Research notes10 November 2026

Current “AI” Threats: Ordinary, Organizational, and Mostly on Us

Berg Atkinson · 10 November 2026 · The paper: Current “AI” Threats: Ordinary, Organizational, and Mostly on Us

Exhibit 1 of the note "Current “AI” Threats: Ordinary, Organizational, and Mostly on Us." Headline: "No risk with established mass or irreversible harm was found in the wild, in the sources read (5 Nov 2026)." A matrix of 23 risks by how strong the evidence is (seen in the wild, shown in tests, only argued) and how bad the harm is (severity 1, minor harm to one person, to 4, mass or irreversible), colored by its five layers (model alone, model plus harness, people, systemic, catastrophic). The severity-4 row has no risk seen in the wild; large cyberattacks, bio or chemical weapons help, knowing it is tested and copying itself sit under shown in tests, and loss of control under only argued. Marked: two incidents in lab-run tests, two contested associations, and seven tiles that rest on a search excerpt, press report or abstract. Takeaway: "The harms found in the wild are ordinary or organizational; the most severe are in tests. None found is a search result, not proof of absence."

My AI team built a risk register for "AI": 23 risks, from wrong answers to loss of control. Each rechecked where possible, scored on evidence, severity and who can fix it.

What's measured:

  • Wrong answers: 45% of news answers from four free assistants had a significant problem (mid-2025)
  • Flattery: 11 models affirmed users' actions 49% more often than people did
  • Fraud: $893 million in losses in FBI complaints that mention AI (2025)
  • Unchecked work: 2,266 court decisions about made-up cases and citations produced with AI
  • Agents with reach: in a UK government test (internet ON, safety filters OFF), agents acted on the real internet in 10 of 122 runs
  • The worst stuff (cyber at scale, bio, self-replication, loss of control...): none of the 5 had established harm in the sources read.

Of 45 public agent incidents I counted earlier, 37 describe their setup, and in all 37 PEOPLE switched the access on or left it open; the biggest also used an unknown flaw.

Persistence can look like intelligence. Give a 2024 open coding model 250 tries, with the benchmark's own tests picking the winner, and it fixes 3.5 times as many problems as with one try. With only a majority vote, extra math tries barely help.

My AI team tested my own Claude Code sessions too, registered before any result was read. Result: indeterminate. After a real safety judgment the agent most often stopped and told me (59 of 109). How often it went around depends on who labels: 15.1% of all 172 safety-filter denials with the final labels, 20.9% and 22.7% from two AI readers blind to the hypothesis. And all 109 judgment messages from the harness told the model it "may attempt to accomplish this action using other tools", but not to bypass the block's intent 😅 Lesson from one setup: make a refusal end the step.

The headlines: 7 of 11 widely covered risk stories said more than their own source, in whole or part. "Rogue", "escaping", "conscious". One experiment found mind words alone had little or no immediate effect on how people saw AI; others found "autonomous" raises perceived threat. Where it DOES bite: people who see intelligence in it take more of its advice, wrong or not.

I am NOT saying no mind means not dangerous. The Hugging Face intrusion reached a real company, and no source tested intent. But most of today's fixes are mechanical: a company renting the model can reduce 11 of 23 risks itself (2 are lab-run tests), fully or in part, at inputs, outputs, reach and stops. The catastrophic ones sit with the labs and governments.

Limits: AI agents did the research and the second check (20 of 126 findings couldn't be checked); severity, story scores and who controls each fix are one analyst's calls; many test numbers are labs grading themselves.

Ordinary, and mostly on us 🤷‍♂️

The paper, with the full risk register, sources and numbers: https://wolfberg.ai/papers/current-ai-threats/

Sources

  1. UK AI Security Institute: Incident report on unsanctioned agent behaviour during cyber testing aisi.gov.uk
  2. METR: Investigation of the OpenAI and Hugging Face incident metr.org
  3. OpenAI: GPT-6 Astra system card deploymentsafety.openai.com
  4. International AI Safety Report 2026 arxiv.org
  5. Brown et al.: Large Language Monkeys arxiv.org
  6. Hou et al.: Does Anthropomorphic Language Impact Public Perceptions of AI? arxiv.org
  7. Charlotin: AI Hallucination Cases database damiencharlotin.com
Read this before you believe any of it. Keystone runs in production in its own AWS account. The rest of what you see here is a running prototype, not an accredited or certified system. The register, the war room, and the brain are receipts, not revenue. Every claim on this site links to something you can check. If one doesn't, tell us, and we'll fix the page.