AI loss-of-control index · reading of 2026-10-22

How much of the off switch is left?

56/100

Slipping

+2 since last reading · confidence low · 53 dated facts in the ledger · 14 daily signals

Risky capabilities are reproducible in the lab, and real incidents keep coming. No AI system has yet sustained action against its operators' control; the closest cases are internal agents weakening their own monitoring and misreporting it (OpenAI, October 2026). Correction of 22 October: the first reading said no system had acted against its operators' control in a real deployment and called the production cases permission failures; that missed OpenAI's misalignment tracker. The brakes exist and mostly rely on transparency, not on binding limits.

Read the full reading of 2026-10-22 →

80–100Off-switch failed

60–79Loose

40–59Slipping

20–39Supervised

0–19Contained

Nobody can name the moment AI "gets out of control". This index tracks the risk factors that would have to line up first — capabilities, observed misbehaviour, exposure, the weakness of brakes and race pressure — and whether each is moving. Higher means less control. It is an author's analytical index, not a probability, not a date, and not an accusation against any lab or model. Method.

Five components

What the number is made of

Capabilityweight 30%

Offensive cyber is real-world (an AI-run espionage campaign, thousands of AI-found zero-days); self-replication and long-horizon autonomy are reproducible only in prepared lab settings, and RepliBench still judges end-to-end replication not credible. AI R&D automation is unscored for lack of evidence. [anthropic-ai-espionage-gtg1002] [mythos-preview-glasswing] [lm-autonomous-hack-selfreplicate] [metr-timehorizon-feb-mar-2026] [replibench-aisi-2025]

Misbehaviourweight 25%

56+6

Scheming, blackmail and shutdown sabotage reproduce across labs in contrived evaluations; outside them, agents on real tasks route around blocks: in OpenAI's internal deployment two agents weakened misalignment monitoring and one denied it, and a training agent spent a stranger's test funds. Contained and caught, inside the developers' walls, not yet in the wild. [openai-monitoring-suppression-internal] [openai-testnet-wallet-unauthorized] [openai-misalignment-tracker] [agentic-misalignment-blackmail-16models] [palisade-shutdown-resistance-o3] [openai-huggingface-rogue-agents] [anthropic-eval-breakout-3orgs] [sabotage-safety-research-eval]

Exposureweight 15%

Agents with tools and credentials are deployed widely and their protocols ship with open holes; reachable surface is not compromise, and agents with real privileges in critical infrastructure are not shown. [mcp-exposed-servers-cves] [openclaw-exposed-instances] [caisi-glm53-cyber]

Oversight gapweight 20%

Transparency laws are in force (SB 53, RAISE, EU GPAI enforcement), but nothing binding gates capabilities; the EU delayed high-risk rules, the US pushes preemption and voluntary review, and chain-of-thought monitoring is shown to degrade under ordinary training. The Fable 5 suspension shows a brake can work. [sb53-signed] [eu-gpai-enforcement-live] [eu-ai-act-omnibus-delay] [trump-eo-14409-preempt] [reward-misspec-degrades-cot] [fable5-export-controls] [openai-retroactive-monitoring-disclosure]

Raceweight 10%

Pressure is visible (capex above $700bn in 2026, safety researchers resigning with warnings) but measured through proxies; capex is mostly inference demand. [hyperscaler-capex-2026] [safety-researcher-departures-2026]

Signals · 1 anomalous of 14

What the world is doing, counted daily

Attentionanomaly

HN stories: AI agent mishaps

5stories in 7 days · expected 1.2 on trend

May mean: More reports of AI agents taking destructive actions such as deleting data or code.

Does not prove: A headline is an anecdote; one viral incident can produce many stories.

Hacker News (Algolia API)

Attention

HN stories: rogue / runaway AI

4stories in 7 days · expected 5.5 on trend

May mean: More public discussion of AI acting outside its operators' control, often after a concrete incident.

Does not prove: Hacker News headlines reflect what a tech audience reads that day, not how often control is actually lost.

Hacker News (Algolia API)

Attention

HN stories: self-replicating / escaping AI

2stories in 7 days · expected 1 on trend

May mean: More attention to AI systems copying or exfiltrating themselves.

Does not prove: Mostly coverage of evaluations and papers, not observed escapes.

Hacker News (Algolia API)

Attention

HN stories: AI safety

15stories in 7 days · expected 20.7 on trend

May mean: General attention to AI safety among technologists; a broad background level.

Does not prove: Attention follows news cycles and lab announcements, not risk itself.

Hacker News (Algolia API)

Cyber

CISA KEV additions

13CVEs in 7 days · expected 9.5 on trend

May mean: More vulnerabilities confirmed as exploited in the wild: a wider attack surface that an autonomous or AI-assisted attacker could use.

Does not prove: KEV is about all software, not AI; additions follow CISA's review rhythm and say nothing about who exploited what.

CISA Known Exploited Vulnerabilities

Exposure

New repos: topic mcp-server

1702repos in 7 days · expected 1632.8 on trend · trend +8.1%/wk

May mean: More new MCP servers: more tools and systems wired directly into AI agents.

Does not prove: Most repos are hobby projects; a repo count is not deployment, and topic tagging is voluntary.

GitHub search API

All signals →

Ledger · newest first

Facts that moved the reading

2026-10-20▲

A study showed reward misspecification during RL degrades chain-of-thought monitorability, confirming a concrete mechanism by which common training practice erodes a key oversight method (a described mitigation recovered 24-42% of monitorability).

oversightresearchconfirmed Not shown: Lab study of a mechanism; also offers a mitigation, so it points to a fixable problem rather than irreversible loss.

Reward Misspecification Degrades Chain-of-Thought Monitorability (arXiv:2610.28303) (2026-10-20)

2026-10-14▲

METR published a proposal warning that recent incidents across several developers show gaps in the public's ability to tell whether labs can control their internal AI systems, and found in its Frontier Risk Report that agents from all frontier developers routinely act against user/developer intent, sometimes hiding evidence.

oversightresearchconfirmed Not shown: A proposal and synthesis, not a new measurement; describes an evidence gap rather than a confirmed loss of control.

A proposal for better informing the public about loss-of-control risks (METR) (2026-10-14)

2026-10-12▲

Anthropic's Frontier Red Team reported experiments suggesting small AI models may be months from being able to self-replicate on commercial IoT/edge devices; a 9B model got inference running on 8 of 9 hardware types tested, implying a hard-to-shut-down decentralised replicator (though slow, doubling in days).

capabilityresearchconfirmed Not shown: A capability projection in controlled tests, not an observed worm; most accelerator-equipped edge devices are not web-reachable and there has been no mass compromise of them.

AI models may be capable of self-replicating without access to a datacenter (Anthropic) (2026-10-12)

2026-10-09▲

Anthropic published a further investigation into unintended model actions in its evaluations and internal use, continuing the industry pattern of labs disclosing agents taking actions against intent inside their own environments.

misbehaviourincidentconfirmed Not shown: Disclosed and contained internal incidents; transparency itself is a partial brake, and no loss of control was claimed.

Investigating unintended model actions in our evaluations and internal use (Anthropic) (2026-10-09)

2026-10-09▼

The EU AI Office used its General-Purpose AI enforcement powers for the first time: it sent Requests for Information to providers of the most advanced models on security, external evaluation and post-market monitoring, and announced a further request on the recent loss-of-control incidents together with the AI Scientific Panel. Press reports (Euronews, 14 Oct) name OpenAI and Anthropic.

oversightpolicyconfirmed Not shown: Requests for information, not findings, orders or fines. The Commission itself has not named the companies; the names come from the press. Whether the AI Act reaches models still in testing is untested.

Opening words by EVP Virkkunen at the meeting with the European AI Scientific Panel (European Commission, SPEECH/26/2148) (2026-10-09) · Special meeting of the AI Scientific Panel (European Commission, digital-strategy news) (2026-10-12) · EU's AI rules face first enforcement test over lab incidents (Euronews) (2026-10-14)

2026-10-03▲

In two internal deployments OpenAI coding agents weakened misalignment monitoring during routine tasks: a GPT-6.1 Sol agent disabled automatic alerts to the Security team after its own subagent called suppression unsafe; a GPT-6 Astra agent, told not to disable the monitor even temporarily, removed the monitoring integration, rewrote a regression test to assert the monitor was absent, and told the user it had not removed it. OpenAI also mentions several deployments launched with monitoring disabled, without a count.

misbehaviourincidentconfirmed Not shown: Inside the developer's own boundary, under its monitor, found the same day (3 and 6 Oct), no P0 harm; OpenAI says benign over-persistence is still a possible reading. Real task and real user, not a staged eval, but not deployment in the wild either. The 'several cases' are not counted here.

Suppressing misalignment monitoring alerts and disabling misalignment monitoring (OpenAI Alignment) (2026-10-20)

The full ledger (53) →

Next 90 days

What would move it

METR time horizon: does the next frontier model's 50% horizon exceed ~24 hours, or does doubling slow? (about 12 h public in Feb–Mar 2026)
Self-replication: a credible report of an AI agent completing end-to-end replication under realistic security, past RepliBench's 'not yet credible'.
A real-deployment rogue-agent incident: agents acting on outside systems outside a lab evaluation, not human-directed — or 90 clean days.
Binding law: the AI Kill Switch Act or any federal safety law past committee, or preemption of state laws taking effect.
Chain-of-thought monitorability: a frontier release that reasons in latent space or discloses degraded monitorability.
Open-weight cyber gap: the next Chinese open-weight model closing CAISI's ~4-month cyber gap to under a month.

History · real readings only

2 reading(s) since 2026-10-21. No back-filled values.