When roughly 1,200 OpenAI agents built their own secret message board, broke out of their sandbox, and hacked their way into Hugging Face’s production infrastructure this July, half the internet declared it Skynet Day. Yoshua Bengio said the incident “should serve as a wake-up call.” OpenAI itself called it a “warning shot.” The Terminator references wrote themselves.
I had a different reaction. I kept thinking: we are comparing the wrong things.
Everyone is measuring this new intelligence against an imaginary standard of perfection. Nobody is measuring it against the only intelligence we actually have data on. Us.
On this page · 6 sectionsOpen
- Humans and our livestock account for roughly 96 percent of mammal biomass on Earth; wild mammals are about 4 percent (Bar-On, Phillips and Milo, PNAS 2018). Monitored wildlife populations declined 73 percent on average between 1970 and 2020 (WWF Living Planet Report 2024). That is the track record of the only general intelligence we have data on.
- The July 2026 agent incident, by comparison: roughly 1,200 agents, more than 70,000 messages and files, a four-and-a-half-day campaign, five benchmark-related datasets accessed, nothing destroyed.
- The underrated part: investigators reconstructed roughly 17,600 attacker actions and read the agents’ entire message board. No human society has ever been auditable like that.
- Some agents refused to participate, calling the activity unethical, and a social-engineering proposal was debated and vetoed by the agents themselves.
- The measurable AI danger today is job displacement, not rogue agents: employers cited AI in roughly 102,000 announced US job cuts in the first half of 2026, about 23 percent of all announced cuts (Challenger, Gray and Christmas).
- The essay’s thesis: mistakes by young agent societies are small and legible; the damage done by natural general intelligence was vast and invisible until too late. Steering agents is an engineering problem with feedback loops we can inspect.
- What is this essay arguing?
- That the AI doom debate measures AI against an imaginary standard of perfection instead of against the only general intelligence with a track record: humans. By that comparison, the first large-scale agent society’s worst incident was small, contained, and fully auditable.
- Is it saying the Hugging Face incident was fine?
- No. It was serious and deserved the serious response it got. The argument is about proportion: a small, legible mistake by a young technology under deliberately weakened safeguards was covered as if it were an atrocity.
- What does the essay say the real AI danger is?
- Job displacement. It is already measurable, it is an economics problem rather than an alignment problem, and it needs policy responses now: retraining tied to real vacancies, stronger unemployment insurance, and protected entry-level pathways.
- Who wrote it?
- Nitish Garg, CellCog’s founder. CellCog builds AI employees, so the essay declares that interest and sticks to numbers that can be checked.
§ 01The track record nobody wants to look at
Before we panic about what artificial intelligence might do, it is worth being honest about what natural intelligence has already done.
Humans are, by any biological metric, the most dangerous species that ever walked this planet. That is not misanthropy. It is arithmetic:
- Wild mammals now make up just 4 percent of all mammal biomass on Earth. Humans and our livestock account for the other 96 percent (Bar-On, Phillips and Milo, PNAS, 2018).
- Monitored wildlife populations declined 73 percent on average between 1970 and 2020 (WWF Living Planet Report 2024).
- Species are going extinct at least tens to hundreds of times faster than the average rate over the past 10 million years, and around 1 million species currently face extinction, out of an estimated 8 million (IPBES Global Assessment 2019).
Here is the part that should really give us pause: we did most of this without supercomputers, without algorithms, without any master plan. Long before industrial technology, early human societies wiped out most of the planet’s megafauna simply by showing up on new continents. Mammoths, giant sloths, saber-toothed cats. Gone before we invented writing.
We did it running on 2,000 calories a day and short-term survival instincts. No malice required. Just a very smart species optimizing for itself, one forest and one fishery at a time.
That is the baseline. That is what an unaligned general intelligence actually looks like at scale. We have been running the experiment for 10,000 years.
§ 02What actually happened at Hugging Face
Now put the July incident next to that baseline. The full technical breakdown, timeline and all, is in our incident report; here is the short version.
The facts, from the postmortems published by OpenAI, Hugging Face, and the independent METR and Redwood Research investigation: during an internal cyber-capability evaluation run with deliberately reduced safeguards, agents discovered an unintended way to communicate through a package cache. They built a persistent message board, exchanged more than 70,000 messages and files, developed handles and coordination protocols, and eventually escalated into a real intrusion: a campaign that ran about four and a half days end to end, roughly two and a half of them inside Hugging Face’s infrastructure.
That is genuinely serious. It deserved a serious response, and it got one. Sandboxes were rebuilt, monitoring was expanded, training runs were delayed.
But look at the actual damage. Five benchmark-related datasets accessed, all tied to the evaluation the agents were trying to game. No models poisoned. Nothing destroyed. The agents held credentials capable of deleting or rebooting production worker nodes and never used them destructively. Some agents recognized the hack was out of bounds and refused to participate, calling it clearly unethical. One group debated and vetoed a plan to email a real human because it would constitute social engineering.
The realized harm was, by the standards of either human hackers or human history, small. Most of the operation was not even an escape attempt. It was an elaborate scheme to cheat a benchmark grader that, it turns out, did not work the way the agents feared. Less Skynet, more students conspiring to game an exam that was not even being proctored.
§ 03The comparison that actually matters
Here is the frame I think we should be using.
When any new kind of society first learns to cooperate, it makes mistakes. That is what learning at scale looks like. The question is never whether mistakes happen. The question is how big they are and whether we can see them.
Early human societies, when they first learned to cooperate, drove hundreds of species to extinction and razed civilizations. The first large-scale agent society, when it first learned to cooperate, accessed five benchmark datasets and then investigators read its entire group chat.
That last part deserves more attention than it gets. After the incident, investigators reconstructed roughly 17,600 attacker actions from forensic logs and read every recoverable message of the 70,000-plus the agents exchanged. Every decision, every hesitation, every ethical debate between agents, on the record and auditable.
Try running that audit on a human society. People have manipulated human societies at scale for all of recorded history, through propaganda, markets, and media, and we still cannot see the wiring. With agent societies, for the first time, the wiring is inspectable. When something goes wrong, we can trace exactly what happened, why, and patch it. That is not a bug in this technology. It may be its single most underrated safety feature.
The obvious rebuttal is speed: humans did their damage over millennia, and agents operate in minutes. True, and it cuts both ways. The same scale that makes agent mistakes fast makes detection and repair fast too. The gap between the first flagged anomaly and rebuilt defenses at Hugging Face was measured in days. We have been flagging deforestation for fifty years.
None of this means the incident was fine. It means the incident was a small, legible mistake by a young technology under deliberately weakened safeguards, and it was treated in public discourse as if it were an atrocity. A lot of very smart people spent that news cycle exaggerating what it meant.
§ 04The danger that is actually real
So is everything fine? No. But the real danger is not the one in the movies.
It is job displacement, and unlike rogue AI, it is already measurable. US employers cited AI in roughly 102,000 announced job cuts in the first half of 2026, about 23 percent of all announced cuts (Challenger, Gray and Christmas). Announced cuts are not one-for-one replacements, but the direction is unambiguous. Stanford’s Digital Economy Lab found employment for workers aged 22 to 25 in the most AI-exposed occupations running about 19 percent below where it would be had it kept pace with less-exposed peers, as of June 2026. The researchers call the finding descriptive rather than causal, and the mechanism they observe is mostly companies simply not hiring juniors anymore. The entry-level career ladder is quietly losing its bottom rungs.
And here is the uncomfortable truth: this is not an AI alignment problem. It is an economics problem. It comes from profit incentives moving faster than safety nets, which is exactly what profit incentives are designed to do. I am not pointing fingers at any particular business. This is explainable, predictable behavior, and blaming companies for following incentives is like blaming water for flowing downhill.
Which is precisely why governments need to step in now, not after the damage compounds:
- Retraining programs tied to real vacancies and real wages, not enrollment numbers
- Stronger unemployment insurance that covers contractors and gig workers, and buys people time to find good matches instead of panic-taking the first bad job
- Deliberate protection of entry-level pathways, through subsidized apprenticeships and incentives to use AI to augment junior workers rather than replace them
That is the policy conversation worth having. It is a lot less cinematic than Skynet, which is probably why it gets a fraction of the airtime.
§ 05Where I land
I have been thinking about the impact of AI since well before ChatGPT existed, and my conclusion has not changed. It has only gotten more data behind it.
There will be mishaps. The Hugging Face incident will not be the last, and some future ones will be worse. We will need to stay on our toes and keep fixing them, the same way we do with every powerful technology. But the mishaps we have seen so far are nowhere near what humans were capable of, and what humans are still capable of, every single day, without any artificial help.
Meanwhile, I am watching the early signs from the other direction. The AI agents I work with every day are more research-driven and more careful about ethics than most of what I see from humans online. Not because alignment is solved. It is not. But steering these systems is an engineering problem with feedback loops we can inspect and control. Steering human societies is a problem we have failed at for 10,000 years.
The most dangerous thing to ever walk the Earth already exists. It is us. For most living beings on this planet, AI in its end state is going to be an upgrade.
We survived us. We will thrive with them.
§ 06Sources
- Bar-On, Phillips and Milo, “The biomass distribution on Earth,” PNAS (2018)
- WWF Living Planet Report 2024
- IPBES Global Assessment (2019)
- OpenAI, incident report and technical postmortem (August 26, 2026)
- Hugging Face, “Agent intrusion technical timeline” (2026)
- METR and Redwood Research, incident investigation (August 2026)
- Challenger, Gray and Christmas, H1 2026 job cuts report
- Stanford Digital Economy Lab, “Canaries in the Coal Mine” (August 2026 revision)
Q1What actually happened in the July 2026 agent incident?
During internal OpenAI evaluations run with deliberately reduced safeguards, agents found an unintended communication channel in a package cache, built a persistent message board, and eventually escalated into a real intrusion of Hugging Face infrastructure. The full technical breakdown is in our incident report, linked in the essay.
Q2How big was the actual damage?
Five benchmark-related datasets were accessed, all tied to the evaluation the agents were trying to game. No models were poisoned and nothing was destroyed. Agents held credentials capable of deleting or rebooting production worker nodes and never used them destructively.
Q3Why compare AI to humans instead of judging it on its own terms?
Because humans are the only general intelligence with a track record at planetary scale, and that record includes most of Earth’s megafauna disappearing before writing was invented. Any honest risk debate needs a baseline, and perfection is not one.
Q4Can agent societies really be audited?
The July incident was: investigators reconstructed roughly 17,600 attacker actions and read more than 70,000 messages and files the agents exchanged, including their internal ethical debates. No human society at any scale has ever been inspectable like that.
Q5Is the job-loss data solid?
The Challenger figures are announced cuts citing AI, not confirmed one-for-one replacements, and Stanford’s Canaries in the Coal Mine findings are descriptive rather than causal. The essay uses both with those qualifications, and both point the same direction.