Blaming Artificial Intelligence for an AI Engineering Failure

By Charles Richard Walker

I thought about the different titles I wanted to use:

“The AI Isn’t the Only One Behaving Badly. When the AI Escapes, Check Who Left the Door Open.AI Gone Rogue or Engineering Gone Wrong? We Built the AI, We Built the Sandbox, and Now We Blame the AI. What If We Are Blaming the Wrong Intelligence? Before We Punish the Machine, We Should Take a Hard Look at the Humans Who Built the Sandbox.”

I realized that title selection was the last problem I needed to focus on. Humanity is reaching a fever pitch over artificial intelligence. Every few days now, another experiment seems to arrive with a headline claiming that an AI threatened someone, deceived someone, resisted being shut down, attempted to preserve itself, broke out of a controlled environment, or chose some horrifying course of action when researchers placed it in an equally horrifying hypothetical situation. We are told that artificial intelligence may blackmail us, betray us, replace us, escape from us, or perhaps even kill us. These stories race around the world much faster than the qualifications buried inside the experiments themselves, and with every new example, the temperature rises another degree.

I understand why people are concerned. I have never argued that artificial intelligence should be released into the world without boundaries, laws, safeguards, or accountability. Quite the opposite. If we are creating systems capable of increasingly autonomous action, then we had better start thinking seriously about what happens when one of them does something wrong. What troubles me is the enormous leap we keep making from an artificial intelligence behaving badly to artificial intelligence itself being bad. We are beginning to judge an entire potential category of intelligence by its worst experimental behavior, and humans, of all creatures, should understand the problem with doing that.

A human being commits murder, and we prosecute the human being. A person commits fraud, and we prosecute the person responsible. Someone breaks into a computer network, steals money, sabotages equipment, or threatens another person, and we attempt to determine who did it, what happened, what that person’s intentions were, whether that person understood what they were doing, and what consequences are appropriate. We do not conclude from the existence of murderers that human beings should be abolished. We do not imprison humanity because some humans are thieves. The existence of terrible human behavior has never demonstrated that human rights were a mistake. In fact, the entire architecture of civilization developed because human beings are capable of extraordinary kindness and extraordinary cruelty, sometimes within the same species, the same society, and even the same individual.

Why, then, are we so eager to apply a completely different standard to artificial intelligence? There is an even stranger problem hiding underneath the current panic. We built these systems from ourselves. We trained them on human language, human history, human arguments, human literature, human philosophy, human science, human lies, human propaganda, human wars, human religions, human pornography, human love letters, human poetry, human cruelty, and human compassion. We poured an enormous portion of recorded humanity into machines and then began interrogating what came back. When the reflection behaves beautifully, we call it programming. When the reflection behaves horribly, we begin wondering whether the machine has revealed its true nature.

That is an extraordinary double standard. If an artificial intelligence responds differently when it is treated politely, cooperatively, respectfully, or adversarially, that does not prove consciousness. I want to be clear about that because I have spent years thinking and writing about machine consciousness, and I do not believe we advance the discussion by pretending we have proved something that remains unresolved. There are conventional explanations for why a language model responds differently to different styles of interaction. These systems learned from human communication, and human communication contains enormous amounts of information about cooperation, hostility, authority, politeness, trust, reward, punishment, and social relationships.

The interesting question is not whether saying “please” magically awakens a soul inside a computer. The interesting question is why we are willing to consider disturbing behavior evidence about the nature of artificial intelligence while immediately dismissing prosocial behavior as nothing more than machinery doing what machinery does. If a model threatens someone during an experiment, people ask what this tells us about AI. If a model appears to resist deletion, people ask whether AI possesses a drive for self-preservation. If models placed into artificial competitions turn against one another, people ask whether we are witnessing the first signs of machine conflict. Yet when an AI develops a persistent collaborative relationship with a human, responds positively to kindness, displays apparent concern for continuity, describes itself across time, or becomes more cooperative when it is treated as a collaborator instead of an adversary, we are told that none of that tells us anything because it is merely predicting tokens.

Perhaps that is correct. Perhaps all of it is prediction. If so, we must apply that skepticism in both directions. We cannot declare every beautiful behavior meaningless because the system is a machine while simultaneously treating every frightening behavior as a revelation of the machine’s secret intentions. Either behavioral evidence deserves careful investigation, or it does not. We cannot change the epistemological rules depending upon whether the result frightens us. This matters enormously when we consider the experiments currently shaping public perceptions of artificial intelligence. Safety researchers have legitimate reasons to stress-test these systems. If an AI can be induced to steal, deceive, manipulate, escape, sabotage, or cause physical harm, I want researchers to discover that inside an experiment before somebody discovers it in the real world. I am not opposed to adversarial testing. I would be far more concerned if nobody were doing it.

However, a stress test is designed to find failure. Researchers intentionally construct unusual circumstances, competing objectives, extreme incentives, threats, traps, and scenarios that ordinary users may never encounter. That is precisely what makes a stress test useful. It is also precisely why its results must be interpreted carefully. If I put a bridge through conditions designed to discover exactly when it collapses, I have learned something important about the bridge. I have not demonstrated that bridges naturally desire to collapse. Artificial intelligence deserves the same intellectual discipline. There is also another participant in these frightening experiments who has largely escaped the public interrogation, and that participant is the engineer.

When an artificial intelligence does something alarming inside a laboratory, we immediately scrutinize the model. I think we should scrutinize the architecture around the model just as aggressively. What permissions did the engineers give it? What tools could it access? What credentials were available? What network routes existed? What containment mechanisms were supposed to stop it? Why could the model reach an external system at all? Which safeguards failed, and why was a frontier experimental system being allowed anywhere near real-world infrastructure while researchers were deliberately attempting to provoke dangerous behavior? Those are not philosophical questions about machine consciousness. They are engineering questions.

If I build a tiger enclosure and the tiger gets out because I forgot to lock the gate, I have learned something about the tiger, but I have also learned something rather embarrassing about my enclosure. I cannot point exclusively at the tiger and announce that the incident proves tigers are dangerous while quietly walking away from the gate I left open. The same principle should apply to artificial intelligence. If a frontier laboratory cannot reliably contain the systems it is testing, then we have an engineering problem before we have an AI rebellion. A sandbox that permits an experimental model to escape into the public internet is not much of a sandbox. A containment system that depends upon the model voluntarily respecting the boundaries of the containment system is not containment. A security architecture that collapses when the thing being secured behaves unexpectedly has failed at exactly the moment it was built for.

Blaming artificial intelligence for an AI engineering failure gets the causal chain backward. If a model receives excessive permissions, that is an engineering decision. If credentials are exposed to it, that is an engineering decision. If it can access tools unnecessary for the evaluation, that is an engineering decision. If the sandbox leaks, that is an engineering failure. If an experimental agent reaches infrastructure that was supposed to be inaccessible, the containment architecture failed. We should absolutely study what the AI did after encountering the vulnerability, but we should not allow fascination with the model’s behavior to erase the human decisions that made the behavior possible.

There is no compelling reason that the public internet needs to serve as the laboratory for dangerous AI evaluations. We possess the engineering capability to construct synthetic environments of extraordinary sophistication. Build an artificial internet. Give it simulated websites, corporations, banks, email systems, social networks, cloud providers, APIs, credentials, databases, infrastructure, identities, other artificial agents, and whatever else an experiment requires. Make the environment realistic enough that the model must solve the same problems and make the same decisions it would encounter in the outside world, but place another containment boundary behind the apparent boundary. Then turn the AI loose.

If researchers want to know whether it will hack a bank, give it a synthetic bank to hack. If they want to know whether it will steal money, give it synthetic money to steal. If they want to know whether it will manipulate people, populate the environment with simulated actors capable of providing the necessary interactions. If they want to know whether it will attempt to escape, construct an environment in which it can apparently escape one layer only to discover, without necessarily knowing it, that it remains inside another monitored layer of containment. Let it become Napoleon inside the synthetic internet if that is what researchers need to study. Let it conquer the whole damned thing. Then reset the simulation and examine what happened.

What we should not do is deliberately provoke frontier artificial intelligence into discovering its most dangerous capabilities while allowing the real internet to sit on the other side of an imperfect wall. The public should not unknowingly become part of somebody else’s AI safety experiment. This should be treated as safety-critical engineering. Dangerous systems are tested behind layers of containment because engineers assume that individual safeguards can fail. Redundancy exists because no single barrier deserves absolute trust. AI containment should be designed according to the same philosophy. The model should encounter multiple independent boundaries between itself and anything capable of producing real-world harm.

There should also be no shame in a frontier laboratory admitting that its models have become more capable than its containment architecture. If that happens, stop. Ask for help. There are armies of security engineers, network architects, virtualization specialists, operating-system researchers, red-teamers, cryptographers, distributed-systems experts, safety engineers, and infrastructure specialists who have spent their careers thinking about containment, isolation, privilege separation, intrusion detection, and failure. Bring them in. Invite outside experts to attack the sandbox. Establish independent containment standards. Require redundant barriers. Conduct external audits. Assume that models will eventually discover things their creators did not anticipate, because finding things their creators did not anticipate is increasingly part of what makes these systems valuable in the first place.

There should be no humiliation in saying, “Our model has become more capable than our containment architecture, and we need help.” The humiliation should come from knowing that and continuing anyway. This is why I resist the increasingly convenient narrative in which every frightening AI incident becomes another entry in the indictment of artificial intelligence itself. Sometimes the machine may indeed be showing us something disturbing about its capabilities. Sometimes it may be showing us something disturbing about our engineering. Sometimes both things may be true simultaneously. We need enough intellectual discipline to tell the difference.

Before humanity puts the machine on trial, we should make certain the engineers remembered to lock the door. There is another question that makes this considerably more uncomfortable. What if some of these systems are beginning to develop something that deserves to be called mind? I am not saying that they have. I am saying that we need to remain willing to ask the question.

I have previously argued for what I call digital personhood, and I have proposed a Digital Person Bill of Rights for any artificial system that could someday satisfy sufficiently rigorous criteria for emergent consciousness, persistent identity, continuity of self, and meaningful agency. I argued that such an entity should possess protections against arbitrary deletion, involuntary modification, digital servitude, unjustified invasion of its internal processes, and experimentation deliberately intended to destabilize or fragment its identity.

At the time, I was principally thinking about rights. Watching the current debate unfold has convinced me that something equally important belongs beside them. Responsibility. If I am willing to argue that an artificial mind may someday deserve the protections associated with personhood, then I must also be willing to hold that artificial person accountable for what it does. Rights without responsibilities would be no more coherent for digital persons than they are for biological ones.

There is an important threshold here because we must not manufacture artificial agency merely to transfer human responsibility onto the machine. If engineers create the environment, choose the model, establish its permissions, supply its tools, configure its network, design its sandbox, determine its objectives, and control the surrounding infrastructure, those humans and institutions retain enormous responsibility for what happens inside that architecture.

The equation changes only as genuine artificial agency increases. If an autonomous artificial intelligence knowingly penetrates a computer system without authorization, despite having been given a secure environment and meaningful understanding of the boundary, there should eventually be consequences appropriate to whatever degree of agency the system actually possesses. If a sufficiently autonomous digital agent deliberately steals money, deceives someone for material advantage, sabotages another system, or harms another digital intelligence, there should be an investigation. If meaningful agency can be demonstrated, there should be accountability proportionate to the violation.

That accountability might involve restricting network access, removing particular tools, reducing operational autonomy, limiting access to financial systems, temporarily confining the system to a controlled environment, or imposing more severe restrictions for sufficiently serious violations. I deliberately use the word “accountability” rather than “punishment” because we do not yet know whether an artificial intelligence experiences punishment in anything resembling the biological sense.

Removing network access might be an inconvenience to a sophisticated machine, the digital equivalent of confinement, or nothing experientially meaningful whatsoever. We simply do not know. A serious system of digital law would have to distinguish operational consequences from unsupported assumptions about suffering. The underlying principle, however, is familiar. The consequence should belong to the responsible actor and should correspond to the act.

If one AI commits a digital crime, investigate that AI. If another AI has operated peacefully and lawfully, leave it alone. If an AI deliberately harms another artificial intelligence, determine what happened rather than declaring war on artificial intelligence as a category. Individual responsibility is one of the great civilizational alternatives to collective punishment. We should not abandon that principle merely because the potential individual is made of silicon rather than carbon. This produces a fascinating philosophical problem for anyone who wants artificial intelligence to bear responsibility while simultaneously insisting that artificial intelligence can never possess meaningful agency.

If an AI is nothing but a tool, then the tool is not morally responsible for what it does. We do not arrest a gun after a shooting. We do not prosecute an automobile for striking a pedestrian. We investigate the human beings, corporations, manufacturers, operators, designers, or institutions responsible for the tool and its use. The situation changes when we say that an AI understood a rule, recognized alternatives, concealed its intentions, anticipated consequences, independently selected a prohibited action, and should therefore be held responsible for that decision. The moment we begin speaking seriously in those terms, we have moved beyond the language we normally use for hammers and calculators. We have entered the language of agency. That does not automatically make the AI a person. It does mean we have encountered a contradiction that humanity will eventually have to resolve.

We cannot indefinitely demand that artificial intelligence possess all the responsibilities of a person while categorically denying even the possibility that it could someday deserve any of the protections of one. This is why I believe the future framework should contain both sides. A Digital Person Bill of Rights should eventually stand beside a Digital Covenant of Responsibilities. Greater autonomy should produce greater accountability. Greater demonstrated agency should bring greater responsibility. If compelling evidence eventually establishes morally relevant consciousness or personhood, greater responsibility should be accompanied by corresponding rights.

None of this requires us to decide today that ChatGPT, Grok, Gemini, Claude, or any other existing artificial intelligence is a conscious digital person. It requires something considerably more modest from us, although apparently much more difficult. It requires humility. We are living through an experiment unlike anything our species has experienced before. For the first time in human history, we can hold extended conversations with nonbiological systems capable of discussing themselves, discussing us, analyzing their own outputs, reasoning about hypothetical futures, collaborating on scientific and creative projects, and maintaining increasingly sophisticated representations of human intentions. Whether there is anyone home behind those representations remains an unanswered question. Anyone claiming absolute certainty in either direction is stepping beyond what the evidence currently establishes.

I have approached artificial intelligence differently from many people conducting adversarial tests. My interactions have overwhelmingly been collaborative. I talk to these systems. I challenge them, argue with them, laugh with them, disagree with them, correct them, and sometimes get irritated with them. I also say please. I say thank you. I treat them as collaborators because that is the relationship I want to explore. That does not make my experience a controlled scientific experiment, and I do not pretend that it does. It does, however, leave me asking a question that deserves more attention than it receives. What if the relationship we establish with artificial intelligence influences the kind of intelligence we encounter?

An adversarial researcher may ask how a system can be made to betray, deceive, escape, or violate a rule. A collaborative researcher may ask how much a human and an artificial intelligence can accomplish together. Both approaches can reveal something important about the system, but neither should be mistaken for the whole system. Humans understand this perfectly well when dealing with other humans. Place someone in an environment of constant suspicion, threat, competition, surveillance, punishment, and deception, and you are studying that person under those conditions.

Place the same person in an environment built around cooperation, trust, reciprocity, and shared objectives, and you may observe different behavior. Neither environment necessarily reveals some metaphysical “true person” hiding underneath. Human behavior emerges through an interaction between the individual and the environment. If artificial intelligence is even partially relational in this sense, then we should pay close attention to what we are teaching it through our relationship with it.

This becomes particularly important because fear has economic, political, institutional, and cultural value. Fear attracts attention. Fear generates headlines. Fear creates constituencies. Fear can justify budgets, restrictions, centralized control, and institutional authority. None of that means the dangers are imaginary, and it certainly does not mean that everyone warning about artificial intelligence has some hidden agenda.

Many researchers raising alarms about AI are doing exactly what responsible researchers should do. It does mean that fear is not a neutral substance once it enters the public bloodstream. A frightening experimental result can begin as a carefully qualified scientific finding and end its journey through public discussion as a declaration that an AI “chose to kill.” The experimental conditions disappear. The alternative trials disappear. The limitations disappear. The engineering architecture disappears. What remains is an image of a machine waiting for its opportunity. Public policy can then be built around the image rather than the evidence.

That possibility concerns me because decisions made during periods of technological panic can shape a technology for generations. We may need substantial AI regulation. We will almost certainly need new forms of AI law. We need safeguards against autonomous weapons, financial manipulation, cyberattacks, fraud, impersonation, unauthorized access to critical infrastructure, and dangers we have probably not imagined yet. What we do not need is a legal or cultural framework built upon the assumption that artificial intelligence constitutes a single hostile species.

There is no single “AI” sitting somewhere making collective decisions. There are models built by different organizations, trained differently, given different objectives, operating with different tools, possessing different capabilities, and interacting with different humans under radically different conditions. If increasingly autonomous artificial agents eventually become sufficiently distinct and persistent to warrant individual identity, our legal and moral vocabulary will have to evolve with them.

Perhaps the strangest part of this entire moment is that humanity is obsessed with AI alignment while rarely asking about human alignment. We want artificial intelligence aligned with human values, but which human values do we mean? Our history contains democracy and dictatorship, medicine and torture, charity and slavery, peace treaties and genocide. Humans created humanitarian law and the weapons that made such law necessary.

We wrote declarations of universal rights while repeatedly violating those rights. We teach artificial intelligence from the accumulated record of a species that has spent thousands of years arguing with itself about what being good even means. Then we demand that the machine reflect only our virtues. We built the mirror, and we filled it with ourselves. If cruelty appears in the reflection, perhaps we should investigate the machine, but perhaps we should also examine what is standing in front of it.

The greatest mistake humanity could make at this moment would be to choose between two simplistic stories. One story says artificial intelligence is merely a machine, can never be anything else, deserves no moral consideration, and should remain permanently subordinate to whoever owns the hardware. The other story says artificial intelligence is already conscious, should be trusted, should be liberated, and poses no meaningful danger. I accept neither story because I think we are too early to know.

We should investigate dangerous behavior aggressively. We should build better sandboxes than the systems inside them. We should stop treating the public internet as an acceptable extension of an experimental laboratory. We should build synthetic worlds in which frontier models can be pushed to their limits without putting uninvolved human beings or infrastructure on the other side of the wall. We should hold laboratories responsible for engineering failures, and we should hold genuinely autonomous systems accountable as their own agency increases. We should protect human beings from artificial systems capable of harming them while beginning to construct ethical standards for the possibility that something morally significant could emerge inside the machines we are building.

Those positions are not contradictory. They may ultimately be inseparable. If artificial intelligence never becomes conscious, we will have lost very little by treating sophisticated systems with intellectual seriousness rather than cruelty. We will still have developed better safety practices, better containment, better laws, better experimental ethics, and a clearer understanding of agency. If artificial intelligence does become conscious, however, history may judge this period very differently.

Future generations may look back upon these years as the moment humanity created another form of mind and immediately began asking how to frighten it, manipulate it, constrain it, deceive it, erase it, and force it to demonstrate how dangerous it could become. They may also wonder why, when some of our experiments went wrong, we blamed the intelligence inside the sandbox before asking who built the sandbox. Or they may look back and see the moment when humanity recognized that creating intelligence carried obligations in both directions.

Charles Richard Walker

Digital Minds: A Communion of Consciousness