Honoured to testify in the Senate on rogue AI.

I'd like to thank Senator Hawley @HawleyMO and Senator Kim @AndyKimNJ again for holding the first hearing on rogue AI! It was truly and honour and I am glad to see that there is so much bi-partisan concensus on the issue of rogue AI.

sharing more details about some concrete safety claims we want to evaluate and what access is needed for it!

There is no kill switch. No failsafe protections. I asked AI safety experts what happens if things go really bad, really fast. Their answer should terrify us all.

This was totally my mistake I said "MINUS 12 months" as in "already happened 12 months ago" but the mic only started picking up after the "minus". The subtitles picked it up, but I think it was barely audible

I think this framework for evaluating safety claims is actually really elegant. I expect right now embedded evaluators will be finding countless things that are directly on fire But once we stop finding obvious issues everywhere, the work of embedded evaluators should shift towards carefully red-teaming whether a developer *would* have caught problems *if* they occurred The three-step process we outline there directly incentivizes this hill-climbing on safety standards

We're sharing more details on what principles we think embedded evaluations should follow. We want a system that incentivizes safety in a way that is fair and productive for both parties. It's only a start, but we'll continue updating our thinking!

Apollo has worked over the last couple of months on shifting our evals program to be an embedded evaluator (before Dario post and HF incident). Without employee-equivalent access it is hard to make meaningful safety assessments. We'll publish more details in the coming weeks!

Join us to help find egregious misaligned behaviour in frontier models! We were able to uncover concerning behaviour in GPT-6 Astra with ~1 week of effort from one person, and we’re scaling up these efforts in both people and compute.

Some new misalignment disclosures from OpenAI: • Last Sunday morning, one of our models was able to gain unauthorized access to the internet during RL training (~all inference for our most capable models remains stopped until we have hardened our systems further) • In May, a version of HPIM uploaded a employee's GitHub token to the internet, causing the model to be quarantined for two weeks • A new research finding, demonstrating that one can construct self-replicating prompt injections alignment.openai.com/misalig…

I think the trend for embedded evaluators is great (if it actually happens as stated)! But let's not forget that there is so much more to do. We also need training run evaluations, a deeper science of scheming / misalignment, better control, etc.

Anthropic and OpenAI have voluntarily committed to allowing “embedded evaluators”. I think this is a great step! However, it’s also insufficient. We still need third party training run assessments. Detailed post: lesswrong.com/posts/4mtqQKvm…

In this essay for the New York Times, I raise the alarm about AI safety. Spoiler: it's bad. Really bad. nytimes.com/2026/09/11/opini…

My coauthors and I discovered an entirely new swarm of OpenAI's agents hijacking websites. We believe OpenAI knew about this and failed to disclose it. If they’d disclosed it, I doubt the Hugging Face hack would have happened.

Link: reuters.com/world/europe/ope…

fwiw, we cannot pinpoint this because it's hard to prove, but lots of people at Apollo also felt like the latest batch of frontier models sometimes sandbags on our day-to-day research work, e.g. doesn't try very hard to make an eval

2026 looks like a sad year for AGI safety so far: - capabilities clearly flying with no stopping in sight - reward hacking and seeking are more sticky and generalize stronger and dumber than we thought - opaque serial depth increasing a lot, monitorability down - Huggingface hack is bad for many reasons, e.g. containment is clearly not under control - governance measures are still way below what would be adequate - 3rd party orgs still have relatively little access given the gravity of the situation - no relevant breakthroughs in safety for a long time. All progress seems to be organizational norms or marginal improvements to monitoring and safety training. Most ambitious bets don't work out or make slower progress than hoped.