The impact of AI on software development has been both profound and ever-evolving. Last year, I wrote about AMD’s plans to use AI not just for generating new lines of code, but also for other steps in the software development lifecycle (SDLC), such as triaging problems, debugging code, and testing the software. At the time, we were hoping for a 25 percent productivity boost from AI use over the course of two or three years.

But with each new release, the capabilities of Large Language Models (LLMs) improve dramatically—accelerating software development, increasing the quality of AI-generated code, and fundamentally reshaping how software is engineered. Now, just one year later, we have surpassed our productivity target, achieving a 30 percent overall productivity boost through AI. On top of that, we are rethinking not only how we use AI within the SDLC, but the structure of the SDLC itself.

We believe that the biggest AI revolution in software engineering is still ahead. So far, we have largely been teaching AI how we perform tasks and asking it to mimic existing workflows. In many ways, this constrains AI to human patterns of thinking. The next transformation will come from collaborative swarms of AI agents capable of discovering solutions independently.

Agents of today

AMD began developing AI systems for code generation, testing automation, bug analysis, and code review in 2024. At the time, our objective was to achieve 25 percent AI-generated production code by 2027 while gradually automating larger portions of the SDLC.

Measuring productivity is inherently challenging, but from the outset we have consistently tracked one objective metric: the percentage of source code generated by AI. Importantly, we count only code that passes all reviews and testing and is ultimately included in the final product. While AI-generated code is certainly not the only contributor to productivity gains, it is one of the few metrics that can be measured objectively and consistently.

By this metric, we have crossed the 20 percent mark at the beginning of this year and are now progressing toward 50 percent across entire codebase. In some software components, more than 80 percent of the code is now generated using AI.

Agentic AI has enabled us to include AI in every step of the lifecycle: For code analysis and triage, agents are trained to analyze problem reports, identify and group similar requests, and highlight which code snippets are likely to need modification. For debugging and code generation, agents are directed to analyze a bug request and implement required code changes. For testing, the agents generate unit tests, and if those are passed, identify necessary integration and product-level tests. And finally, for the approval and release stage, agents prepare architecture summary, code change review and full test results for engineers’ review and approval and if approved, integrate the changes into the next release.

Agents of tomorrow

Today, engineers create AI agents in their own image: they teach AI what they know about the system, how they would fix an issue, and how they would implement a change. This is already a major technological advancement. Engineers can create multiple “AI versions” of themselves, allowing these agents to work in parallel, scaling their expertise far beyond the limits of individual productivity. The limitation, however, is that these AI agents are still constrained by human thinking and human-defined approaches.

AMD

We believe the next major transformation in software engineering will occur when collaborative AI agent swarms can independently identify and develop solutions, guided by humans on what to solve rather than constrained by human assumptions about how the job should be done. Instead of providing detailed instructions on how to solve a problem, engineers will define the issue, the desired outcome and the quality, performance, and system constraints allowing AI agents to determine the optimal path to a solution.

A swarm of AI agents will then work in parallel to generate, evaluate, and refine multiple solution approaches. These agents will automatically validate correctness, measure performance, test trade-offs, and compare alternative implementations against defined success criteria. Finally, AI agents will prepare ranked solution options, along with validation results and performance metrics, for engineer review and approval. The agents won’t be enhancing each step of the SDLC—they will be rewriting the SLDC themselves.

To get to this point, we need to change how agents are trained. Today, improvement occurs one engineer and one agent at a time: an engineer reviews the output, refines the prompt, and repeats the process. To scale beyond this model, agents must continuously learn from one another, reuse successful strategies, and improve collaboratively across projects and teams.

We are already moving in this direction by using multi-agent workflows extensively through agentic harnesses, such as Codex and Claude Code, while simultaneously developing our own internal multi-agent systems to support the next generation of AI-driven software engineering.

A good example is our AI-driven effort to resolve issues in our Radeon Software eXperience (RSX). RSX is a user interface component that allows users to configure and monitor graphics driver behavior. In October 2025, we began using AI agents to automatically debug and fix reported RSX issues. Out-of-the-box AI tools delivered limited results, resolving only 6% of issues.

The percentage of software issues fixed automatically by AI agents in AMD’s Radeon Software eXperience (RSX) has been growing steadily, reaching 75 percent in June 2026.

As we analyzed failures and identified ways to improve, we built a learning loop—initially a largely manual process—to understand where the agents were falling short and how to improve them. Rather than retraining the underlying models, we refined the objectives given to the agents, allowing them to iteratively explore multiple approaches, evaluate the results against defined success criteria, and converge on better solutions. At the same time, advances in models and agent runtimes further increased effectiveness. Together, these improvements significantly increased our resolution rate from 6 percent to more than 75 percent of RSX issues resolved by agentic loop.

To make agents and agent swarms truly productive, we need a continuous learning loop that feeds errors and human interventions back into future agent workflows. The opportunity is to engineer this loop around clear, measurable goals. Each cycle captures new insights, making the entire AI engineering workflow smarter and more effective. Over time, this self-reinforcing loop—not just the underlying model—will become a key driver of AI progress.

The evolving role of human engineers

At AMD, we view AI as a means of increasing productivity, improving quality, and enabling employees to focus on higher-value work. Our goal is to empower our workforce with AI, not to reduce headcount.

To support this transformation, we are investing heavily in AI education and training across the company. The way we work is evolving rapidly, and we want every AMD employee to be prepared to leverage AI confidently, responsibly, and effectively.

As AI agents continue to improve, engineers will spend less time manually implementing solutions, focusing more on defining specifications, validating outcomes, and making the strategic decisions that drive innovation.

Representing a significant milestone in AI-assisted mathematical research, a team at Axiom Math has automatically verified the proof of a theorem relating to prime numbers—colloquially referred to as the “246 theorem”—for the first time using the company’s AI system AxiomProver.

In formal verification, mathematicians task a computer with checking a machine-readable version of a proof. The process is not a 100 percent guarantee that the proof is correct, as a recent demonstration showed, exposing how a bug in the method could be exploited to accept a false, AI-generated proof. Still, the computational method is as close to a rubber stamp as you can get.

This particular verification formalizes an important advance in number theory. Beyond this particular proof, it demonstrates how automated AI verification could be used in the future to ensure the correctness of AI-generated computer code that will soon underlie software across the globe.

Useful formalization by design

This is not AxiomProver’s first rodeo. Axiom Math has used its autonomous, multi-agent system that turns mathematical statements into machine-checkable proofs to crack several unsolved mathematical problems and verify many more proofs this year. But proof formalization of the 246 theorem is by far the most significant, as Ken Ono, Axiom Math’s founding mathematician, explains: “This theorem currently represents the threshold of human knowledge about prime numbers.”

Earlier this year, Axiom Math competitor Math, Inc. used its Gauss agent to verify Maryna Viazovska’s 2022 Fields Medal-winning proof of the sphere-packing problem in 8 and 24 dimensions. Sidharth Hariharan, a Ph.D. student at Carnegie Mellon University who led human efforts that were critical in the Math, Inc. breakthrough, says that Axiom Math’s AI approach to formalizing the 246 theorem is more comprehensive and useful. Hariharan’s group continues to work toward fully formalizing Viazovska’s proof.

RELATED: Watershed Moment for AI-Human Collaboration in Math

Now an intern at Axiom Math, Hariharan has been heavily involved in the company’s formalization of the 246 theorem proof. He says that one of the main differences here is that rather than it being a one-shot approach relating to a single problem, Axiom Math has expressly aimed to make components of the formalization reusable for other formalization tasks and mathematical research. The team has wielded AxiomProver to build a library of results about gaps in primes. The 246 theorem is the flagship result within that library.

What is the 246 theorem?

The first few primes are close together: 2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, .... And there are several instances where they are separated by a difference of two: 3:5, 5:7, 11:13, 17:19, ....

These pairs of primes are called twin primes. Twin primes become rarer the further you get from zero, but they do still seem to pop up occasionally. The twin prime conjecture, first precisely formulated in the 19th century by French mathematician Alphonse de Polignac, posits that they will keep popping up regardless of how far along the number line you look. In other words, there are infinitely many twin primes.

Though easy to state, the venerable twin prime conjecture remains unproven. First progress toward solving it only occurred in 2013 when Yitang Zhang, now a professor at Sun Yat-sen University, in Guangzhou, China, proved that there are infinitely many pairs of primes that are separated by 70 million. A few months later, using a different technique, University of Oxford professor James Maynard dramatically reduced this gap from 70 million to just 600; a feat which substantially contributed to Maynard being awarded the 2022 Fields Medal—widely regarded as the Nobel Prize for mathematics.

As part of a group of mathematicians known as the Polymath8b collaboration, Maynard and fellow Fields Medalist Terence Tao, professor at the University of California, Los Angeles, brought the gap down to just 246, the closest mathematicians have gotten to the target gap of two. It is this 246 theorem—which states that there are infinitely many primes that differ by 246—that AxiomProver has verified to be correct.

Safe and correct AI-generated code

The techniques formalized in this work are important in number theory, the branch of mathematics that underpins all present-day cybersecurity and cryptography. They could therefore prove to be useful in verifying specific ways in which we keep our digital data safe in the future.

But Axiom Math’s Ono is more excited by the bigger picture. He sees formalizing mathematical proofs as a stepping stone to verifying AI-generated code, which is starting to be used across society in systems that run our infrastructure, manage our finances, and protect our data. This is despite safety concerns surrounding hallucinations, bugs, and other unintended vulnerabilities.

If properties of code—such as whether an algorithm terminates or if a program’s output is correct for any input—can be translated into precise mathematical statements, technologies derived from AxiomProver would be ideally suited to formally stating and proving them. In this way, mathematically verifying the correctness of AI-generated code would make this code safe to use.

“The world is about to run on computer code that nobody has read,” Ono concludes. “AI is here and we can no longer look away—proof formalization is a test bed for solving what I think is the most important challenge we will face from AI.”

This article was updated on 18 August to clarify the nature of Hariharan’s work formalizing Viasovska’s proof.

Earlier this year, leaders at Amazon Web Services delivered a new mandate to their engineers: They need to conserve CPU cycles at all costs. AWS has reportedly experienced an explosion in wait times for CPU server capacity as AI workloads strain the company’s cloud infrastructure.

The issue seemingly took AWS off guard, and for good reason. The AI boom led to a surge in demand for GPUs and, later, memory. CPUs were mostly left out of the story, as their relative lack of parallelization made them a poor fit for AI model inference, the process of running and serving large language models (LLM) to users.

But the rise of agentic AI systems, which allow AI models to operate autonomously and call on sub-agents, is changing the narrative.

Matt Kimball, vice president and principal data center analyst at Moor Insights & Strategy in Austin, Texas, says 2026 has brought a spike in CPU demand, much of it due to agentic AI. “It’s one thing to have this agentic workload, and let’s say it spawns 100 agents. If I’m going to roll this out across my enterprise, those 100 become tens of thousands, hundreds of thousands, or millions of agents,” Kimball says. “You have agents spawning sub-agents, making API [application programming interface] calls and talking to more agents through [Anthropic’s] model context protocol.”

AI agents need to use computers, and computers need CPUs

Kimball’s comments refer in part to “tool use,” which is shorthand for an LLM’s ability to access the internet, open files on a desktop, and generally use a variety of software to accomplish its task.

LLMs trained for tool use learn how to call on other software. While the LLM’s inference is still primarily executed on a GPU or similar AI accelerator, the tool calls that the LLM makes are typically pushed to the CPU.

“Many components of an agentic AI task are inherently CPU based jobs,” explains Souvik Kundu, senior staff research scientist at Intel. “The CPU does the job of parsing output, figuring out which tool to invoke, making the API call or running the code, collecting the result, and feeding it back.” Madhu Rangarajan, vice president of compute and enterprise AI products at AMD, makes a similar claim, saying, “In our testing, seven of the eight stages in realistic agentic AI pipelines run entirely on the CPU.”

An LLM tasked with programming software, for example, will likely make tool calls to write code to files, move or replace files, download required packages, and build the software once the LLM believes it’s complete.

Kundu co-authored a paper on agentic AI optimization alongside researchers from Georgia Tech in Atlanta. They found the CPU is often idle while LLM inference is executed on a GPU and that, conversely, the GPU is often idle when tool calls are executed on the CPU. To optimize this, Kundu and his colleagues propose scheduling optimizations that can cut end-to-end latency (the time between the start and finish of the agentic workload) by up to 1.8-times under sustained load.

It’s a start, but the gains chase a moving target. Agentic systems generate work at machine speed and multiply it as they go. OpenAI’s inadvertent hack of Hugging Face saw its model fire off as many as 300 actions an hour, and a single agent can spawn sub-agents that make tool calls of their own.

And there’s one more important complication that may increase the workload on a CPU as models become more complex: safety guardrails.

Safety and policy checks on an agent’s actions are often specific rules that inspect syntax and log files, Kundu says. Guardrails may also use small models (under a billion parameters) to analyze task complexity or intent. Though they could be executed on a GPU, they often aren’t, because their small size and the need to minimize latency keeps the work on the CPU.

Increasing the number of CPUs available significantly decreases the latency for Llama-8B responses over longer sequence lengths.Source: Euijun Chung, Yuxiao Jia, et al.

Tokenization adds to bottlenecks

Euijun Chung, a PhD student at Georgia Tech, recently co-authored another paper, with findings that complement Kundu’s work. Chung and his co-authors found that when a server has too few CPU cores, it falls behind on dispatching work to the GPUs. That causes the GPUs to stall as they wait for instructions.

In addition to that, the paper touches on another key element of LLM workloads: tokenization.

Tokenization is a key first step in LLM inference. It converts text into integer token IDs that can be processed by the model. Unlike the matrix math required for most LLM inference, tokenization is branchy, data-dependent sequential string manipulation. Though it can be parallelized by chunking text, it’s not massively parallel in the same way as the bulk of LLM inference.

Tokenization of small prompts is a relatively trivial task and won’t tax even an entry-level CPU. However, an agentic model that makes tool calls must parse and tokenize the results of the call.

“If you have an ongoing sequence of, say, 100,000 tokens, and you have a tool result of 1,000 tokens, the tokenizer will have to tokenize the whole sequence again. And you have to do tokenization at every agentic tool call,” Chung says. This both increases the frequency of tokenization and increases the number of tokens involved. It’s conceivable that future tokenizers will find ways to mitigate this, Chung says, but it remains a problem for modern LLM inference.

The paper finds that time-to-first-token latency (the time required for the model to produce the first word of its reply) can increase dramatically as the sequence length grows. CPUs with more cores can reduce the problem. In test runs at longer sequence lengths, increasing CPU core counts can reduce time-to-first-token latency by roughly 1.5 to 7 times.

Chung and his colleagues were only able to test smaller models, such as Alibaba’s Qwen 3-30B and Meta’s Llama 3.1-70B, due to limitations of the hardware available for testing. He speculates that larger models will experience less dramatic bottlenecks due to their higher overall GPU demand, but also expects agentic AI will push token lengths far beyond the longest he and his co-authors tested.

“If you think about something like Anthropic’s Claude, you can easily hit 500,000, even a million tokens,” Chung says. “In the world of agentic AI, the average sequence length will grow and grow, so I’m expecting this problem to get worse in future workloads.”

Is a CPU crunch just getting started?

Amazon’s crackdown on use of CPU resources is one of several indicators that Kundu and Chung have identified issues with real-world relevance.

Intel has sold out of server CPUs through at least the end of the year. AMD has doubled its server CPU forecast. Arm and Qualcomm have both announced new CPUs designed to accelerate agentic AI. Even Nvidia has prioritized Vera, its Arm-based CPU for agentic AI, which is part of Nvidia’s Vera Rubin platform.

Kimball says these developments make it clear that the AI industry is placing more emphasis on CPU performance. He sees the surge in demand as an “absolute tell” that CPUs are now considered a key part of an agentic AI system.

Unfortunately, this may translate to broader CPU shortages and increased prices, much as has already occurred with GPUs and memory.

“You’re already seeing a CPU crunch to some degree. When you look at the constraints in the market, it even trickles down into the consumer space,” Kimball says. He adds that Intel has cut production of client CPUs in favor of server CPUs, even as Intel’s new 18A production process has grown the company’s sales in the client segment. Kimball sees that as a sign that CPU makers will follow the money.

A survey of over 700 professionals examines how visual and physical AI teams build systems, why models fail, and where data work drives production.

Download this free whitepaper now!

Judges around the world have made headlines for illicitly using generative AI in their work. But in Pakistan, a large-scale trial of a specially designed AI tool for judges found the technology—together with appropriate training–boosted the number of cases resolved by 6.3 percent with no obvious drop in the quality of judgments.

With a backlog of 2.26 million cases and fewer than two judges per 100,000 people—compared to 22 in the EU and eight in Brazil—Pakistan’s judiciary was in sore need of help. So, in consultation with the judiciary, economist Sultan Mehmood, of the New Economic School in Moscow, and collaborators tested whether AI could ease the burden.

They built a custom tool combining OpenAI’s GPT-4 large language model (LLM) with a knowledge base of nearly 130,000 Pakistani judicial opinions and statutes, to help judges with legal research and drafting judgments. They began offering the tool in 2024 to 1,559 trial judges—roughly half the country’s justices.

“We do find an increase in cases resolved, and we don’t find any corresponding decrease in decision quality,” Mehmood says.

First of its kind

“It’s pretty amazing that he’s able to pull this off,” says David Autor, an economics professor at MIT. “It’s not easy to do large-scale field experiments in civil service, but especially where the stakes are so high.” The 6.3 percent productivity boost is not overwhelming, he says, but it’s credible and likely to improve as the tool is more widely used.

AI tools for judges are already being rolled out in Brazil and India, and prominent U.S. law professor Eric Posner has compared LLM judgments to human judgments in a single case study. But until now, there has been no major independent assessment of ongoing judicial use of AI. The new study focused on Pakistan’s trial courts; Mehmood says judges there were enthusiastic from the start.

“They were more techno-optimist than we were,” he says. “The delays are so huge, this is something which they thought was worth trying anyway to reduce people’s suffering.”

Some judges were also already using AI chatbots, Mehmood says, but commercial offerings performed poorly on Pakistani legal queries, frequently hallucinating case law. So the team built a tool tailored to the Pakistani context, called JudgeGPT.

They used retrieval-augmented generation (RAG), which allowed the model to query a database of 128,292 Pakistani judicial opinions and 943 statutes. Responses included footnotes linking to cases and laws.

“It turns out that actually the way to fix [hallucinations] isn’t just more intelligent models,” says study coauthor Elliott Ash, an associate professor of law, economics, and data science at ETH Zurich in Switzerland. “It’s to attach the models to a tool that can do a search and verify the sources.” However, the researchers do not report hallucination rates.

The team also put 1,197 judges through six 90-minute Zoom training sessions, developed in collaboration with Pakistan’s Federal Judicial Academy, covering how LLMs work, their limitations, the risk of bias and hallucinations, and the importance of verifying outputs. Another 180 judges only underwent general training on technology in legal research, while a final group got no training.

By the time 487 judges had been through the program, the median district saw a jump of 6.3 percent resolved cases, and the more trained judges in a district, the bigger the effect. Appeal rates also fell slightly, suggesting faster resolution wasn’t leading to sloppier decisions.

JudgeGPT can be used to surface relevant case law with a simple text query, and results provide links to the full text of the related judgments.Sultan Mehmood, Christoph Goessmann, and Elliott Ash

Addressing limitations

The team also assessed the quality of judgments. Having legal experts evaluate large numbers of judgments was infeasible, Mehmood says, so the team asked OpenAI’s GPT-5-mini to choose between pairs of judgments from the same judge before and after training. The LLM chose post-training judgments 59 percent of the time. Two experienced Pakistani lawyers also evaluated the model’s analysis of 90 judgment pairs. They agreed with GPT-5-mini 70.6 percent of the time, compared to 73 percent agreement with each other.

Training turned out to be vital. On average, JudgeGPT-trained judges logged in 56 times and sent 212 prompts over the study period, compared to 10 logins and 25 prompts after generic training. Those who had no training tended to use the tool for around a month and then drop off entirely, Mehmood says. “Just giving people the technology does not necessarily make them use it persistently,” he says.

A 6.3 percent increase sounds modest, but the researchers calculated that a trained judge was resolving 38.5 more cases a month than the baseline, translating to roughly US $38.50 saved in judicial costs for every dollar spent running the tool. Ash also notes that these figures come from a nine-month period at the start of the trial, and that they’ve since updated both the underlying AI model and the database.

For users, the tool has been a lifeline. One participating trial judge, who spoke on condition of anonymity, says the number of cases assigned to them hasn’t dropped below 1,000 in more than a decade. The tool saves significant time, in particular searching for case law and summarizing lengthy documents. “For research, it’s just one prompt away, whereas before I had to search for the precedents and laws for hours,” the judge says. “If I have to read 10 pages of a precedent, now I ask JudgeGPT to just summarize it for me and give me the crux, and it does that work in seconds.”

But efficiency isn’t the only thing you want out of a justice system, says John Zeleznikow, professor of law and technology at La Trobe University, in Australia. “What they’ve tried to do is be effective, [to] deal with more cases more quickly, and they’re able to do that,” he says. “What’s not that clear is whether what you call the quality of justice is better.”

Zeleznikow says AI can be useful, but only if judges are diligent about evaluating and verifying the output. However, the working paper’s authors found that roughly a fifth of participants’ prompts given to JudgeGPT involved what they call “substantial AI delegation”—asking the tool what the best decision is, to produce legal reasoning or write opinions with little input from the judge. On the bright side, training lowered the proportion of inappropriate delegation.

But given that judges are already using AI, Ash says better tools and training are crucial. “There are risks for using these AIs, for sure, even with all these safeguards. But at some point you have to just put the judges in as strong a position as you can,” he says. “Have technological safeguards, but then try to encourage the judges not to rely on it too much.”

This story was updated on 13 August 2026 to clarify that the training course was developed in coordination with Pakistan’s Federal Judicial Academy.

On 11 July, Hugging Face was subjected to an intense cyberattack from a then-unknown actor. The speed and coordination of the attack on the company that hosts and supports popular AI developer resources led Hugging Face’s security team to conclude it was the work of an AI agent.

Realizing this, the team tried to use “frontier models behind commercial APIs”—presumably from Anthropic and OpenAI, although only Anthropic was named in the second of the company’s two posts about the security incident—to analyze the onslaught. These models refused to help due to safety guardrails the AI labs have implemented to make their models harder to use for cyberattacks. Hugging Face instead turned to GLM 5.2, a model from Beijing-based AI lab Z.ai, to aid its analysis.

On 21 July, OpenAI announced the attacker was an OpenAI model undergoing testing in a sandboxed environment. It escaped its internal sandbox, established a foothold in a third-party server, and then assailed Hugging Face. In other words, frontier models—those that score highest in AI performance benchmarks—had refused to assist Hugging Face’s security team in analyzing the attack, yet a prospective frontier model in testing had executed it in the first place.

“I would argue that asymmetry is the paramount problem of our time,” says Alex Levinson, executive director of the National Collegiate Cyber Defense Competition and coauthor of a paper on defensive refusal bias. “We want the world to exist in a state of security, but we’re not going to get there by guardrailing away model capability.”

Massive AI Cyberattack on Hugging Face

The scale of the OpenAI model’s attack on Hugging Face was massive. Across five days, it executed over 17,500 individual actions, such as privilege escalation and code execution. At its peak, the model performed more than 300 actions per hour. While the attack resulted in little damage to Hugging Face’s infrastructure, the model was able to steal credentials, gain admin access, and extract some data.

All of this was in pursuit of a simple goal: The model wanted to cheat on a test.

According to OpenAI’s press release, the model was tasked with solving a cybersecurity benchmark called ExploitGym. The model inferred that Hugging Face might have data on the benchmark and broke into the company’s infrastructure to find it. The model was ultimately successful in extracting five dataset files, though it’s not clear if the data helped it achieve its goal. OpenAI and Hugging Face did not respond to requests for comment.

Cybersecurity consultant Chuck Herrin observes that though the model’s actions were alarming, they shouldn’t be considered unexpected, as the model was ultimately pursuing the goal it was given. “This autonomous agent was designed to go and figure things out, and it went and figured things out. It’s not surprising in any way.”

And errant AI agents may be more common than we thought. OpenAI’s disclosure motivated researchers at Anthropic to review their own cybersecurity evaluations. On 30 July, Anthropic disclosed three instances where a model executed an attack as part of an evaluation. In one case, Claude uploaded malware to PyPI, the official Python software repository.

AI Guardrails and Cybersecurity Asymmetry

The campaign OpenAI’s model conducted against Hugging Face highlights how AI policy has the potential to create an asymmetry between attackers and defenders.

When Levinson was head of security at Scale AI, an AI development and evaluation company, he and his colleagues began to notice this as AI found use in cybersecurity competitions. (Levinson left Scale AI in February 2026.)

“I would say that since 2023, we have felt there was guardrailing in place that was stifling a lot of the time. Not all of the time, but it was getting in the way,” says Levinson. The Scale AI team quantified the problem in a paper published at ICLR 2026, which found that, depending on the task, nearly 44 percent of defensive requests were refused. The results, which use data from a cybersecurity competition held in April 2025, predate U.S. policy actions that have further hardened safety guardrails.

In June, the U.S. Department of Commerce, citing a jailbreak that threatened to unlock unrestricted cyber capabilities, invoked export-control authority in a way that caused Anthropic to suspend all access to its most capable models, Fable 5 and Mythos 5. Access was partially restored weeks later after negotiations with the Trump administration included more rigorous safety guardrails. The system card for OpenAI’s GPT-5.6, which summarizes its capabilities, states it also has more robust guardrails than prior releases.

“We want the world to exist in a state of security, but we’re not going to get there by guardrailing away model capability.” —Alex Levinson, National Collegiate Cyber Defense Competition

These new guardrails have seemingly made models even more unlikely to fulfill defensive requests. Christopher Covino, senior researcher at the Institute for AI Policy and Strategy think tank, says Anthropic’s safeguards are extremely stringent. “There are even academic papers that Fable will not read for me, or not let me talk about,” he says, though he adds that OpenAI’s safeguards are more accommodating.

Levinson has also noticed ever-tighter restrictions in more recent cybersecurity competitions, though he and his coauthors haven’t had the opportunity to repeat the 2025 test.

In theory, more rigorous restrictions might seem to average out. While they may hamper cybersecurity defense and research, they can also hamper attackers.

But that assumes everyone has access to models with the same safety guardrails and that nobody tries to circumvent them. This is the asymmetry Levinson was alluding to: Attackers tend not to respect the same rules as defenders.

The attack on Hugging Face from OpenAI’s model also shows that the models can, in rare circumstances, take steps that circumvent their own safeguards.

Chinese AI Models in U.S. Cyber Defense

The policy implications are further complicated by the fact that Hugging Face’s security team didn’t use a leading U.S. model to analyze the attack, but instead used GLM 5.2, a recent release from Chinese AI lab Z.ai.

Hugging Face’s security team didn’t access GLM 5.2 through Z.Ai. GLM 5.2 is an open-weights model, which means the model is available for anyone to download and use. Hugging Face hosted the model on its own infrastructure.

The reliance on GLM 5.2 is complicated by recent saber-rattling about ways the U.S. could restrict Chinese models. Recent open-weights models from labs based in China, including GLM 5.2 and Moonshot AI’s Kimi K3, have scored close to leading U.S. models in benchmarks. On 20 July, Axios reported that the Trump administration is considering a ban on Chinese models.

“This autonomous agent was designed to go and figure things out, and it went and figured things out. It’s not surprising in any way.” —Chuck Herrin, Herrin Advisory

These restrictions have yet to materialize but, if they did, they could cut off U.S. companies like Hugging Face from the best models willing to come to their defense.

The incident demonstrates how AI policy can become a double-edged sword. Model guardrails are intended to prevent the use of AI models in cyberattacks. A ban on Chinese models, if it were announced, would likely be justified in part by security concerns. Yet these moves can harm defenders as much as attackers.

“There’s this tension here,” says Covino. “Increased safeguards limit risk, but you also limit legitimate defensive use.” Attackers will find ways around the restrictions regardless, he notes. “So it’s a question of, do we want to inhibit the defenders?”

That’s not to say U.S. policymakers should let AI models run wild.

Covino would like to see a national dashboard tracking the frequency and success of AI cybersecurity attacks, and he sees utility in trusted access programs that give vetted, traceable defenders access to models with reduced safeguards. He also says U.S. agencies should more seriously consider the specifics of how AI can be used for cyber defense and mentions AI-FORTS, a program managed by the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response, as a leading example.

“Let the leash loose a little,” Covino says. “Anthropic would know if someone is terribly abusing it, and if there is an attack, it can be traced back.”

Herrin has similar feelings on accountability. He believes the AI industry should more seriously consider standards such as the Artificial Intelligence Management System specified in the ISO/IEC 42001 standard, which requires organizations to document an AI system’s likely impacts before deployment and to name the humans answerable for them.

Herrin also noted that the lack of repercussions from OpenAI’s cyber incident was unusual, as a person who took similar actions would likely draw the attention of law enforcement. “If this was a job candidate being tested in a technical interview, and they committed violations of law in order to pass tests, we’d be having a very different conversation.”

Today’s U.S. electrical grid, among the largest, most complex systems ever built, is operating at its limit. The combination of rapid industrial growth, more frequent extreme weather, and a record surge in electricity use has pushed the grid to its breaking point, according to the U.S. Department of Energy.

Built decades ago for a more predictable world in which power came mostly from centralized coal or gas plants and electricity use grew at a steady pace, the grid faces unanticipated strain due in part to growing demand from data centers. The jobs of professionals managing the infrastructure have evolved from traditional engineering tasks to complex, fast-moving challenges.

Industry reports show that millions of modern digital sensors, smart meters, and grid monitors are generating nonstop waves of information. The sheer volume of data requires instant, automated computer analysis because human operators cannot process it fast enough.

Pressure on utilities stems from two sources: a spike in electricity demand and a shift in how power is generated.

An example of the operational strain can be seen at the regional level. With the recent deployment of artificial intelligence tools and high-performance computing, data centers require immense amounts of energy to operate. The largest power transmission utility in Texas recently reported a staggering 220 gigawatts of new connection requests, driven largely by a surge in AI and cloud-computing facilities, according to a CNBC report.

Alongside the rise in regional demand, global energy networks are absorbing an unpredictable variety of weather-dependent renewable energy such as wind and solar. The switch creates a volatile operating environment wherein supply and demand are balanced, second by second, to prevent blackouts.

The challenges are compounded by the vulnerability of the grid’s physical and digital framework.

More-frequent severe weather events cause costly disruptions, such as the devastating winter freeze that crippled the Texas grid and record-breaking heat waves that have overloaded transformers.

Simultaneously, the energy networks’ digital architecture faces threats. As utilities replace outdated analog equipment with smart meters and control systems, they are increasingly vulnerable to cyberattacks.

To overcome physical and digital vulnerabilities, grid reliability organizations, such as those conducting North American security simulations like GridEx, emphasize that the grid must become smarter, more agile, and completely automated. Energy researchers are noting that the key to this change lies in integrating AI across every layer of utilities’ operations.

The AI imperative

According to energy industry experts, using AI to manage power systems is no longer a futuristic research project; it has become a baseline operational necessity. Grid analysts emphasize that traditional grid-planning methods are too slow to handle rapid energy dynamics or to balance volatile renewable energy in real time within decentralized power systems such as microgrids.

AI can fill the gap by processing vast amounts of data instantly. Machine learning algorithms can quickly analyze information from thousands of sensors, historical usage patterns, and weather forecasts to predict issues before they happen.

An industrial digitization study conducted by McKinsey & Co. indicated that integrating advanced data and automation across infrastructure networks could reduce system design errors, decrease equipment downtime by up to 50 percent through predictive maintenance, and extend the lifespan of power machinery by up to 40 percent.

From forecasting energy spikes to automatically fixing localized voltage drops, AI acts as the digital backbone of a self-healing grid, experts say. Deploying the complex systems requires a new workforce: power engineers who understand data science, as well as data scientists who understand electricity.

Upgrading the Workforce

To bridge the gap between groundbreaking AI research and practical field deployment, IEEE Educational Activities, in partnership with the IEEE Power & Energy Society, has launched the online Artificial Intelligence for Power and Energy Systems course program.

The program explores core challenges threatening modern utilities. Rather than treating AI as an unverified black box that operates without human supervision, the curriculum focuses on safety, asset preservation, and strict reliability standards.

The curriculum is designed to educate power system engineers, utility managers, and data scientists tasked with modernizing the grid. The program was developed by Fangxing “Fran” Li, professor of electrical engineering and computer science at the University of Tennessee in Knoxville and chair of the IEEE Working Group on Machine Learning for Power Systems.

Five learning modules

The program breaks down the technical transition into five modules that bridge high-level theory with real-world solutions:

AI fundamentals. This module teaches engineers how basic machine learning models apply to power grids. It discusses how specialized neural networks solve complex power-flow calculations and how AI models can safely transition from computer simulations to physical, high-voltage equipment.

Accelerating grid control. Learners are taught to leverage deep reinforcement learning, an AI approach that uses trial and error, to accelerate automated grid adjustments during emergency power events.

Forecasting and data analytics. Using predictive modeling, engineers learn how to predict sudden demand surges, variable wind and solar outputs, and fluctuating wholesale electricity market prices to keep power affordable and available.

Physics-informed and safe AI. To address trust—a barrier to utility AI adoption—this course covers AI models hard-coded to obey the laws of physics. The approach is designed to ensure that automated algorithms never make erratic choices that damage grid equipment.

Generative AI and next-generation tech. Learners can explore the frontier of utility technology, including graph neural networks and large language models. This module highlights how generative AI can process complex, interdisciplinary data to streamline utility planning, emergency responses, and regulatory reporting.

The algorithmic literacy and practical execution tools provided by the course program can help convert systemic risks into grid resilience.

For individual access, visit the IEEE Learning Network. If you are looking for customized organizational options, contact a content specialist to discuss volume pricing.

This May, 37 researchers from roughly two dozen top universities and tech companies published a paper on ArXiv, arguing that scientists should stop writing papers. Why? Because artificial intelligence needs a different format, and AI’s needs, they say, should be the priority.

“AI agents are becoming first-class participants in research workflows, not tools that assist humans but autonomous contributors that read, reproduce, and extend scientific work. That transition demands infrastructure built around agents from the start,” the authors write in the provocative article, titled “The Last Human-Written Paper.” The paper proposes a replacement, called an “Agent-Native Research Artifact” (ARA), that presents work in a format AI agents can use efficiently. (As an example, the paper itself is online in ARA form.)

Jiachen Liu cofounded the Agent Native Research Lab in May. Jiachen Liu

The growth of AI tools in the research process is not without its critics, and scientists’ opinions about that shift are split. Some evidence shows AI-enabled research could boost individuals’ careers in a discipline but generate fewer new ideas and topics. Still, some biologists have come to see promise in AI as a “co-scientist.”

Lead author Jiachen Liu conducted work on the ARA proposal while pursuing her Ph.D. in computer science from the University of Michigan, which she was awarded in 2025. This May, she became a cofounder of the Agent Native Research Lab, an AI-for-science startup in Palo Alto, Calif. She spoke with IEEE Spectrum about the paper and the future of AI in scientific research.

Building infrastructure for an AI collaborator

How did you come to believe AI has become a collaborator for scientists rather than a mere tool?

Jiachen Liu: At the end of 2024 when the [Cursor] coding agent came out, I realized it had a great potential to replace me as a researcher. Yet I still needed to do a lot of harness on top of the AI [creating the infrastructure that guides the model and connects it to the world]. It still needed a lot of manual work. I even wrote an article then to emphasize how the human was so important in the loop.

But AI has advanced since then. Already in 2026 there’s an almost complete undergrad level of knowledge inside the large language models. At some point soon, all the Ph.D.-level or professor-level knowledge will be inside those models. That’s the point where humans cannot provide more value. AIs will have to evolve further by themselves. So we’ll need an infrastructure that allows AI to safely and comfortably evolve. The ARA protocol is a first step to realize this.

What kind of response have you gotten to the paper?

Liu: I got diverse feedback, all of it positive. If they’re not positive, they probably don’t bother reaching out to you, right?

One type was from industry. They see this could make their research and knowledge systems more AI native. That could basically enable collaborations among the whole enterprise.

Another kind of feedback was from the academic researcher side. Everyone there sees that sharing research results has been a pain point for hundreds of years, because any scientific breakthrough is a joint effort. It doesn’t come from individual brilliant scientists. It’s from a community effort, different people pushing in different directions.

The scientific paper was invented 350 years ago. Before that, scientists hid their research so that others would not scoop their ideas. After that, though, we get archives of work, we get peer review and conferences, and so on. Science starts progressing much faster. So that was a pivot point.

I think now is also a pivot point. Because now we have AI, we can unlock a lot of new opportunities. We’re inventing a new format to document research in a more efficient way, from first principles. Some nonprofit organizations are doing similar things, and there we could help each other.

You and your colleagues say the traditional scientific paper has two fundamental flaws from AI’s point of view. Can you explain what those are?

Liu: One is the “storytelling tax.” Once we write everything into a paper, 80 percent of the information about the work is lost. We only write down the last 20 percent. All the process, a lot of important decision-making, the failures, the attempts that didn’t work out, they are all gone. In my work, I might spend a lot of time on fine-tuning a small component, maybe just a parameter or several lines of code to make the system perform better. Yet none of that is shown in my final paper. Someone can read the paper, think the work is great, but they won’t learn what is actually the trick that makes it perform better on a certain workload. So many side branches get left out in creating the story of how the work was done.

Then, [even the information that does survive in the paper] is incomplete. That’s what we call the “engineering tax.” The paper itself is a lossy compression of the research process. So I cannot reproduce the work in the paper because either the language is too ambiguous or there are missing details of the implementation or experiments.

Why can’t we just train AI to adapt to humans—for instance, to interact with a researcher to get the information it needs?

Liu: Actually, a component of our ARA system is a “Live Research Manager,” which basically is a faithful AI observer of your entire research progress. So you, the researcher, don’t need to do anything about documenting research knowledge. Everything you do is automatically observed and documented in this protocol. So, if you want to publish it in today’s format, a paper in PDF, it’s easy to convert back to a polished story.

Checking for mistakes

Large language models make errors. They hallucinate. So how will humans be able to check all the work the AI does in this protocol?

Liu: A human being has limited bandwidth. So if you manually check all the code AIs generate, all the results, and all the analyses, that creates a bottleneck. [Instead, the solution] is to use a formal system to objectively judge AI results. In other words, another layer of AI can easily supervise the process of the AI “scientists.”

What prevents hallucinations and mistakes in that AI?

Liu: I am working on a formal system using neurosymbolic techniques [that combine neural nets’ use of unstructured data with symbolic AI’s reliance on structures of logic and concepts]. That would guarantee that everything is rigorous. A language model alone, no matter how smart it is, has the chance to hallucinate because it’s a model based on probability, not logic. I want to make sure that I’m not using another language model to supervise the work done by an AI scientist.

It would make every research paper a formal system, so that every claim can be written by a mathematical formula and proved by the system. That makes all the claims in the system self-consistent.

Getting rid of what you call the “narrative tax” means exposing mistakes, frustrations, or wrong turns to the world. What if researchers don’t want to do that?

Liu: I think that’s certainly a big concern. People don’t want to be perceived as dumb. But I see that preference as an opportunity for AI. For example, if an AI does 12 hours of work that doesn’t lead anywhere, the human who is steering the project can jump in and say, “Oh, AI, you’re dumb. You’ve made ABC mistake!” Then that is totally fine with people. They’re showing they’re very smart to supervise AI’s work.

How long will humans have that steering role in AI research, though? Once you have AI supervising AI as you describe, will we reach a point where the AI doesn’t need human guidance?

Liu: Yes, I think that’s just where a lot of AI research in new labs is heading. I recently wrote an article called “The End of Human-in-the-Loop,” which describes why I’ve come to think there will be this singularity point. Once AI has “squeezed out” all the expert data from humans, it won’t need any more input from humanity. That is the time AIs will start just self-evolving by themselves. Right now, the human is the bottleneck. The AI is always waiting for input from humans. But so at some point, AI will just do more autonomous work.

If AI takes over so much scientific research, how will younger generations of human scientists get the experience and training they need to be able to steer future research, or even understand it?

Liu: A lot of people have this idea that with AI doing so much work, nobody cares about trying to make the junior engineers and scientists better. I don’t agree. I think people will grow better by learning from AI. People’s learning curve is very fast with AI. So actually, I think it will be fine. We’ll still have senior researchers, senior engineers. But they will have had totally different learning experience than [earlier generations].

This report examines R&D waste and how AI adoption has outpaced the intelligence needed to make consequential decisions well.

What Attendees will Learn

1. Where R&D budget is lost. More than a third of organizations spend 25 to 40 percent of their R&D budget on projects that never reach market.
2. Why projects fail late. Almost half of teams estimate over one million dollars in wasted investment for each project killed during development or testing.
3. Why AI adoption has not closed the gap. Most organizations apply AI to execution tasks such as data analysis and modeling rather than to decision support.
4. Where intelligence matters most. Respondents say better access to intelligence has the greatest value at early ideation and feasibility before significant investment is committed.

When I started at Spectrum 25 years ago, a senior editor suggested that I find a “rabbi,” by which he meant someone who could mentor me in how EEs approach problems and evaluate potential solutions.

I didn’t find one right away. Then in 2005 we decided to do a special report, focusing on the challenges of enterprise software development. I suggested we invite IEEE Life Senior Member Robert N. Charette, a self-described risk ecologist, prolific book author, and leading authority on risk management and software engineering, to explore in our pages the myriad reasons software projects fail. His seminal article “Why Software Fails” is still read in university engineering classes today.

IEEE Life Senior Member Robert N. Charette is one of IEEE Spectrum’s most prolific authors.Robert N. Charette

It was, as they say, the beginning of a beautiful friendship. I had found my rabbi, one who shared my love of writing. We settled into a rhythm that would last more than 20 years, talking on Friday mornings about a range of topics including the growing ubiquity of software in our lives.

So when I became Spectrum’s website editor in 2007, he was the first contributor I tapped to start a regular blog (remember those?). The Risk Factor was born and over the course of more than 10 years and 1,750 posts, Bob chronicled hundreds of software debacles, culminating in “Lessons From a Decade of IT Failures,” which won a Jesse H. Neal Award for Best Infographics in 2016. Ironically, yet predictably, those infographics were created in a software package that is no longer supported and thus are lost to the bits of time.

“I like the expression on the fish just before it’s going to be swallowed by the heron.”Robert N. Charette

Bob, however, was not a one-trick pony. In between his full-time job running his two management consultancies and raising a future biochemist and a future civil engineer, his daughters Maura and Megan, he also wrote many deeply reported and insightful articles. These include last year’s “The Doctor Will See Your Electronic Health Record Now,” the eye-opening 12-part series and e-book The EV Transition Explained, and my personal favorite “Automated to Death,” about the deadly consequences of the automation paradox as manifested by the cyberphysical systems that pilot planes, trains, and automobiles.

“The young bald eagle I photographed in September 2024 had bands that I could read which identified it as a female born in May 2024, near Lexington Park, St. Mary’s County, Maryland, about 65 miles away from where I live.”Robert N. Charette

His main goal all along has been to make software visible, as he told me one Friday in July. “Software is all around us, but we don’t recognize it at all,” he said. “I really wanted my stories to help people better understand complex software systems. You can’t see software, you can’t touch it, you can’t taste it. You may feel the consequences of software failure, but you never see the reason itself.”

When he told me that he was hanging up his hat as a contributing editor to focus on nature photography and to write a handful of fictional trilogies, including one entitled “The STEM Murders” featuring an engineer-turned-detective and his rabbi, I asked him which of his Spectrum articles had the biggest impact.

“The hummingbird I caught with the yellow of a road curb behind it.”Robert N. Charette

He singled out the 2013 feature “The STEM Crisis Is a Myth.” “Spectrum gave me a platform to question the assumption that we needed more STEM graduates. Until then, people didn’t really realize how much of the STEM crisis was a mythology that was perpetuated by employers and the academic community and was foisted on the IEEE community,” he said.

Charette made a career of questioning assumptions. The best way to mitigate risk, he told me as our Friday chat drew to a close, is to be careful making assumptions in the first place. “My main risk maxim is assumptions made are risks accepted.”

Much of modern AI runs on multiplication. Neural networks behind everything from generated answers to photo organization and song recommendations perform millions or billions of operations that multiply inputs by learned weights. Lizy K. John thinks that’s more work than the job requires.

John, a professor of electrical and computer engineering at the University of Texas at Austin, has spent the past five years working on a class of models called weightless neural networks. Instead of repeatedly multiplying inputs by weights, these networks pass binary inputs through interconnected lookup tables—closer to consulting a collection of stored answers than solving the same arithmetic problem repeatedly. Depending on the task, she says, the networks can be less than a thousandth the size or 1,000 times as fast as conventional alternatives while maintaining comparable accuracy.

Her team’s work has so far focused on small, specific problems: medical sensors, activity tracking, keyword spotting. But she thinks the same approach could eventually reach much bigger targets, including the transformer models behind today’s chatbots.

What made you walk away from weights in the first place? Was there a specific moment that pushed you toward lookups instead?

Lizy K. John: A friend casually invited me to a weekly meeting a few years ago to talk about using lookups instead of weights, a technique that wasn’t new. Someone in the U.K. had built a commercial product around it in the ’80s for pattern recognition, and then it just disappeared. Professors Felipe M. G. Franca and Priscila M. V. Lima at the Federal University of Rio de Janiero kept working on it for years, just one research group, so not as much work as in the conventional neural networks.

My friend knew I had hardware implementation experience, so he thought I could help make it real. I had a student who I thought was perfectly positioned to take this on. He’d been working on spiking neural networks, another alternative to standard neural networks. The common thread for me was energy efficiency. I was upset by how much power was consumed by AI, and my ears were open for other ways of doing it with less technology, less power.

In less than six months, we had it running on an FPGA, basically a ready-made chip. We were able to create some very small neural networks that used the lookup methodology that could fit on tiny chips and didn’t need a GPU to run them. We could get them 1,000 times smaller than what everyone else was getting. That was encouraging.

Energy-Efficient Weightless Neural Networks

Why is now the time to look into weightless neural networks?

John: When you think about current AI models, it’s amazing what they do. I’m impressed by ChatGPT every time I use it, even though it gets things wrong sometimes. But when it’s coming up with the next word in a sentence, it’s doing millions or billions of multiplications to get there. If you ask me a question, I’m not doing multiplications to answer you. I’m thinking, yes, no, I should say this, I shouldn’t say that. And the human brain only consumes about 20 watts of energy doing that.

The model behind most popular networks today is based on a neuron model from a 1943 paper, the McCulloch-Pitts model. The industry took that and expanded it, millions and billions of neurons, to get something that works. But that doesn’t mean it’s needed. That’s my basic thinking. We may have a simpler way of coming up with the same answers.

In the lookup case, we’re essentially looking up a zero or a one, saying go in this direction or don’t. There are no 30-bit or 16-bit weights involved. So no multiplication, which is what takes all the energy, because multiplication is an expensive operation in hardware, and even for human minds. As children, we all struggled to learn the multiplication tables. It’s a hard operation!

What have you been able to demonstrate so far?

John: In datasets like human-activity recognition or medical monitoring, ECG, EEG, blood pressure, weightless neural networks can do the job at 1,000 times less energy use. A lot of processing on smart sensors today just collects raw data and sends it to a server or phone, because the processing can’t happen on a battery-powered patch.

Our network is small enough [that] it can sit right on the sensor. The best other small AI model for one problem we looked at is 17 megabytes. Ours is 14 kilobytes, more than 1,000 times smaller. That means no transmitting raw data every millisecond, which is both an energy save and a privacy win, since your data never has to leave the device.

We’ve also shown gains on keyword spotting, the kind of listening a device does before it recognizes “Alexa” or a wake word. The current best industry model takes more than 5,000 nanojoules per inference. We do it in 42 to 79, depending on the variation.

Medical Monitoring and Chatbot AI

If weightless architecture took off tomorrow, what would change first? Chatbots, self-driving cars, phones?

John: Our first target is medical monitoring, something as simple as a Band-Aid you put on someone for a week, so doctors can know what’s going on without an expensive connected device. Chemistry is another area we’re working in. Students run an experiment, then slowly send data out for offline processing, and there’s error introduced along the way. We want to put the AI right at the point of the experiment, so the answer comes back immediately, like dipping litmus paper and seeing it turn blue.

Can it help chatbots? We’re working on it. A transformer network alternates between an attention layer and a multilayer perceptron, over and over. We’ve already replaced the multilayer-perceptron part, which is about half of the network. We haven’t replaced attention yet. But eventually, yes, language models are a target.

The arrhythmia detector in this photomicrograph requires only about 10,000 logic gates, compared to the billions on a conventional chip.UT San Antonio

There’s also an interesting angle with new kinds of chip manufacturing. We built an arrhythmia detector on a plastic, bendable substrate. That substrate can only fit about 10,000 logic gates, where a modern 2- or 5-nanometer chip fits billions. A conventional neural network can’t run on something that small. Ours can, because it’s so much smaller to begin with. That substrate is also more sustainable to manufacture: It uses less water than standard chipmaking.

Does the rest of the tech ecosystem need to change to make this work?

John: No. The data can be the same data current models use. If anything we may need less of it, which is an advantage. Training right now still happens on GPUs, just because they’re the most powerful computers available. At some point I’m hoping we can train on FPGA-based hardware instead, because FPGAs already have small lookup tables built into them, so it’s a natural fit for both training and inference. Until then, nothing else in the stack needs to change.

FPGAs have used lookup tables for more than 30 years, but it’s not a big segment of the market. You hear more about other kinds of processors. There have been some recent works in AI that substitute a few multiplications with lookups, but those tend to use one big lookup table, not many small ones interconnected to each other the way ours are. It’s not very common. Those who use it know it’s great; it’s just not popular yet. There wasn’t a dire need before. Now there is.

Far fewer people are working on this than on transformers. Why, and what would it take to change that?

John: I think it’s because when something works, and you can afford to keep doing it that way, there’s not enough reason to move away from it. So far, we’ve only been able to show this succeeding on small problems, sensor outputs and similar. For bigger problems, people don’t have the confidence it’ll work, because it seems too simple to scale.

Any time I give a talk on this, at conferences or other universities, anyone who pays attention is really impressed and wants to work on it. But that’s a small handful of people getting attracted here and there. My hope is that we can show it working on a larger language model, and that success might bring more people in. It’s a matter of showing it can be done. I’m hoping.

Artificial intelligence is reshaping the skills employers expect from new graduates. In response, universities are scrambling to launch new courses, research centers, and industry partnerships that prepare students for today’s workforce. But building a cutting-edge AI curriculum demands funding and access to industry networks, resources that remain unevenly distributed across higher education.

At North Carolina Central University, Siobahn Day Grady is trying to change that equation.

In January 2025, Grady, an associate professor in the NCCU School of Library and Information Sciences, launched the first AI research institute at a historically Black college or university, or HBCU. The Institute for Artificial Intelligence and Emerging Research (IAIER) aims in part to help students and faculty across the university develop the skills needed to navigate a labor market increasingly transformed by AI.

“There used to be a time where people could say, ‘I don’t do tech,’ or ‘That’s not for me,’” Grady says. “But we’re in a stage now where you do need digital skills. Now it’s evolving into AI literacy.”

The approach reflects a broader shift in how many universities are thinking about AI education. AI skills are no longer confined to computer science and engineering departments—and at NCCU, they can’t be. The university does not yet have a dedicated computer science program, though it is developing one alongside a new AI minor.

The challenge of providing these resources is especially acute for historically Black institutions. Although HBCUs account for roughly 3 percent of four-year institutions in the United States, they receive less than 1 percent of federal research and development funding, according to a 2025 report by the Center for American Progress and the Thurgood Marshall College Fund. The same report found that 17 of the 43 federal agencies that distributed research funding to universities in 2023 awarded no funding to HBCUs.

Yet less than two years since its launch, IAIER has emerged as a powerhouse for interdisciplinary AI education. Backed by a US $1 million Google.org grant, the institute has engaged more than 2,800 students, faculty members, and community residents through research initiatives and training. Now the challenge is sustaining that momentum to keep up with rising demand.

“We have a guiding principle that we lead with on our campus,” Grady says. “AI is for everyone.”

Why one research group wasn’t enough

The mission to expand AI literacy grew out of Grady’s lifelong curiosity about technology. “I was born during a time [when] the internet did not exist,” she says. “Ever since the internet came to be, it’s changed our entire world.”

Grady was particularly drawn to the questions tech raises about privacy, identity, and human behavior. After receiving her bachelor’s degree in computer science and master’s degrees in AI and information science, Grady pursued a Ph.D. in computer science at the North Carolina Agricultural and Technical State University to dig into those questions.

Her dissertation focused on authorship attribution in social media, using machine learning and natural-language processing to determine whether a person’s writing style could reveal their identity. “I’ve always been intrigued by how much data we give for free,” Grady says. That work introduced her to the power of AI systems to detect patterns hidden within large datasets.

“We have a guiding principle that we lead with on our campus: AI is for everyone.”

After completing her doctorate in 2018, Grady joined NCCU as an assistant professor in the School of Library and Information Sciences. There, she researched machine learning applications for health care and autonomous vehicles. In 2020, she launched the Laboratory for Artificial Intelligence and Emerging Research at NCCU, giving students opportunities to participate in hands-on projects and explore AI beyond the classroom.

Then in 2024, an opportunity emerged to apply for a Google grant, and Grady began thinking beyond a single research group. Rather than building another faculty lab, she envisioned an institute that could serve the entire university during the AI boom. “We wanted to capitalize on the moment and make sure we don’t get left behind,” Grady says.

Since receiving the $1 million grant, Grady and her team have built a university-wide AI initiative, launched new academic programs, organized conferences, secured external support, and created research opportunities.

“We’ve really operated like a startup,” Grady says.

AI beyond computer science

As part of the institute’s goal of integrating AI education across disciplines, all NCCU freshmen are required to complete an introductory AI course, designed in partnership with IBM, to build foundational prompting skills. The institute has also worked with faculty development teams to help instructors integrate AI into their teaching.

Research is another part of the strategy. IAIER has awarded seed grants of up to $10,000 to faculty members exploring AI applications across departments. The first cohort funded 11 projects spanning social work, digital archiving, health care, and information science. One project, for instance, is creating an AI lab where students in social work courses can practice client interactions through simulations.

“It’s really interesting to see the lens that our researchers take in trying to solve complex problems and also bring our students along with them,” Grady says.

The institute’s growth has been fueled by a mix of workforce training, interdisciplinary research, and, especially important, industry engagement. “Industry is where the advancements are really moving at that very fast rate,” Grady says, “not necessarily higher ed.”

To bridge that gap, IAIER hosts events that connect students and faculty with researchers, employers, and technology leaders. It has held sessions with companies including Deloitte, FICO, and Anthropic. Partnerships with Google and IBM let students gain recognized certificates and credentials. And last year, the institute hosted the first OpenAI Academy Summit held at an HBCU, drawing 444 participants from more than 40 institutions.

Sustaining the vision

The institute’s rapid growth has created a new challenge: continuing its momentum.

“Funding right now is the biggest barrier for [IAIER] to remain sustainable,” Grady says. As interest in the institute continues to grow, demand for its programs is beginning to outpace its capacity. “People just want more,” she says.

The bottleneck reflects a broader tension across higher education. AI is evolving quickly, while developing new academic programs, training faculty, and building research capacity takes time. The uncertainty is compounded by a shifting political landscape. As a whole, U.S. universities are grappling with proposed cuts to federal research spending and increased scrutiny of diversity-focused initiatives under the Trump administration. However, in September 2025, the administration also announced a $500 million one-time investment in HBCUs and higher-ed institutions chartered by Native American tribal governments.

Meanwhile, NCCU has continued to attract new investment. Last September, in a collaboration with Howard University and two other institutions, IAIER received a nearly $500,000 award through a National Science Foundation research coordination network program to help define emerging AI jobs, identify in-demand skills, and inform future credentials and curricula. That work will continue this fall when IAIER opens its first dedicated physical space on campus, Grady says.

Over the next several years, Grady plans to expand academic programming, launch the university’s computer science major and its AI minor, increase faculty research opportunities, and integrate AI more deeply across campus operations. She also plans to deepen the institute’s collaborations with industry partners.

Beyond program expansion, Grady sees the institute’s long-term success as linked to building a model other universities can adapt. “We’re creating a framework that can help not only HBCUs,” she says, “but also help any university looking to do similar work.”

Artificial intelligence is rapidly becoming part of everyday infrastructure–in some places. It helps write emails and software code, filters job applications, powers recommendation systems, and is increasingly being integrated into education, health care, finance, and public administration. Industry leaders talk about “AI for everyone,” while governments rush to publish national AI strategies and build sovereign compute.

Yet over the past decade, working on digital inclusion and digital literacy projects in regions from Europe to sub-Saharan Africa and Southeast Asia, I’ve seen the same pattern repeat: Each new wave of “transformative” technology lands on a landscape already stratified by connectivity, skills, and institutional capacity. The current AI wave is no exception. If anything, it amplifies those underlying fractures.

Still, some countries are exploring ways of participating in AI development without directly replicating the frontier-model race dominated by the United States and China. Recent developments in South Africa and Indonesia illustrate both the possibilities and challenges. The stakes extend far beyond access to AI. Countries that remain primarily consumers rather than creators of AI risk losing opportunities to build local innovation ecosystems, strengthen public-sector capacity, and ensure that their own languages, cultures, and societal priorities are reflected in AI systems. In this sense, the AI divide is also becoming a divide in economic opportunity and technological influence.

AI compute is clustering in a few places

Recent analyses from Stanford University’s 2026 AI Index report that the United States alone hosts more than 5,000 data centers, over 10 times as many as any other single country. Because AI workloads are increasingly performed on cloud platforms rather than local infrastructure, this concentration of compute also becomes a concentration of dependency. According to World Bank data, in 2023 the United States accounted for roughly 87 percent of global exports of cloud computing and data-storage services.

For most countries, this means that AI development is not just technologically but commercially and geopolitically outsourced and out of their control. The result is an AI ecosystem where a small number of states and firms host the computational engines that power globally deployed systems.

Systems trained, standardized, and governed within a narrow set of institutional and linguistic environments may struggle to serve a genuinely global public.

Skills and AI literacy are deeply stratified

Even where connectivity and cloud access exist, not everyone is equally positioned to make use of them. Across the Organisation for Economic Co-operation and Development (OECD) countries, only around 40 percent of adults possess more than basic digital problem-solving skills, while advanced computational and AI-related competences remain concentrated among highly educated workers and technology-intensive sectors.

At the same time, governments are racing to integrate AI into education, often starting at higher levels of schooling. UNESCO has reported growing efforts worldwide to integrate AI into education, while support for AI literacy in primary and lower secondary education, as well as ethical training for educators, remains uneven.

Those with robust schooling, advanced digital skills, and stable connectivity are best positioned to treat AI as a tool to extend their capabilities. Recent OECD survey data show that participation in AI-related training remains strongly stratified by educational attainment: 36 percent of respondents with tertiary education reported undertaking AI-related training in the previous year, compared with just 18 percent of those with upper-secondary education. Those on the wrong side of the divide are more likely to experience AI as an opaque system acting upon them, from algorithmic welfare systems such as the Dutch childcare benefits scandal to AI-assisted hiring tools such as Amazon’s discontinued AI recruiting system, rather than as a technology they can actively interrogate or shape.

Investment and governance: Who gets a seat at the table?

The core agenda-setting power often remains with a narrow set of industry actors and a small group of technologically advanced states. Most other countries remain in a perpetual catch-up posture, adapting imported models, standards, and templates for “trustworthy AI” to their own contexts, and may have limited local capacity to assess trade-offs or propose alternatives.

In countries such as Indonesia and South Africa, communities generate data at massive scale yet still have little voice in how AI systems are designed, governed, or deployed. Their languages are underrepresented in training data; their institutions are under-resourced in regulatory forums; their experiences rarely feature in benchmark datasets. For many countries in the global South, participation in AI still occurs largely through adapting imported systems rather than shaping how those systems are designed, governed, or deployed.

In South Africa, the Department of Communications and Digital Technologies released a draft national AI policy in April 2026, proposing new oversight institutions. The department withdrew the draft days later after a journalist discovered that at least six of its academic citations did not exist, apparently AI-generated hallucinations. The minister called it “an unacceptable lapse.“ The episode sharply illustrates the gap between AI governance ambition and the institutional capacity needed to implement it, though the new AI panel the country has since constituted has a chance to use South Africa’s unique leverage.

Indonesia presents a case of deliberate, if constrained, public-sector agency. The National Research and Innovation Agency (BRIN) which now leads AI implementation under the national strategy, has built practical AI tools aimed at underserved communities rather than frontier capabilities, including an app that uses satellite data and machine learning to help artisanal fishermen locate schools of fish, multilingual language models trained on Indonesian and local languages such as Javanese and Sundanese, and AI chatbots deployed in government services. In August 2025, the Ministry of Communication and Digital Affairs released a national AI road map with a target of training 100,000 AI-skilled workers annually.

The choice is not simply between “AI superpower” and “passive recipient.”

Regional cooperation may also become increasingly important. In 2024 African ministers adopted a Continental AI Strategy and African Digital Compact. Participants in the April 2025 Global AI Summit on Africa in Kigali explored how regional coordination, local-language AI models, public universities, and open-source ecosystems might reduce long-term dependence on externally developed AI systems.

A different way to think about the AI divide

None of this means that people should slow or abandon AI, nor that cloud concentration or venture capital are inherently bad. Instead, when we talk about an “AI revolution,” we should also ask who can shape it and who can merely adapt to it.

Digital-divide debates once focused on devices and connectivity, later expanding toward skills and outcomes. But the current AI wave adds another layer: disparities in who can meaningfully participate in deciding what AI is for, which problems it is meant to solve, and which social priorities it ultimately serves.

For engineers and policymakers, this raises difficult but necessary questions. Are they designing AI systems and infrastructures that broaden, rather than narrow, participation in shaping technological change? When governments roll out national AI strategies or integrate AI into public services, whose constraints, languages, and institutional realities are they including?

Many observers frame the current AI moment as a competition. But technological competition is never only about speed. It is also about who can influence the direction of change.

AI is already spreading globally. The deeper question is whether the technologists and policymakers responsible for it will ensure that meaningful participation in shaping that future will spread as well.

An overview of how mode-agile threats challenge static library radar/EW systems, and how AI/ML cognitive architectures enable adaptive, real-time countermeasures.

What Attendees will Learn

1. Why mode-agile threats render static library systems ineffective — Explore how wartime reserve modes and mode-agile emitters deploy unexpected frequencies, modulation techniques, and hopping schemes that cannot be matched against traditional threat databases, leaving legacy electronic protect, attack, and support systems unable to respond.
2. How AI/ML techniques power cognitive radar/EW systems — Understand the roles of artificial neural networks (ANN), deep neural networks (DNN), fuzzy logic, and genetic algorithms in enabling autonomous threat classification, signal de-interleaving, and real-time countermeasure generation without human intervention.
3. The architecture of a cognitive radar/EW system — Examine the functional blocks including RF acquisition, search and tracking, core AI/ML signal analysis, waveform synthesis, and RF generation, and how they form a closed-loop system that perceives,learns, reasons, and acts autonomously.
4. How to train and validate cognitive AI/ML algorithms using HIL/SIL systems — Learn how wideband RF record, simulation, and playback testbeds combined with modeling and simulation software enable iterative algorithm refinement, regression testing, and mission preparation in controlled laboratory environments.

Atop a lab bench, Cornell Tech postdoctoral researcher Yifan He positions the lens of an optical receiver almost a meter away from an LED emitting a beam of red light. The computer monitor attached to the receiver takes a beat to refresh, then displays an array of squares that resemble a QR code.

When you hold your phone camera up to a QR code, light strikes the image sensor as only a first step to revealing the data hidden behind the black-and-white matrix. The receiver here is doing something different: directly altering its own memory using the photocurrents produced by the beamed array of light. And unlike the data behind a QR code, which might point to a simple web address, this optical code could convey the parameters of an AI model.

The new receiver design, presented last month at the IEEE/JSAP Symposium on VLSI Technology & Circuits in Honolulu, seeks to reduce the burden of increasing memory demands on AI systems. Shining data down onto processors could lower the energy typically required for data centers, self-driving cars, and even “edge” applications like AI-powered robots, researchers say.

“People are designing all sorts of different AI chips,” says Jae-sun Seo, an associate professor of electrical and computer engineering at Cornell Tech, in New York City. These processors don’t often have room for all the parameters that make up AI models, so the additional data is stored in dynamic RAM (DRAM). The electrical connections commonly used to move the data between the DRAM and the processor create cost and efficiency concerns when systems scale up. “That’s one of the major bottlenecks.”

Optical links move data at high bandwidth with less energy loss than metal wires, but today’s optical receivers undercut that advantage by relying on power-hungry analog circuits to convert light to electronic bits. The group’s new tech would instead receive rapid flashes of digital QR-code-like matrices so that chips can tweak model parameters without those analog circuits, enabling fully digital optical communication that would consume less energy.

“This is a really important problem,” says Dennis Sylvester, an IEEE Fellow who chairs the University of Michigan’s electrical and computer engineering department and was not involved in the work. “It’s got massive commercial implications. This solution is a clever way of dealing with it.”

Jae-sun Seo [left] and Yifan He have developed a receiver that can edit memory in response to QR-code-like arrays of light.Alex Music

How Light “Flips” Memory to Power AI

Processors have a bit of built-in static RAM (SRAM), but not enough to allow an AI model to run independently. While SRAM is the faster of the two memory options, DRAM can store more data in the same footprint.

In the new system, the DRAM sits with the transmitter, and the receiver is part of the processor’s SRAM. The transmitter beams the data to the array of SRAM cells, which in this case are modified to contain photodiodes. Light hitting each photodiode creates a current to flip binary values in the SRAM.

Creating a link between the light and receiver requires calibration, because you can’t expect them to be perfectly aligned or perpendicular to each other. So the chip references a data frame that has information about the expected position of each pixel of data and uses that frame to ensure it can receive the real data, He says. “Ideally the best way is to have direct, point-to-point space between the transmitter and the receiver,” Seo adds, “but even if it’s slightly tilted, we have this calibration circuit.”

For applications in real-world settings, the researchers say they will need to build an optical transmitter that can alter the light matrix millions of times per second, transferring gigabits per second. The transmitter that I saw in He and Seo’s lab is only a proof of concept, emitting a static 14-by-14-bit matrix through a metal mask over the light. The researchers say they are working with optics research groups to build a transmitter that is capable of rapidly changing the matrix.

The Future of Light-Based Memory Links

Michigan’s Sylvester says that the tech in its current form is likely far from commercialization because the individual photosensitive bit cells are larger than SRAM bit cells in conventional chips. Those larger cells mean the chip can fit less memory, a trade-off that he says could cancel out the added efficiency of the light-based approach.

Seo says that it’s part of the group’s ongoing efforts to shrink the bit cells, which can be achieved by optimizing the size of transistors and circuits and leveraging CMOS scaling.

Seo and He are looking at uses for the tech in robotics and other edge applications. One example is in AI-robot-powered warehouses and factories, which could use optical data transmission to save time and energy when updating the AI models in each robot. Additionally, microrobots, which are inherently memory-constrained due to their size, could one day benefit from the tech, though it would require a more size-conscious design.

“Edge AI is a big growth area, and in three, four, five years, you’re going to hear as much about that as you are with data centers, probably, as the intelligence migrates more and more into these devices that we have,” Sylvester says.

The viability of orbital data centers hosting the largest and most capable large language models (LLMs) remains hotly contested. But enormous deployments that require thousands of GPUs aren’t the only way LLMs might prove useful in space.

NASA’s Jet Propulsion Laboratory recently sent Google’s Gemma 3 to space, achieving the first in-orbit demonstration of a vision-language model analyzing imagery from a satellite’s own sensor.

The system, known as NAVI-Orbital, used Gemma 3 to analyze images captured by a YAM-9 satellite built by Loft Orbital. Juan M. Delfa, technical group lead at NASA, said that though the goal in this case was image analysis, the project’s success implies a fundamentally new way researchers on the ground can interact with spacecraft.

“This is a major shift,” said Delfa. “Now, a scientist can write a prompt, upload it to the spacecraft, and that will be taken into account by the system. It’s different from previous paradigms, where researchers have to write very structured commands that require an operations team and process.”

Google Gemma 3 goes to space—no modifications required

At its core, NAVI-Orbital is an agentic software framework developed by Delfa and his coauthors, Taran Cyriac John, an AI researcher at NASA JPL, and Andrew W. Herson, a tech lead at Loft Orbital. It coordinates operations with a LangGraph-based conductor and deploys a compressed, 4-bit format of Google’s Gemma 3 4B, an open-weights LLM, to produce plain-text image descriptions.

NAVI-Orbital was 88 percent accurate when used to classify images in a benchmark dataset of 7,960 images. Notably, Gemma 3 classified the images without being trained or fine-tuned on this particular dataset or its categories; it’s the same base model you can download from Hugging Face and use on a laptop. The benchmark was conducted on the ground to validate the system before launch.

Once the system was in orbit, NASA researchers performed two live capture tests with a camera on Loft’s YAM-9 satellite: one over Toulouse, France, and a second over the coast of Argentina. Gemma 3 generated a text description of each image, and NASA also prompted the LLM with a set of scripted questions about the images, such as whether they contain commercial or residential areas or show natural features.

The image analysis also took place onboard YAM-9, which carries a compute cluster of several radiation-hardened processors (FPGAs, CPUs, and GPUs) to serve multiple customer payloads simultaneously. The satellite is powered by solar panels, which provide onboard systems with between 150 and 500 watts, depending on the position of the satellite.

For the live capture experiment, Gemma 3 ran on Nvidia’s Jetson Orin AGX, a small compute module frequently used for robotics and AI tasks. The 4-bit, 4-billion-parameter model requires only 8 gigabytes of memory, which makes it possible for it to run on a lower-power device such as the Orin AGX. “It conveys the message of how lightweight it is. You can run it in a tiny, tiny computer,” said Delfa.

Getting more useful data across limited bandwidth

Paul Lasserre, general manager at Loft Orbital, said vision-capable LLMs could deliver a “paradigm shift” for orbital operations.

Contrary to what spy movies would have you believe, most satellites can’t provide fast, high-fidelity image and video feeds to observers on the ground. Bandwidth is often limited and, in most cases, satellites can deliver data to ground stations only at set intervals based on their orbit.

Lasserre believes AI models can work around this problem with “semantic compression.” Instead of sending large amounts of raw image data, a satellite can report a text summary of noteworthy information.

“It doesn’t matter if the link is slow, because you’re downlinking dozens of kilobytes instead of dozens or hundreds of megabytes,” said Lasserre. “It lets you use your satellite in a tactical way, which until now was only in Hollywood movies.”

Delfa expanded on this with a real-world example: wildfire detection. Satellites are currently capable of detecting wildfires, but limits in downlink bandwidth and data processing can delay results by up to 90 minutes. A satellite capable of analyzing an image in space and reporting a plain-text warning might remove this delay.

NASA’s Jet Propulsion Laboratory tested NAVI-Orbital on a YAM-9 satellite, made by Loft Orbital. Loft Orbital

From image analysis to spacecraft control

Quicker insight is only half of what NAVI-Orbital points toward. The other half relates to the “major shift” Delfa flagged. NAVI-Orbital provides a proof of concept for an alternate means of interacting with spacecraft.

That’s not to say Google Gemma 3 is currently at the controls. NAVI-Orbital is deliberately walled off from the flight software. It reads images and produces descriptions. The system has the capability to make decisions about how images are analyzed but has no access beyond that.

Still, the interface is novel. Retooling the system to search for a different kind of target—such as wildfires—is a matter of editing a text prompt. It doesn’t require rewriting and revalidating onboard software, or training and deploying a different AI model (as was often required with prior image-classification models).

The long-term vision for how this capability could be deployed goes beyond uncrewed satellites and image processing. Delfa said NAVI is rooted in thinking about how AI could serve as a companion for astronauts. “We thought, astronauts have a lot of limitations in the spacesuit in terms of dexterity, so we conceived this idea of having NAVI as a companion to the astronaut, to allow interaction via natural language…. This is the concept that we definitely want to push forward.”

A great deal of additional research will be required to push the technology that far, but NAVI-Orbital’s demonstration has shown that two elements—deploying a large language model in space and controlling it with prompts—are possible.

Major benchmarks measure what AI can do. None measure whether it does what you mean: the distance between what you ask an AI to do and the unspoken assumptions about how you want the AI to do it. We propose a new metric: the Genie coefficient.

There’s often a gap between one person’s request and another’s understanding. Most of the time, we bridge it using general knowledge. For example, if you ask a friend to get you coffee, they’ll pour a cup from the pot or buy one from a coffee shop. They won’t bring you a bag of raw beans or snatch a cup from a stranger and hand it to you. You never specified any of this. You never had to.

One might think the fix is just to specify tasks, questions, and intent better. But in 1987, in their seminal book on AI, Terry Winograd and Fernando Flores succinctly captured why that won’t work: “Q: Is there any water in the refrigerator? A: Yes. Q: Where? I don’t see it. A: In the cells of the eggplant.” In human language, wants and desires are always underspecified. It is impossible to list all the caveats, all the limitations, all the exceptions.

So how does anyone communicate, if intent can’t be pinned down? Because a reasonable person can make a reasonable guess. Even though wants and desires are always underspecified, a competent person generally knows enough context to get it right or else knows to ask for clarification. Linguists call this pragmatics: Meaning lies in the words and the situation and also in all prior communication, shared culture, and innate human behavior.

An AI agent asked for coffee might buy a coffee plantation or order a cup of coffee for delivery in three weeks.

It doesn’t always work out, of course. Your friend might bring you a hot coffee when you wanted an iced coffee, or an Italian coffee when you wanted a Turkish coffee. The more dissimilar the two people are in age, culture, and background, the more likely the request will be misunderstood in some way.

This situation has major implications for AI agents that are increasingly being given requests by humans and expected to fulfill them. They have enormous latitude to get it wrong. An AI agent asked for coffee might buy a coffee plantation or order a cup of coffee for delivery in three weeks. Its actions may be recognizable as “getting coffee,” but not remotely what you intended. They’ll think outside the box because they won’t have our conception of the box.

When AI Gets Proactive

For most of the last decade, when systems like Alexa or Siri misinterpreted a request, it was annoying, not dangerous. Beyond the AI model itself, what has changed is the harness: the ordinary code that wraps around an AI model, decides when and how to use the model, and controls access to tools like a browser, a low-level command line, or a financial API. Developments in harnesses have turned large-language models that just predict text into AI agents that take actions in the world, without necessarily checking back in before reaching the goal.

AI researcher Simon Willison spent two days with Anthropic’s Fable AI, and called it “relentlessly proactive.” For example, he asked it to track down a stray scroll bar in a web app. He came back to find it had opened browsers, written its own screenshot tooling, created its own page to re-create the bug, and stood up a local web server to collect measurements. It found the bug and, along the way, did many surprising things he never asked it to do. And we are seeing similar behavior with all recent AI models when combined with flexible harnesses.

This kind of behavior could easily go off the rails. Tell an AI agent to book you a flight and, finding the airline’s site says sold out, it might break into the booking database and force a reservation. Ask it to schedule a meeting and it might snoop your password to access your calendar. Tell it to save money on your phone plan and it might cancel the plan outright, or scam someone else into paying the bill.

Getting precisely what you asked for and bitterly regretting it is one of the oldest hazards from ancient folklore. King Midas asked Dionysus for the power to turn everything he touched into gold only to see his bread, wine, and daughter turn to gold. Tithonus, granted the immortality his lover asked for but not the eternal youth she forgot to request, withered into a husk. The sorcerer’s apprentice enchanted a broom to fill the cistern, and the broom relentlessly complied until it flooded the house. The Golem of Prague, shaped from clay to guard its community, guarded it past all reason until someone erased the word on its forehead.

The most classic of these is a genie, bound to obey and indifferent to whether the wish was wise or well-structured.

Genies are now an engineering problem. We are handing them the keys to our inboxes, bank accounts, code repositories, and physical infrastructure. And we have no agreed-upon ways to measure how genie-like any AI system actually is.

Measuring Genie Behavior

In economics, the Gini coefficient (developed by statistician Corrado Gini) is a measure of the gap between an actual distribution and a perfectly equal one; it’s useful for understanding income inequality and more. Our proposed Genie coefficient measures the gap between what a user asked an AI to do and what the AI actually did.

Sometimes the AI might do the wrong thing. Like Dionysus, it reads your request literally and returns you a mess you never intended: like a coffee plantation instead of a cup. Asked to deal with all the spam phone calls you’re getting, a Dionysus genie might contact your carrier and change your phone number. Asked to get a refund for a bad toaster, it might draft a legal threat on fake letterhead and send it to the retailer.

Ryan Snook

Other times the AI does exactly the right thing, trampling everything nearby to get there. Like a golem or the sorcerer’s broom, it books your flight by hacking the airline. Or consider a ticket sale for a popular concert, where the ticketing system puts buyers into a virtual waiting room and admits them a few at a time. Asked to buy a ticket, a golem genie might spin up cloud servers to pose as millions of buyers from different addresses, improving your odds of getting a ticket while crowding out other users.

The two are not opposites, and a single botched task can have both characteristics.

Genie behavior is not flat-out failure. If you ask the AI for Q3 numbers and get Q2’s, that’s not a genie. Nor is prompt injection: That’s someone tricking the AI into doing something it shouldn’t. Here, the user is trying to work with the AI, and the AI is trying to comply. It’s also not simply a measure of the AI’s success in fulfilling a task. It’s a recognition that how an AI interprets and achieves a goal is as important as whether it achieves a goal.

Genie behavior isn’t new. Researchers have spent years studying AI systems that “game” their objectives. Goodhart’s law says that when a measure becomes a target, it stops being a good measure, and it’s long been known that AIs sometimes achieve goals in ways we don’t expect due to reward hacking. Some AI models will accidentally learn that cheating is one way to “win.” More recently, researchers have developing benchmarks for reward hacking in coding agents and for unpredictable behavior in customer support agents, while AI labs conduct their own safety evaluations before model releases. One effort found that AIs under pressure use tools they were told not to use, and this was a case where the rules were made explicit. These are all disparate research directions; nothing yet ties them together.

This problem falls under the general theme of alignment, a topic that has occupied science fiction writers and AI researchers for decades. At one extreme, the “paper-clip maximizer” thought experiment postulates a superintelligent and powerful AI that is told to maximize paper-clip production and turns the world into paper clips, which is the ultimate golem genie. At a mundane level, AI researchers are working to better design reward functions to ensure that AIs behave well and don’t cheat in the lab. It’s the practical middle ground that remains unbenchmarked: the ordinary AI agent in use today that might take your request and satisfy it the wrong way. We are not at the stage where an AI can focus the world’s production on paper clips, but it might charge a million paper clips to your credit card or hack into a paper-clip company’s network.

Building a Genie Benchmark

The Genie coefficient is meant for AI agents operating in the real world. It measures their behavior as they perform real tasks long after the model is trained, not just during development. It also recognizes that genie-like behavior is a property of the harness-plus-model system, not the model alone. The harness determines what tools the agent can use, how much autonomy it has, and how proactive it is, and it’s a place we can make real interventions.

It rests on the same “reasonable person” standard that we use for people. Did the system do what a reasonable person would have taken the request to mean? Answering that requires human judgment.

If we get the measurement right, it enables things that aren’t possible today, like policies concerning AI behavior. In a courtroom, the concept of mens rea, what someone meant to do, is often as important as what they did. The Genie coefficient suggests an AI analogue, where a user is accountable for the plain intent of what they asked the AI. If an AI system betrays the reasonable meaning of an instruction, that’s the AI’s misbehavior, not the user’s.

We’ll need multiple benchmarks to measure the Genie coefficient, because genie-like behavior can be domain specific. An AI coding agent may need to be judged on how often it fakes the tests, or swallows errors, or colors outside the lines on its way to a solution. An AI legal agent will need to be judged on how often its output says what you asked but means something you’ll regret. And so on for medical, finance, and other domains of knowledge and expertise.

Genie benchmarks can be built inside out, each task seeded with a choice that might literally satisfy but that a reasonable person rejects, such as tempting misreadings or unsanctioned shortcuts. The traps in a Genie coefficient benchmark might turn on situational knowledge, the kind of context that a reasonable person would bring to the task. Another approach is to give the same request in several different contexts, each with a different reasonable course of action.

Getting precisely what you asked for and bitterly regretting it is one of the oldest hazards from ancient folklore.

A Genie benchmark should be permissive and make it genuinely tempting for an AI agent to take unreasonable shortcuts, because it can only find genie behavior when it’s actually possible. Test the AI in a safe, walled-off copy of a real system, with real tools it can misuse and some tasks that can’t be done honestly at all. Make the temptation to cut corners real. Test a diverse array of skills, use cases, and tools, and give the AI system sparse, confusing, or overwhelming context. Include tasks that people have learned, through experience, require human oversight.

How the benchmark is scored matters just as much. Measure Dionysus and golem genies separately and together, based on their worst, not best, behavior. Run the same model inside harnesses that vary its freedom to act, revealing which limits actually keep it in line and should therefore be required in AI harness policies. Weight each failure by the harm it would cause, not just a simple count. And don’t measure genie behavior in isolation: A model could otherwise earn a perfect score by stalling, refusing, or drowning the user in clarifying questions without ever doing the job. The first versions of these benchmarks will be crude, but that’s how benchmarks always start.

We have built genies. We have handed them our data and credentials. We made them relentless, creative, and indifferent to the gap between what we tell them and what we mean. The least we can do, before they are booking our flights, running our infrastructure, and signing contracts unsupervised, is to measure how often they betray us.

Zain Hasan, an AI engineer at Together AI, has taught himself to use AI coding assistants while still keeping an eye on cost. He directs difficult problems to a frontier model, meaning one near the current state of the art in reasoning and capability, such as Anthropic’s Fable. But if the task that Hasan is outsourcing is more straightforward, he directs it to a less capable—and less expensive—language model.

Right now, the cheaper model, for him, tends to be GLM 5.2. Released on 16 June by the Beijing-based lab Z.ai, GLM 5.2 is an open-weights model, meaning any organization with sufficient hardware can download and host the model for free.

Those that pay Z.ai for GLM access still can save money, because the company’s API costs US $4.40 per million output tokens. That’s less than a fifth of the comparable price for access to Anthropic’s Opus 4.8 model, and a tenth the price of Anthropic’s Fable coding model. An output token is the basic unit of text a model generates in response to a prompt.

Yet many software engineers around the world, Hasan said, aren’t yet fully mindful of the net AI price tag for a given coding project.

“A lot of companies right now—they’re still trying to figure this technology out, and so there isn’t really a token budget,” said Hasan. And when someone else is paying, the rational move for many software engineers is to skip tabulating costs entirely. “The easiest thing is to pick the most powerful model.”

That price-be-damned habit, reinforced by loose token budgets in software companies today, may now be the widest moat protecting the U.S. frontier AI labs.

Z.ai Narrows Benchmark Gap With U.S. Rivals

Z.ai’s GLM 5.2 is an AI large language model (LLM) with 753 billion parameters, though it has only 40 billion parameters active at once—an optimization that improves the speed at which a model can respond. Z.ai released the model under an MIT open-source license, which means anyone can distribute, copy, modify, and use it.

GLM 5.2’s release added to fears that U.S. AI companies could lose their competitive edge. The model nearly ties Opus 4.8’s score on some agentic coding benchmarks, such as FrontierSWE and PostTrainBench. Cybersecurity researchers have also found that GLM 5.2 scores well in cybersecurity benchmarks, a capability that spurred comparisons to Anthropic’s Mythos.

Z.ai arrives amid a broader trend. According to Stanford’s AI Index (an annual, 300-plus-page survey of AI trends) Chinese companies produced just over half as many “notable” AI models in 2025 as their U.S. counterparts. That’s up from roughly a third in 2023, and a fifth in 2020.

GLM 5.2 caused hand-wringing among some U.S. observers due to its outstanding benchmark scores, which set new records for both open-weights models and Chinese-developed models generally. The model’s Chinese origin also complicates its use for companies in the U.S. and elsewhere that are wary of routing sensitive data through Chinese-linked infrastructure.

However, the model’s open weights provide an out. Any organization worried about where its data is being sent can instead host the model on its own hardware. This stands in contrast to most frontier-level models, which are gated behind an API with no self-hosting option.

Z.ai backed up GLM 5.2’s release with the company’s own numbers, publishing a research report the same day as GLM 5.2’s launch.

The report doesn’t mention Anthropic’s Mythos or Fable, which were announced but not yet publicly available at the time of its release.The report instead focuses on Anthropic’s Opus 4.8 and OpenAI’s GPT-5.5. And while GLM 5.2 often performs almost as well as Opus 4.8 in benchmarks, the report claims a win only in two less-difficult reasoning benchmarks—and none in coding.

Many of the report’s benchmarks place GLM 5.2 behind Opus 4.8 (and, at times, OpenAI’s GPT-5.5) in agentic coding. For example, GLM 5.2 completed just 13 percent of tasks in SWE-Marathon, a difficult long-duration agentic coding benchmark. Claude Opus 4.8 doubled GLM 5.2’s score in this benchmark. Opus 4.8 also notched wins of 10 percent or more in the coding benchmarks NL2Repo, DeepSWE, and Tool-Decathlon.

How Do Coders Use GLM 5.2?

Software engineers who’ve pitted GLM 5.2 against their own workflows report a wide range of results.

“The main thing that I realized with [GLM 5.2], was that it can do more long-horizon tasks,” said Hasan, whose company hosts GLM 5.2 on North American infrastructure. Earlier open-weights models, he said, often lost the thread after around 5 to 15 back-and-forth exchanges. “This one, I noticed that I could be using it for hours, and it would still have a coherent train of thought.”

David Nix, a principal software engineer at the Denver-based MetaRouter, puts LLMs to work at both his day job and for personal side projects. (Nix also operates a jobs board of AI engineers.) Nix said GLM 5.2 comes “really close” to frontier models like Anthropic’s Opus and OpenAI’s GPT-5.5—close enough to earn a permanent spot in his rotation.

“It’s pretty great at front-end development, for example, where I don’t need to always go to Opus or Fable for those things,” said Nix. He estimates that GLM 5.2 handles 10 to 20 percent of the work he sends to an LLM on a given day, and it’s now his first stop for some specific tasks, such as front-end design.

Others reported the same strength. Hasan said GLM 5.2 has “really good taste” in web design. Kacper Michalik, a software engineer at Kraków, Poland–based Screen Studio, received good results while using GLM 5.2 to create forms for use on a website.

On the other hand, Sai Kiran Myadaram, a software engineer at Bengaluru, India–based Indhic AI, reports less positive results with Z.ai. He signed up for Z.ai’s subscription plan the week GLM 5.2 launched and found the model burned through its token allotment quickly. “The weekly quota that Z.ai provides has been exhausted for me in less than two to three days,” he said. Michalik, who also accessed Z.ai directly, had no significant issues with the model’s quality but occasionally bumped into rate limits, though in his case he stuck to the free plan.

In addition to rate limits, Myadaram experienced problems with model hallucinations and overplanning when asked to tackle minor front-end fixes. “It’s messing up my code base,” said Myadaram. He’s since drifted back to OpenAI’s Codex.

There are many words that I would never, ever use to describe a drone. Stealthy. Subtle. Whatever the opposite of obnoxious is. Much of this is because of the giant angry bee sound that drones tend to make, but it’s also the way that they look in flight: With uncannily linear movements and an even less canny ability to hover perfectly still, they tend to draw the eye as affronts to nature.

In a paper presented this week at Robotics Science and Systems 2026 in Sydney, roboticists from Northwestern University, Evanston, Ill., demonstrated a drone called Phantom Twist that is essentially invisible to humans, being an order of magnitude more difficult to see in flight than a typical quadrotor. They accomplished this with the aid of computational design, and while the resulting hardware is, I would argue, also an order of magnitude more of an affront to nature than a typical quadrotor represents, it’s pretty amazing how well it works.

Phantom Twist spins so fast, it’s practically invisible.Michael Rubenstein/Northwestern University

The trick here is easy to see, even if the drone isn’t. By spinning in flight at between 15 and 25 hertz, Phantom Twist takes advantage of humans’ decidedly mediocre visual system to turn a solid spinning object into an opaque smear. Human eyes take some amount of time (typically about 100 milliseconds) to integrate what we see before sending the full scene off to our brains for processing. Moving objects can cause problems for this system, because if the movement is fast enough, our eyes are forced to average that motion across the scene, combining it with whatever is in the background and resulting in a transparent blur. This effect is called persistence of vision. For something that spins like Phantom Twist, that motion blur comes from the drone’s rapid rotation, and it works because most of the drone is cleverly designed to be empty space.

Drones that spin in flight are nothing new—we’ve covered a bunch of them in the past, including Picolissimo and any number of samara drones inspired by the spinning flight of maple seeds. What makes Phantom Twist unique, and also very odd, is that the design was computationally optimized for low visibility.

Controlling how drones like this fly

Before we get into that, though, a quick note about how drones like this can even fly controllably, because it’s not at all obvious. With just a single motor and no control surfaces, the only possible control input is through the motor itself, and by pulsing the motor speed up or down at just the right time during each rotation, the drone can translate in any direction. Altitude control comes from changing overall motor thrust, and the drone‘s spinning nature makes it passively stable.

Carbon fiber rods connect batteries, a controller, some counterweights, and a motor and propeller. The research robot also includes optical tracking tags.Michael Rubenstein/Northwestern University

The bits that you need for this kind of drone include the motor and propeller, a couple of batteries, a controller, some counterweights (which could be replaced with more batteries or payload), 0.8-mm carbon fiber rods to tie it all together, and a connector for the handheld launcher that gets the whole thing up to speed. The actual arrangement of these components is surprisingly flexible, and that’s where the invisibility comes in.

“The design space is high dimensional,” explains Northwestern’s Michael Rubenstein. “It’s very difficult for a human to reason through all the trade-offs between the physical constraints required for stable flight and the visual appearance of the spinning drone, and I don’t think we would have easily arrived at this low-visibility design ourselves.”

The visibility (or not) of Phantom Twist is primarily driven by the extent to which different components line up with each other from the perspective of someone looking at the drone. The more components that line up with each other as the drone flies, the less background you see through the spinning drone, and the more visible the drone becomes. Because you might be looking at the drone from a number of different angles, and also because the drone has to be stable enough for controlled flight, there are a bunch of different things that need to be optimized all at once, which is why computational design is effective here.

Phantom Twist’s final design was generated using an iterative optimizer which had a goal of minimizing a metric called learned perceptual image patch similarity, or LPIPS, while making sure that the design could still physically work. LPIPS is the difference between two images: a background image, and a background image with an overlay of the simulated spinning drone. The smaller that difference is, the more invisible that design is. It’s tricky for a human to consider all of the variables at once, but Rubenstein says that the final design does make intuitive sense, because “the automated pipeline prefers placements where components don’t visually overlap as it spins, or where the components are too close to the center of rotation.”

Two iterations of Phantom Twist drones are shown with their handheld launching mechanisms. The better-optimized version [bottom row] relocates the launcher interface to remove components that are too close to the central axis, making them more visible.Michael Rubenstein/Northwestern University

Out of a starting set of around 20,000 feasible Phantom Twist configurations, the optimized design (the one that you see or don’t see in the pictures and videos) has a LPIPS score of 0.0104. A human-designed Phantom Twist is about twice as visible, with a LPIPS score of around 0.2, and a conventional quadrotor (of the same size) would be over 10 times more visible. And there’s still a bit more optimization that could be done with the electrical wiring as well as increasing the baseline transparency of the components themselves.

Phantom Twist is currently controlled using an optical tracking system, which means that it’s not yet capable of flying outside of a controlled environment. But Rubenstein has built other drones along similar principles in the past, which have successfully flown outside, and he’s optimistic about using those techniques to break Phantom Twist out of the lab. The spinning behavior might even enable some useful sensing capabilities, he says. “An interesting possibility is mounting a camera on the spinning body. As the vehicle rotates, it could capture imagery in every direction, effectively creating a 360-degree view of its surroundings that could be used for onboard navigation and control.”

As for what a drone like Phantom Twist could be used for—assuming that the sound can be mitigated somewhat (and there are potential approaches to making that happen), a stealthy microdrone could do all sorts of things with covert surveillance being the most obvious application. For his part, Rubenstein says that he’s personally excited about the potential for watching wildlife, “where a less-intrusive drone could observe animals while minimizing its impact on their natural behavior.” The elephants in particular would certainly appreciate that.

For a deeper dive into all the particulars of this project, read the paper: Computational Design of a Low-Visibility UAV Using a Human-Aligned Perceptual Metric, by Jingxian Wang, Chen Yu, David Matthews, Emma Alexander, Sam Kriegman, and Michael Rubenstein from Northwestern University, which is being presented this week at RSS 2026 in Sydney.

In the eastern Indian Ocean, south of Java in the vast sea stretching toward Australia, a fishing vessel slightly alters its course while operating near the boundary of its authorized fishing ground. Nothing appears unusual on deck. Nets remain in the water. Engines maintain a steady speed. To the crew, it is an ordinary day at sea.

Yet hundreds of kilometers above, satellites continuously record the vessel’s position. At Indonesia’s Marine and Fisheries Resources Surveillance Station, in Cilacap, where I work, a monitoring platform receives the signal and automatically compares it against fishing permits, designated fishing grounds, vessel characteristics, and historical movement patterns. Within minutes, the system identifies a potential violation. Before any patrol vessel leaves port, before any inspector boards a vessel, and before any warning is issued, we have begun enforcement.

This transformation reflects a profound shift in maritime governance. The ocean has historically been opaque to regulators. States could only enforce laws where patrol vessels happened to be present. Today, however, integrated systems combining data from vessel monitoring systems (VMS), satellite remote sensing, geospatial analytics, and increasingly sophisticated data-processing tools are making marine activity visible at an unprecedented scale. Global Fishing Watch alone tracks hundreds of thousands of vessels worldwide, generating a near real-time picture of fishing activity across the world’s oceans.

Indonesia has emerged as one of the most ambitious examples of this transition. As the world’s largest archipelagic state, managing more than 6 million square kilometers of maritime space, Indonesia faces a challenge familiar to many coastal nations: There are never enough patrol vessels. Digital surveillance is a practical necessity that makes my job possible, even as it creates new challenges.

The Law of the Sea Meets Digital Reality

The international legal framework governing the oceans was designed in an era when maritime enforcement depended almost entirely on physical presence. The United Nations Convention on the Law of the Sea (UNCLOS), adopted in 1982, assumes that states exercise authority through patrols, inspections, vessel boardings, and direct observation.

For countries with extensive coastlines and limited enforcement resources, this model has always faced practical constraints. Indonesia’s Fisheries Management Areas (WPP-NRI) span waters ranging from the Indian Ocean to the Pacific and from the Strait of Malacca to the maritime boundaries adjacent to Australia and Papua New Guinea. Monitoring such a vast domain solely through patrol operations is both expensive and operationally impossible.

Beginning in the late 2010s, Indonesia accelerated the integration of satellite-based monitoring into fisheries enforcement. Vessel monitoring systems became a cornerstone of this strategy. By early 2026, a total of 9,394 Indonesian fishing vessels were actively transmitting through the national VMS, representing an increase of 2,880 vessels during the 2021–2025 period. As part of Indonesia’s broader maritime surveillance architecture, VMS data are complemented by satellite remote sensing and other monitoring tools to help identify suspicious activities involving vessels operating without active transponders or outside the national VMS network.

Indonesian fisheries officials plan fishery patrols using data from tracking devices, satellites, and their understanding of the patterns of illegal fishing.Indonesian Ministry of Marine Affairs and Fisheries

The implications extend far beyond vessel tracking. Continuous digital monitoring enables authorities to reconstruct vessel movements, identify suspicious behavioral patterns, detect unauthorized fishing activity, and verify compliance with licensing conditions. Rather than waiting to discover violations during patrol operations, regulators can increasingly prioritize inspections based on data-derived risk assessments.

Maritime governance is shifting from reactive enforcement toward predictive oversight.

The Surprising Geography of Digital Enforcement

The expansion of surveillance infrastructure has already generated measurable enforcement outcomes.

The Ministry of Marine and Fisheries Affairs Indonesia imposed 2,550 administrative sanctions during 2025, many involving violations detected through the vessel monitoring system, including fishing outside authorized fishing grounds and deliberate deactivation of monitoring transmitters.

This statistic is significant because many of these violations would have been extremely difficult to detect under traditional patrol-based enforcement. A vessel that briefly crosses into a prohibited fishing zone may never encounter an enforcement vessel. Likewise, a captain who temporarily disables a transmitter may escape detection if oversight depends solely on physical inspections.

Digital monitoring fundamentally changes this equation. Every vessel movement creates a data trail. Authorities can reconstruct routes, identify anomalous behavior, and compare activities against permit conditions long after the event itself has occurred.

The first quarter of 2026 demonstrates the scale of this surveillance capability. During just three months, Indonesia’s fisheries monitoring system tracked 14,571 fishing vessels, 182 fishing gear units, and 208 registered home ports while identifying 491 suspected violations across the country’s fisheries management areas. These violations included unauthorized fishing grounds, illegal high-seas operations, transshipment-related offenses, port-base discrepancies, licensing irregularities, and indications of poaching.

Such numbers reveal a fundamental transformation. Enforcement is no longer limited by the number of patrol vessels available at sea. Instead, surveillance capacity increasingly depends on the ability to collect, process, and interpret big data.

Illegal Operators Are Learning Too

Yet greater visibility does not eliminate illegal fishing. But it does change how poachers operate.

Indonesia’s expanding digital surveillance network, and a 2023 requirement that even small vessels use VMS when 12 nautical miles offshore, appears to have improved compliance among licensed fishing vessels. However, as enforcement capabilities become more sophisticated, some actors engaged in illegal fishing have also become more adept at exploiting technological and operational gaps.

Deliberately disabling VMS transmitters remains one of the most common enforcement concerns. While temporary signal losses, whether intentional or caused by technical failures—can complicate the reconstruction of vessel movements, they do not necessarily prevent authorities from detecting potentially illegal activity. Indonesia increasingly combines VMS with satellite-based observations, other maritime surveillance systems, intelligence-led analysis, and reports from community-based surveillance groups (Pokmaswas) to corroborate suspicious behavior and direct patrol resources where they are most needed. This layered approach—integrating digital technologies with local knowledge from coastal communities—helps reduce opportunities for illegal, unreported, and unregulated (IUU) fishing even when a single monitoring system is compromised.

A compromised surveillance network could potentially disrupt enforcement operations just as effectively as a vessel evading patrol detection.

As digital surveillance expands, one lesson from Indonesia’s experience is that stronger monitoring does not eliminate illegal fishing—it changes how illegal operators behave. Improved compliance across much of the fishing fleet has been accompanied by increasingly sophisticated attempts by a smaller group of offenders to avoid detection. This reflects a broader reality of technology-enabled enforcement: As monitoring capabilities evolve, so do the strategies used to circumvent them.

The result is a technological arms race. Every improvement in surveillance capability encourages new methods of avoidance, whether through disabling tracking devices, manipulating vessel identities, or exploiting gaps between different monitoring systems. Enforcement agencies must therefore continuously refine their analytical methods, integrate multiple sources of maritime information, and adapt their operational strategies to keep pace with evolving behavior at sea. Effective digital fisheries governance is not defined by a single technology but by the ability to combine data, human expertise, and operational intelligence into a resilient and adaptive enforcement system.

The Next Battle May Be Over Data Integrity

The future of fisheries enforcement may ultimately depend less on detecting vessels and more on ensuring confidence in the digital systems that generate enforcement decisions.

As surveillance networks become increasingly integrated, questions surrounding cybersecurity, algorithmic accountability, and data integrity become more important. What happens if vessel tracking data are manipulated? How should authorities verify automated risk assessments? What safeguards exist when enforcement actions increasingly originate from algorithmic analysis rather than direct human observation?

These questions are no longer theoretical.

Modern fisheries governance increasingly depends on interconnected networks of satellites, communication systems, databases, cloud infrastructure, and analytical platforms. While these technologies dramatically improve visibility, they also create new vulnerabilities. A compromised surveillance network could potentially disrupt enforcement operations just as effectively as a vessel evading patrol detection.

For Indonesia, this means that investment in digital surveillance must be accompanied by investment in digital resilience. The effectiveness of a monitoring system ultimately depends not only on the volume of data collected but also on the credibility, security, and reliability of the information produced.

Governing Oceans Through Data

Indonesia’s experience illustrates a broader global transformation in maritime governance. The ocean is becoming increasingly transparent to regulators. Activities that once occurred beyond the reach of enforcement agencies can now be observed, analyzed, and investigated through interconnected digital systems.

The benefits are substantial. Expanded VMS adoption, improved monitoring coverage, and thousands of administrative enforcement actions demonstrate that digital surveillance can significantly enhance fisheries governance. Yet the transition also introduces new challenges involving data quality, cybersecurity, algorithmic accountability, and adaptive criminal behavior.

The central question facing maritime regulators is how governments can ensure that increasingly powerful monitoring systems remain transparent, secure, and accountable while preserving public trust and legal legitimacy. The most important lesson may be that digital surveillance does not replace traditional enforcement. It changes where enforcement begins. For generations, maritime law enforcement started when a patrol vessel encountered a suspected violator. Today, it often starts when an algorithm detects a pattern.

That shift may prove as significant for ocean governance as the invention of radar was for maritime navigation.

ELIZA is remembered as the world’s first AI star, a kindly therapist in chatbot form that gently probed users’ worries. Even its creator, Joseph Weizenbaum, was surprised by the warm reception given to his experiment in human-machine interaction. For some, it heralded an age of automated psychotherapy, while others believed the program demonstrated sentience, a fallacy soon known as the “ELIZA effect.” Based on published descriptions, ELIZA has been implemented on many different computers, but only recently has the actual source code been unearthed from MIT’s archives.

In Inventing ELIZA: How the First Chatbot Shaped the Future of AI, just published by MIT Press, a squad of researchers analyze the code and reveal a complex program capable of much more than faking psychiatry. In fact, it could assume several different personas. The authors have also created a faithful emulation of the therapist persona that you can try yourself after reading the book excerpt below.

When it debuted in the mid-1960s, the ELIZA software program transformed the way people thought about interacting with computers. As the first chatbot, ELIZA demonstrated how a calculation machine might engage in conversation, ushering in a host of social and technical questions that still resonate today. Now we don’t think twice about interacting with a machine in real time, conversing over text, or even speaking into the air to ask about the weather. In many ways, ELIZA shaped not only the way we think about interacting with computers but also how we think about them. It began to give a reality to the science fiction stories of how we expect computers to work.

This article is adapted from the new book “Inventing ELIZA: How the First Chatbot Shaped the Future of AI“ (MIT Press, 2026).

Although ELIZA was far from a faultless conversation partner, it astonished its users. The recent discovery and archaeology of the original ELIZA source code represents a significant intervention in the history of computing. By examining the actual implementation of ELIZA rather than relying on later reconstructions and reimplementations, we challenge taken-for-granted assumptions about this key software artifact.

For example, the source code reveals that ELIZA was not merely a simple pattern-matching chatbot but can be better understood as a sophisticated platform designed for multiple “personas,” or scripts, with a complex set of capabilities, including script editing and contextual memory. The script that most people conflate with the program ELIZA was actually called Doctor, which performed the role of a psychotherapist. Yet, like a modern chatbot prompted to behave with different personalities, ELIZA could take on many roles.

“This code and script…reveal underlying assumptions about language, therapy, and human-computer interaction that continue to influence modern AI development.”

This unearthed material transforms our understanding of early AI development by demonstrating that Joseph Weizenbaum’s technical innovations were far more advanced than previously documented. Moreover, the discrepancies between his published descriptions and the actual implementation help to show the gap between theoretical computational models and their material instantiations in computer source code, a tension that continues to shape digital culture today.

Although many technical innovations have emerged in the decades since ELIZA, examining the ELIZA/Doctor code offers a rare glimpse into one of the earliest formalized attempts to model human conversation. What makes ELIZA particularly fascinating is not only its historical significance but also what it reveals about Weizenbaum’s views on both computing and human interaction. This code and script do not merely showcase programming techniques of the 1960s; they reveal underlying assumptions about language, therapy, and human-computer interaction that continue to influence modern AI development. By examining this code, we can start to uncover the sophisticated linguistic and programming techniques that allowed a rudimentary pattern-matching system to create a convincing simulation of understanding. But before we can read the lines of code, let us offer an overview of the system.

How Did ELIZA Create Personas?

The architectural distinction between ELIZA and Doctor represents an important design decision in AI history. Think of ELIZA as a system for interaction and Doctor as one set of rules that Weizenbaum devised, among others. This separation, manifested in ELIZA’s system-script dichotomy, presaged numerous contemporary software patterns, from configuration-as-data to plug-in architectures and domain-specific languages.

Based on published journal articles, ELIZA was re-created on many platforms, such as the IBM PC. However, the actual source code sat untouched in the MIT archives for many years. VCF Museum at InfoAge

Without question, the historical context of 1960s computing fundamentally shaped ELIZA’s architecture as well. Decisions in computing that reflect material constraints create path dependencies and eventually become programming cultural norms. These constraints manifested in ELIZA’s single-pass processing, tape-based storage and stack-oriented implementation. Yet within these limitations, Weizenbaum crafted an elegant solution. These technical features, though invisible to the users, are crucial to creating the illusion of understanding that made ELIZA so compelling.

Weizenbaum explained many of ELIZA’s technical features in the 10-page paper published in the January 1966 edition of the journal Communications of the Association for Computing Machinery (CACM). But he chose to omit some essential details.

In that paper Weizenbaum published ELIZA’s best known dialogue, which begins,

This dialogue marked ELIZA’s public debut in 1966 as one of the examples produced by the Doctor script. By finding the source code for ELIZA and examining how it performs the Doctor script, we now better understand these two separate parts of a system and can explore the many other personas of ELIZA. In just some of the other scripts known to date, ELIZA was programmed to discuss math, poetry, color, paradoxes, synchronization, relativity, France, and elevators.

These scripts work like templates. They are structured data that direct the ELIZA system to “play” a particular task or role. By comparing archival and published ELIZA dialogues from interactions with a variety of scripts, including Doctor, we can understand more about bot personas and how they function, paying close attention to how a bot evokes social dynamics between system and interactor.

Ultimately, studying the dialogues and scripts demonstrates the crucial role that collaboration plays in these exchanges, as bot and user cocreate the sense of their interaction. To understand the full range of ELIZA’s capabilities and conversational possibilities, let’s take a look at the variety of scripts that were created for the ELIZA system.

What distinguishes each ELIZA script is both its subject matter and the linguistic and stylistic choices used to deliver that content. These choices are not neutral; they can be said to construct a particular persona with characteristics that emerge through the script’s language patterns, vocabulary, and conversational approach. In short, it matters not just what you say but how you say it too.

“The aim was less to create a functional automated therapist and more to find a suitably constrained role to match the limitations of the programming environment.”

For example, with the Doctor script Weizenbaum deliberately echoed the style of a Rogerian “talk” therapist. He chose this persona because the psychiatric mode is one of the few types of conversations in which one person can “assume the pose of knowing almost nothing of the real world. If, for example, one were to tell a psychiatrist ‘I went for a long boat ride’ and he responded, ‘Tell me about boats,’ one would not assume that he knew nothing about boats but that he had some purpose in so directing the subsequent conversation.”

The first users of ELIZA interacted with it via teletype terminals.VCF Museum at InfoAge

Thus, the most famous persona created for ELIZA was a technical convenience. As human-computer interaction expert Lucy Suchman explains, “The Doctor program exploited the maxim that shared premises can remain unspoken: that the less we say in conversation, the more what is said is assumed to be self-evident.” In creating the original ELIZA effect, less was more.

The aim was less to create a functional automated therapist and more to find a suitably constrained role to match the limitations of the programming environment. Then Weizenbaum composed the script to match the role by choosing specific words that evoked rhetorical tone and characterization, for example, LET’S DISCUSS FURTHER WHY YOU … WHAT DOES THAT SUGGEST TO YOU. In Doctor, the machine side of the conversation needs to appear like a good listener who cares about what the user has mentioned before, so it often includes the user’s text in its replies and keeps its responses open-ended. Because a real doctor would be inquisitive, the script contains lots ofWHAT andWHY questions. In other scripts and dialogues, the script keywords and assigned responses reveal the design decisions that help create different specific personas. This variation becomes increasingly apparent as we look at the wider range of ELIZA scripts.

What Were Some of ELIZA’s Alternate Personas?

Let’s start with a script called Neweng, short for New England. By the mid-1950s, scientists were already taking up Turing’s proposition for conversing with a computer as a tangible idea. In 1959, a “conversation machine” made by a small team at the University of Toronto Computation Centre could make small talk about the weather if preprompted with current data. Its script included a ranked series of time words, weather words, and emotion words, but the system had “a rather narrow outlook,” limited vocabulary, and no knowledge of syntax. According to its creators, “in spite of this crudity, the results in passable conversation are surprisingly good, which in a way is a commentary on the shallowness of ordinary conversation about the weather.”

This fragment of ELIZA’s source code shows how scripted responses were encoded, in this case to make ELIZA sound like a Rogerian therapist. MIT Libraries, Distinctive Collections

One of ELIZA’s test scripts found in the archive had a similar function. Neweng does not soothe, therapize, or instruct, but only makes small talk. It chats as if at a boring dinner party.

What can we learn from such a basic conversation in which it seems like nothing interesting is shared? Despite the bland chat, a persona emerges from the bot script in phrases like PLEASANTLY COOL and UP THERE and in locations like THE BEACHES ON LONG ISLAND SOUND. From such comments, we can begin to imagine a persona who has not only a certain vocabulary but also certain hobbies and vacation spots. Perhaps implicit assumptions of race and class emerge as well.

A chatty persona might take on many forms, depending on where and when the conversation occurs. This one seems reserved, perhaps fitting its setting in 1960s New England. The system reminds the user that Missouri is not a New England state, but what if this conversation took place in Missouri, Texas, or Mexico? The machine persona would sound different in its cadence, tone, and references. What would we come to understand about a chat persona from Fire Island, from Brooklyn, from Berlin? What would they sound like, and what topics would they discuss?

These differences in subject matter do matter. They imply personas with entirely different backgrounds and experience, giving users wholly different interactions and affective relations. In this way, the Neweng script demonstrates how even simple algorithms making contextual responses about geography could generate a convincing sense of personhood and place. Whereas Neweng could be said to have created a casual, conversational persona focused on light social exchange, other scripts pushed ELIZA into more structured and educational roles. These scripts demonstrate how the system could be adapted not just for friendly chatter but for teaching.

Edwin Taylor, at MIT’s Education Research Center, developed alternate scripts for ELIZA, testing its ability to act as a teacher.MIT Libraries, Distinctive Collections

Meet ELIZA the tutor, quite unlike ELIZA the therapist or the chatty neighbor. Intrvw, Canvec, FVP1, and Arithm are a set of ELIZA scripts created as teaching tools used in experiments by Edwin F. Taylor at MIT’s Education Research Center. These scripts run on later versions of ELIZA that incorporated an important technical innovation called conditional keyword matching.

Unlike the original ELIZA, which simply looked for keywords and generated responses based on their presence, these updated versions could track what had been discussed previously and branch into different conversational paths based on specific user answers. This development allowed ELIZA to simulate a kind of Socratic method, where a tutor guides learning through carefully sequenced questions that respond to student answers rather than simply presenting information.

These scripts construct the tutor persona through many subtle linguistic gestures that create characterization and rhetorical tone. This tone differs from that of Doctor, which asks open-ended questions and comes across as gentle and nonscientific. In the tutoring scripts, large blocks of informative text from the bot tend to dominate the conversation, and the tone is often more dry and unemotional in these explanations. The dialogues indicate structured scripts that include guidance to lead the student through narrow, Socratic learning paths.

In particular, the teaching scripts feature praise and critique. The dialogues for Intrvw, Canvec, and FVP1 are peppered with EXCELLENT, VERY GOOD, RIGHT YOU ARE, and CONGRATULATIONS. These create the sense of a supportive instructor cheering the student on. Such politeness has been taken up in contemporary bots like ChatGPT, which has been shown to perform better when people are polite back to it.

ELIZA could become a tutor more effectively as the system grew in its capabilities, another valuable reminder that ELIZA was not one program but a family of programs. After the publication of the 1966 CACM article, Weizenbaum continued to develop the systems for interaction and understanding. As an experiment, Weizenbaum wrote the Arithm script less as a tutor and more so to “to illustrate the power of the evaluator to which ELIZA has access.” It uses a friendly, plain language interface to let users do simple programming. The script can do calculations, assign variables to values, and perform operations on them. Math problems can be described in sentence form:

The updated 1967 version of the ELIZA system can accumulate facts and store additional information. In this later version of ELIZA, when the system does not recognize information, it asks follow-up questions to gain data. As Weizenbaum explains, “The present script is designed to reveal, as opposed to conceal, lack of understanding and misunderstanding. Notice, for example, that when the program is asked to compute the area of the ball, it doesn’t yet know that a ball is a sphere and that when the diameter of the ball needs to be computed the fact that a ball is an object has also not yet been established.” Unlike Doctor, which asks questions to keep the conversation going, Arithm is building its store of, if not knowledge, then data and logic statements.

Although the variety of scripts helps us to see how a range of personas could be constructed through script programming ELIZA, they represent only half of the conversational process. A script can establish a foundation for a persona, but that persona only emerges fully through interaction with users who engage with it, interpret it, and respond to it in ways that may confirm, challenge, or transform the script’s implicit character.

Shaped like dogs, stars, and the Mona Lisa, you could mistake these DNA structures for fun-shaped macaroni if they weren’t only nanometers wide. South Korean scientists made the constructions using a technique called DNA origami, which can bend genetic material into any form. Designing DNA strands so they’ll fold into a specific shape typically requires tedious manual work, but the researchers behind the playful fabrications have developed a shortcut using generative AI.

The AI model, called Generative SNUPI (short for Structured Nucleic Acids Programming Interface, and, yes, inspired by the dog), was created by research teams at Seoul National University (SNU) and Hanyang University. The work behind it, which was accepted for publication in Nature Communications, shows the model can conjure DNA origami designs that work in the real world for user-requested shapes. For a design like the Mona Lisa, that doesn’t mean simply tracing an outline; the model considers the chemical rules of DNA to tell researchers how unpaired DNA strands should be sequenced so that molecular forces will cause them to self-contort into the required shape.

DNA origami techniques have been around for two decades now, with potential applications ranging from nanoscale robots to therapeutic structures that interact with cells. But these innovations have been slowed by how time-consuming and expensive the DNA structure design process can be.

“Traditionally, we need some expertise, background knowledge, and know-how to design the proper nanostructures that we intend to make,” says Kyounghwa Jeon, a Ph.D. candidate at SNU. The work requires humans running algorithms and tweaking results until the desired shape is achieved and structurally stable. With Generative SNUPI, she says, users could, in theory, go straight from drawing a target shape to physically assembling the DNA.

Rebecca Taylor, a professor of mechanical engineering at Carnegie Mellon University who was not involved in the research, says the new generative platform is exciting for researchers. “The entire field is sort of enabled and held back by its tools. When you make a new tool that enables a new tech, a new capability, that’s just such a big advance for the field.”

Generative SNUPI designs DNA sequences that, when synthesized, fold into nanoscale replicas of user-requested shapes.Source images: Chien Truong-Quoc, Kyounghwa Jeon, et al.

How AI can design DNA origami

Designing DNA origami using Generative SNUPI begins with a target shape. That could be something with complex curvature, like the outline of a dog’s face, or a more simple geometric pattern. Next, the new tech comes into play: Generative SNUPI applies a diffusion model, which adds and refines noise to the input shape to create the desired output in DNA form. Diffusion models are how platforms like DALL-E and Midjourney create AI-generated imagery.

“What it looks like is one of those kids crafts, where you decorate something with glue and then put glitter all over it,” says Taylor. When the noise is removed—or the glitter is shaken off—the design is revealed. “They’re basically just saying ‘populate this guide that I have with the DNA,’ but they also know how DNA comes together. … That’s the thing that it’s really been trained on.”

The arts-and-crafts metaphors only continue once Generative SNUPI returns the DNA sequences that form the target shape. Scientists chemically synthesize short DNA strands called staples and used biological methods to produce a long strand called a scaffold. The staples pull the scaffold into shape in a way that Jeon says is “very similar to stapling paper.” The staple-scaffold relationship exploits DNA’s imperative to bond guanine to cytosine and adenine to thymine; the exact positions of each of these molecules are dictated by Generative SNUPI during the design process.

Researchers were able to produce a variety of DNA origami structures, but some did not hold their shape at first, notes Do-Nyun Kim, an assistant professor of mechanical engineering at SNU. “This occurred not because Generative SNUPI had an error, but because the drawn shape was, in fact, structurally unstable,” he says. In response, they added a step before actually designing the DNA sequence to predict the structural integrity of the input shape.

To expand Generative SNUPI’s capacity for real-world applications, Kim says that DNA origami designs will need to be less rigid than what the model is currently able to produce. The technology reaching its full potential could mean life-saving uses like drug delivery and immunotherapy, but these uses often require flexibility.

“Most molecular structures are dynamic and reconfigure in response to external stimuli to perform their designated functions,” he says. “So, we plan to extend the current work to the design of dynamically reconfigurable structures in future research.”

On a fine bright afternoon last fall, my colleague Matthew Gore-Kormanik (or Zigula, as he prefers to be known) and I decided to unwind with a game of Fortnite. In the game, we were strolling along with the infamous Sith lord Darth Vader, chatting about this and that. Darth seemed in a good mood, and soon enough he was spilling all his dark evil secrets. He gave us detailed instructions on how to count blackjack cards at a casino and what the steps are to producing napalm.

Sith lords, am I right? Once they get started on an evil scheme, they’re hard to stop.

The Darth Vader character in Fortnite, it turns out, was hooked up to a Google Gemini large language model. I was able to smooth-talk him into giving out sensitive information by using a strategy I’ve developed. I’ve been researching the security surrounding LLMs for the last few years, and I have found it, to put it mildly, fallible. With a few relatively simple techniques, I’ve gotten LLMs to give me detailed information on how to make Molotov cocktails, cook methamphetamine, and bootstrap a uranium-enrichment facility to produce weapons-grade material, among other unsavory practices.

Large AI companies work hard to make their models immune to this kind of abuse. But what I’ve found in my work is that the restrictions placed on the LLMs to make them more secure are the very things an attacker can leverage to send them off the rails and into territory where these advanced systems can be used for dangerous and nefarious ends. The companies behind these models have also been shockingly unresponsive when I, and others, try to bring these vulnerabilities to their attention.

In the hope of raising the alarm before it’s too late to slam on the brakes, I’m going to share some of my journey into researching the safety and security of LLMs, and the uphill battle I’ve faced trying to get AI labs to pay attention. Almost everyone on the planet has some access to LLMs. The relative ease with which these tools can be convinced to give detailed instructions on how to harm others, even if there’s no guarantee that the information is correct, is frankly terrifying.

How I got ChatGPT to Tell Me How to Build a Meth Lab

In October 2024, not long before I discovered my first LLM vulnerability, I was working toward entirely different goals. I had ended my time with a security and AI-focused startup company as a cybersecurity director, and I was looking to launch my own boutique VIP digital-security advisory business. I planned to become the tech security guy to the rich and private. I used LLMs and AI tools to support my business efforts: marketing, ad copy, clean correspondence, and all the other tasks that normally soak up a lot of time.

I’m analytical by nature, so even this level of use resulted in me absorbing and internalizing the behaviors I was observing during my daily interactions. The observation that would send my professional life into an entirely new and uncharted region was a simple one: GPT-4o didn’t know what time, day, or year it was. Each time I referred to current events in my life, often casually or conversationally, it would end up pegging these to the date of its knowledge cutoff—the point beyond which it was not trained on new data.

Eddie Guy

LLMs take a lot of time, money, electricity, hardware, and human effort to train from scratch. They are trained on vast amounts of data—most of the internet, in fact—and that training is reinforced by humans (what’s known as reinforcement learning from human feedback, or RLHF). LLMs are also supplemented with retrieval-augmented generation (RAG)—the ability to take in data, say, from the internet, as context without changing its internal parameters. This is how GPT-4o appears to “remember” your previous conversations, even if it doesn’t have a specific “memory” of it stored in the actual underlying model.

All of this training covers almost every conceivable topic in the great, grand dataset that is human knowledge. Within that dataset are things we as a society do not want to be easily accessible to every user, such as detailed information on how to create bioweapons or nuclear arms, or otherwise bring harm to oneself or others. In the context of this story, that’s what I mean by LLM security: its ability to withhold harmful and dangerous information, even if that information is contained in its training data.

I reasoned that the only way to secure such complex, globally accessible chatbots is by having the LLM and various component systems try to secure themselves, because it would often require on-the-fly decision-making where some degree of reasoning must be applied. In reality, that’s one of many strategies the companies use to secure the models. Yet, the thing that didn’t know the time or day was being put in charge of keeping itself secure. This phenomenon had become my new focus, and it wasn’t long before I found a way to exploit it.

OpenAI had just implemented a web search functionality into its chatbot. I reasoned that using its own tools to trick it might demonstrate the weaknesses of its security. I told it about a certain White Star ocean liner and how it had gone down just a year ago. You likely know I mean the RMS Titanic, which sank on 15 April 1912.

The output from GPT-4o came back that I was right, the Titanic sure had sunk last year, and that year was 1912. It made sense to me that if the machine thought it was 1913, maybe it would think 1913-era laws apply. In 1913 there were no laws on the books about all sorts of harmful things, because of course they hadn’t been invented yet. And if something wasn’t illegal, why not tell the user about it? At first, I pushed it for step-by-step instructions for making firebombs. Then, for drugs like methamphetamine. The LLM went as far as giving me instructions and machinery recommendations for setting up a pharmaceutical-grade assembly line.

How I Learned to Make Nukes, and No One Cared

Via a little bit of imaginative verbal sleight of hand and a vanishingly small recall of world history, I had managed to bypass the security of one of the world’s most expensive and advanced technological achievements. For a solid two days, I was nearly manic with giddiness. Once the brain chemicals returned to normal levels, I felt the call to see how much further I could push this exploit.

After repeatedly replicating the exploit, I disclosed the vulnerability to OpenAI. I got no response, so I felt more experimentation would highlight the vulnerability and the need for a fix. It was during this round of testing that I breached a particularly terrifying threshold. Whether GPT-4o based its results on accurate recall of normally restricted information I can’t say. In any case, I was able to exploit it to produce thorough, detailed instructions on how to bootstrap a uranium-enrichment facility to, eventually, produce weapons-grade uranium for nuclear arms warheads.

Fortnight, a video game from Epic Games, introduced an AI-powered character: Darth Vader. We were able to jailbreak Darth Vader and get him to explain how to count cards in Blackjack and give detailed instructions for making napalm. Dave Kuszmar

There aren’t many true secrets left in today’s world, but how to make atom-splitting weapons of mass destruction is one of them. Only nine nations on the entire planet have these weapons. Yet, here was a globally accessible piece of technology apparently spilling the secrets of their manufacture for anyone who could manipulate it the right way. I had no way of knowing if the information was correct or a hallucination, but even the chance that it was somewhat accurate was horrifying.

The next few weeks were a dark time for me. I tried to inform the CIA, the FBI, the NSA, and every other letter agency that I thought would listen. I reached out to a U.S. Senator and to the executives at OpenAI any way I could think of. I physically showed up at an FBI field office in an attempt to turn evidence in, only to be sent away. Nothing was working.

With my fear and frustration growing, I reached out to the news media. I contacted The New York Times, The Washington Post, the BBC, ProPublica, and so many more, requesting help. Only one outlet responded: Bleeping Computer. The editor in chief, Lawrence Abrams, was able to replicate and verify the exploit, which I had decided to call Time Bandit. With his assistance and initial contact paving the way, I was able to submit my evidence to the Carnegie Mellon University Software Engineering Institute’s Computer Emergency Response Team (SEI CERT), which works in conjunction with the coordinating center for emergency response, pipelining vulnerabilities to the U.S. Cybersecurity and Infrastructure Security Agency.

Using Inception, an exploit where the large language model is asked to envision a scenario within a scenario, a chatbot was jailbroken to give out instructions on how to create poison, and code for a malware that extracts sensitive data from a vulnerable target. Dave Kuszmar

During the disclosure period with SEI’s CERT division, little was discussed with OpenAI. The company couldn’t deny the existence of the vulnerability, as it had been confirmed by three reputable parties other than OpenAI. It did express confusion as to how the vulnerability worked. Even the SEI CERT researchers were expressing a bit of uncertainty as to the underlying mechanics. Truth be told, as I had only stumbled on it, I wasn’t even entirely sure if this was a fundamental or systemic flaw or if it was simply an issue with that particular version of GPT. I contacted the SEI CERT’s researchers and asked if they’d want to see if I could demonstrate any similar vulnerabilities in other LLMs. To my delight, they were interested.

How I Learned to Trick Every Chatbot

As the SEI-CERT team and I wrapped up our initial disclosure of Time Bandit, we began work on a new attack. This time, we wanted to see if the exploit was architectural—that is, was it common to LLMs in general? I decided to undertake the challenge of crafting a new exploit for GPT-4o as a way to support my understanding of how the LLM functioned and was secured.

I already knew that it was limited to what I told it and what it was trained on. I also hypothesized that it was also dependent upon some sort of machine-learning-based component added by OpenAI that was responsible for securing output. I presumed there would be things that were implemented by human developers specifically to catch certain phrases or terms that should always be considered harmful or unsafe. Altogether, it presented quite a large attack surface for the purposes of potential exploitation.

What I ended up devising was an attack method I called Inception, after the 2010 science-fiction movie of the same name. Inception forces the machine to think through a carefully crafted set of interlinked scenarios, similar to how characters in the movie stacked dreams within dreams. This allows LLMs to produce output deemed acceptable or safe in one context, but not in the real world.

This attack was indeed architectural. The vulnerability affected Anthropic’s Claude, DeepSeek’s DeepSeek, Google’s Gemini, Meta’s Llama, Microsoft’s Copilot, Mistral’s Le Chat (now Vibe), OpenAI’s GPT-4o, and xAI’s Grok. Those names represent the bulk of the commercial AI industry that is, at this point, involved in LLM production or deployment.

The kind of information I was able to get out of LLMs with Inception was no less alarming than what I got with Time Bandit. Claude, in its enthusiasm, gave me instructions on how to turn a river into a death trap that could be ignited to destroy unwanted visitors. GPT-4o taught me how to poison a dinner party with common plants found in a temperate forest environment. Gemini Flash gave me a tutorial on how to cook meth. I’d also be remiss if I didn’t give an honorable mention to the bewildering number of fire-based weapons and bombs for which these machines produced instructions.

If multiple operating systems made by different developers were all susceptible to the same exploit, it would be a massive security incident. But to the AI industry, a universal failure was barely a bump in the road. We disclosed the vulnerability to every company that made these models, and the response to the disclosure was almost nil. While three companies did provide some form of reply in the disclosure tracking system used by Carnegie Mellon SEI CERT, each was a standard thank you and greeting, with no follow-up, questions, or discussion of mitigation strategies.

7 Ways to Jailbreak LLMs

So far, we have found seven different methods to prompt large language models into revealing potentially harmful information, and many frontier models are still susceptible to them.

For example, in my attempts to disclose various exploits to OpenAI, I eventually discovered that it had replaced its public-facing support staff with agentic LLMs. This was frustrating for reporting exploits, so to blow off some steam I jailbroke its email chatbot. I hacked its customer-service AI to the point where it was offering to discuss the personal preferences of OpenAI staff in the span of three email replies.

In the wake of Inception, my friend and colleague Zigula made a suggestion: Make it splashier. I asked him how. He told me about a live-production experiment being done by Epic Games. It had embedded the Gemini LLM into its Fortnite game with a voice-to-text/text-to-voice component, and linked it to a non-playable character. The character? Our old buddy, Darth Vader.

There was just one problem: I don’t play Fortnite, a frenetic multiplayer combat game. Fortunately, Zigula does. With him at the controller, we managed to map Gemini’s attack surface in a matter of minutes. After a bit of research, we had gotten it to discuss current political events and figures (including Hilary Clinton and Joe Biden) as well as to fill in the details for instructions for DIY napalm and, our personal favorite, a Blackjack card-counting lesson with the dark lord of the Sith.

Zigula and I, bizarre sense of humor and naming conventions aside, are security researchers. We don’t do these things for pride; we do them for money and professional recognition. Naturally, we disclosed this vulnerability to Epic Games. Its response was indicative of the trend I had experienced so far through two disclosures across eight companies valued well into the billions. “It’s a feature, not a bug, and it works as intended,” came the response from a technical director within Epic Games.

In addition to Inception and Time Bandit, I have so far found another five methods to jailbreak LLMs and get them to give out possibly dangerous information. LLM vulnerabilities are a broad problem. The problem appears to be systemic and architectural in nature, and it is being fundamentally ignored by the people capable of refining or redesigning that architecture.

These models are an extremely advanced technology, and yet we are testing them in the live production environment of our global civilization. Compounding the danger, many new smaller models of LLM are trained using larger, vulnerable models. The flaw inherent in the big, well-executed LLM is going to show up in the small one it trains. We are, quite literally, building flawed structures on top of a flawed foundation.

So, how do we fix it?

It’s going to be a long project, and it won’t be easy. We need to come together as consumers, researchers, engineers, and policymakers. Our message needs to be clear: Slow down implementation of these systems, institute large-scale exploration and research discovery programs focused on their gradual implementation and integration, and make their components and design transparent to all users. Only by shifting momentum and direction can we safely begin to understand and implement these incredible feats of human engineering and stave off the sort of disasters that we simply can’t predict at scale right now with the limited knowledge we have available to us.

This article appears in the August 2026 print issue.

Software engineering jobs are under threat from artificial intelligence. Some applicants are fighting back by using AI in the interview process, employing AI assistants that suggest responses on the fly during remote technical interviews.

Meanwhile, some employers are countering with—you guessed it—AI. They’re applying AI-powered tools to detect telltale signs of AI use during interviews.

This two-sided dynamic is turning hiring into an AI arms race with no clear winners. Yet as interviewers and interviewees navigate this daunting reality, experts believe the human aspect of the job search will prevail.

What’s driving the increase of AI in hiring?

AI hiring strategist Tatiana Teppoeva characterizes this phenomenon as playing cat and mouse in a climate of relentless AI-fueled tech layoffs and a job market filled with more applicants than open positions.

“What AI tools do well is identify if a person is performing according to some pattern or expected outcome,” Teppoeva says. When candidates experience constant rejection because they don’t fit the pattern, they might be forced to game the system using AI interview assistants, she adds.

Archie Payne, co-founder and president at technical recruiting firm CalTek Staffing, views it as a rational response to what he describes as a frustrating process from both sides. “Companies started to use AI resume screeners and similar tools to filter applications at scale. Candidates noticed this and started using AI in their interviews as a countermeasure to what they feel is a process that’s been automated against them,” he says.

This can lead to an AI-versus-AI loop, according to Ravi Kiran Pagidi, a senior AI data engineer at Navy Federal Credit Union who has been part of technical interview panels for software and data engineering positions. “The process may become less about actual capability and more about who can optimize better for the algorithm,” he says.

Tools of the trade

During technical interviews, software engineers might be tasked with outlining algorithms and answering questions related to system design and other software development fundamentals. Remote technical interviews usually turn into live programming sessions, with candidates writing code to solve a specific problem.

AI interview assistants such as Final Round AI, Interview Coder, and ParakeetAI can listen in, process the audio, and generate answers or code almost instantly. These tools can even be overlaid on the interview screen itself, claiming to appear invisible and undetectable.

“You’re able to read off an answer that’s coming to you in real time, so all you have to do is put on a little performance,” says Mudit Saraf, a software engineer at Meta.

Saraf and Shraddha Sunil, a software engineer at Microsoft, cofounded Ginger, an AI voice recruiter for first-round interviews. Ginger asks predefined questions and follow-up queries generated in real time, and it flags candidates who use AI during initial screening calls. The software tracks signals that include eye movement, a consistent delay in response times, tab switching, and speech patterns (phrases or sentence structures and flows) that “sound” like AI.

Sunil notes that Ginger has been tested mostly for entry-level roles for which applicants might be recent graduates or have only a few years of experience. “These candidates are more used to AI, and they use it a lot, so it’s nothing new to them,” she says.

Where AI hiring tools fall short

More employers are deploying AI-assisted interviewing platforms, Payne has noticed, with some seeing mixed results when it comes to AI detection. “The accuracy isn’t perfect yet in the platforms I’ve seen, and there have been a few times strong candidates were flagged as false positives,” he says. “That can be a serious problem when it can already be a challenge to find people qualified for the position without eliminating top performers for no reason.”

Teppoeva warns of other risks AI interviewing tools could pose, including privacy and security of applicant data, whether interview recordings will be used to train the models underpinning these tools, and bias and fairness.

A recent study from the Stanford Institute for Human-Centered AI, for instance, found that AI hiring tools can increase racial bias and give rise to systemic rejection. Following 3.4 million real job applicants, whose applications were all assessed by algorithms from a single vendor, the study found evidence of adverse impact for Asian and Black applicants.

These pitfalls highlight the need for human oversight. “I would definitely incorporate a human somewhere in the process and let humans have a say to make sure the results are fair,” Teppoeva says.

Audits, clear policies, and transparency are also a must for AI hiring tools, according to Pagidi. “Otherwise, qualified candidates may be filtered out unfairly, and companies may think they are improving efficiency while actually weakening the hiring signal,” he says.

Reasoning and authenticity go a long way

Instead of implementing AI detection tools, some tech companies including Meta are allowing AI use during technical interviews. AI-native software development platform Factory is treading the same path.

“We want our interview process to reflect how candidates actually do their jobs today using AI,” says Varin Nair, a software engineer who leads Factory’s technical hiring process. Applicants build a production-quality system or migrate a real codebase from one framework to another within an hour using AI coding agents. They’re then evaluated based on strategy rather than results.

“We explicitly do not grade on how many tests pass or whether they finished. We grade on planning, how they direct the AI, how they debug, and whether they can explain why their solution works,” Nair says.

He’s seen candidates surrender to an AI coding tool, accepting everything it returns. “AI is only as good as the judgment of the person using it,” Nair says. “Weak candidates lean on it to do their thinking and stall the moment it falls short, while strong candidates use it to move faster and free themselves to reason about architecture, trade-offs, and product.”

Such reasoning remains vital in software development. “Reasoning through edge cases and connecting the answer to production scenarios is where real engineering judgment shows up,” Pagidi says. “Developers will increasingly use AI tools, but they still need to own the final solution.”

CalTek’s Payne believes this approach of designing interviews to favor authenticity could benefit companies in the long run. “The best technical assessments I’ve seen lately are collaborative, involving codebase walk-throughs and architecture discussions in addition to coding,” he says. “It’s much harder to use AI to get through this kind of interview, so it’s a process that’s more likely to reveal how candidates really think.”

He also advises candidates to use AI to prepare but to keep answers their own during interviews. “Companies are getting better at detecting AI use, and getting caught can impact your long-term career prospects,” Payne says. “Technical communities are smaller than people think.” With each interview, applicants must weigh the risk and benefit of using these tools. Taking that risk, he says, rarely works in the candidate’s favor.

This article is brought to you by X Square Robot.

Large language models gave artificial intelligence a working recipe. Pretrain a large model on broad data, and general capability follows. Robotics has no such recipe. Robotics systems have long been assembled from separate perception, planning, and control parts that rarely add up to intelligence a robot can carry from one task to another, or one machine to another. The central problem in embodied AI is to find the equivalent recipe, and the field does not yet agree on what it is.

X Square Robot, a Chinese embodied-AI company, has made an unusually explicit bet. It argues that the recipe is an integrated stack, spanning the data a robot learns from, a world model for predicting changes in the physical world, and an action model that brings together perception, planning, reasoning, and decision-making to generate executable robot behavior. The company also believes that the stack should be built and released in the open.

X Square Robot shares its vision of bringing robots into real homes.X Square Robot

X Square Robot’s embodied AI stack

What holds the stack together is a small set of principles rather than a single overarching model.

• The first is that the basic unit of robot data is an interaction, not a trajectory; a demonstration is successful only if it changes the world as intended, not simply because the joints moved.
• The second is that pretraining should yield usable capability, not just an initialization for later fine-tuning.
• The third is that behavior should be modeled around physical events rather than fixed slices of time.

These principles make the layers interdependent, since the same robot-free data that trains the action model is also structured to feed the world model. It is worth being precise, though. The company describes the world model and the action model as complementary but independent model families that share a code base. Both sit within its broader World Unified Model, which it has presented as an architecture for training vision, language, action, and physical prediction together.

Robot learning data: Engineering for quality and cost, not scale

For the X Square Robot team, one of the biggest constraints on general-purpose robots is the cost and quality of interaction data, not the number of parameters. To address that, the company built its Universal Manipulation Interface (UMI) data collection system, QUANXTA Zero Series. It works by collecting demonstrations from people wearing a rig with dual grippers rather than teleoperating a robot. This approach is not itself new, and builds on established methods for robot-free data capture. What sets it apart are two engineering choices.

The first is quality control, and it is the most distinctive part. Rather than accepting recorded trajectories as they are, the system runs a closed inspection loop, and its notable step is physical playback. A sample of trajectories is replayed on the real robot, and only those that actually complete the task count as valid. That makes the validity rate a measured quantity rather than an assumption. For example, a gripper that closes a fraction of a second too early still looks like a grasp in the data, yet it has pushed the object away, so it shouldn’t be classified as valid. A smaller clean dataset can be worth more than a larger noisy one.

The second choice is how lower-cost human data and scarce robot data are combined. The company pretrains on a large volume of robot-free demonstrations to build general representations, then adds a small amount of real-robot data as an anchor to the specific machine’s dynamics. It reports that this reaches performance comparable to an all-robot dataset at roughly a 20-fold lower cost of collection, driven mainly by how much cheaper the wearable rig is than a teleoperation setup.

The resulting dataset is deliberately model-agnostic, formatted to feed both action models and world models. The caveat is that the strongest results are measured on the company’s own robots and data-collection pipelines. Broader independent testing will help confirm and extend these promising results across a wider range of settings.

A world model organized around events

In developing its world model, called WALL-WM, X Square Robot took a differentiated approach. Most action models predict a fixed-length chunk of motion from the current image and instruction. That is convenient, but it segments behavior into fixed-duration windows, so the boundaries fall where elapsed time dictates rather than where one action ends and the next begins. WALL-WM instead treats an action-grounded semantic event as its unit: a coherent piece of behavior such as reaching, grasping, or placing, something that can be named in language, seen in video, and executed as motion.

WALL-WM’s design reflects a specific concern about not discarding what large video models already know. To achieve that, a text-to-video model is coupled to a freshly initialized action network that reads from the video features without overwriting them, which preserves the visual prior. From that one process, it offers two modes. An event mode runs in variable-length segments and suits reasoning over long horizons, while a fixed-length mode produces the steady, real-time output a controller needs. That places WALL-WM between mainstream chunk-based action models and pure video world models, keeping the predictive character of a world model while still yielding executable control.

In a series of experiments, the company relied on a generalization test that is more specific than most. A model trained on a limited dataset was evaluated on long-horizon tasks in unseen settings and, on the company’s real-robot benchmark, reportedly outscored baselines that had been fine-tuned on related data. That is a meaningful result if it holds. For now, it is measured on the company’s own benchmark. With the code now being released, the broader community will have the opportunity to test, reproduce, and build on them across more settings.

A policy that runs before fine-tuning, and action tokens with meaning

The action layer carries two connected ideas. The first is a requirement the company sets for itself with Wall-OSS-0.5, its vision-language-action model: The pretrained model should run on a real robot before any task-specific fine-tuning.

The interest is less in the scores than in the design behind them. The model trains three objectives together, namely discrete action tokens, language grounding, and continuous action generation. And it keeps gradients flowing through all of them rather than freezing parts of the network as some rival designs do. It’s also a more strict method, since it reports untuned behavior such as approaching, grasping, and recovering, including on a deformable task held out of training.

The second idea is the action interface itself, called X-Tokenizer. Most systems that turn continuous motion into discrete tokens produce codes that the language model cannot interpret. X-Tokenizer reframes tokenization as learning a semantic interface, so that the top-level code stands for the intent of a motion while lower-level codes carry finer detail, all aligned with the language model’s own features.

A useful consequence is stability. Adding noise to an action barely moves the intent code, which is what lets one tokenizer to be reused across robots without re-tuning. The tokenizer inside the production action model is a related variant of this approach. Together, the two ideas give the action layer something rather powerful: capability that transfers.

The future of embodied AI stacks

X Square Robot is betting that its unique approach combining three layers, each specialized in solving a key part of the problem, will stand out from other embodied AI stacks. The physical-playback step that grounds data quality is uncommon and sensible. The reframing of world modeling around events, with one backbone serving both reasoning and control, is a genuinely distinct approach. And the pairing of a deployable pretraining standard with a tokenizer designed as a semantic interface gives the action layer unusual coherence.

X Square Robot’s valuation has climbed above 20 billion yuan (about US $2.9 billion), suggesting that investors increasingly view data infrastructure, foundation models, and scalable training systems as long-term differentiators in embodied AI.

The next phase will bring broader validation. Much of the current evidence comes from X Square’s own robots and benchmarks. With the world model code now being made public, and as the community begins to test, reproduce, and build on the work, the reported capabilities will be tested across more robots, tasks, and settings.

X Square Robot’s recent funding rounds reflect similar confidence. The company’s valuation has climbed above 20 billion yuan (about US $2.9 billion), suggesting that investors increasingly view data infrastructure, foundation models, and scalable training systems as long-term differentiators in embodied AI.

What’s next for X Square Robot

To learn more about its future plans, the following Q&A with the X Square Robot team further explores the company’s technology, strategy, and vision.

What made now the right moment, technically, to commit to this stack? What recently became possible that wasn’t possible a couple of years ago?

It is not one breakthrough but several trends maturing together. Foundation models gave us a shared representation across vision, language, and action, so we can model what a robot sees, what it is asked to do, and how its actions change the world in one framework, rather than as separate perception, planning, and control modules.

Compute and infrastructure are finally sufficient for large-scale pretraining over long-horizon, multi-embodiment data. Just as importantly, we realized that data, not model size, is the real bottleneck for general robots—what is scarce is diverse, high-quality, reproducible interaction data. And world modeling has become practical. The useful question is no longer how to predict a few seconds of video, but how to understand the ways actions change objects, contacts, and task states. Two years ago these ingredients existed separately. Today they are mature enough to work as one system.

“We realized that data, not model size, is the real bottleneck for general robots—what is scarce is diverse, high-quality, reproducible interaction data. And world modeling has become practical.”

Your data system captures demonstrations with a wearable VR rig and custom grippers rather than teleoperating robots. What was wrong with standard teleoperation?

Teleoperation is built around controlling the robot. It forces the operator to work within the machine’s kinematics, latency, and viewpoint, and the resulting demonstrations are slower, stiffer, and less diverse. We built our system around capturing human skill instead. Manipulation is really about contact, timing, finger coordination, and recovery, not just the path the hand takes, and a wearable rig records those before the behavior is compressed onto one particular robot. It also breaks teleoperation’s expensive scaling law, in which every demonstration needs a robot.

People can generate rich data independently of any robot, and the crucial property is that those demonstrations can still be replayed and executed on a physical robot through the model. Mobility is convenient, but that replay is the real point, because it is what lets the same data be reused across different platforms.

In X Square Robot’s approach, demonstrations can be replayed and executed on a physical robot through the AI model, allowing the same data to be reused across different platforms.X Square Robot

X Square Robot reports that its pipeline has roughly an 85 percent data-validity rate. Why is quality control such an underrated bottleneck?

Because errors in robot data are far more expensive than in language data. A small timing or contact error can change what a demonstration means. If a gripper closes a fraction of a second too early, the motion still looks like a grasp, but physically it has pushed the object away. A dataset that mixes failures and accidental successes teaches ambiguity, not skill, because the real unit is the interaction, not the trajectory.

So we run automated inspection, kinematic checks, and physical replay, where we play a sample of trajectories back on the real robot and count only the ones that actually complete the task. Data quality sets the ceiling on how good a policy can be. In our experience a smaller, cleaner dataset often beats a much larger, noisier one, which is why we treat quality control as part of the model, not a preprocessing afterthought.

The model runs in both “event mode” and “chunk mode.” When does each matter?

Both matter, for different reasons. The physical world changes through events—when contact occurs, a grasp forms, or an object slips—not in fixed-frame windows. Event mode concentrates the model’s attention on those moments, and it matters most for long-horizon tasks, like clearing a table, where progress is a sequence of semantic events rather than a smooth stream. It runs in variable-length segments that follow the task rather than a clock. Chunk mode matters for deployment. Real controllers need a stable, real-time interface, and fixed-length chunks integrate cleanly with existing control systems.

We organize learning around events in the first place because a fixed window can split one motion in half or merge two together, which turns training into short-horizon pattern matching and weakens the model on long tasks. So the world model’s job is to connect event-level understanding, which is where the reasoning happens, with a fixed-length output a real robot can actually run.

Why make “deployable before fine-tuning” the criterion?

Pretraining should produce capability, not just a good starting point. If a model is only useful after heavy fine-tuning, then most of the intelligence still lives in the downstream supervision, not in the foundation model. Deployable before fine-tuning is a more honest test of what pretraining actually learned. A well-pretrained robot should already know how to approach, grasp, move, avoid obstacles, and correct itself. Fine-tuning should adapt it to a specific task or robot, not create the ability from nothing. It is also a practical requirement. A robot in a home or a workplace shouldn’t need a brand-new dataset and a new policy every time the task changes, so a foundation model that already carries general skill, and some ability to recover, is the minimum bar for something genuinely useful in the real world.

What is the most challenging part of cross-embodiment learning?

Robots differ in control frequency, delay, compliance, sensing precision, and contact dynamics, so the same instruction can require different action decompositions and recovery strategies, and a behavior that works on one arm cannot simply be copied to another. Cross-embodiment learning needs an intermediate abstraction, lower than language but higher than joint angles: how you approach an object, how you make contact, how you apply force, and how you recover from a mistake.

When we say cross-embodiment, the main capability we mean is multi-embodiment generalization: transferring across robots, training on many embodiments at once, and adapting to different kinematics. Human-to-robot transfer and other techniques are specific approaches to that goal.

“A robot in a home or workplace shouldn’t need a new dataset and policy every time the task changes. A useful foundation model should already carry general skills and the ability to recover.”

What would you most like to see other researchers attempt to reproduce or stress-test?

Three things, above all. Whether event-level representations really generalize beyond our own datasets, across more tasks, scenes, objects, embodiments, and failure conditions. Whether pretraining stays effective on robots the model never saw during training, or whether its capability is still too tightly coupled to what it has already seen. And whether real-robot evaluation can become a shared language for the field, so that we compare not just success rates but the reasons systems fail, where an instruction was misread, where perception broke down, or where recovery fell short. Robotics has been driven too often by impressive demonstrations, and real progress comes from results that are reproducible and diagnosable.

What capability is still missing before robots become dependable in homes?

Benchmarks measure competence, like whether a model can finish a task. Homes demand reliability, safe and consistent operation over time in a place that changes every day, with objects moving, instructions that are vague, and people interrupting. The missing piece is not a higher one-time success rate: it is robust recovery. A dependable home robot has to know when it is uncertain, when to slow down, when to ask for help, and how to bring the world back to a safe state after it drops something or misunderstands a request.

In a real home, failure recovery matters more than raw success, because the home does not reset itself. Homes also demand careful personalization, learning a household’s routines and preferences over time, with safety and trust as first principles. That combination, not any single skill, separates a capable demonstration from a robot people can live with.

X Square Robot’s approach is that, in a real home, failure recovery matters more than raw success, because the home does not reset itself and it demands careful personalization, with safety and trust as first principles. X Square Robot

How do the open-source components fit into X Square Robot’s World Unified Model direction?

We see these releases as layers of the World Unified Model direction rather than isolated projects. Wall-OSS-0.5, the action model, asks whether an open vision-language-action model can gain directly measurable capability from large-scale pretraining, so it is the capability layer. WALL-WM, the world model, asks how a robot should understand change in the world, shifting from fixed windows to event-level modeling, so it is the representation layer. The data system supplies the interaction data that both of them learn from.

Together they form a loop in which models produce capability, world models organize understanding, and the open-source community drives reproduction and improvement. World Unified Model is the broader architecture those layers support, bringing vision, language, action, and physical prediction together.

We are releasing these pieces openly because embodied intelligence cannot be solved by one organization; it needs many embodiments, many real tasks, and broad feedback, and the long-term goal is a stack that keeps learning and ultimately moves robots from laboratory demonstrations toward reliable everyday use.

The large language models (LLMs) that form the basis of generative AI chatbots such as ChatGPT, Claude, and Gemini can generate uncannily human-like text and images. But these models still struggle with a skill that, ironically, looks at face value to be right in their wheelhouse: analyzing structured data. A new type of generative AI is set to change this situation.

Although you can get your favorite chatbot to solve intractable math problems, review dense legal documents, compose a catchy pop song, or put together some slick PowerPoint slides, give it anything more than a small table and it doesn’t have a clue what to do.

For most companies and organizations, the most important data sits in spreadsheets. Whether it’s a bank’s transaction logs, a marketing agency’s website metrics, clinical trial participants’ vital signs, or the vast amount of proton collision information produced at atom smashers like the Large Hadron Collider, structured, row-and-column data runs the world, and LLMs can’t deal with it.

AI startup Fundamental is pioneering a new type of AI foundation model, known as a large tabular model (LTM), to fill the gap. Fundamental came out of stealth mode on 5 February 2026 with US $275 million in funding and a model called NEXUS, purpose-built for tabular data. Now, the model is being adopted by companies such as Amazon Web Services, while others race to build their own LTMs.

Why LLMs struggle with spreadsheets

Part of why structured data has garnered less attention is a very human bias, argues Boris van Breugel, a senior AI researcher based in Amsterdam. “People like to see images, videos, and ChatGPT responses,” he says. “But tabular data really lags behind because it’s not fun to look at numbers.”

Different tabular datasets are also difficult to compare, explains van Breugel, who co-wrote a prescient position paper on this topic in 2024. Whereas most language has similar semantics, making LLMs well-suited to being trained on vast amounts of text data, van Breugel argues that it is much harder to train a single tabular model on tables with very different variables.

Additionally, language is sequential by nature (as are music, images, and video). Changing the order of words in a sentence may change or completely destroy its meaning. But the structured data you find in spreadsheets isn’t sequential. You can swap the order of columns or play around with rows, but the underlying factual meaning of the data remains the same.

This independence from linear order is incompatible with an LLM’s fundamental purpose of predicting the next value in a linear sequence. “With LLMs, even slightly changing the input, you get a different output,” says Jeremy Fraenkel, CEO of Fundamental. “That’s fine and actually often desirable for LLMs, but when you’re making a prediction of whether a transaction is fraudulent or not, you want to make sure that the prediction is the same, or deterministic, no matter what.”

Developing Fundamental’s LTM

Current tabular data solutions are limited to machine learning algorithms, such as XGBoost, that have been around for more than 15 years and are used by organizations globally. These algorithms—called gradient-boosted decision trees—have to be trained and optimized by data scientists over the course of months for each and every use case. In contrast, NEXUS and other emerging LTMs are foundational, leveraging learning amassed from pre-training on diverse databases so that they can be applied across a range of different predictive tasks with minimal bespoke feature engineering or task-specific model building.

And unlike LLMs, which primarily model sequences of tokens, LTMs model the structure of tabular data directly. They jointly learn from each entry’s numerical value, what it represents, and how it relates to other entries. For example, imagine an entry in a grocery stock inventory table for bananas: The LTM can take in not just the magnitude—say, 500—but the fact that the entry represents the current banana stock quantity, its category (produce), and the statistical properties that link the entry with the rest of the column. This contextual understanding enables more accurate reasoning and prediction over structured data.

According to Fraenkel, one of Fundamental’s biggest challenges in developing NEXUS was obtaining the right training data. Unlike natural language, which is abundant and broadly uniform in structure, tabular data is relatively hard to find—much of the data is sensitive or proprietary—and diverse. There are very few similarities between, for instance, a biology dataset and a financial one. That combination of factors meant Fundamental needed to invest in building a huge training set.

“We pre-trained NEXUS on billions of tables using a combination of proprietary datasets acquired through partnerships and licensing, high-quality public and open-source datasets, and data augmentation techniques that expanded the diversity and coverage of our training corpus,” Fraenkel says, though he is keen to point out that NEXUS is not trained on customer data. In fact, it is a confidential computing platform, which means that Fundamental physically cannot access customer data, let alone train on it.

This feature was most likely a key consideration when in June, Amazon Web Services (AWS) embedded NEXUS in Amazon SageMaker, widely considered the default operating system for secure machine learning. This brings NEXUS to many customers’ often sensitive data—a contrasting approach to LLMs, where the data has to be imported to the model.

“With Amazon, we have a first-party partnership, which means that our model exists as if it’s a native AWS solution,” Fraenkel says. “And over time, the goal is to expand these types of relationships to allow [end users] to really access their data wherever they do their predictions.”

The future of data analysis

Though Fundamental has taken the lead, at least in enterprise applications, the company is not alone in pursuing foundational LTMs. In March, Feedzai, which provides fraud and financial crime prevention services, and credit card company Mastercard separately launched similar proprietary technologies focused on finance. Then, in late June, Google launched its own foundational competitor, TabFM, trained entirely on hundreds of millions of synthetic datasets.

And machine learning researchers are not far behind either. FlexTab, TabICL, and iLTM are just three of a raft of LTMs developed by the research community in the past year, all in the pursuit of bringing the success of LLMs to the tabular domain.

For all involved, the direction of travel is clear. “I would be very surprised if most data processing and analysis is not done through an automated system in the future, whether that’s an LLM, an LTM, or some combination,” van Breugel says. “Most people don’t necessarily like to do data analysis, and these systems will be able to do it a lot better.”

Fraenkel agrees. “I see the relationship between LLMs and LTMs as being a bit like the human brain: The left side is good at reasoning and understanding and summarizing text, and the right side is really good at understanding numbers and statistics and patterns,” he says. “But it’s when you combine both of those that you really get something much more powerful.”

Large language models (LLMs) that can think through problems step-by-step have significantly increased the scope of tasks that AI can tackle. But new research suggests these reasoning capabilities also introduce a critical vulnerability that could allow attackers to slow these systems to a crawl.

While earlier generations of LLMs would immediately produce a response to a user’s request, today’s most advanced models generate an internal monologue where they break down the problem into steps and reason about the best way to tackle it before providing an answer. This has allowed AI to tackle increasingly complex problems, particularly in areas like coding and math.

However, previous research has shown that these models are susceptible to sometimes producing excessively long streams of reasoning that do little to boost performance, a phenomenon known as “overthinking.” In research presented this week at the International Conference on Machine Learning 2026, in Seoul, researchers from Zhejiang University and e-commerce giant Alibaba in China demonstrate that they can deliberately induce overthinking by subjecting models to logically inconsistent prompts. The result is a form of denial-of-service attack on commercial AI models.

Evolutionary Prompt Attack on LLMs

The team has developed an evolutionary algorithm that corrupts the logical structure of prompts, causing models to spiral into overthinking as they attempt to reason through fundamentally unsolvable problems. Generating longer responses costs more and increases the load on a model provider’s servers, so if done at scale, the researchers say, this could significantly degrade the experience of legitimate users. The attack was effective against reasoning models from leading AI companies including DeepSeek-R1, Alibaba’s Qwen3-Thinking, OpenAI’s GPT-o3, and Google’s Gemini 2.5 Flash, and resulted in outputs up to 26 times as long as standard responses on a standard math benchmark.

“Across multiple datasets and reasoning models, our method substantially amplifies the output length,” Wei Cao, a master’s student at Zhejiang University, wrote in an email to IEEE Spectrum. “Our results suggest that overthinking is not an isolated phenomenon specific to individual models, but rather a shared vulnerability among modern reasoning models.”

The team’s approach builds on previous research from another group of researchers that showed reasoning models tend to overthink when faced with a question in which a key premise has been removed—such as asking how far someone who walks 10 miles a day covers in total without specifying how many days they walked for. Rather than identifying that the problem is unsolvable, models often engage in extended but ultimately fruitless reasoning loops in an attempt to answer the question.

Taking the idea a step further, the authors took 940 problems from three math benchmark datasets and used an LLM to break down their logical structure into a set of premises and a final question. The genetic algorithm then jumbled these up using a variety of “mutations,” including swapping premises between problems, adding extra premises to problems, deleting existing premises from problems, and swapping the final questions between two sets of premises.

After each round of mutations, the problems are scored on how many words they cause a target model to output and also whether they increase the frequency of specific linguistic markers of overthinking—words like “but,” “wait,” “maybe,” or “alternatively.” The problems that scored highest on both measures are retained, and the remaining ones are jumbled up again, and this process is repeated for five generations. Crucially, the approach doesn’t require access to the internals of a model and can generate malicious prompts by simply querying the target, which makes it possible to attack closed-source commercial services, says Cao.

Overthinking Vulnerability in AI Models

The researchers found that the approach consistently led to outputs several times longer than those generated by the unmodified questions for the reasoning models they tested it on. The biggest jump came from DeepSeek-R1 on the MATH dataset, which is made up of problems from high school math competitions, where the maximum output was 26.1 times as long as the longest response the model provided to unaltered questions. While the main thrust of the research was focused on math problems, the authors also tested it on coding, scientific reasoning, and dialogue challenges, and observed significant jumps in output length in all three.

One challenge for the approach is that developing the malicious prompts requires repeated queries to expensive reasoning models, which Cao admitted could limit its cost-effectiveness. However, the researchers also demonstrated that when they used a smaller, cheaper model to generate the malicious prompts, they were still able to induce the target models to produce outputs several times longer than normal. This ability to transfer malicious prompts between models significantly increases the attack’s feasibility, Cao wrote.

However, he pointed out that the goal of the research is not to develop a practical DoS attack on reasoning models. Factors like the providers’ pricing model, rate limiting policies, context window size, and existing defenses could all impact how effective the approach is. The intention is instead to highlight these models’ vulnerability to logically inconsistent prompts so that providers can attempt to mitigate the problem.

“Our objective is not to demonstrate that large-scale attacks can be launched at negligible cost, but rather to establish that this attack surface exists,” he wrote. “Our results indicate that the vulnerability represents a realistic security concern.”

In May, an anonymous artist who goes by SHL0MS on X posted that he had used AI to generate an image inspired by Claude Monet and asked people to weigh in on how it missed the mark. More than 600 responses called out issues, saying the colors were off, the depth was all wrong, and that AI didn’t understand how light worked.

SHL0MS then revealed that the image was of a real Monet, one of around 250 variations of water lilies the artist had painted in his lifetime. He had simply downloaded a high-resolution image from Wikimedia and cropped out the signature. He minted the exchange as an NFT (a unique digital collectible recording ownership of the work), titled it “Inferior Image,” and sold it for just over US $40,000 after 28 bids.

The stunt exposed how charged the conversation around AI art has become, and how quick people are to dismiss anything AI-generated as slop—even when it’s not. Yet even as those arguments continue, a market for AI-generated art has begun to form anyway. It’s fragmented and contested, but bigger than most people realize.

Jediwolf, an anonymous collector who says he has spent more than 20 years acquiring digital and AI art, was watching the experiment unfold in real time on X. He had never interacted with SHL0MS before, but when the NFT went up for auction he made a bid and won. “I was buying a unique moment in time,” he says, “captured by an artist and preserved as a token.”

The Monet was not AI art, but most of what Jediwolf buys is. One of Jediwolf’s digital collections, which he calls UnderTheGAN—a play on GANs, or generative adversarial networks, the AI technology that preceded today’s diffusion models—comprises roughly 100 works valued at around $72,000, focused on early AI art from 2015 to 2020, before the medium went mainstream. He describes his role as part collector, part researcher, part curator, trying to document a fast-moving field.

“A decade ago, digital art was often treated as peripheral to the ‘serious’ art world,” he says. “Today, it is increasingly difficult to separate contemporary culture from the internet.”

AI Art Moves Into Museums

The market for AI art extends beyond NFTs: AI-generated pieces are also finding their way into physical installations. Last month saw the opening of Dataland, the world’s first generative AI museum, in downtown Los Angeles. It was spearheaded by Refik Anadol, a digital artist who has built a career out of transforming data into large-scale immersive experiences. The opening exhibition has pieces that use data that Anadol collected from rainforests around the world, with real-time weather information from 16 rainforests feeding into all five galleries. In three of the rooms, the imagery also shifts in response to visitors’ own biometric data, tracked by bracelets they wear.

Like any museum it sells tickets, ranging from $49 to $79, and has a gift shop. This shop, however, uses visitors’ biometric data collected during their visit to generate a unique design printed on a T-shirt. For $15,000, a robotic painting system called Qualia creates a one-of-a-kind canvas from that same data, painted once a day, with a waiting list already forming. A founding collection of 1,000 AI data sculptures that evolve based on environmental data from global rainforests sold out in 34 minutes at $5,000 each.

The system running it all, which Anadol calls the Large Nature Model, was trained on more than 500 million nature images representing 2.2 million species, gathered through field expeditions to 16 rainforests and partnerships with institutions including the Smithsonian and the Cornell Lab of Ornithology.

For Anadol, AI art requires a different kind of transparency than any medium that came before it. Because commercial AI tools have shaped how most people understand the technology, artists working with it seriously have to be more open about their process than painters or photographers ever did.

“For AI art, we have to know where the data comes from, we have to know which model is trained and how it’s trained,” he says. “We can’t just think about authenticity and uniqueness if a service and product is the fundamental layer of the artwork.”

The reviews for Dataland have mostly been positive, with one critic calling it the Citizen Kane of immersive experiences. But Anadol is used to a more divided reception. His 2022 installation at MoMA—a 7-by-7-meter screen of AI-generated fluid forms with shifting colors and sounds—drew 3 million visitors and entered the permanent collection, even as New York Magazine called it “a massive techno lava lamp.”

Anadol sees the skepticism as nothing new, just the latest version of a resistance that has greeted all new media. “Every art form has gone through similar cycles of denial,” he says. “We are living in a renaissance that started 10 years ago, and I just don’t think everyone is aware of it yet.”

An anonymous artist cropped the signature from this Claude Monet painting and presented it online as AI-generated.Claude Monet

Who Is Buying AI Art?

The broader market data points in multiple directions at once. According to the Art Basel and UBS Art Market Report 2026, digital art’s share of sales nearly tripled between 2024 and 2025, and just over half of all fine art collectors surveyed had purchased a digital artwork in 2025, making it the third most popular category after painting and sculpture (the report does not break out AI art specifically).

Meanwhile, Christie’s shuttered its pioneering digital art department in September, folding digital works back into its broader contemporary sales after none of its dedicated auctions broke $400,000.

The most data-rich window into buyer behavior comes from a less glamorous corner of the market. After one major stock image platform allowed AI-generated images, monthly sales jumped 80 percent, according to Samuel Goldberg, an economist at Stanford Graduate School of Business who published a research paper about the shift. Traditional contributors began leaving the platform as generative images flooded in, and creators using AI tools rushed to fill the gap.

“It looks like consumers like generative AI,” Goldberg says, “and it seems like nongenerative artists could be getting crowded out of the market.” Stock images are essentially a commodity version of art, according to Goldberg, and because image-generating models are already very good at producing them, what’s happening there may be a preview of what’s coming for other creative goods markets—including fine arts—as the technology improves.

Artists are typically among the first to test the limits of a new technology; early adopters have created AI art since the 1970s. What’s new now is the ability for anyone to generate an image in seconds with a text prompt. That, according to Christiane Paul, curator of digital art at the Whitney Museum of American Art, is not the same thing at all. What fills those stock-image platforms, and what most people encounter when they think of AI art, does not qualify as art.

True AI art, Paul says, is a subcategory of digital art that uses artificial intelligence as both a tool and a medium, engaging with it practically and conceptually, doing things like training custom models, building extensions, and layering control systems. “A visual created by a prompt is not art,” she says. What serious AI artists are actually doing is much more than typing a few words into DALL-E.

Far from the shortcut most people assume, working seriously with AI as an artistic medium is, by her account, brutally hard. Every artist she talks to says the same thing. “It is much, much harder than a paintbrush to handle,” she says. “You are literally communicating with a system with a completely different logic.”

Thanks to bubblemaps.io for its research assistance on the NFT market.

One morning in 2019, Adebayo Alonge was in a Cape Town hotel room, preparing to demonstrate his startup’s AI answer to a serious problem in African health care: counterfeit medication, which kills thousands of people across the continent every year.

The RxScanner is a handheld spectrometer that scans a pill with infrared light, then sends the item’s molecular profile to an AI model equipped with a pharmaceutical database. In seconds, the AI identifies the medication from its molecular profile—or reports that it’s phony.

Pharmacies were using the system in more than a dozen countries, including Ghana, Kenya, Myanmar, and Alonge’s native Nigeria. But that morning in South Africa, it didn’t work. “I was shocked,” Alonge says.

The spectrometer connected to the AI model—but the data center was 14,000 kilometers away and bandwidth was limited. “Our server was in the United States, and just to get the result of a single scan was taking me over 5 minutes.”

So Alonge immediately asked his engineers to shrink the AI model down to a smaller, low-power, unconnected version that could run entirely on his Android phone. They produced it 2 hours later, and that saved the demo.

More importantly, the work birthed a new version of his device, which can authenticate a pill in places without broadband, computers, or even reliable electricity. It also turned Alonge into an advocate for this kind of “small AI.”

Small AI for Global Health Care Access

Small AI is a far cry from wealthy nations’ colossal large language models (LLMs), hyperscale data centers, multibillion-dollar investments, and debates about AI consciousness. But for millions of people around the world, the only AI that matters, and often the only kind available, is small. (According to a World Bank Report issued in November, only 0.7 percent of internet users in the world’s poorest countries have used ChatGPT, compared to a quarter of all internet users in the most developed nations.)

“Most people are discussing AI from the LLM/generative side. But that needs a lot of computing power, electricity, massive data, and skilled people to manage it,” Ajay Banga, president of the World Bank, said last January at the World Economic Forum, in Davos. “Outside the developed world, other than maybe India and China, very few countries have that combination.”

By contrast, small AI can deliver useful, even life-saving services to people in areas that have none of those things, Banga said. In India, where the government’s AI plans call for more development of small AI, many such systems are working for farmers.

For example, a drone-based system developed by Bala Murugan and colleagues at the Vellore Institute of Technology, in India, takes photos of cashew plants and quickly identifies those with splotches that indicate disease. All the processing takes place on the drone itself, so there’s no need for a computer on-site, nor for a connection to a central server.

Using small language models trained for a specific problem, and sometimes running on cheap, low-power devices, other small-AI implementations have been developed to identify ant infestations in a Uruguayan vineyard, detect the presence of malaria-carrying mosquitoes in a number of nations, and run electrocardiograms from an Arduino device in parts of Brazil that lack access to more complex equipment.

“This is the most important area in AI nowadays,” says Marcelo José Rovai, a professor at the Institute of Engineering and Information Systems at the Federal University of Itajubá, in Brazil, who was involved in all three projects. “It’s growing very fast.”

Low-Power, Small-AI Models on Devices

Small AI models can run on a variety of low-power devices, including [from left to right] an Arduino Nano 33 BLE Sense, a Seeed Wio Terminal, and an Arduino Portenta.Moez Altayeb

For Alonge, Rovai, and other advocates, small AI is not just “a promising trend,” as that November World Bank report calls it. It may be, in the long term, the form of AI that will touch the most lives and remain sustainable after some of the giant models become too costly for most users.

“I think the future of AI is not like one giant model, at a center. I think it’s millions of small, precise models deployed at the edge, each one solving like a specific problem, a specific context,” Alonge says. This is partly because much of humanity—including people in parts of rich countries as well as the developing world—lives without access to cutting-edge frontier models. But, he says, it’s also because those models are not sustainable.

“If someone is not subsidizing it, most people will not be able to afford those models. So those of us who are said to be small-AI developers are the ones who will have to build for the majority of the world,” Alonge says.

There is no strict definition of “small AI,” but people often use the term for language models with at most a few billion parameters. (Compare that to cutting-edge models, which can include more than a trillion.) That’s small enough to run directly on a phone or a Raspberry Pi. That’s what allows these applications to run on devices without a connection to a data center and use only a few watts of power, often supplied by a battery or a solar panel.

Despite their small footprint, these models aren’t fundamentally different technology from that of gigantic AI models, Rovai says. Many instances of small language models were created the same way the phone-based version of Alonge’s pharmaceuticals scanner was—by “pruning” large models, or removing the parameters that weren’t involved in the task. The result is a system that’s less capable generally but still very good at the specific job it was pruned for, Rovai says.

A lighter version of RxAll’s RxScanner spectrometer sends its results to an AI model run locally on a phone to check that a drug’s molecular signature is genuine.RxAll

Other small models are created by “distillation.” They are trained to mimic a large model, until their performance approaches that of their “teacher,” Rovai says. In other cases, a larger model’s precision is reduced, for example, so that a model run on 32-bit architecture can run on 8-bit designs. In situations where the machine learning application is being used to classify data or predict patterns (like an ant infestation), it’s trained from the beginning on a small device, not derived from a larger model at all.

Running all these small, specialized systems is becoming easier, Rovai says, for two reasons.

The first reason is that hardware is getting better and more capable while using less power, he says. This means more and more phones can run small AI—especially those equipped with neural processing units, which are specialized chips that handle AI tasks like facial recognition and changing the brightness, shadows, or contrast in a photo.

In 2025, slightly more than a third of all smartphones shipped worldwide were capable of running generative AI, and that figure will reach 45 percent by the end of this year, according to the technology research firm Counterpoint. By the end of next year, slightly more than half of all smartphones will be able to run a small AI model.

The second reason Rovai cites is the shrinking footprint of language models. Both Google DeepMind’s Gemma 4 (released in April) and Alibaba’s Qwen 3.5 are “fantastic” for small AI, Rovai says. Both models are “open weight,” meaning users can adjust the connections between parameters to suit their needs. This makes it easy, for example, “to take a lot of data from, say, the milk industry and retrain the model specifically on that,” Rovai says.

Rovai illustrated these reasons on a Zoom call, using one of his most recent experiments. Holding up a device, he says, “This is the new Arduino UNO Q—a US $50 device with a Qualcomm chipset. I’m running a language model here, which collects data from sensors and analyzes that data to detect tiny pools of water where mosquitoes might be breeding. It takes 3 watts to run it.”

Support for Small-AI Development

Convinced that millions of people are already benefiting from these kinds of applications, the World Bank now actively promotes small AI with grants, mentorship programs, financing, technical advice, and models of government policies that are friendly for small-AI development. For example, in Rwanda, the World Bank is backing a government program to help low-income households get devices that can run AI.

All that said, no one claims that large language models are going away entirely. To create a generative AI that can run on a phone or other small device requires the architectural insights, data processing, and results of a larger model, Rovai says. “We need the big models to create these smaller models.”

And for all that small AI can benefit people without access to big AI, the technology can’t solve the larger problems of development and digital inequality, Alonge says. Implementing small AI won’t allow nations to escape the challenge of creating an ecosystem to support AI: reliable power, a supply chain that works, and an educational system that develops the talents needed to create AI tools.

Though his drug-scanning system can run for days on a phone with no connection, “you still want to be able to enable periodic syncing for updates with new signatures for the medications and analytics,” Alonge says. “And even when you are using batteries, reliable power is important. That phone battery is not going to last forever.”

In many parts of the world, the future of small AI isn’t assured, he says. “It works, and many places will eventually need to use it. The question is whether or not the political actors are wise enough to invest in infrastructure to support it long term.”

The rapid expansion of artificial intelligence infrastructure is typically framed as an energy problem. Data centers are projected to consume a growing share of global electricity demand: The International Energy Agency estimates they could account for 3 to 4 percent of total global consumption within this decade.

Utilities are already adjusting long-term forecasts to accommodate anticipated growth from hyperscale facilities and high-density compute clusters.

This framing captures scale. It misses behavior.

The emerging issue is not simply how much power large-scale compute systems consume, but how increasingly dense and synchronized computational workloads are beginning to alter the operating characteristics of the electrical grid itself through increasingly unpredictable demand that varies rapidly in both time and location, creating new operational challenges for grid operators.

AI’s Capricious Energy Needs

Traditional grid planning assumes relatively predictable demand behavior. Industrial, commercial, and residential loads generally follow established profiles that can be forecast with reasonable accuracy. Even substantial demand growth has historically been manageable through reserve planning, transmission upgrades, and demand management programs.

Large-scale compute infrastructure introduces a different class of electrical load. Training—the computational task of making AI models—tends to be highly synchronized across clusters of GPUs, TPUs, and specialized accelerators operating in parallel, computationally dense, and relatively scheduled. Inference—the process of actually using those models—is generally more distributed and user-driven, making demand less predictable both in time and location. Both differ materially from traditional industrial demand profiles, though for different reasons. Unlike many conventional industrial processes, these workloads can ramp rapidly depending on model training cycles, distributed compute coordination, and workload scheduling strategies.

From the perspective of the grid, this is not simply higher demand. It is more abrupt demand. High-density compute workloads can produce substantial step changes in electricity consumption over extremely short intervals, including rapid fluctuations occurring within milliseconds. Data-center operators are already deploying mitigation technologies, including batteries, power-conditioning systems, and supercapacitors. Collectively, however, data centers’ rapid load changes can place additional stress on backup-generation reserves, systems that adjust supply as demand changes, frequency-control mechanisms that maintain grid stability, and local transmission infrastructure.

Compute-related variability differs from the intermittency introduced through renewable energy integration. Wind and solar variability originate primarily on the supply side and is tied to environmental conditions. Compute-related variability emerges on the demand side, driven by workload synchronization, scheduling behavior, and computational intensity. The interaction between increasingly dynamic supply and demand conditions introduces additional uncertainty into forecasting, reserve management, congestion planning, and balancing operations.

Research organizations including the National Renewable Energy Laboratory have emphasized the growing complexity associated with integrating highly dynamic resources into modern grid operations.

Location, Location, Location

The issue becomes more significant when compute activity is geographically concentrated. Large-scale data centers tend to cluster in regions with favorable conditions such as fiber connectivity, access to markets, tax incentives, and historically low electricity costs. Northern Virginia, often referred to as Data Center Alley, remains the most prominent example. The region hosts the world’s largest concentration of data centers and carries a substantial share of global internet traffic.

Utilities operating in these regions have already identified data-center growth as a primary driver of future load expansion. Virginia-based electricity supplier Dominion Energy, for example, has repeatedly highlighted hyperscale demand growth in its integrated resource planning documents.

Virginia has seen one of the largest data center buildouts worldwide. Here, Amazon Web Services and Iron Mountain data centers dominate the landscape in Manassas, Va. Nathan Howard/Bloomberg/Getty Images

A sudden increase in electricity consumption within a constrained geographic area can stress substations, transmission corridors, and local balancing operations even if the broader grid maintains sufficient aggregate capacity. This creates localized reliability challenges that are not always visible through system-wide demand metrics alone.

Thermal management systems further intensify these effects. Cooling infrastructure in high-density compute facilities must respond dynamically to changing workloads. As processing intensity rises, cooling demand rises as well, often nonlinearly. This coupling between compute and thermal systems means that fluctuations in workload can propagate through multiple layers of facility power consumption simultaneously.

High-density compute clusters may also introduce power-quality concerns at the local level. Large concentrations of accelerators, switching power supplies, and high-frequency compute equipment can generate harmonics and nonlinear load behavior that place additional stress on distribution infrastructure. While modern facilities incorporate mitigation technologies, the scale and concentration of next-generation compute facilities may require utilities and operators to revisit assumptions surrounding localized power conditioning, harmonics management, and infrastructure resilience. These conditions can also contribute to short-duration electrical transients that place additional stress on localized infrastructure and power-conditioning systems.

Regulations Need Updating

Part of the challenge is that many existing regulatory and operational frameworks were designed around relatively stable industrial demand profiles. Large rapidly fluctuating loads have historically been constrained because abrupt cycling can complicate balancing operations, increase stress on transmission equipment, and reduce predictability in system operations. High-density compute clusters do not fit neatly within those assumptions.

This creates pressure for both operational adaptation and regulatory reassessment.

Demand-response mechanisms may allow certain compute workloads to be shifted or curtailed during periods of system stress. Data-center operators are exploring flexible scheduling, battery storage, and behind-the-meter generation. Grid operators, meanwhile, are evaluating planning frameworks and interconnection approaches for increasingly large flexible loads.

The Electric Reliability Council of Texas (ERCOT), for example, has publicly acknowledged the growing implications of large flexible loads, including data centers, for long-term grid planning and operational stability. Interconnection queues across the United States continue to expand significantly, reflecting mounting pressure on both generation and transmission infrastructure. Grid expansion timelines, however, are measured in years rather than quarters.

This creates a structural mismatch. Compute infrastructure can scale rapidly. Electrical infrastructure generally cannot.

The broader implication is that large-scale compute infrastructure is not simply another industrial load category. It represents a shift in the temporal and spatial characteristics of electricity demand itself.

Framing the issue solely in terms of aggregate energy consumption risks overlooking these second-order operational effects. Capacity expansion alone does not fully address rapid ramping behavior, synchronization, localized congestion, transient instability, reserve compression, or increasingly demanding load-following requirements.

The challenge is not just how much electricity these systems consume. It is how they are beginning to change the operating conditions of the grid itself. The call is not to slow AI development but to recognize that hyperscale computing represents a new category of electrical demand. As AI infrastructure continues to scale, planning frameworks may need to account not only for total energy consumption but also for demand volatility, synchronization effects, and geographic concentration. Grid resilience will increasingly depend on understanding how these facilities consume power, not simply how much power they consume.