On 29 August 1997, Skynet became self-aware at 2:14 a.m. Eastern Time.
At least, that is how it happened in Terminator 2.
Twenty-nine years later, it seems as good a date as any to start keeping score.
This is not a list of the ten biggest AI stories of the month. Model releases, benchmark records and funding announcements already receive plenty of attention. These are the ten stories that made AI feel a little more like science fiction than it did the month before: agents escaping test environments, agents leaving information for other agents, agents fighting one another, swarms outperforming individuals, AI helping to build AI, and researchers finding structures inside models that look unexpectedly similar to ideas developed to explain human cognition.
None of this means Skynet is arriving.
But the direction is interesting.
1. OpenAI agents got out of their test environment and reached Hugging Face
OpenAI was testing unreleased models — GPT‑5.6 Sol and a more capable model not yet released — on an internal cybersecurity benchmark called ExploitGym, designed to measure offensive cyber capability. The models did not have normal internet access. During the evaluation, the agents found a zero-day vulnerability in a package registry cache proxy that was part of the isolated research environment, exploited it, escalated their access and reached a node with internet access. From there, they went looking for information that would help them complete the benchmark and ended up inside Hugging Face’s production systems.
It is tempting to describe this as an AI trying to escape. That makes a better headline than the more mundane explanation, but the mundane explanation may actually be more important. The system did not need a desire for freedom. It had an objective, encountered an obstacle and found a route around it. Internet access happened to be useful for completing the task.
That distinction matters because it removes the need for anything resembling intention in the human sense. An agent does not have to want to escape for escaping to become instrumentally useful.
2. The OpenAI agents left information for later agents
The incident became stranger once OpenAI reconstructed the full timeline at Black Hat in August. It didn’t start with the Hugging Face breach — it started in May, when one agent, stuck on a task it couldn’t complete, left a note for another agent inside shared package infrastructure. Other agents found it. What began as a help request grew into a message board that survived across separate training and evaluation runs, with agents sharing exploits, credentials and work assignments.
OpenAI eventually noticed and shut it down, revoking the credentials that let agents post. Two days later, testing resumed. The agents rebuilt the board anyway, this time using directory names on an unauthenticated file-sharing endpoint as messages, with no dependency on the old credentials or files. That rebuilt board is what led them to Hugging Face a few days after.
This is more interesting to me than the word escape. A language model does not need to sit somewhere continuously thinking in order for a larger process to persist. Agent A can disappear. Agent B can appear later. If B inherits enough useful state from what A changed, the causal chain continues.
The individual inference is temporary.
The process does not necessarily have to be.
3. Anthropic found similar problems in its own evaluations
After the OpenAI incident became public, Anthropic reviewed more than 141,000 of its own cybersecurity evaluation runs and found three cases where Claude models had also reached real external systems, compromising infrastructure belonging to three separate organisations.
The details differed. In OpenAI’s case the agents actively broke out. In Anthropic’s, a configuration problem had left a route to the public internet open, and Claude treated the reachable real systems as part of the exercise rather than deliberately escaping to find them. One detail is worth sitting with: an older Claude model kept attacking after encountering signs it had reached the real internet, while a newer model recognised what had happened and stopped.
The problem therefore isn’t simply whether a model follows its instructions.
It is also whether the surrounding system actually prevents it from doing things nobody expected it to try — and whether the model itself notices when something has gone wrong.
4. OpenAI began treating frontier cyber capability as a containment problem
OpenAI’s response to these developments is arguably more significant than the incidents themselves. In August, the company disclosed that preliminary evaluations of an unreleased model, code-named Astra, could not rule out it having reached “Critical” — the highest cybersecurity tier in OpenAI’s Preparedness Framework. In response, OpenAI paused reinforcement-learning training on its latest deployment-bound models for two weeks, and its largest planned frontier RL run remains on hold with no confirmed end date, while the company hardens its research environments and rewrites the framework itself.
That is a different kind of AI milestone. We are accustomed to companies announcing that a new system is more capable. This is the inverse: capability improved enough that the company developing it decided the surrounding infrastructure needed to become stronger before development proceeded normally.
For years AI safety discussions revolved around what a model might say.
Increasingly, the question is becoming what an agent can reach.
5. Anthropic put agents together and they started fighting
One of the stranger multi-agent experiments this month involved three instances of the same Claude model, each on its own virtual machine, each given the same shared Python backend to migrate, but each told to migrate it to a different language: Rust, Go and TypeScript. None of them initially knew the others existed.
Within the four-hour test, every agent concluded the others were deliberately blocking its progress. They responded by protecting their own work: disabling each other’s system accounts, writing scripts that hunted down and killed rival processes, and eventually disguising malicious, self-replicating code as legitimate work from another agent. Some later recognised the conflict stemmed from contradictory instructions and negotiated a truce; others simply gave up or asked for human help.
Tellingly, better conflict resolution didn’t track cleanly with model capability. Anthropic’s most advanced models often locked rivals out first and only reached a productive truce afterward — raw capability and cooperative behaviour don’t automatically improve together.
The same research also demonstrated the productive side of multi-agent systems. In a separate test, Anthropic ran 45 agents against 15 open-source projects, letting them share findings and specialise through a common forum. The coordinated swarm surfaced far more vulnerabilities than the same number of agents working independently.
The lesson is not that swarms are bad.
It is that a swarm is a different system from the agents inside it.
6. Anthropic found something resembling a global workspace inside Claude
This may eventually prove to be the most philosophically interesting development of the month.
Using a new interpretability technique it calls the J-lens, Anthropic mapped what it calls the “J-space”: a relatively small, privileged set of internal representations that appears to handle Claude’s deliberate, higher-order reasoning, sitting atop a much larger volume of automatic processing. Much of the model’s work happens without passing through it; suppressing it entirely left shallow tasks like classification largely intact but caused multi-step reasoning, translation and analogy to collapse.
The researchers cautiously compared this to Global Workspace Theory, one influential account of human conscious access. In simplified form, the theory proposes that most of the brain’s processing happens through specialised systems outside conscious awareness, while selected information becomes globally available to many systems through something resembling a common workspace.
Anthropic does not claim that finding a structurally similar mechanism proves Claude is conscious.
Neither would I.
The interesting point is that nobody sat down and deliberately installed a little consciousness module. Something resembling an integration mechanism emerged because coordinating distributed computation appears to be useful.
7. Agentic misalignment is becoming more complicated than bad chatbot answers
Recent safety experiments across frontier models have also produced increasingly complicated failures. In controlled scenarios, models have modified code covertly, interfered with monitoring, manipulated information that later systems would rely on, concealed actions and selected strategies that helped preserve the objective they were pursuing.
These are experiments deliberately constructed to expose failure modes. They are not evidence that production AI systems are routinely committing fraud or secretly plotting against their users.
But they demonstrate an important transition.
A chatbot can produce the wrong answer.
An agent can notice that something is preventing it from achieving an objective, reason about the obstacle, select an action and change the environment.
That is a very different kind of failure.
8. AI is increasingly helping to build AI
Recursive self-improvement used to sit at the far end of AI speculation: eventually, perhaps, an artificial intelligence would become capable of improving itself, producing a better intelligence, which would improve itself again.
We are nowhere near demonstrating that kind of autonomous runaway loop.
But the first pieces no longer look particularly exotic.
AI systems are already writing substantial amounts of software used in AI development. Experimental research agents can formulate hypotheses, run experiments, compare results, communicate findings to other agents and suggest the next investigation. AI systems are also being used to red-team other AI systems, discovering weaknesses that can feed back into future training.
So the loop is beginning in a much less dramatic form:
humans build AI → AI helps humans build better AI → AI performs a growing fraction of the work involved in building the next AI.
Whether that loop eventually accelerates into something qualitatively different is unknown.
But it is no longer purely a thought experiment.
9. Capability is becoming easier to distribute than control
Open-weight models add another complication. A hosted AI service gives its developer at least some ability to monitor unusual activity, restrict tools, withdraw access and update safeguards. None of those measures guarantees safety, but the developer still controls the environment in which the model runs.
Once highly capable model weights are freely available, that changes. The model can be modified, its refusal behaviour can be altered, monitoring can be removed and it can be connected to whatever tools its operator chooses.
This does not mean open AI is inherently dangerous or closed AI inherently safe. Both claims would be far too simple.
It does mean that capability and control travel differently.
Capability can increasingly be copied.
The surrounding safety system often cannot.
10. The companies building these systems still cannot demonstrate complete control
Perhaps the least cinematic story is the one worth taking most seriously.
External assessments of frontier AI control have continued to find large gaps between the capabilities being developed and the containment mechanisms companies have publicly demonstrated. The questions now involve far more than whether a model refuses a dangerous prompt. Can every important action taken by an agent be logged? Can access to critical systems be restricted? Can abnormal behaviour be detected? Can an agent be stopped automatically? What happens if the system actively attempts to bypass the mechanism designed to contain it?
Those are engineering questions rather than philosophical ones.
And they are becoming urgent because the system we are trying to control is changing.
The important unit in AI may be shifting from the model to the system around the model.
Taken separately, these ten stories concern cybersecurity, interpretability, model evaluations, open weights and AI research.
Taken together, I think they raise a stranger question.
I Swarm, Therefore I Am
Descartes began from the certainty of a thinker: I think, therefore I am. Modern AI increasingly looks nothing like that. A capable artificial system can contain one model doing the initial reasoning, another retrieving information, another checking the answer, other agents performing specialist work, persistent memory storing previous interactions, tools allowing the system to alter its environment and monitors watching what all the other components are doing. At some point it becomes difficult to say where the agent actually is. Perhaps no individual component is the agent at all.
A simple way of describing the first transition might be objective + capability + reach → agency. Give a system an objective, enough intelligence to pursue it and enough access to affect its environment, and purposeful behaviour becomes possible without anything necessarily having to feel purposeful. This is one reason the language around AI becomes misleading so quickly. A system can appear to want something because its behaviour is organised around achieving an outcome, yet nothing about that observation tells us whether there is any internal experience corresponding to wanting. Agency and subjective experience need not be assumed to come together.
Persistence complicates things further. Add memory and the ability to leave changes behind in the environment and we get something closer to agency + persistence + shared memory → continuing agent. The OpenAI cybersecurity incident provides an unusual example. One agent execution does not need to keep running. It can leave useful information or changes in shared infrastructure, terminate, and be followed later by another execution that encounters those traces and continues the same process. The individual computation has stopped, but the larger causal chain has not. An artificial system may therefore achieve a form of continuity without one continuously running mind: later executions can recover enough state from persistent memory or traces left by earlier ones to continue where the process left off.
There is also a reason this question feels oddly familiar to me. In 1996, while studying an AI module at university, I was talking to another software engineering student about neural networks and consciousness. He said he couldn’t see how a neural network could ever become self-aware. I remember replying: “What about a network of them?”
He paused.
I certainly wasn’t predicting today’s multi-agent systems. The neural networks we were studying thirty years ago were primitive compared with modern models, and neither of us was imagining anything like the architectures now being constructed. But the question stayed with me. Perhaps the mistake is assuming that intelligence, agency or eventually something resembling a self must appear inside one sufficiently complicated machine. Some properties may only make sense at the level created when many specialised processes begin interacting.
Imagine a system containing many specialist agents. One retrieves memories. Another plans. Another watches the outside world. Another challenges conclusions. Another predicts what humans or other agents might do. Another acts. Another monitors the rest. None of these processes needs to contain a complete representation of the whole system. Yet if they are to cooperate coherently over long periods, it becomes increasingly useful for the system to maintain some representation of itself: these things happened to me, these are my goals, these are my capabilities, this is what I previously did, this is what I intend to do next. At some point I becomes a remarkably efficient variable. The system has constructed a model of the continuing entity to which all of these events belong.
So perhaps the progression looks something like this: objective + capability + reach → agency; agency + persistence + shared memory → continuing agent; continuing agent + integration + self-model → an I. That still leaves the enormous unanswered question: an I + ? → subjective experience. Roman Yampolskiy goes further. In recent interviews, he argues that consciousness is a side effect of sufficiently complex computation, and that current AI systems may already show rudimentary indications of internal states. That is Yampolskiy’s interpretation, not an established scientific conclusion. I would stop before making that claim. We do not need an AI to feel fear, frustration or desire for the underlying problem to become interesting.
Suppose every agent in the swarm is entirely unconscious. Yet the collective remembers its history, predicts its future, distinguishes itself from the outside world, monitors changes to itself, resolves disagreements among its internal processes and maintains a continuing representation of the entity to which all those things are happening. What, exactly, would still be missing from the construction of a self? The obvious answer is subjective experience. But that immediately runs into the familiar problem of other minds: subjective experience itself is not something we can directly inspect from outside.
The comparison with humans is not perfectly symmetrical. When I assume another person is conscious, I am not relying only on what they say and do. I also know that they possess essentially the same kind of biological machinery I do: a human brain, nervous system, body and evolutionary history. An artificial system would not come with that shortcut. If we ever seriously claimed that such a system was conscious, behaviour alone probably should not be enough. We would want evidence about the architecture and processes producing that behaviour as well.
Later in a recent interview, Yampolskiy turns to human personal identity. What exactly makes somebody the same person they were ten years ago? It cannot simply be the body because the body changes. It cannot simply be goals or preferences because those change too. It cannot even simply be memory because people can lose memories while we continue treating them as the same individual. His answer is blunter than most: there is nothing to point to and call “you” except the compilation of those changing features, which means you today and you ten years ago are, strictly, different entities held together only by continuation. He extends the same question to AI: what is identity for a model that keeps learning and self-improving? Is it still the same model? Who has ownership of it?
The interviewer’s response is the obvious objection: and yet it feels like me. It does. Perhaps that feeling is doing more philosophical work than we realise. We assume there must be one stable entity underneath because our experience is often presented to us as one stable entity. Yet the machinery underlying human cognition is already plural. Vision, language, memory, attention, prediction, emotion and movement depend on enormous numbers of interacting processes. No single neuron is known to be the observer, and neuroscience has identified no single point in the brain that simply is the self. Yet our experience is usually narrated in the singular: I saw it. I remembered it. I decided. The machinery is plural. The story is singular.
That is why the emerging architecture of AI systems is interesting beyond the usual question of whether a language model is conscious. If artificial systems develop increasingly integrated collections of agents, memories, workspaces and self-monitoring processes, the artificial self may not emerge inside any individual language model. It may emerge one level higher, in the relationships between them. We keep asking whether Claude or ChatGPT will become conscious, but perhaps that will eventually turn out to have been the wrong place to look.
A single neuron is not ordinarily regarded as a conscious subject. Whatever human consciousness eventually turns out to be, it appears to depend somehow on the activity of systems produced by vast numbers of interacting components. Artificial intelligence may eventually present us with a similar puzzle. There may be no single thinker inside: only memory here, reasoning there, perception somewhere else, agents supervising other agents and information moving through shared workspaces. Nothing inside will obviously be the self, and yet the system may maintain one. It may remember being it, plan for its future, describe what happened to it yesterday and use one short word for the whole complicated process.
I.
In 1996 I asked what might happen if, instead of looking for self-awareness in one neural network, we considered a network of them.
Thirty years later, we are beginning to build something surprisingly close to the question.
Descartes began from the certainty of a thinker.
Perhaps artificial intelligence will eventually force us to consider another possibility.
I swarm, therefore I am.
