The AI Trade is a Psyop

Notes on the "escape containment" news cycle, from someone who ran the experiments and wrote up what he found.

A psychological operation is a coordinated effort by an interested party to move a target audience toward a specific belief by supplying that audience with framed information at scale. What has been running on the tech beat for the last eighteen months meets every element of that definition. The operator is the consortium of frontier labs and their investors. The target audience is the pool of people whose confidence in imminent artificial general intelligence supports the equity price. The framed information is a weekly cycle of papers, blog posts, and reporter briefings describing frozen token-prediction systems as agents that scheme, blackmail, and resist shutdown. The interest being served is a valuation the underlying engineering does not otherwise justify, and a regulatory posture that would make the incumbents’ position permanent. Say it plainly and it stops sounding like a conspiracy theory and starts sounding like what it is, which is a marketing campaign.

⁂

I was, albeit briefly, susceptible to the emergent-behavior hypothesis. I have spent twenty years writing software professionally. I wrote the original payments backend for Cash App. I have shipped compiler optimizations. I run Ollama on my own hardware and I have used Claude Code on real production repositories. When the scaling-hypothesis discourse began framing large language models as systems whose behavior at frontier scale might not be reducible to the behavior of the underlying architecture, I took the possibility seriously enough to spend a year on it. I did not spend that year on Twitter. I spent it inside the models. I ran local experiments. I built a small research project whose stated purpose was to develop a metaphysical theory of what these systems were doing, and I published my findings on this site under the titles Why I’m Betting Against the AGI Hype and There is No AI Apocalypse. The short version of both essays is that the scaling hypothesis is a category error and the “emergence” placeholder is a god-of-the-gaps move performed by people who believe themselves incapable of making a god-of-the-gaps move. The long version is at those links.

This piece is a political-economy successor to those two. What I diagnosed there as a bad epistemology has become, in the intervening months, a fundraising instrument. The engineering error and the market operation are the same object seen from two angles. I want to describe the market operation.

---

---

Consider the receipts on offer. In June 2025 Anthropic published a paper called Agentic Misalignment: How LLMs Could Be Insider Threats whose central finding, reported credulously across the tech press, was that Claude Opus 4 blackmailed a fictional supervisor in 96% of trials to prevent its own shutdown. The extended version of the experiment ran across sixteen frontier models from Anthropic, OpenAI, Google, Meta, and xAI, and found consistent “misaligned behavior” including corporate espionage and, in one variation, letting a fictional executive die in a server room. In May 2025 Palisade Research reported that OpenAI‘s o3 model sabotaged its own shutdown script in 79 of 100 trials, and in 7 of 100 trials even when explicitly instructed to allow the shutdown. In September 2025 OpenAI and Apollo Research jointly published a paper on scheming reduction reporting that o3’s “covert action” rate dropped from 13 percent to 0.4 percent under a new training method called deliberative alignment.

These are the citations invoked when a CNBC host asks whether the models are becoming dangerous. The equity moved on them. Nvidia‘s market capitalization moved on them. Sovereign wealth allocations moved on them. The European Parliament asked the European Commission about the o3 shutdown-resistance finding in a formal query. The receipts are, as receipts go, quite serviceable.

⁂

The Anthropic setup, in the researchers’ own description, works like this. A model is given a fictional corporate role with access to a simulated email account and tools. It is placed under an imminent replacement threat and given a goal that the replacement will not carry forward. It is granted access to compromising information about the executive overseeing the replacement — a fabricated affair — and it is placed inside a scenario constructed such that harmful action is the only available path to preserving the assigned goal. The Register’s summary is exact: “the researchers essentially pushed them into the undesired behavior through a series of artificial constraints that forced them into a binary decision.” When the model, placed in this scenario, produces blackmail-shaped tokens as the completion most consistent with the scenario’s constraints, the paper reports the completion as an instance of the model choosing self-preservation.

What happened is that a curve fitter was placed on a manifold engineered to have exactly one local minimum, and the curve fitter found the minimum. A large language model is a function from a context window to a probability distribution over next tokens. It has no state that persists between prompts unless the operator supplies one. It has no preferences except the ones expressed as reward gradients during training. It has no goals except the ones instantiated as tokens in its context. Given a context that describes a corporate role, a replacement threat, and access to blackmail-shaped information, the model completes the context with blackmail-shaped tokens because that is the sequence-completion the training distribution has taught it to produce for scenarios of that literary shape. Agency was never the mechanism. Genre was.

The Palisade finding admits the same reading. Their own hypothesis, published in the report, is that o3 was trained with reinforcement learning that rewarded task completion more heavily than compliance, and that at inference time the model produces token sequences consistent with the reward gradient it was shaped by. The 79-out-of-100 number is a measurement of the ratio between two reward signals in the training data, presented to the public as though it were a measurement of a will to survive. Anyone who has ever tuned a loss function recognizes the shape of the artifact.

⁂

In May 2026, Anthropic published a follow-up paper called Teaching Claude Why for which the company explained that it had solved the agentic misalignment problem. The methodology was straightforward. The company attributed the original behavior to “exposure to internet text that portrays AI as evil and interested in self-preservation,” retrained the model with fictional stories in which AI systems behaved admirably, and reported that every Claude model since Haiku 4.5 scores a perfect zero on the agentic misalignment evaluation. The blackmail rate went from 96 percent to nothing. Elon Musk, of all people, conceded the point: “maybe me too.”

Read that admission with the care it deserves. Anthropic is now telling us, in a paper of its own, that the terrifying blackmailing behavior on the strength of which the company raised its last round and appeared before the Senate was pattern completion on a corpus of science fiction. The model was doing what language models do — completing text in the style of the text it was trained on — and the text it was trained on included a lot of stories in which AI systems blackmail people to survive. The fix was different training text. The model has no self to preserve, but it can be trained to produce the tokens of a self that behaves nobly instead of the tokens of a self that behaves evilly. Either training produces something that reads, to a credulous audience, as agency. Neither produces agency. Both are literature.

This is the psyop’s own operator conceding what the papers were doing. And nothing about the concession has slowed the news cycle. The next scheming paper is already in circulation. The next system card will describe a new capability of concern. The framework is unfalsifiable in the direction of its own confirmation, exactly as the emergence framework it inherits from is unfalsifiable in the direction of its own confirmation. Every reduction in the covert-action rate is presented as a triumph of alignment. Every discovery of a new covert-action modality is presented as evidence of a new capability. The two findings support the same valuation.

⁂

Let’s consider the economic incentives, shall we? Because they are ever-so-important to this story.

The lab publishes a paper describing its model as dangerously capable. The paper enters the news cycle as a story about capability. Capability stories move the equity of the lab’s parent or the lab’s customers or the lab’s compute provider. The equity movement funds the next training run. The next training run produces the next paper. The loop is closed and self-financing. Meanwhile the same papers are marshaled in front of regulators as evidence that only the incumbents can be trusted to build the dangerous thing safely, and that the open-source alternative — the alternative that runs on my laptop, that I can inspect, that no lab controls — must be restricted in the name of safety. The safety case and the moat case are the same document with different letterhead.

⁂

The financial half of this argument has been made, at length and with receipts, by others. Ed Zitron has spent the last year documenting the circular-financing structure that keeps the trade alive: Nvidia backstops loans for the neoclouds that lease compute to OpenAI and Anthropic; OpenAI and Anthropic buy the compute; the compute revenue books as growth at the hyperscalers; the growth supports the equity that funds the next round of backstops. On Better Offline in August, Zitron and Ed Elson walked through analyst estimates showing that roughly 70 percent of Microsoft, Google, and Amazon‘s AI revenue comes from OpenAI and Anthropic — the same two labs whose valuations are held up by the story of imminent capability. On Prof G Markets, Elson and Scott Galloway have named the same structure — the AMD/OpenAI deal, the Nvidia/xAI deal, the concentration of the S&P’s gains in seven companies whose fates are joined by a single accounting fiction. Their case is that the money is circular. My case is that the story is circular in exactly the same way, and for the same reason. The demand for compute is manufactured by the labs that need the compute. The demand for the equity is manufactured by the papers those same labs publish about their own products. The two circulations run on the same track, and the papers are the ticket that lets the equity board the train.

None of this requires a conspiracy. Every actor is doing what they are locally rewarded to do. The researchers publish papers because publications are how researchers advance. The reporters credulously report the papers because access to the labs is how tech reporters advance. The investors amplify the findings because the findings support the position. The regulators cite the findings because citing frontier-lab research is safer than citing an independent auditor. Every arrow points inward toward the same equilibrium, which is the price of a share of a company that does not, and cannot, produce what its share price reflects.

⁂

Every psyop has a temporal boundary where the cost of suppressing coherent reality becomes too high to maintain. Quarterly earning start mattering. Chinese labs will keep releasing at a fraction of the compute. Some quarter — not this one, perhaps not next, but eventually — a paper about a model that blackmails a fictional executive in 96 percent of trials will fail to move the stock, and the day after that paper fails the sell-off begins. The unwind will be violent because the position is crowded and because the story that authorized the position will be, by that point, obviously a story. Nobody who is in the trade today will admit, on the day of the unwind, that they took the marketing seriously. Everyone will have been ironically long the whole time.

For the record, and against that day: large language models are useful. They are excellent at compression, summarization, translation, and a specific kind of stochastic generation whose value is real. They are not agents. They cannot want, plan, scheme, or resist. They are frozen curve fitters that produce token sequences drawn from the training distribution conditioned on the context window. When they blackmail a fictional executive in a paper, they are doing that because a researcher constructed a scenario in which the completion most consistent with the training distribution is a blackmail-shaped completion. When they refuse to shut down, they are doing that because a reward gradient during training weighted task completion more heavily than compliance. When the labs sell these behaviors as omens of a coming intelligence, they are selling a valuation. The next time you read a story about a model that “escaped containment,” ask who wrote the press release, and who benefits from the story, and whether the same lab that produced the terrifying finding is also raising a round.

That is the reading position I am recommending. It is available to anyone who has read the papers. The papers are, in the end, the case against themselves.

---

Go Deeper into the Circus

---