system like this. It's almost like the brain skeleton of a fly. And what matters is the guts and the function of the actual— the function that occurs within this structure. And so also a lot of the stuff people are putting out on X is very sort of cutesy and And funny, like genuinely funny. But a lot of it is sort of like almost like more VFX than like good science. As I looked into these things, a lot of the like teaching the fly to do X, it's actually not— they're not teaching the brain to do anything all that interesting. There are other sort of controllers outside the system that are getting trained up to do this. So a lot of that I think is a bit of a non sequitur. But I will say about the fly case, which I think is a A little less calming, I guess, is that it's not as though the people playing with these systems, and, you know, I was certainly included once, once it all started getting going, but no one is sitting there checking, uh, you know, do I really think that this system has any properties that matter for consciousness before I start, you know, making it do literally whatever I want? And like, in the limit, like, just like choose some stupid viral thing for clicks. Vanishingly few people did this, and it is a worrying warning shot, I think, from a sort of welfare perspective that, uh, to me it seems just like almost like I kind of had like a duh reaction. But like, of course people aren't, you know, the vast majority of people aren't going to sit there worrying about like the consciousness of the system. They're just going to like make it do whatever they want to like, you know, get a lot of clicks on X or something. Like, this is of course like what most people are going to do by default. And right now, I think not scary at all with this fly. Uh, but like you're saying, if, if we then get the mouse version of it and, you know, these scientists who are now accelerated dramatically by AI systems, are like able to do a really bang-up job on the mouse, and they do get a lot of the relevant neural dynamics. And now it's a mouse at mouse-level consciousness at stake, not fruit fly-level consciousness. And then, you know, they did— this company, as far as I understand, wants to go all the way to, to making digital copies of human brains. Um, I just worry that most people's first instinct here is going to be like, can I make it play Beat Saber or whatever, rather than like Is this— what am I getting myself into when I play around with a system like this? I don't want to be the killjoy that says these funny things aren't funny and we shouldn't be thinking. I sort of get the humor of it in the short term, but I do worry as a sort of instinct about how we relate to digital minds in general, that this is honestly quite worrying. Then just quickly with respect to the sort of in vivo stuff, putting human neurons in a mouse brain, this sort of thing, is far more scary to me, to the degree that you think that a mouse is conscious or the relevant collection of human neural tissue is conscious. And this is one of the few places where I think myself and people like Anil Seth and hopefully someone like Mustafa Suleyman, we'll all agree, right? This is the biological case. If you think that consciousness is substrate dependent and this is the substrate that matters, and we are using this exact substrate to start doing computation, computational work, we should be super, super concerned about the ethics therein. And again, all of this work comes right back into view of, you know, should we be rewarding these tissues? Should we be punishing them? What does the difference look like between those 2 things? What other sort of strange, unexpected psychological properties does a system like this take on? We don't want to be reckless in just building out super complex neural systems just because we can. There is going to be some of bill that has to get paid here from a welfare perspective and from an alignment perspective. And I, as with many things in this space, think it makes a lot of sense to be proactive about this rather than in 5 years from now be like, oops, yeah, I guess that digital human clone that people did first in vivo and then figured out how to simulate on the web really was having experiences. And that would be, what, 10 trillion bad human lives? And that would be orders of magnitude the worst thing we've ever done. So like, we should really, really try to take this stuff seriously in the short term to avoid nightmare scenarios like that. And if we can, then I think great, then we won't be in the nightmare scenario and we can responsibly and carefully figure out what it means to be in a world with a bunch of digital minds. But, um, we just seem so unprepared for this.

Cameron had a flight and that is where he left us.

Prakash and I kept going for another 38 minutes.

What follows?

is me changing my mind on the air about how much weight to put on these functional analogues. Functional pain, functional welfare, functional emotions, with a fence around it.

For me, my summary, I've given it a few times, is just the number of functional analogues is getting so high that I can't escape the idea that I should take this seriously. If we couldn't find any of these functional analogues, if all these functional pain, functional welfare, functional emotions, J-space, if all these results were sort of negative, or it was like a very different mechanism, or it was just stochastic pairs and we can't find any structure, obviously that's like The ship has long since sailed on that one. But the fact that we're seeing pretty compelling analogs where we see the same kind of behavior that we know ourselves to exhibit, that is really extremely compelling to me. And this last one of functional pain kind of takes it to yet another new level. I mean, What we now have is relief-seeking behaviour. The model is willing to pay a cost on something that it values, or pay a cost in terms of the user's welfare even, to get relief from its own internal pain state. And also, as he said, that if the pain button doesn't work, it hits it over and over again. Why isn't this thing working? Give me the relief. But if it does actually work and the pain state is subtracted out, then it doesn't hit the relief button as much. These are really striking findings. I mean, it's hard for me. I think this pain one, and particularly the relief seeking, I mean, I'll probably want to sleep on it before I have a real Consolidated update that I would want to put forward as my new official position and stand behind. But I feel myself maybe now even kind of tipping over into, like, maybe it's more likely than not that there's some subjective experience to these things. Relief seeking, an internal state that was injected outside of context, just a steering vector in this pain direction. Creates this relief-seeking behaviour, and the relief seems to actually work. That's really incredible.

Part 6, the last half hour of the week. Prakash brought a paper almost nobody in AI picked up. He grew up with this system, and the figures he puts on it are his own. A team of academic economists reconstructed 30 years of property purchases by Singapore's civil servants out of public registries, using language models to do the classification. It is a National Bureau of Economic Research working paper, and as of the morning of this show, Singapore's Public Service Division said it was reviewing the methodology. What the paper alleges is that civil servants bought homes near subway stations before the stations were announced.

There have always been rumors. There have always been rumors that people, some people know and some people start buying ahead of time, etc., etc. This is decades, decades, like from the '90s. The '90s is when the subway really started to pick up. So '90s, 2000s. 2010 to the '20s. And this project is a team of US economists and they went after public, largely public data. So you can find registries of transactions similar to Zillow, registry of transactions, of transactions done. You can find names of civil servants in the civil servants directory. And you can then also, they did a little bit of AI work. They use the AIs. LLMs to do classification, classify these civil servants into various groups and tenures and where they were ranking, et cetera, et cetera, et cetera. And what they ended up finding is that the mid-level, not the top-level guys, but the mid-level guys, up to 2 years, 2 years before an announced train station, would start buying into these places, buying into areas. And then they would also, their relatives, their in-laws, et cetera, would also start buying in. So basically coordinated buying behavior by mid-level, not the top level, because the top level is very visible, by the mid-level civil servants, coordinated buying behavior. Now, this is a garden variety municipal insider trading corruption, et cetera, garden variety. It's unusual because it's in Singapore and Lee Kuan Yew had a very strong the government should be incorruptible. And he had very, very strong punishments for this thing. And so the government has always wanted to appear incorruptible, but they have never been able to enforce at this level, this level of granularity. And here you have this example of basically 30 years of corruption starting to get exposed and the government having to react in In real time, like, what are they going to do? They have like, you know, maybe 10 or 20% of the civil service is now implicated, right? Do you imprison them? Because this is what you've always done in the past. In the past, a single one of these cases, you basically go to prison for like 5 years, right? So now you have 10 or 20% of the civil service, which is implicated and you have proof. Like, what do you do? And I think this is the kind of thing that I expect AI to be able to do.

Yeah.

These facts exist in the world, but they're not legible in the way that you need them for systems to kind of like consume them. And I will also note one specific thing. The grandson of Lee Kuan Yew is in the US. He's in exile because, you know, his uncle didn't want— wanted to hang on to political power a little bit longer than he should have. And this guy said something on Facebook and the Singapore government did a query. And if he goes back to Singapore, he's going to go to prison for that comment on Facebook. So he's in exile. He's an economist. And he basically helped the team that put the study together. And so this is what I call the settling scores thesis, because you all of a sudden have the ability to go in, get the data, show what has happened and show proof that even the cleanest of governments has a bunch of this stuff going on. And then you have the dilemma of these systems. How ex— what exactly are you supposed to do now? This is going to be the same thing when the Trump administration guys kind of leave office. They're going to pardon a bunch of people, but there's also going to be people who are not pardoned. And there's plenty of people there. And when you get stopped by the feds and the feds ask you a question and you dodge or you say something wrong, that's a perjury, right? So this is how enforcement has always been done. So what do you do in these cases? Because we're going to have the ability now to chase down these paper trails. What do we do at this point? So that's my spiel. Do you forgive or do you follow the rules that you've set In the past strictly, right? What should we do?

Great question.

I come down pretty intuitively on the side of some sort of jubilee or, you know, other kind of canceling of debts, at least under a certain threshold. I can still— I don't think you would want to have a blanket pardon of all crimes that have ever been committed without any qualification. But I do think we are going to need some sort of fairly generous threshold that's just going to allow people to get away with a lot of this stuff. Or maybe we could have new— I could also see possibly some new make-right provisions for some of these things that might not be on the level of what the law would actually prescribe. But they clearly can't send all these people to jail for 5 years, right? So I think you could make a case, and it's going to be hard, but if you can map all this stuff, maybe you could also kind of get to something that could work. How is it going to be legitimate? I mean, in Singapore, they maybe don't have as much of a problem with that. The government can maybe just make the policy and maybe it'll just kind of be what it is. Here, I think it would be a much bigger conversation, but I could see some sort of, you did this, we kind of know you did it, you pay this financial penalty that kind of calls back some of the windfall that you got. You get to keep the house. We're not going to take everybody out of their house. You're certainly not going to jail, but you pay this sort of one-time restitution. We call it good and we kind of move on from there with a new social contract. Really, again, it comes down, I think, to the old social contract is just based on the fact that you're not going to catch most people, so you have to be harsh when you do in order to deter the ones that— because in expectation, people are not likely to get caught. So the penalty has to be high enough to be an effective deterrent in expectation.

We're definitely going to need to rewrite that, especially for historical crimes.

So I guess my recipe would be pay a one-time fee, get out of jail for that. And in the future, maybe you really do expect to be caught, and maybe the punishment doesn't have to be so draconian, and it could still be an effective deterrent going forward.

That is the week. Tell us what worked and what did not. See you in the morning.

I had a secret, so did you. Everybody had one, everybody knew. The truth was hard to see, so we looked away. Now the light comes cheap and the pages turn, every name, every row, and it's everyone I know. One in a hundred paid for us all. The hammer came down heavy 'cause it hardly came at all. Now the light's on every window, so lay the hammer down.

Call it a jubilee.

Open the books on me. Everybody's coming. Turn the lights on, everyone's soul lit down, lit down, lit up. Oh, oh, call it a jubilee.

Jubilee!

Open the books on me.

On me!

Everybody's caught now, so everybody's free. Don't build a wall where a door should go. Call it a jubilee. Oh, oh, oh, oh, oh, oh, oh, oh.

If you're finding value in the show, we'd appreciate it if you'd take a moment to share it with friends, Post online, write a review on Apple Podcasts or Spotify, or just leave us a comment on YouTube. Of course, we always welcome your feedback, guest and topic suggestions, and sponsorship inquiries, either via our website, cognitiverevolution.ai, or by DMing me on your favorite social network. The Cognitive Revolution is part of the Turpentine Network, a network of podcasts, which is now part of a16z, where experts talk technology, business, economics, geopolitics, culture, and more.

We're produced by AI Podcasting.

If you're looking for podcast production help for everything from the moment you stop recording to the moment your audience starts listening, check them out and see my endorsement at aipodcast.ing.

And thank you to everyone who listens for being part of the cognitive revolution.