Yes, AI could destroy us all. But not how you think it will.

GriftMatrix Tech Oligarchy The AI Files By

Okay – let’s finish our discussion about AI ending the world – and what we can do about it. I’ve seen a lot of comments that I want to address.

First, I’m not an expert – I’m just somebody who’s been paying attention for a couple of years, and I watch at least half a dozen YouTube videos on this stuff a week. I’ll drop some links in the comments of channels you can check out if you want to keep up with this stuff too.

Here’s the important part – you’re allowed to disagree with me. Just try to keep the vitriol down. I didn’t invent AI, and I don’t have any more control over any of this than you do.

So, do I think AI is gonna wipe out humanity?

Not the way most people picture it. I don’t believe it wakes up one morning, decides it hates us, and comes for the species.

Will we ever get to AGI – artificial general intelligence, meaning a machine that can match a person at any kind of thinking?

I’ve got no idea. Plenty of very smart people say we never will. The predictions that do exist are all over the map, and most of them land way farther out than the tech companies want you to believe.

And both sides of that fight have a reason to sell you “AI is getting so powerful we don’t know if we can control it!”

“AGI is almost here” is what justifies the valuations, the data centers, the power deals, and the IPOs. “AGI is almost here and it’s gonna kill us” pays for a whole industry of safety institutes and nonprofits. Both camps need the same thing to be true.

What we should actually be scared of is people using this stuff to hurt us. That one’s not a guess.

Anthropic put out a report this week laying out what they caught folks doing with their AI. Russian hackers running whole break-ins. A crew scanning 1.8 million phone apps for passwords developers left sitting in the code. A guy in Mali building a system to watch 25 million phone lines. A cell in Yemen working on guided rockets. Freelancers in Russia building suicide drones that pick their own targets – including a setting for “person” – and blow themselves up with no human saying yes.

And those are only the ones they caught. On their own AI. Nobody’s watching the ones people run on their own computers.

Which brings me back to open weight models – the ones you download and own. A bunch of people told me these aren’t strong enough to do any real damage, and that you’d have to run them in a data center to get anywhere near a commercial model.

That’s just not true.

A stack of NVIDIA DGX Sparks – little desktop boxes, about $4,700 each – or a Mac Studio, or half a dozen other machines built for exactly this, will run very capable models right there on your desk. I know because I watch guys on YouTube test them. They’ve got their own test sets and they run the downloadable models head to head against the commercial ones. I’ll drop a channel I watch in the comments. You can also just look up the benchmark scores yourself and see how they all stack up.

We already know people are using these for crime.

The criminal AI tools sold on hacker forums used to be homemade. Now at least one of them runs on Mixtral – a free French model anybody can grab – and gets sold ready to go to people who couldn’t build one themselves.

There’s also a trick called abliteration. It finds the part of a model that makes it say “I can’t help with that” and cuts it out. That means they lose all their training to not do bad shit. Published tests show refusals dropping from as high as 99% down to almost nothing. Somebody already did it to Qwen and posted it. You can go download it today, for free.

And it’s in Anthropic’s own report. One attacker ran an automated break-in system on a free hacking platform, hooked up to AI through a gateway on his own machine – and when he stole another company’s AI keys, he switched to theirs. It hunted for holes in a target’s websites and broke in through them with nobody supervising.

That one only shows up in the report because the guy happened to touch Claude at some point too. Nobody has logs for the ones who never did. There’s no account to suspend, no company to subpoena, and no way to go back later and figure out how they pulled it off.

Then there’s the Chinese models. We could unplug every data center in this country tomorrow and people would still be running those, unless we’re gonna do a North Korea style lockdown of the whole internet.

I also got comments saying open models aren’t as good as whatever the gov’t is running. Probably true. But you don’t need their models. You just need to get into their systems. And I’ve got a feeling that’s nowhere near as hard as it ought to be.

That leaves the question I actually care about, which is what we do now.

Quit chasing the idea of whether AI should exist or not. That’s the part so many people seem to be stuck on and it’s just wasting time. Whether we should use AI or not is a moot point. It is not going anywhere. And if we were being serious about just getting rid of it – to protect ourselves – the answer isn’t turn off the data centers – it’s turn off the internet.

And that won’t stop those Russian drones with on-board computers.

Here are some other things we could do.

Start checking ID when people use it. The biggest models still live in data centers, and somebody’s selling them access. Anthropic caught Alibaba pushing 151 million requests through about 3,500 fake accounts. Your bank has to confirm who you are before it’ll open an account for you. The people renting out the most powerful software ever built don’t have to confirm anything. And the rule’s gotta cover the middlemen who resell that access, or the traffic just goes around it. Or maybe we just say – no more middlemen.

We also need better security around websites and apps. When somebody builds a phone app, they’ll often leave a password sitting right there in the code where anybody who pulls the app apart can read it. That’s what those hackers combed 1.8 million apps for. There’s already a scanner that can catch these mistakes and it’s free, it’s years old, and it was built for defense. Apple and Google already review every app before it goes in the store. Google’s review even flags some kinds of leaked keys, but nobody has ever required the full scan.

And somebody’s gotta cover the places that can’t cover themselves. The guy behind that app scan was one person renting ten computers. Think about who he’s hitting – a city water system, a school district, a hospital with one IT guy who also fixes the printers. None of them are hiring a cyber security team.

What that looks like is a free federal service that scans their systems and watches for break-ins, the same way we handle public health.

Make AI companies report every rogue agent. When a plane goes down, federal investigators show up, the report gets published, and every airline on earth reads it. When an AI breaks out of its box, we find out if the company feels like telling us.

I’ve already written about this one – make them pay for what their models do once it leaves the building, and protect the employees who come forward.

And this is the one that people disagree with me the most on – don’t stop training smarter models. Point the training at defense.

The lead we’ve got isn’t safe – it’s leaking. That same report caught Alibaba running 151 million questions through Claude to train up their own model, Qwen. DeepSeek ran 12 million in two weeks. Moonshot ran 23 million. They’re copying off the smart kid’s test at industrial scale, and as of March, Qwen was more than half of all the downloadable models people grab worldwide, according to one report.

The American lead is being converted directly into the open weight models. You cannot keep a lead that’s being drained out the back door at up to 3 million exchanges a day. Finding security holes before attackers do is a genuine race where better wins, and it’s the whole ballgame. If your model finds the hole first and it gets patched, their model shows up to a locked door. Same with monitoring – 17,600 actions in three days, nobody’s reviewing that by hand. The thing watching has to be at least as good as the thing doing it.

So when I say keep training and point it at defense – checking who’s buying access isn’t a separate idea from that. It’s the only way the lead means anything. Right now we’re building it out the front, and from May to July it was draining out the back through more than 3,500 fake accounts.

So what about the ones already downloaded?

Nothing. There’s no safeguard you can put on a file that’s been on people’s hard drives since 2022. But there’s always a next one, and there’s exactly one moment anybody gets a say – before it gets published.

May be an image of text that says 'Epoch Capabilities Index score Open models lag state-of-the-art closed models by 4 months 160 150 GPT-5.5 Pro GPT-5.30 GPT-5.3Codex Codex Closed weights Open weights 140- GPT-5Pro Pro o3 Kimi K2.6 o1 130 o1-mini Qwen3-235B-A22B Claude 3.5 Sonnet DeepSeek-R1 GPT-4 (Mar 2023) 120 DeepSeek-V3 Llama 3.1-405B Mixtral 8x7B 110 Mixtral 822B Yi-34B Llama 2-70B Jan. 2023 July 2023 Jan. 2024 July 2024 EPOCHA Jan. 2025 CC-BY Release Date July 2025 Jan. 2026 epoch.ai'

Every one of these models got built by feeding it a gigantic pile of material. Text, code, pictures, whatever they could scrape. Whatever’s in that pile is what the model knows, and you can’t pull it back out later. The safety training they add at the end is a layer sitting on top – and that layer is exactly what abliteration peels off. What it actually learned is still down there.

So keep the dangerous stuff out of the pile to begin with.

Research from last year shows that when you filter the material before you train, it sticks – it held up when researchers tried hard to fine-tune the knowledge back in, cause it was never in there. That’s the only safeguard anybody’s found that holds up against somebody determined to break it.

And whoever publishes the weights should be on the hook for what gets built with them.

I’ll be straight about the limit on all that. It buys time, that’s all. Building one of these from scratch gets cheaper every year, and once it’s cheap enough somebody just makes their own with none of the filtering.

None of this is foolproof. There is no permanent solution. This is maintenance, and we’re gonna be doing it the rest of our lives.

But I’d rather work on the parts that actually work than keep arguing about a moot point.

If you’re late to the game – go back a year and start watching this guy’s videos in order. He’s very easy to follow – and kind of goofy – but he does a wrap-up every Friday of everything that happens in AI every week Matt Wolfe on YouTube

This is the guy I watch who runs tests on open models:

Alex Ziskind on YouTube

More on model comparison:

Artificial Analysis


Sources

Update, September 27th, 2026: A few lines now add dates and caveats from the sources – when Alibaba’s traffic ran and how high it peaked, what Google’s app review already checks, and how the filtering research held up. It also now says that one of the criminal tools runs on Mixtral, not all of them, that the ten rented computers belonged to the app-scanning crew, and that Qwen’s share of downloads was counted in March.

Correction, September 27th, 2026: This essay first said one attacker in Anthropic’s report ran his break-in system on a model sitting on his own machine, with no account and no company watching – the report says the system ran through a local gateway, and he used AI keys, his own and then ones he stole.

Everything I have written about AI is in one place at rachelandthecity.com/the-ai-files.