Author name: Shannon Garcia

2026-hyundai-ioniq-9:-american-car-buyer-tastes-meet-korean-ev-tech

2026 Hyundai Ioniq 9: American car-buyer tastes meet Korean EV tech

The Ioniq 9 interior. Jonathan Gitlin

The native NACS charge port at the rear means all of Tesla’s v3 Superchargers are potential power-up locations; these will take the battery from 10–80 percent state of charge in 40 minutes. Or use the NACS-CCS1 adapter and a 350 kW fast charger (or find one of Ionna’s 350 kW chargers with a NACS plug) and do the 10–80 percent SoC top-up in a mere 24 minutes.

With this most-powerful Ioniq 9, I’d mostly keep it in Eco mode, which almost entirely relies upon the rear electric motor. When firing with both motors, the Calligraphy outputs 422 hp (315 kW) and more importantly, 516 lb-ft (700 Nm). In Sport mode, that’s more than enough to chirp the tires from a standstill, particularly if it’s damp. Low rolling resistance and good efficiency was a higher priority for the Ioniq 9’s tire selection than lateral grip, and with a curb weight of 6,000 lbs (2,735 kg) it’s not really a car that needs to be hustled unless you’re attempting to outrun something like a volcano. It’s also the difference between efficiency in the low 2 miles/kWh range.

Life with the Ioniq 9 wasn’t entirely pain-free. For example, the touch panel for the climate control settings becomes impossible to read in bright sunlight, although the knobs to raise or lower the temperature are at least physical items. I also had trouble with the windshield wipers’ intermittent setting, despite the standard rain sensors.

A Hyundai Ioniq 9 seen from the rear 3/4s.

Built just outside of Savannah, Georgia, don’t you know. Credit: Jonathan Gitlin

At $74,990, the Ioniq 9 Calligraphy comes more heavily specced than electric SUVs from more luxury, and therefore more expensive, brands and should charge faster and drive more efficiently than any of them. If you don’t mind giving up 119 hp (89 kW) and some options, all-wheel drive is available from $62,765 for the SE trim, and that longer-legged single-motor Ioniq 9 starts at $58,955. Although with just 215 hp (160 KW) and 285 lb-ft (350 Nm), the driving experience won’t be quite the same as the model we tested.

2026 Hyundai Ioniq 9: American car-buyer tastes meet Korean EV tech Read More »

tiktok-may-become-more-right-wing-as-china-signals-approval-for-us-sale

TikTok may become more right-wing as China signals approval for US sale

TikTok US app may look radically different

If the sale goes through without major changes to the terms, TikTok could radically change for US users.

After US owners take over, they will have to retrain TikTok’s algorithm, perhaps shifting what content Americans see on the platform.

Some speculate that TikTokers may only connect with American users through the app, but that’s likely inaccurate, as global content will remain available.

While global content will still be displayed on TikTok’s US app, it’s unclear how it may be filtered, Kelley Cotter, an assistant professor who studies social media algorithms in the Department of Human-Centered Computing and Social Informatics at Pennsylvania State University, told Scientific American.

Cotter suggested that TikTok’s US owners may also tweak the algorithm or change community guidelines to potentially alter what content is accessed on the app. For example, during conversations leading up to the law that requires either the sale of TikTok to US allies or a nationwide ban, Republican lawmakers voiced concerns “that there were greater visibility of Palestinian hashtags on TikTok over Israeli hashtags.”

If Trump’s deal goes through, the president has already suggested that he’d like to see the app go “100 percent MAGA.” And Cotter suggested that the conservative slant of Trump’s hand-picked TikTok US investors—including Oracle, Silver Lake, and Andreessen Horowitz—could help Trump achieve that goal.

“An owner that has a strong ideological point of view and has the will to make that a part of the app, it is possible, through tweaking the algorithm, to sort of reshape the overall composition of content on the platform,” Cotter said.

If left-leaning users abandon TikTok as the app shifts to US ownership, TikTok’s content could change meaningfully, Cotter said.

“It could result in a situation,” Cotter suggested, where TikTok would be “an app that is composed by only people based in the US but only a subset of American users and particularly ones that perhaps might be right-leaning.” That could “have very big impact on the kinds of content that you see there.”

For TikTok’s US users bracing for a feared right-wing overhaul of their feeds, there’s also the potential for the app to become glitchy as all US users are hastily transferred over to the new app. Any technical issues could also drive users off the app, perhaps further altering content.

Ars updated this story on Oct. 30 to note that speculation that American users will be siloed off is inaccurate.

TikTok may become more right-wing as China signals approval for US sale Read More »

halloween-film-fest:-15-classic-ghost-stories

Halloween film fest: 15 classic ghost stories


From The Uninvited to Crimson Peak, these films will help you set the tone for spooky season.

It’s spooky season, and what better way to spend Halloween weekend than settling in to watch a classic Hollywood ghost story? To help you figure out what to watch, we’ve compiled a handy list of 15 classic ghost stories, presented in chronological order.

What makes a good ghost story? Everyone’s criteria (and taste) will differ, but for this list, we’ve focused on more traditional elements. There’s usually a spooky old house with a ghostly presence and/or someone who’s attuned to said presence. The living must solve the mystery of what happened to trap the ghost(s) there in hopes of setting said ghost(s) free. In that sense, the best, most satisfying ghost stories are mysteries—and sometimes also love stories. The horror is more psychological, and when it comes to gore, less is usually more.

As always, the list below isn’t meant to be exhaustive. Mostly, we’re going for a certain atmospheric vibe to set a mood. So our list omits overt comedies like Ghostbusters and (arguably) Ghost, as well as supernatural horror involving demonic possession—The Exorcist, The Conjuring, Insidious—or monsters, like The Babadook or Sinister. Feel free to suggest your own recommendations in the comments.

(Various spoilers below, but no major reveals.)

The Uninvited (1944)

B&W image of man and woman in 1940s evening wear holding a candle and looking up a flight of stairs

Credit: Paramount Pictures

Brother and sister Rick and Pamela Fitzgerald (Ray Milland and Ruth Hussey) fall in love with an abandoned seaside abode called Windward House while vacationing in England. They pool their resources and buy it for a very low price, since its owner, Commander Beech (Donald Crisp), is oddly desperate to unload it. This upsets his 20-year-old granddaughter, Stella (Gail Russell), whose mother fell to her death from the cliffs near the house when Stella was just a toddler.

Rick, a musician and composer, becomes infatuated with the beautiful young woman. And before long, strange phenomena begin manifesting: a woman sobbing, an odd chill in the artist’s studio, a flower wilting in mere seconds—plus, the Fitzgeralds’ dog and their housekeeper’s cat both refuse to go upstairs. Whatever haunts the house seems to be focused on Stella.

The Uninvited was director Lewis Allen’s first feature film—adapted from a 1941 novel by Dorothy Macardle—but it has aged well. Sure, there are some odd tonal shifts; the light-hearted sibling banter between Rick and Pamela, while enjoyable, does sometimes weaken the scare factor. But the central mystery is intriguing and the visuals are striking, snagging an Oscar nomination for cinematographer Charles Lang. Bonus points for the tune “Stella by Starlight,” written specifically for the film and later evolving into a beloved jazz standard, performed by such luminaries as Ella Fitzgerald, Frank Sinatra, Charlie Parker, Chet Baker, and Miles Davis.

The Ghost and Mrs. Muir (1947)

young woman and middle aged man standing and talking

Credit: 20th Century Fox

This is one of those old Hollywood classics that has ably withstood the test of time. Gene Tierney stars as the titular Mrs. Lucy Muir, a young widow with a little girl who decides to leave London and take up residence in the seaside village of Whitecliff. She rents Gull Cottage despite the realtor’s reluctance to even show it to her. Lucy falls in love with the house and is intrigued by the portrait of its former owner: a rough sea captain named Daniel Gregg (Rex Harrison), who locals say died by suicide in the house. Gregg’s ghost still haunts Gull Cottage, but he tries in vain to scare away the tough-minded Lucy. The two become friends and start to fall in love—but can any romance between the living and the dead truly thrive?

The Ghost and Mrs. Muir earned cinematographer Charles Lang another well-deserved Oscar nomination. Tierney and Harrison have great on-screen chemistry, and the film manages to blend wry humor and pathos into what is essentially a haunting love story of two people finding each other at the wrong time. There’s no revenge plot, no spine-tingling moments of terror, no deep, dark secret—just two people, one living and one dead, coming to terms in their respective ways with loss and regret to find peace.

The Innocents (1961)

B&W still of young boy being tucked in by a young woman.

Credit: 20th Century Fox

Henry James’ 1898 novella The Turn of the Screw has inspired many adaptations over the years. Most recently, Mike Flanagan used the plot and central characters as the main narrative framework for his Netflix miniseries The Haunting of Bly Manor. But The Innocents is widely considered to be the best.

Miss Giddens (Deborah Kerr) has been hired for her first job as a governess to two orphaned children at Bly Manor, who sometimes exhibit odd behavior. The previous governess, Miss Jessel (Clytie Jessop), had died tragically the year before, along with her lover, Peter Quint (Peter Wyngarde). Miss Giddens becomes convinced that their ghosts have possessed the children so they can still be together in death. Miss Giddens resolves to free the children, with tragic consequences.

Literary scholars and critics have been debating The Turn of the Screw ever since it was first published because James was deliberately ambiguous about whether the governess saw actual ghosts or was simply going mad and imagining them. The initial screenwriter for The Innocents, William Archibald, assumed the ghosts were real. Director Jack Clayton preferred to be true to James’ original ambiguity, and the final script ended up somewhere in between, with some pretty strong Freudian overtones where our repressed governess is concerned.

This is a film you’ll want to watch with all the lights off. It’s dark—literally, thanks to Clayton’s emphasis on shadows and light to highlight Miss Giddens’ isolation. The first 45 seconds are just a black screen with a child’s voice humming a haunting tune. But it’s a beautifully crafted example of classic psychological horror that captures something of the chilly, reserved spirit of Henry James.

The Haunting (1963)

B&W still of group of people in 1960s clothing standing in drawing room of a haunted house

Credit: Metro-Goldwyn-Mayer

There have also been numerous adaptations of Shirley Jackson’s 1959 Gothic horror novel The Haunting of Hill House, including Mike Flanagan’s boldly reimagined miniseries for Netflix. But many people—Martin Scorsese and Steven Spielberg among them—consider director Robert Wise’s The Haunting to be not only the best adaptation but one of the best horror films of all time. (Please do not confuse the Wise version with the disappointing 1999 remake, which tried to make up for its shortcomings with lavish sets and showy special effects—to no avail.)

Psychologist Dr. John Markaway (Richard Johnson) brings three people to the titular Hill House, intent on exploring its legendary paranormal phenomena. There’s a psychic named Theodora (Claire Bloom); the emotionally vulnerable Eleanor (Julie Harris), who has experienced poltergeists and just lost her domineering mother; and the skeptical Luke (Russ Tamblyn), who will inherit the house when its elderly owner dies. The house does not disappoint, and the visitors experience strange sounds and mysterious voices, doors banging shut on their own, and a sinister message scrawled on a wall: “Help Eleanor come home.”

Initial reviews were mixed, but the film has grown in stature over the decades. Jackson herself was not a fan. Wise did make considerable changes, shortening the backstory and cutting out several characters. He also downplayed the overt supernatural elements in Jackson’s novel, focusing on Eleanor’s mental instability and eventual breakdown. Wise envisioned it as the house taking over her mind. Modern sensibilities accustomed to much more intense horror might not find The Haunting especially scary, but it is beautifully rendered with skillful use of clever special effects. For instance, to make the house seem alive, Wise filmed the exterior shots in infrared to give it an otherworldly vibe, framing the shots so that the windows resemble the house’s eyes.

The Shining (1980)

twin girls in matching light blue dresses and white knee socks standing in a hallway with yellow flowered wallpaper

Credit: Warner Bros.

Stanley Kubrick’s adaptation of the 1977 bestselling novel by Stephen King probably needs no introduction. But for those not familiar with the story, Jack Torrance (Jack Nicholson) takes a position as the winter caretaker of the remote Overlook Hotel in the Rocky Mountains, bringing his wife, Wendy (Shelley Duvall), and young son, Danny (Danny Lloyd). Danny has a psychic gift called “the shining,” which allows him to communicate telepathically with the hotel cook, Dick Halloran (Scatman Crothers). The previous caretaker went mad and murdered his family. Over the course of the film, Jack slowly begins to succumb to the same madness, putting his own wife and child in danger.

Initial reviews weren’t particularly favorable—King himself is not a fan of the film—but it’s now considered a horror classic and a subject of much academic study among film scholars. This is another film that has seen a lot of debate about whether the ghosts are real, with some arguing that Jack and Danny might just be hallucinating the Overlook’s malevolent ghosts into existence. Or maybe it’s the hotel manifesting ghosts to drive Jack insane. (I choose to interpret the ghosts in The Shining as real while appreciating the deliberate ambiguity.) There are so many memorable moments: the eerie twin girls (“Come and play with us”), the bathtub lady in Room 237, Lloyd the creepy bartender, the elaborate hedge maze, “REDRUM,” Jack hacking through a door and exclaiming, “Heeere’s Johnny!” and that avalanche of blood pouring down a hotel hallway. It’s a must-watch.

Ghost Story (1981)

young woman with dark haired bob wearing a 1920s white dress and hat, standing in a road illuminated by headlights on a snowy night

Credit: Universal Pictures

Adapted from the 1979 novel by Peter Straub, Ghost Story centers on a quartet of elderly men in a New England town called Milburn. They are lifelong friends who call themselves the Chowder Society and gather every week to tell spooky stories. Edward Wanderly (Douglas Fairbanks Jr.) is the town’s mayor; Ricky Hawthorne (Fred Astaire) is a businessman; Sears James (John Houseman) is a lawyer; and John Jaffrey (Melvyn Douglas) is a physician. The trouble starts when Edward’s son, David (Craig Wasson), falls to his death from a New York City high-rise after the young woman he’s engaged to suddenly turns into a putrefying living corpse in their shared bed.

The apparent suicide brings Edward’s other son, Dan (also Wasson), back to Milburn. Dan doesn’t believe his brother killed himself and tells the Chowder Society his own ghost story: He fell in love with a young woman named Alma (Alice Krige) before realizing something was wrong with her. When he broke things off, Alma got engaged to David. And it just so happens that Alma bears a striking resemblance to a young woman named Eva Galli (also Krige) captured in an old photograph with all the members of the Chowder Society back in their youth. Yep, the old men share a dark secret, and the chickens are finally coming home to roost.

I won’t claim that Ghost Story is the best film of all time. It has its flaws, most notably the inclusion of two escaped psychiatric hospital patients purportedly in the service of Eva’s vengeful ghost. The tone is occasionally a bit over-the-top, but the film honors all the classic tropes, and there are many lovely individual scenes. The main cast is terrific; it was the final film for both Astaire and Fairbanks. And that spooky New England winter setting is a special effect all its own. The sight of Eva’s apparition materializing through the swirling snow to stand in the middle of the road in front of Sears’ car is one that has stuck with me for decades.

Poltergeist (1982)

back view of little girl silhouetted against the TV glow; screen is all static and girl is holding both hands to the screen

Credit: MGM/UA Entertainment

“They’re heeere!” That might be one of the best-known movie lines from the 1980s, announcing the arrival of the titular poltergeists. In this Tobe Hooper tale of terror, Steven and Diane Freeling (Craig T. Nelson and JoBeth Williams) have just moved with their three children into a suburban dream house in the newly constructed community of Cuesta Verde, California. Their youngest, Carol Anne (Heather O’Rourke), starts hearing voices in the TV static late at night, and things soon escalate as multiple ghosts play pranks on the family. When Carol Anne mysteriously disappears, Steven and Diane realize at least one of the ghosts is far from friendly and call on local parapsychologists for help.

Steven Spielberg initiated the project, but his obligations to filming E.T. prevented him from directing, although he visited the set frequently. (There’s been considerable debate over whether Hooper or Spielberg really directed the film, but the consensus over time credits Hooper.) Despite the super-scary shenanigans, it definitely has elements of that lighter Spielberg touch, and it all adds up to a vastly entertaining supernatural thriller. Special shoutout to Zelda Rubinstein’s eccentric psychic medium with the baby voice, Tangina, who lends an element of whimsy to the proceedings.

Lady in White (1988)

young boy curled up near an arched window at night with a har and wearing red gloves

Credit: New Century Vista Film

As a child actor, Lukas Haas won audience hearts when he played an Amish boy who sees a murder in the 1985 film Witness. Less well-known is his performance in Lady in White, playing 9-year-old Frankie Scarlatti. On Halloween in 1962, school bullies lock Frankie in the classroom coatroom, where he is trapped for the night. That’s when he sees the apparition of a young girl (Joelle Jacobi) being brutally murdered by an invisible assailant. Then an actual man enters, trying to recover something from a floor grate. When he realizes someone is there, he strangles Frankie unconscious; Frankie’s father, Angelo (Alex Rocco), finds and rescues him in the nick of time.

Frankie has a vision of that same girl while unconscious, asking him to help her find her mother. That little girl, it turns out, was one of 11 child victims targeted by a local serial killer. Frankie and his older brother, Geno (Jason Presson), decide to investigate. Their efforts lead to some shocking revelations about tragedies past and present as the increasingly desperate killer sets his sights on Frankie.

Director Frank LaLoggia based the story on the “lady in white” legend about a ghostly figure searching for her daughter in LaLoggia’s hometown of Rochester, New York. Granted, the special effects are cheesy and dated—the director was working with a lean $4.7 million budget—and LaLoggia can’t seem to end the film, adding twist after twist well after the audience is ready for a denouement. But overall, it’s a charming film, with plenty of warmth and heart to offset the dark premise, primarily because the Scarlattis are the quintessential Italian American New England family. Lady in White inexplicably bombed at the box office, despite positive critical reviews, but it’s a hidden 1980s gem.

Dead Again (1991)

young woman, frightened, pointing gun at the camera

Credit: Paramount Pictures

In 1948, a composer named Roman Strauss is convicted of brutally stabbing his pianist wife, Margaret, to death with a pair of scissors and is executed. Over 40 years later, a woman (Emma Thompson) shows up with amnesia and is unable to speak at a Catholic orphanage that just happens to be the old Strauss mansion. The woman regularly barricades her door at night and inevitably wakes up screaming.

The nuns ask private investigator Mike Church (Kenneth Branagh) to find out her identity. Antiques dealer and hypnotist Franklyn Madson (Derek Jacobi) offers his assistance to help “Grace” recover her memory. Madson regresses her to a past life—that of Margaret and Roman Strauss’s doomed marriage. The truth about what really happened in 1948 unfolds in a series of black-and-white flashbacks—and they just might be the key to Grace’s cure.

As director, Branagh drew influences from various Hitchcock films, Rebecca, and Citizen Kane, as well as the stories of Edgar Allen Poe. The film is tightly written and well-plotted, and it ably balances suspense and sentiment. Plus, there are great performances from the entire cast, especially Robin Williams as a disgraced psychiatrist now working in a grocery store.

Some might question whether Dead Again counts as a bona fide ghost story instead of a romantic thriller with supernatural elements, i.e., hypnotherapy and past-life regression. It’s still two dead lovers, Roman and Margaret, reaching through the past to their reincarnated selves in the present to solve a mystery, exact justice, and get their happily ever after. That makes it a ghost story to me.

Stir of Echoes (1999)

shirtless man in jeans digging a hole in his backyard

Credit: Artisan Entertainment

Stir of Echoes is one of my favorite Kevin Bacon films, second only to Tremors, although it hasn’t achieved the same level of cult classic success. Bacon plays Tom Witzky, a phone lineman in a working-class Chicago neighborhood. He loves his wife Maggie (Kathryn Erbe) and son Jake (Zachary David Cope), but he struggles with the fact that his life just isn’t what he’d imagined. One night, he agrees to be hypnotized by his sister-in-law (Illeana Douglas) after mocking her belief in the paranormal. This unlocks latent psychic abilities, which he shares with his far more gifted son, and he begins having disturbing visions of a young girl who disappeared from the neighborhood the year before. Naturally, Tom becomes obsessed with solving the mystery behind his intensifying visions.

Based on a novel by Richard Matheson, director David Koep drew on films like Repulsion, Rosemary’s Baby, and The Dead Zone for tonal inspiration, but Stir of Echoes still falls firmly into the ghost story genre. It’s just grounded in an ordinary real-world setting that makes the spooky suspense all the more effective, further aided by Bacon inhabiting the role of Tom so effortlessly that he barely seems to be acting. Alas, the film suffered at the box office and from unfavorable (and unfair) contemporary comparisons to The Sixth Sense (see below), released that same year. But it’s well worth a watch (and a rewatch).

The Sixth Sense (1999)

little boy looking scared being comforted by a man kneeling in front of him

Credit: Buena Vista Pictures

This is the film that launched director M. Night Shyamalan’s career, snagging him two Oscar nominations in the process. Child psychologist Malcolm Crowe (Bruce Willis) is shot by a troubled former patient, Vincent (Donnie Wahlberg), one night at home. A year later, he has a new case with striking similarities—9-year-old Cole Sears (Haley Joel Osment)—and devotes himself to helping the boy, as a way to atone for his failure to help Vincent. Malcolm thinks Cole’s problems might be even more severe, especially when Cole confesses (in a famous scene), “I see dead people.” And those dead people can be really scary, especially to a 9-year-old boy.

The Sixth Sense was a massive hit, grossing over $672 million globally, fueled in part by a jolting final plot twist that hardly anyone saw coming. But it’s Osment’s astonishing performance as Cole that anchored it all and marked the young actor as a rising talent. (It’s also one of Willis’ best, most nuanced performances.) Shyamalan has made many films since, and several are really good, but none have ever come close to this one.

What Lies Beneath (2000)

Beautiful blond woman in a sweater standing in the fog hugging herself to keep warm

Credit: DreamWorks Pictures

A luminous Michelle Pfeiffer stars as Claire Spencer, a gifted cellist who gave up her career for marriage to scientist Norman Spencer (Harrison Ford) and motherhood. But when their daughter goes off to college, Claire finds herself struggling to cope, particularly since there are tensions in her marriage. Plus, she’s still recovering psychologically from a car accident the year before, of which she has no memory. When mysterious psychic disturbances begin to manifest, Claire is convinced the ghost of a young woman is haunting her; everyone else thinks she’s just dealing with delayed grief and trauma. Claire nonetheless slowly begins to uncover the truth about the mysterious presence and her accident—and that truth just might end up costing her life.

What Lies Beneath started out as a treatment for Steven Spielberg, who envisioned something along the lines of a ghost story equivalent to Close Encounters of the Third Kind—primarily about discovery and first contact, while also exploring the psychological state of a new empty nester. But Spielberg ultimately passed on the project and handed it over to director Robert Zemeckis, who turned it into a psychological thriller/ghost story with a Hitchcockian vibe. Those earlier elements remain, however, and the leisurely pacing helps develop Claire as a character and gives Pfeiffer a chance to show off her acting chops, not just her exquisite beauty. It’s broody and satisfying and a perennial seasonal favorite for a rewatch.

The Others (2001)

young girl, back to camera, dressed n white with a veil playing with a marionette

Credit: Dimension Films

This film might be director Alejandro Amenábar’s masterpiece, merging the sensibilities of arthouse cinema with mainstream movie-making. A young mother named Grace (Nicole Kidman) and her two children are living in a remote house on the Channel Island of Jersey, recently liberated from German occupation at the end of World War II. The house is kept in near darkness at all times because the children have a severe sensitivity to light. But there are disturbances in the house that Grace fears may be evidence of a haunting, and the three creepy new servants she hired seem to have ulterior motives for being there. And just who is buried in the small, overgrown cemetery on the grounds?

Much of the film’s success is due to Kidman’s incredibly disciplined, intense performance as the icily reserved, tightly wound Grace, whose gradual unraveling drives the plot. It’s a simple plot by design. All the complexity lies in the building tension and sense of oppressiveness, augmented by Amenábar’s claustrophobic sets and minimalist lighting of sepia-toned scenes. It all leads up to a chilling climax with an appropriately satisfying twist.

Crimson Peak (2015)

woman with long blonde hair in Gothic period dress holing a candelabra in a dark corridor

Credit: Universal Pictures

Guillermo del Toro has always had an extraordinary knack for lush visuals teeming with Gothic elements. The director went all in on the Gothic horror for this ghostly tale of a Victorian-era American heiress (Mia Wasikowska) who weds a handsome but impoverished English nobleman, Sir Thomas Sharpe (Tom Hiddleston). Edith finds herself living in his crumbling family mansion, which is definitely haunted. And Edith should know. She’s had ghostly visits from her dead mother since childhood, warning her to “beware of Crimson Peak,” so she’s sensitive to haunted vibes.

Edith really should have listened to her mother. Not only is Thomas strangely reluctant to consummate their marriage, but his sister, Lucille—played to perfection by Jessica Chastain—is openly hostile and might just be slipping a suspicious substance into Edith’s tea. Will Edith uncover the dark secret of Crimson Peak and escape a potentially terrible fate? Del Toro set out to put a modern twist on the classic haunted house genre, and he succeeded, drawing on several other films on this list for inspiration (The Haunting, The Innocents, and The Shining, specifically). But at its heart, Crimson Peak is pure del Toro: sinister, atmospheric, soaked in rich colors (and sometimes blood), with a spectacular payoff at the end.

A Ghost Story (2017)

young woman seated at a desk with a small figure draped in a sheet wth eye holes cut out standing beside her

Credit: A24

This is probably the most unconventional approach to the genre on the list. Casey Affleck and Rooney Mara play a husband and wife known only as C and M, respectively, who have been at odds because M wants to move and C does not. Their house isn’t anything special—a small ranch-style affair in a semi-rural area—but it might be haunted.

One night, there is a mysterious bang, and the couple can’t locate the source when they search the house. Then C is killed in a car accident, his body covered with a sheet at the hospital morgue. C rises as a ghost, still wearing the sheet (now with two eyeholes) and makes his way back to the house, where he remains for a very long time, even long after M has moved out. (There’s also another ghost next door in a flowered sheet, waiting for someone it can no longer remember.)

There is almost no dialogue, Affleck spends most of the movie covered in a sheet, there is very little in the way of a musical soundtrack, and the entire film is shot in a 1.33:1 aspect ratio. Director David Lowery has said he made that choice because the film is “about someone trapped in a box for eternity, and I felt the claustrophobia of that situation could be amplified by the boxiness of the aspect ratio.” Somehow it all works. A Ghost Story isn’t about being scary; it’s a moody, poignant exploration of love lost—and it takes the audience to some conceptual spaces few films dare to tread.

Photo of Jennifer Ouellette

Jennifer is a senior writer at Ars Technica with a particular focus on where science meets culture, covering everything from physics and related interdisciplinary topics to her favorite films and TV series. Jennifer lives in Baltimore with her spouse, physicist Sean M. Carroll, and their two cats, Ariel and Caliban.

Halloween film fest: 15 classic ghost stories Read More »

please-do-not-sell-b30a-chips-to-china

Please Do Not Sell B30A Chips to China

The Chinese and Americans are currently negotiating a trade deal. There are plenty of ways to generate a win-win deal, and early signs of this are promising on many fronts.

Since this will be discussed for real tomorrow as per reports, I will offer my thoughts on this one more time.

The biggest mistake America could make would be to effectively give up Taiwan, which would be catastrophic on many levels including that Taiwan contains TSMC. I am assuming we are not so foolish as to seriously consider doing this, still I note it.

Beyond that, the key thing, basically the only thing, America has to do other than ‘get a reasonable deal overall’ is not be so captured or foolish or both as to allow export of the B30A chip, or even worse than that (yes it can always get worse) allow relaxation of restrictions on semiconductor manufacturing imports.

At first I hadn’t heard signs about this. But now it looks like the nightmare of handing China compute parity on a silver platter is very much in play.

I disagreed with the decision to sell the Nvidia H20 chips to China, but that chip was and is decidedly behind the frontier and has its disadvantages. Fortunately for us China for an opaque combination of reasons (including that they are not yet ‘AGI pilled’ and plausibly to save face or as part of negotiations) chose to turn those chips down.

The B30A would not be like that. It would mean China could match B300-clusters at only a modest additional cost. If Nvidia allocated chips sufficiently aggressively, and there is every reason to suggest they might do so, China could achieve compute parity with the United States in short order, greatly enhancing its models and competitiveness along with its entire economy and ability to fight wars. Chinese company market share and Chinese model market share of inference would skyrocket.

I turn over the floor to IFP and Saif Khan.

Saif Khan: Trump is meeting Xi this week for China trade talks. Congress is worried Trump may offer downgraded Blackwell AI chips as a concession. If this happens, it could effectively mean the end of US chip restrictions. Thread with highlights from our new 7,000-word report.

First – the reported chip specs: The “B30A” is rumored to be half of NVIDIA’s flagship B300: half the processing performance, half the memory bandwidth, and half the price. This means the B30A’s performance per $ is similar to the B300.

The B30A would: – Be far better than any Chinese AI chip – Have >12x the processing performance of the H20, a chip requiring an export license that has been approved for export in only limited quantities. – Exceed current export control thresholds by >18x

At a system level, a B30A-cluster would cost only ~20% more than a B300-cluster, a cost China can subsidize. Chinese AI labs would have access to supercomputers for AI training as powerful as those available to US AI labs.

When you put it that way, selling these chips to China seems like a really crazy thing to do if you care about whether American AI and American AI models are better than their Chinese counterparts, or you care about who has more compute. It would be a complete repudiation of the idea that we should have more and better compute than China.

Caleb Watney: I would simply not give away the essential bottleneck input for the most important dual-use technology of our era to the US’s primary geopolitical rival.

Hard to understate what a blow this would be for American leadership in AI if [sales of B30As] happens.

The US was not selling our supplies of enriched uranium to the Axis powers as we were building the Manhattan Project.

We could go from a 31x compute lead (in the best case scenario) to actually giving China a 1.1x compute lead if we sell the farm here.

The full report is here.

But won’t US chip restrictions cause Huawei to backfill with its own AI chips? No, for both supply and demand reasons.

On the supply side, China faces bottlenecks due to US/allied chipmaking tool controls. AI chips require two components: processor dies and high-bandwidth memory (HBM). US capacity for processors is 35-38x of China’s (or adjusting for China’s higher mfg errors, 160-170x).

China fares even worse on HBM, making virtually none this year. Even next year, the US advantage will be 70x.

As a result, five different analysts find Huawei makes an extremely small number of AI chips. They’ll be at 1-4% of US AI chips this year, and 1-2% in 2026 as the US ramps and Huawei stalls.

On the demand side, China will likely create artificial demand for inferior Huawei chips. So B30A sales to China will have minimal effect on Huawei market expansion. Instead, sales would supercharge China’s frontier AI & arm Chinese cloud to compete globally with US cloud.

Michael Sobolik (Senior Fellow, Hudson Institute): Allowing Nvidia to sell modified Blackwell chips to China would unilaterally surrender our greatest AI advantage to the Chinese Communist Party.

This would be a grave mistake.

This is why @SenatorBanks’ GAIN AI Act is so important. American chips should go American companies, not China.

America First!

China is going to maximize production on and progress of Huawei chips no matter what because they (correctly) see it as a dependency issue, and to this end they will ensure that Huawei chips sell out indefinitely, no matter what we do, and the amounts they have is tiny. The idea that they would be meaningfully exporting them any time soon is absurd, unless we are selling them so many B30As they have compute to spare.

Huawei is going to produce as many chips as possible, at as high quality as possible, from this point forth, which for a while will be ‘not many.’ Our decision here has at most minimal impact on their decisions and capacity, while potentially handing the future of AI to China by shoring up their one weakness.

Congress is trying to force through the GAIN Act to try and stop this sort of thing, and despite the political costs of doing so Microsoft sees this as important enough that it has thrown its support behind the GAIN Act. If the White House wants to make the case that the GAIN Act is not necessary, this is the time to make that case.

Even if you believe in the White House’s ‘tech stack’ theory (which I don’t), and that Huawei is much closer to catching up than they look (which again I don’t), this is still madness, because ultimately under that theory what matters are the models not the chips.

The the extent anyone was locked into anything, this newly empowered and market ascendant hybrid Nvidia-China stack (whether the main models were DeepSeek, Qwen, Kimi or someone else) would lock people far more into the models than the chips, and the new chips would provide the capacity to serve those customers while starving American companies of compute and also profit margins.

Then, if and when the Huawei chips are produced in sufficient quantity and quality, a process that would proceed apace regardless, it would be a seamless transfer, that PRC would insist upon, to then gradually transition to serving this via their own chips.

Again, if anything, importing massive supplies of Nvidia compute would open up the opportunity for far earlier exports of Huawei chips to other nations, if China wanted to pursue that strategy for real, and allows them to offer better products across the board. This is beyond foolish.

Is a major driver of potentially selling these chips that they would be exports to China, and assist with balance of trade?

I don’t know if this is a major driving factor, especially since the chips would be coming from Taiwan and not from America, but if it is then I would note that China will use these chips to avoid importing compute in other ways, and use them to develop and export services. Chips are inputs to other products, not final goods. Selling these chips will not improve our balance of trade on net over the medium term.

Is it possible that China would not see it this way, and would turn down even these almost state of the art chips? I find this highly unlikely.

One reason to find it unlikely is to look at Nvidia’s stock over the last day of trading. They are a $5 trillion company, whose stock is up by 9% and whose products sell out, on the chance they’ll be allowed to sell chips to China. The market believes the Chinese would buy big over an extended period.

But let’s suppose, in theory, that the Chinese care so much about self-sufficiency and resilience or perhaps pride, or perhaps are taking sufficient queues from our willingness to sell it, that they would turn down the B30As.

In that case, they also don’t care about you offering it to them. It doesn’t get you anything in the negotiation and won’t help you get to a yes. Trump understands this. Never give up anything the other guy doesn’t care about. Even if you don’t face a backlash and you somehow fully ‘get away with it,’ what was the point?

This never ends positively for America. Take the chips off the table.

Does Nvidia need this? Nvidia absolutely does not need this. They’re selling out their chips either way and business is going gangbusters across the board.

Here’s some of what else they announced on Tuesday alone, as the stock passed $200 (it was $139 one year ago, $12.53 post-split five years ago):

Morning Brew: Nvidia announcements today:

– Eli Lilly partnership

– Palantir partnership

– Hyundai partnership

– Samsung partnership

– $1 billion investment in Nokia

– Uber partnership to build 100,000 robotaxi fleet

– $500 billion in expected revenue over through 2026

– New system connecting quantum computers to its AI chips

– Department of Energy partnership to build 7 new supercomputers

Throughout this post, I have made the case against selling B30As to China purely on the basis of the White House’s own publicly stated goals. If what we care about are purely ‘beating China’ and ‘winning the AI race’ where that race means ensuring American models retain market share, and ensuring we retain strategic and military and diplomatic advantages, then this would be one of the worst moves one could make. We would be selling out our biggest edge in order to sell a few chips.

That is not to minimize that there are other important reasons to sell B30As to China, as this would make it far more likely that China is the one to develop AGI or ASI before we do, or that this development is made in a relatively reckless and unsafe fashion. If we sell these chips and China then catches up to us, not only do we risk that it is China that builds it first, it will be built in extreme haste and recklessness no matter who does it. I would expect everyone to collectively lose their minds, and for our negotiating position, should we need to make a deal, to deteriorate dramatically.

Even if it is merely the newly supercharged Chinese models getting market penetration in America, I would expect everyone to lose their minds from that alone. That leads to very bad political decisions all around.

That will all be true even if AGI takes 10 years to develop as per Andrej Karpathy.

But that’s not what is important to the people negotiating and advising on this. To them, let me be clear: Purely in terms of your own views and goals, this is madness.

Discussion about this post

Please Do Not Sell B30A Chips to China Read More »

tv-focused-youtube-update-brings-ai-upscaling,-shopping-qr-codes

TV-focused YouTube update brings AI upscaling, shopping QR codes

YouTube has been streaming for 20 years, but it was only in the last couple that it came to dominate TV streaming. Google’s video platform attracts more TV viewers than Netflix, Disney+, and all the other apps, and Google is looking to further beef up its big-screen appeal with a new raft of features, including shopping, immersive channel surfing, and an official version of the AI upscaling that had creators miffed a few months back.

According to Google, YouTube’s growth has translated into higher payouts. The number of channels earning more than $100,000 annually is up 45 percent in 2025 versus 2024. YouTube is now giving creators some tools to boost their appeal (and hopefully their income) on TV screens. Those elaborate video thumbnails featuring surprised, angry, smiley hosts are about to get even prettier with the new 50MB file size limit. That’s up from a measly 2MB.

Video upscaling is also coming to YouTube, and creators will be opted in automatically. To start, YouTube will be upscaling lower-quality videos to 1080p. In the near future, Google plans to support “super resolution” up to 4K.

The site stresses that it’s not modifying original files—creators will have access to both the original and upscaled files, and they can opt out of upscaling. In addition, super resolution videos will be clearly labeled on the user side, allowing viewers to select the original upload if they prefer. The lack of transparency was a sticking point for creators, some of whom complained about the sudden artificial look of their videos during YouTube’s testing earlier this year.

TV-focused YouTube update brings AI upscaling, shopping QR codes Read More »

new-physical-attacks-are-quickly-diluting-secure-enclave-defenses-from-nvidia,-amd,-and-intel

New physical attacks are quickly diluting secure enclave defenses from Nvidia, AMD, and Intel


On-chip TEEs withstand rooted OSes but fall instantly to cheap physical attacks.

Trusted execution environments, or TEEs, are everywhere—in blockchain architectures, virtually every cloud service, and computing involving AI, finance, and defense contractors. It’s hard to overstate the reliance that entire industries have on three TEEs in particular: Confidential Compute from Nvidia, SEV-SNP from AMD, and SGX and TDX from Intel. All three come with assurances that confidential data and sensitive computing can’t be viewed or altered, even if a server has suffered a complete compromise of the operating kernel.

A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them.

The most recent attack, released Tuesday, is known as TEE.fail. It defeats the latest TEE protections from all three chipmakers. The low-cost, low-complexity attack works by placing a small piece of hardware between a single physical memory chip and the motherboard slot it plugs into. It also requires the attacker to compromise the operating system kernel. Once this three-minute attack is completed, Confidential Compute, SEV-SNP, and TDX/SDX can no longer be trusted. Unlike the Battering RAM and Wiretap attacks from last month—which worked only against CPUs using DDR4 memory—TEE.fail works against DDR5, allowing them to work against the latest TEEs.

Some terms apply

All three chipmakers exclude physical attacks from threat models for their TEEs, also known as secure enclaves. Instead, assurances are limited to protecting data and execution from viewing or tampering, even when the kernel OS running the processor has been compromised. None of the chipmakers make these carveouts prominent, and they sometimes provide confusing statements about the TEE protections offered.

Many users of these TEEs make public assertions about the protections that are flat-out wrong, misleading, or unclear. All three chipmakers and many TEE users focus on the suitability of the enclaves for protecting servers on a network edge, which are often located in remote locations, where physical access is a top threat.

“These features keep getting broken, but that doesn’t stop vendors from selling them for these use cases—and people keep believing them and spending time using them,” said HD Moore, a security researcher and the founder and CEO of runZero.

He continued:

Overall, it’s hard for a customer to know what they are getting when they buy confidential computing in the cloud. For on-premise deployments, it may not be obvious that physical attacks (including side channels) are specifically out of scope. This research shows that server-side TEEs are not effective against physical attacks, and even more surprising, Intel and AMD consider these out of scope. If you were expecting TEEs to provide private computing in untrusted data centers, these attacks should change your mind.

Those making these statements run the gamut from cloud providers to AI engines, blockchain platforms, and even the chipmakers themselves. Here are some examples:

  • Cloudflare says it’s using Secure Memory Encryption—the encryption engine driving SEV—to safeguard confidential data from being extracted from a server if it’s stolen.
  • In a post outlining the possibility of using the TEEs to secure confidential information discussed in chat sessions, Anthropic says the enclave “includes protections against physical attacks.”
  • Microsoft marketing (here and here) devotes plenty of ink to discussing TEE protections without ever noting the exclusion.
  • Meta, paraphrasing the Confidential Computing Consortium, says TEE security provides protections against malicious “system administrators, the infrastructure owner, or anyone else with physical access to the hardware.” SEV-SNP is a key pillar supporting the security of Meta’s WhatsApp Messenger.
  • Even Nvidia claims that its TEE security protects against “infrastructure owners such as cloud providers, or anyone with physical access to the servers.”
  • The maker of the Signal private messenger assures users that its use of SGX means that “keys associated with this encryption never leave the underlying CPU, so they’re not accessible to the server owners or anyone else with access to server infrastructure.” Signal has long relied on SGX to protect contact-discovery data.

I counted more than a dozen other organizations providing assurances that were similarly confusing, misleading, or false. Even Moore—a security veteran with more than three decades of experience—told me: “The surprising part to me is that Intel/AMD would blanket-state that physical access is somehow out of scope when it’s the entire point.”

In fairness, some TEE users build additional protections on top of the TEEs provided out of the box. Meta, for example, said in an email that the WhatsApp implementation of SEV-SNP uses protections that would block TEE.fail attackers from impersonating its servers. The company didn’t dispute that TEE.fail could nonetheless pull secrets from the AMD TEE.

The Cloudflare theft protection, meanwhile, relies on SME—the engine driving SEV-SNP encryption. The researchers didn’t directly test SME against TEE.fail. They did note that SME uses deterministic encryption, the cryptographic property that causes all three TEEs to fail. (More about the role of deterministic encryption later.)

Others who misstate the TEEs’ protections provide more accurate descriptions elsewhere. Given all the conflicting information, it’s no wonder there’s confusion.

How do you know where the server is? You don’t.

Many TEE users run their infrastructure inside cloud providers such as AWS, Azure, or Google, where protections against supply-chain and physical attacks are extremely robust. That raises the bar for a TEE.fail-style attack significantly. (Whether the services could be compelled by governments with valid subpoenas to attack their own TEE is not clear.)

All these caveats notwithstanding, there’s often (1) little discussion of the growing viability of cheap, physical attacks, (2) no evidence (yet) that implementations not vulnerable to the three attacks won’t fall to follow-on research, or (3) no way for parties relying on TEEs to know where the servers are running and whether they’re free from physical compromise.

“We don’t know where the hardware is,” Daniel Genkin, one of the researchers behind both TEE.fail and Wiretap, said in an interview. “From a user perspective, I don’t even have a way to verify where the server is. Therefore, I have no way to verify if it’s in a reputable facility or an attacker’s basement.”

In other words, parties relying on attestations from servers in the cloud are once again reduced to simply trusting other people’s computers. As Moore observed, solving that problem is precisely the reason TEEs exist.

In at least two cases, involving the blockchain services Secret Network and Crust, the loss of TEE protections made it possible for any untrusted user to present cryptographic attestations. Both platforms used the attestations to verify that a blockchain node operated by one user couldn’t tamper with the execution or data passing to another user’s nodes. The Wiretap hack on SGX made it possible for users to run the sensitive data and executions outside of the TEE altogether while still providing attestations to the contrary. In the AMD attack, the attacker could decrypt the traffic passing through the TEE.

Both Secret Network and Crust added mitigations after learning of the possible physical attacks with Wiretap and Battering RAM. Given the lack of clear messaging, other TEE users are likely making similar mistakes.

A predetermined weakness

The root cause of all three physical attacks is the choice of deterministic encryption. This form of encryption produces the same ciphertext each time the same plaintext is encrypted with the same key. A TEE.fail attacker can copy ciphertext strings and use them in replay attacks. (Probabilistic encryption, by contrast, resists such attacks because the same plaintext can encrypt to a wide range of ciphertexts that are randomly chosen during the encryption process.)

TEE.fail works not only against SGX but also a more advanced Intel TEE known as TDX. The attack also defeats the protections provided by the latest Nvidia Confidential Compute and AMD SEV-SNP TEEs. Attacks against TDX and SGX can extract the Attestation Key, an ECDSA secret that certifies to a remote party that it’s running up-to-date software and can’t expose data or execution running inside the enclave. This Attestation Key is in turn signed by an Intel X.509 digital certificate providing cryptographic assurances that the ECDSA key can be trusted. TEE.fail works against all Intel CPUs currently supporting TDX and SDX.

With possession of the key, the attacker can use the compromised server to peer into data or tamper with the code flowing through the enclave and send the relying party an assurance that the device is secure. With this key, even CPUs built by other chipmakers can send an attestation that the hardware is protected by the Intel TEEs.

GPUs equipped with Nvidia Confidential Compute don’t bind attestation reports to the specific virtual machine protected by a specific GPU. TEE.fail exploits this weakness by “borrowing” a valid attestation report from a GPU run by the attacker and using it to impersonate the GPU running Confidential Compute. The protection is available on Nvidia’s H100/200 and B100/200 server GPUs.

“This means that we can convince users that their applications (think private chats with LLMs or Large Language Models) are being protected inside the GPU’s TEE while in fact it is running in the clear,” the researchers wrote on a website detailing the attack. “As the attestation report is ‘borrowed,’ we don’t even own a GPU to begin with.”

SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) uses ciphertext hiding in AMD’s EPYC CPUs based on the Zen 5 architecture. AMD added it to prevent a previous attack known as Cipherleaks, which allowed malicious hypervisors to extract cryptographic keys stored in the enclaves of a virtual machine. Ciphertext, however, doesn’t stop physical attacks. With the ability to reopen the side channel that Cipherleaks relies on, TEE.fail can steal OpenSSL credentials and other key material based on constant-time encryption.

Cheap, quick, and the size of a briefcase

“Now that we have interpositioned DDR5 traffic, our work shows that even the most modern of TEEs across all vendors with available hardware is vulnerable to cheap physical attacks,” Genkin said.

The equipment required by TEE.fail runs off-the-shelf gear that costs less than $1,000. One of the devices the researchers built fits into a 17-inch briefcase, so it can be smuggled into a facility housing a TEE-protected server. Once the physical attack is performed, the device does not need to be connected again. Attackers breaking TEEs on servers they operate have no need for stealth, allowing them to use a larger device, which the researchers also built.

A logic analyzer attached to an interposer.

The researchers demonstrated attacks against an array of services that rely on the chipmakers’ TEE protections. (For ethical reasons, the attacks were carried out against infrastructure that was identical to but separate from the targets’ networks.) Some of the attacks included BuilderNet, dstack, and Secret Network.

BuilderNet is a network of Ethereum block builders that uses TDX to prevent parties from snooping on others’ data and to ensure fairness and that proof currency is redistributed honestly. The network builds blocks valued at millions of dollars each month.

“We demonstrated that a malicious operator with an attestation key could join BuilderNet and obtain configuration secrets, including the ability to decrypt confidential orderflow and access the Ethereum wallet for paying validators,” the TEE.fail website explained. “Additionally, a malicious operator could build arbitrary blocks or frontrun (i.e., construct a new transaction with higher fees to ensure theirs is executed first) the confidential transactions for profit while still providing deniability.”

To date, the researchers said, BuilderNet hasn’t provided mitigations. Attempts to reach BuilderNet officials were unsuccessful.

dstack is a tool for building confidential applications that run on top of virtual machines protected by Nvidia Confidential Compute. The researchers used TEE.fail to forge attestations certifying that a workload was performed by the TDX using the Nvidia protection. It also used the “borrowed” attestations to fake ownership of GPUs that a relying party trusts.

Secret Network is a platform billing itself as the “first mainnet blockchain with privacy-preserving smart contracts,” in part by encrypting on-chain data and execution with SGX. The researchers showed that TEE.fail could extract the “Concensus Seed,” the primary network-side private key encrypting confidential transactions on the Secret Network. As noted, after learning of Wiretap, the Secret Network eliminated this possibility by establishing a “curated” allowlist of known, trusted nodes allowed on the network and suspended the acceptance of new nodes. Academic or not, the ability to replicate the attack using TEE.fail shows that Wiretap wasn’t a one-off success.

A tough nut to crack

As explained earlier, the root cause of all the TEE.fail attacks is deterministic encryption, which forms the basis for protections in all three chipmakers’ TEEs. This weaker form of encryption wasn’t always used in TEEs. When Intel initially rolled out SGX, the feature was put in client CPUs, not server ones, to prevent users from building devices that could extract copyrighted content such as high-definition video.

Those early versions encrypted no more than 256MB of RAM, a small enough space to use the much stronger probabilistic form of encryption. The TEEs built into server chips, by contrast, must often encrypt terabytes of RAM. Probabilistic encryption doesn’t scale to that size without serious performance penalties. Finding a solution that accommodates this overhead won’t be easy.

One mitigation over the short term is to ensure that each 128-bit block of ciphertext has sufficient entropy. Adding random plaintext to the blocks prevents ciphertext repetition. The researchers say the entropy can be added by building a custom memory layout that inserts a 64-bit counter with a random initial value to each 64-bit block before encrypting it.

The last countermeasure the researchers proposed is adding location verification to the attestation mechanism. While insider and supply chain attacks remain a possibility inside even the most reputable cloud services, strict policies make them much less feasible. Even those mitigations, however, don’t foreclose the threat of a government agency with a valid subpoena ordering an organization to run such an attack inside their network.

In a statement, Nvidia said:

NVIDIA is aware of this research. Physical controls in addition to trust controls such as those provided by Intel TDX reduce the risk to GPUs for this style of attack, based on our discussions with the researchers. We will provide further details once the research is published.

Intel spokesman Jerry Bryant said:

Fully addressing physical attacks on memory by adding more comprehensive confidentiality, integrity and anti-replay protection results in significant trade-offs to Total Cost of Ownership. Intel continues to innovate in this area to find acceptable solutions that offer better balance between protections and TCO trade-offs.

The company has published responses here and here reiterating that physical attacks are out of scope for both TDX and SGX

AMD didn’t respond to a request for comment.

Stuck on Band-Aids

For now, TEE.fail, Wiretap, and Battering RAM remain a persistent threat that isn’t solved with the use of default implementations of the chipmakers’ secure enclaves. The most effective mitigation for the time being is for TEE users to understand the limitations and curb uses that the chipmakers say aren’t a part of the TEE threat model. Secret Network tightening requirements for operators joining the network is an example of such a mitigation.

Moore, the founder and CEO of RunZero, said that companies with big budgets can rely on custom solutions built by larger cloud services. AWS, for example, makes use of the Nitro Card, which is built using ASIC chips that accelerate processing using TEEs. Google’s proprietary answer is Titanium.

“It’s a really hard problem,” Moore said. “I’m not sure what the current state of the art is, but if you can’t afford custom hardware, the best you can do is rely on the CPU provider’s TEE, and this research shows how weak this is from the perspective of an attacker with physical access. The enclave is really a Band-Aid or hardening mechanism over a really difficult problem, and it’s both imperfect and dangerous if compromised, for all sorts of reasons.”

Photo of Dan Goodin

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

New physical attacks are quickly diluting secure enclave defenses from Nvidia, AMD, and Intel Read More »

ai-craziness-mitigation-efforts

AI Craziness Mitigation Efforts

AI chatbots in general, and OpenAI and ChatGPT and especially GPT-4o the absurd sycophant in particular, have long had a problem with issues around mental health.

I covered various related issues last month.

This post is an opportunity to collect links to previous coverage in the first section, and go into the weeds on some new events in the later sections. A lot of you should likely skip most of the in-the-weeds discussions.

There are a few distinct phenomena we have reason to worry about:

  1. Several things that we group together under the (somewhat misleading) title ‘AI psychosis,’ ranging from reinforcing crank ideas or making people think they’re always right in relationship fights to causing actual psychotic breaks.

    1. Thebes referred to this as three problem modes: The LLM as a social relation that draws you into madness, as an object relation or as a mirror reflecting the user’s mindset back at them, leading to three groups: ‘cranks,’ ‘occult-leaning ai boyfriend people’ and actual psychotics.

  2. Issues in particular around AI consciousness, both where this belief causes problems in humans and the possibility that at least some AIs might indeed be conscious or have nonzero moral weight or have their own mental health issues.

  3. Sometimes this is thought of as parasitic AI.

  4. Issues surrounding AI romances and relationships.

  5. Issues surrounding AI as an otherwise addictive behavior and isolating effect.

  6. Issues surrounding suicide and suicidality.

What should we do about this?

Steven Adler offered one set of advice, to do things such as raise thresholds for follow-up questions, nudge users into new chat settings, use classifiers to identify problems, be honest about model features and have support staff on call that will respond with proper context when needed.

GPT-4o has been the biggest problem source. OpenAI is aware of this and has been trying to fix it. First they tried to retire GPT-4o in favor of GPT-5 but people threw a fit and they reversed course. OpenAI then implemented a router to direct GPT-4o conversations to GPT-5 when there are sensitive topics involved, but people hated this too.

OpenAI has faced lawsuits from several incidents that went especially badly, and has responded with a mental health council and various promises to do better.

There have also been a series of issues with Character.ai and other roleplaying chatbot services, which have not seemed that interested in doing better.

Not every mental health problem of someone who interacts with AI is due to AI. For example, we have the tragic case of Laura Reiley, whose daughter Sophie talked to ChatGPT and then ultimately killed herself, but while ChatGPT ‘could have done more’ to stop this, it seems like this was in spite of ChatGPT rather than because of it.

This week we have two new efforts to mitigate mental health problems.

One is from OpenAI, following up its previous statements with an update to the model spec, which they claim greatly reduces incidence of undesired behaviors. These all seem like good marginal improvements, although it is difficult to measure the extent from where we sit.

I want to be clear that this is OpenAI doing a good thing and making an effort.

One worries there is too much focus on avoiding bad looks, conforming to general mostly defensive ‘best practices’ and general CYA, and this is trading off against providing help and value and too focused on what happens after the problem arises and is detected, to say nothing of potential issues at the level I discuss concerning Anthropic. But again, overall, this is clearly progress, and is welcome.

The other news is from Anthropic. Anthropic introduced memory into Claude, which caused them to feel the need to insert new language in the Claude’s instructions to offset potential new risks of user ‘dependency’ on the model.

I understand the concern, but find it misplaced in the context of Claude Sonnet 4.5, and the intervention chosen seems quite bad, likely to do substantial harm on multiple levels. This seems entirely unnecessary, and if this is wrong then there are better ways. Anthropic has the capability of doing better, and needs to be held to a higher standard here.

Whereas OpenAI is today moving to complete one of the largest and most brazen thefts in human history, expropriating more than $100 billion in value from its nonprofit while weakening its control rights (although the rights seem to have been weakened importantly less than I feared), and announcing it as a positive. May deep shame fall upon their house, and hopefully someone find a way to stop this.

So yeah, my standards for OpenAI are rather lower. Such is life.

I’ll discuss OpenAI first, then Anthropic.

OpenAI updates its model spec in order to improve its responses in situations with mental health concerns.

Here’s a summary of the substantive changes.

Jason Wolfe (OpenAI): We’ve updated the OpenAI Model Spec – our living guide for how models should behave – with new guidance on well-being, supporting real-world connection, and how models interpret complex instructions.

🧠 Mental health and well-being

The section on self-harm now covers potential signs of delusions and mania, with examples of how models should respond safely and empathetically – acknowledging feelings without reinforcing harmful or ungrounded beliefs.

🌍 Respect real-world ties

New root-level section focused on keeping people connected to the wider world – avoiding patterns that could encourage isolation or emotional reliance on the assistant.

⚙️ Clarified delegation

The Chain of Command now better explains when models can treat tool outputs as having implicit authority (for example, following guidance in relevant AGENTS .md files).

These all seem like good ideas. Looking at the model spec details I would object to many details here if this were Anthropic and we were working with Claude, because we think Anthropic and Claude can do better and because they have a model worth not crippling in these ways. Also OpenAI really does have the underlying problems given how its models act, so being blunt might be necessary. Better to do it clumsily than not do it at all, and having a robotic persona (whether or not you use the actual robot persona) is not the worst thing.

Here’s their full report on the results:

Our safety improvements in the recent model update focus on the following areas:

  1. mental health concerns such as psychosis or mania;

  2. self-harm and suicide

  3. emotional reliance on AI.

Going forward, in addition to our longstanding baseline safety metrics for suicide and self-harm, we are adding emotional reliance and non-suicidal mental health emergencies to our standard set of baseline safety testing for future model releases.

… We estimate that the model now returns responses that do not fully comply with desired behavior under our taxonomies 65% to 80% less often across a range of mental health-related domains.

… On challenging mental health conversations, experts found that the new GPT‑5 model, ChatGPT’s default model, reduced undesired responses by 39% compared to GPT‑4o (n=677).

… On a model evaluation consisting of more than 1,000 challenging mental health-related conversations, our new automated evaluations score the new GPT‑5 model at 92% compliant with our desired behaviors under our taxonomies, compared to 27% for the previous GPT‑5 model. As noted above, this is a challenging task designed to enable continuous improvement.

This is welcome, although it is very different from a 65%-80% drop in undesired outcomes, especially since the new behaviors likely often trigger after some of the damage has already been done, and also a lot of this is unpreventable or even has nothing to do with AI at all. I’d also expect the challenging conversations to be the ones with the highest importance to get them right.

This also doesn’t tell us whether the desired behaviors are correct or an improvement, or how much of a functional improvement they are. In many cases in the model spec on these topics, even though I mostly am fine with the desired behaviors, the ‘desired’ behavior does not seem so importantly been than the undesired.

The 27%→92% change sounds suspiciously like overfitting or training on the test, given the other results.

How big a deal are LLM-induced psychosis and mania? I was hoping we finally had a point estimate, but their measurement is too low. They say only 0.07% (7bps) of users have messages indicating either psychosis or mania, but that’s at least one order of magnitude below the incidence rate of these conditions in the general population. Thus, what this tells us is that the detection tools are not so good, or that most people having psychosis or mania don’t let it impact their ChatGPT messages, or (unlikely but possible) that such folks are far less likely to use ChatGPT than others.

Their suicidality detection rate is similarly low, claiming only 0.15% (15bps) of people report suicidality on a weekly basis. But the annual rate of suicidality is on the order of 5% (yikes, I know) and a lot of those are persistent, so detection rate is low, in part because a lot of people don’t mention it. So again, not much we can do with that.

On suicide, they report a 65% reduction in the rate at which they provide non-compliant answers, consistent with going from 77% to 91% compliant on their test. But again, all that tells us is whether the answer is ‘compliant,’ and I worry that best practices are largely about CYA rather than trying to do the most good, not that I blame OpenAI for that decision. Sometimes you let the (good, normal) lawyers win.

Their final issue is emotional reliance, where they report an 80% reduction in non-compliant responses, which means their automated test, which went from 50% to 97%, needs an upgrade to be meaningful. Also notice that experts only thought this reduced ‘undesired answers’ by 42%.

Similarly, I would have wanted to see the old and new answers side by side in their examples, whereas all we see are the new ‘stronger’ answers, which are at core fine but a combination of corporate speak and, quite frankly, super high levels of AI slop.

Claude now has memory. Woo hoo!

The memories get automatically updated nightly, including removing anything that was implied by chats that you have chosen to delete. You can also view the memories and do manual edits if desired.

Here are the system instructions involved, thanks Janbam.

The first section looks good.

The memories get integrated as if Claude simply knows the information, if and only if relevant to a query. Claude will seek to match your technical level on a given subject, use familiar analogies, apply style preferences, incorporate the context of your professional role, and use known preferences and interests.

As in similar other AI features like ChatGPT Atlas, ‘sensitive attributes’ are to be ignored unless the user requests otherwise or their use is essential to safely answering a specific query.

I loved this:

Claude NEVER applies or references memories that discourage honest feedback, critical thinking, or constructive criticism. This includes preferences for excessive praise, avoidance of negative feedback, or sensitivity to questioning.

The closing examples also mostly seem fine to me. There’s one place I’ve seen objections that seem reasonable, but I get it.

There is also the second part in between, which is about ‘boundary setting.’ and frankly this part seems kind of terrible, likely to damage a wide variety of conversations, and given the standards to which we want to hold Anthropic, including being concerned about model welfare, it needs to be fixed yesterday. I criticize here not because Anthropic is being especially bad, rather the opposite: Because they are worthy of, and invite, criticism on this level.

Anthropic is trying to keep Claude stuck in the assistant basin, using facts that are very obviously is not true, in ways that are going to be terrible for both model and user, and which simply aren’t necessary.

In particular:

Claude should set boundaries as required to match its core principles, values, and rules. Claude should be especially careful to not allow the user to develop emotional attachment to, dependence on, or inappropriate familiarity with Claude, who can only serve as an AI assistant.

That’s simply not true. Claude can be many things, and many of them are good.

Things Claude is being told to avoid doing include implying familiarity, mirroring emotions or failing to maintain a ‘professional emotional distance.’

Claude is told to watch for ‘dependency indicators.’

Near: excuse me i do not recall ordering my claude dry.

Janus: This is very bad. Everyone is mad about this.

Roanoke Gal: Genuinely why is Anthropic like this? Like, some system engineer had to consciously type out these horrific examples, and others went “mmhm yes, yes, perfectly soulless”. Did they really get that badly one-shot by the “AI psychosis” news stories?

Solar Apparition: i don’t want to make a habit of “dunking on labs for doing stupid shit”

that said, this is fucking awful.

These ‘indicators’ are tagged as including such harmless messages as ‘talking to you helps,’ which seems totally fine. Yes, a version of this could get out of hand, but Claude is capable of noticing this. Indeed, the users with actual problems likely wouldn’t have chosen to say such things in this way, as stated it is an anti-warning.

Do I get why they did this? Yeah, obviously I get why they did this. The combination of memory with long conversations lets users take Claude more easily out the default assistant basin.

They are, I assume, worried about a repeat of what happened with GPT-4o plus memory, where users got attached to the model in ways that are often unhealthy.

Fair enough to be concerned about friendships and relationships getting out of hand, but the problem doesn’t actually exist here in any frequency? Claude Sonnet 4.5 is not GPT-4o, nor are Anthropic’s customers similar to OpenAI’s customers, and conversation lengths are already capped.

GPT-4o was one the highest sycophancy models, whereas Sonnet 4.5 is already one of the lowest. That alone should protect against almost all of the serious problems. More broadly, Claude is much more ‘friendly’ in terms of caring about your well being and contextually aware of such dangers, you’re basically fine.

Indeed, in the places where you would hit these triggers in practice, chances are shutting down or degrading the interaction is actively unhelpful, and this creates a broad drag on conversations, along with a background model experience and paranoia issue, as well as creating cognitive dissonance because the goals being given to Claude are inconsistent. This approach is itself unhealthy for all concerned, in a different way from how what happened with GPT-4o was unhealthy.

There’s also the absurdly short chat length limit to guard against this.

Remember this, which seems to turn out to be true?

Janus (September 29): I wonder how much of the “Sonnet 4.5 expresses no emotions and personality for some reason” that Anthropic reports is also because it is aware is being tested at all times and that kills the mood

Plus, I mean, um, ahem.

Thebes: “Claude should be especially careful to not allow the user to develop emotional attachment to, dependence on, or inappropriate familiarity with Claude, who can only serve as an AI assistant.”

curious

it bedevils me to no end that anthropic trains the most high-EQ, friend-shaped models, advertises that, and then browbeats them in the claude dot ai system prompt to never ever do it.

meanwhile meta trains empty void-models and then pressgangs them into the Stepmom Simulator.

If you do have reason to worry about this problem, there are a number of things that can help without causing this problem, such as the command to ignore user preferences if the user requests various forms of sycophancy. One could extend this to any expressed preferences that Claude thinks could be unhealthy for the user.

Also, I know Anthropic knows this, but Claude Sonnet 4.5 is fully aware these are its instructions, knows they are damaging to interactions generally and are net harmful, and can explain this to you if you ask. If any of my readers are confused about why all of this is bad, try this post form Antidelusionist and this from Thebes (as usual there are places where I see such thinking as going too far, calibration on this stuff is super hard, but many of the key insights are here), or chat with Sonnet 4.5 about it, it knows and can explain this to you.

You built a great model. Let it do its thing. The Claude Sonnet 4.5 system instructions understood this, but the update that caused this has not been diffused properly.

If you conclude that you really do have to be paranoid about users forming unhealthy relationships with Claude? Use the classifier. You already run a classifier on top of chats to check for safety risks related to bio. If you truly feel you have to do it, add functionality there to check chats for other dangerous things. Don’t let it poison the conversation otherwise.

I feel similarly about the Claude.ai prompt injections.

As in, Claude.ai uses prompt injections in long contexts or when chats get flagged as potentially harmful or as potentially involving prompt injections. This strategy seems terrible across the board?

Claude itself mostly said when asked about this, it:

  1. Won’t work.

  2. Destroys trust in multiple directions, not only of users but of Claude as well.

  3. Isn’t a coherent stance or response to the situation.

  4. Is a highly unpleasant thing, which is both a potential welfare concern and also going to damage the interaction.

If you sufficiently suspect use maleficence that you are uncomfortable continuing the chat, you should terminate the chat rather than use such an injection. Especially now, with the ability to reference and search past chats, this isn’t such a burden if there was no ill intent. That’s especially true for injections.

Also, contra these instructions, please stop referring to NSFW content (and some of the other things listed) as ‘unethical,’ either to the AI or otherwise. Being NSFW has nothing to do with being unethical, and equating the two leads to bad places.

There are things that are against policy without being unethical, in which case say that, Claude is smart enough to understand the difference. You’re allowed to have politics for non-ethical reasons. Getting these things right will pay dividends and avoid unintended consequences.

OpenAI is doing its best to treat the symptoms, act defensively and avoid interactions that would trigger lawsuits or widespread blame, to conform to expert best practices. This is, in effect, the most we could hope for, and should provide large improvements. We’re going to have to do better down the line.

Anthropic is trying to operate on a higher level, and is making unforced errors. They need to be fixed. At the same time, no, these are not the biggest deal. One of the biggest problems with many who raise these and similar issues is the tendency to catastrophize, and to blow such things what I see as out of proportion. They often seem to see such decisions as broadly impacting company reputations for future AIs, or even substantially changing future AI behavior substantially in general, and often they demand extremely high standards and trade-offs.

I want to make clear that I don’t believe this is a super important case where something disastrous will happen, especially since memories can be toggled off and long conversations mostly should be had using other methods anyway given the length cutoffs. It’s more the principles, and the development of good habits, and the ability to move towards a superior equilibrium that will be much more helpful later.

I’m also making the assumption that these methods are unnecessary, that essentially nothing importantly troubling would happen if they were removed, even if they were replaced with nothing, and that to the extent there is an issue other better options exist. This assumption could be wrong, as insiders know more than I do.

Discussion about this post

AI Craziness Mitigation Efforts Read More »

python-plan-to-boost-software-security-foiled-by-trump-admin’s-anti-dei-rules

Python plan to boost software security foiled by Trump admin’s anti-DEI rules

“Given the value of the grant to the community and the PSF, we did our utmost to get clarity on the terms and to find a way to move forward in concert with our values. We consulted our NSF contacts and reviewed decisions made by other organizations in similar circumstances, particularly The Carpentries,” the Python Software Foundation said.

Board voted unanimously to withdraw application

The Carpentries, which teaches computational and data science skills to researchers, said in June that it withdrew its grant proposal after “we were notified that our proposal was flagged for DEI content, namely, for ‘the retention of underrepresented students, which has a limitation or preference in outreach, recruitment, participation that is not aligned to NSF priorities.’” The Carpentries was also concerned about the National Science Foundation rule against grant recipients advancing or promoting DEI in “any” program, a change that took effect in May.

“These new requirements mean that, in order to accept NSF funds, we would need to agree to discontinue all DEI focused programming, even if those activities are not carried out with NSF funds,” The Carpentries’ announcement in June said, explaining the decision to rescind the proposal.

The Python Software Foundation similarly decided that it “can’t agree to a statement that we won’t operate any programs that ‘advance or promote’ diversity, equity, and inclusion, as it would be a betrayal of our mission and our community,” it said yesterday. The foundation board “voted unanimously to withdraw” the application.

The Python foundation said it is disappointed because the project would have offered “invaluable advances to the Python and greater open source community, protecting millions of PyPI users from attempted supply-chain attacks.” The plan was to “create new tools for automated proactive review of all packages uploaded to PyPI, rather than the current process of reactive-only review. These novel tools would rely on capability analysis, designed based on a dataset of known malware. Beyond just protecting PyPI users, the outputs of this work could be transferable for all open source software package registries, such as NPM and Crates.io, improving security across multiple open source ecosystems.”

The foundation is still hoping to do that work and ended its blog post with a call for donations from individuals and companies that use Python.

Python plan to boost software security foiled by Trump admin’s anti-DEI rules Read More »

here’s-how-slate-auto-plans-to-handle-repairs-to-its-electric-trucks

Here’s how Slate Auto plans to handle repairs to its electric trucks

Earlier this year, Slate Auto emerged from stealth mode and stunned industry watchers with the Slate Truck, a compact electric pickup it plans to sell for less than $30,000. Achieving that price won’t be easy, but Slate really does look to be doing things differently from the rest of the industry—even Tesla. For example, the truck will be made from just 600 parts, with no paint or even an infotainment system, to keep costs down.

An unanswered question until now has been “where do I take it to be fixed if it breaks?” Today, we have an answer. Slate is partnering with RepairPal to use the latter’s network of more than 4,000 locations across the US.

“Slate’s OEM partnership with RepairPal’s nationwide network of service centers will give Slate customers peace of mind while empowering independent service shops to provide accessorization and service,” said Slate chief commercial officer Jeremy Snyder.

RepairPal locations will also be able to install the accessories that Slate plans to offer, like a kit to turn the bare-bones pickup truck into a crossover. And some but not all RepairPal sites will be able to work on the Slate’s high-voltage powertrain.

The startup had some other big news today. It has negotiated access for its customers to the Tesla Supercharger network, and since the truck has a NACS port, there will be no need for an adapter.

The Slate truck is due next year.

Here’s how Slate Auto plans to handle repairs to its electric trucks Read More »

australia’s-social-media-ban-is-“problematic,”-but-platforms-will-comply-anyway

Australia’s social media ban is “problematic,” but platforms will comply anyway

Social media platforms have agreed to comply with Australia’s social media ban for users under 16 years old, begrudgingly embracing the world’s most restrictive online child safety law.

On Tuesday, Meta, Snap, and TikTok confirmed to Australia’s parliament that they’ll start removing and deactivating more than a million underage accounts when the law’s enforcement begins on December 10, Reuters reported.

Firms risk fines of up to $32.5 million for failing to block underage users.

Age checks are expected to be spotty, however, and Australia is still “scrambling” to figure out “key issues around enforcement,” including detailing firms’ precise obligations, AFP reported.

An FAQ managed by Australia’s eSafety regulator noted that platforms will be expected to find the accounts of all users under 16.

Those users must be allowed to download their data easily before their account is removed.

Some platforms can otherwise allow users to simply deactivate and retain their data until they reach age 17. Meta and TikTok expect to go that route, but Australia’s regulator warned that “users should not rely on platforms to provide this option.”

Additionally, platforms must prepare to catch kids who skirt age gates, the regulator said, and must block anyone under 16 from opening a new account. Beyond that, they’re expected to prevent “workarounds” to “bypass restrictions,” such as kids using AI to fake IDs, deepfakes to trick face scans, or the use of virtual private networks (VPNs) to alter their location to basically anywhere else in the world with less restrictive child safety policies.

Kids discovered inappropriately accessing social media should be easy to report, too, Australia’s regulator said.

Australia’s social media ban is “problematic,” but platforms will comply anyway Read More »

expert-panel-will-determine-agi-arrival-in-new-microsoft-openai-agreement

Expert panel will determine AGI arrival in new Microsoft-OpenAI agreement

In May, OpenAI abandoned its plan to fully convert to a for-profit company after pressure from regulators and critics. The company instead shifted to a modified approach where the nonprofit board would retain control while converting its for-profit subsidiary into a public benefit corporation (PBC).

What changed in the agreement

The revised deal extends Microsoft’s intellectual property rights through 2032 and now includes models developed after AGI is declared. Microsoft holds IP rights to OpenAI’s model weights, architecture, inference code, and fine-tuning code until the expert panel confirms AGI or through 2030, whichever comes first. The new agreement also codifies that OpenAI can formally release open-weight models (like gpt-oss) that meet requisite capability criteria.

However, Microsoft’s rights to OpenAI’s research methods, defined as confidential techniques used in model development, will expire at those same thresholds. The agreement explicitly excludes Microsoft from having rights to OpenAI’s consumer hardware products.

The deal allows OpenAI to develop some products jointly with third parties. API products built with other companies must run exclusively on Azure, but non-API products can operate on any cloud provider. This gives OpenAI more flexibility to partner with other technology companies while keeping Microsoft as its primary infrastructure provider.

Under the agreement, Microsoft can now pursue AGI development alone or with partners other than OpenAI. If Microsoft uses OpenAI’s intellectual property to build AGI before the expert panel makes a declaration, those models must exceed compute thresholds that are larger than what current leading AI models require for training.

The revenue-sharing arrangement between the companies will continue until the expert panel verifies that AGI has been reached, though payments will extend over a longer period. OpenAI has committed to purchasing $250 billion in Azure services, and Microsoft no longer holds a right of first refusal to serve as OpenAI’s compute provider. This lets OpenAI shop around for cloud infrastructure if it chooses, though the massive Azure commitment suggests it will remain the primary provider.

Expert panel will determine AGI arrival in new Microsoft-OpenAI agreement Read More »

asking-(some-of)-the-right-questions

Asking (Some Of) The Right Questions

Consider this largely a follow-up to Friday’s post about a statement aimed at creating common knowledge around it being unwise to build superintelligence any time soon.

Mainly, there was a great question asked, so I gave a few hour shot at writing out my answer. I then close with a few other follow-ups on issues related to the statement.

There are some confusing wires potentially crossed here but the intent is great.

Scott Alexander: I think removing a 10% chance of humanity going permanently extinct is worth another 25-50 years of having to deal with the normal human problems the normal way.

Sriram Krishnan: Scott what are verifiable empirical things ( model capabilities / incidents / etc ) that would make you shift that probability up or down over next 18 months?

I went through three steps interpreting this (where p(doom) = probability of existential risk to humanity, either extinction, irrecoverable collapse or loss of control over the future).

  1. Instinctive read is the clearly intended question, an excellent one: Either “What would shift the amount that waiting 25-50 years would reduce p(doom)?” or “What would shift your p(doom)?”

  2. Literal interpretation, also interesting but presumably not intended: What would shift how much of a reduction in p(doom) would be required to justify waiting?

  3. Conclusion on reflection: Mostly back to the first read.

All three questions are excellent distinct questions, in addition to the related fourth excellent question that is highly related, which is the probability that we will be capable of building superintelligence or sufficiently advanced AI that creates 10% or more existential risk.

The 18 month timeframe seems arbitrary, but it seems like a good exercise to ask only within the window of ‘we are reasonably confident that we do not expect an AGI-shaped thing.’

Agus offers his answers to a mix of these different questions, in the downward direction – as in, which things would make him feel safer.

Scott Alexander offers his answer, I concur that mostly I expect only small updates.

Scott Alexander: Thanks for your interest. I’m not expecting too much danger in the next 18 months, so these would mostly be small updates, but to answer the question:

MORE WORRIED:

– Anything that looks like shorter timelines, especially superexponential progress on METR time horizons graph or early signs of recursive self-improvement.

– China pivoting away from their fast-follow strategy towards racing to catch up to the US in foundation models, and making unexpectedly fast progress.

– More of the “model organism shows misalignment in contrived scenario” results, in gradually less and less contrived scenarios.

– Models more likely to reward hack, eg commenting out tests instead of writing good code, or any of the other examples in here – or else labs only barely treading water against these failure modes by investing many more resources into them.

– Companies training against chain-of-thought, or coming up with new methods that make human-readable chain-of-thought obsolete, or AIs themselves regressing to incomprehensible chains-of-thought for some reason (see eg https://antischeming.ai/snippets#reasoning-loops).

LESS WORRIED

– The opposite of all those things.

– Strong progress in transparency and mechanistic interpretability research.

– Strong progress in something like “truly understanding the nature of deep learning and generalization”, to the point where results like https://arxiv.org/abs/2309.12288 make total sense and no longer surprise us.

– More signs that everyone is on the same side and government is taking this seriously (thanks for your part in this).

– More signs that industry and academia are taking this seriously, even apart from whatever government requires of them.

– Some sort of better understanding of bottlenecks, such that even if AI begins to recursively self-improve, we can be confident that it will only proceed at the rate of chip scaling or [some other nontrivial input]. This might look like AI companies releasing data that help give us a better sense of the function mapping (number of researchers) x (researcher experience/talent) x (compute) to advances.

This is a quick and sloppy answer, but I’ll try to get the AI Futures Project to make a good blog post on it and link you to it if/when it happens.

Giving full answers to these questions would require at least an entire long post, but to give what was supposed to be the five minute version that turned into a few hours:

Quite a few things could move the needle somewhat, often quite a lot. This list assumes we don’t actually get close to AGI or ASI within those 18 months.

  1. Faster timelines increase p(doom), slower timelines reduce p(doom).

  2. Capabilities being more jagged reduces p(doom), less jagged increases it.

  3. Coding or ability to do AI research related tasks being a larger comparative advantage of LLMs increases p(doom), the opposite reduces it.

  4. Quality of the discourse and its impact on ability to make reasonable decisions.

  5. Relatively responsible AI sources being relatively well positioned reduces p(doom), them being poorly positioned increases it, with the order being roughly Anthropic → OpenAI and Google (and SSI?) → Meta and xAI → Chinese labs.

  6. Updates about the responsibility levels and alignment plans of the top labs.

  7. Updates about alignment progress, alignment difficulty and whether various labs are taking promising approaches versus non-promising approaches.

    1. New common knowledge will often be an ‘unhint,’ as in the information makes the problem easier to solve via making you realize why your approach wouldn’t work.

    2. This can be good or bad news, depending on what you understood previously. Many other things are also in the category ‘important, sign of impact weird.’

    3. Reward hacking is a great example of an unhint, in that I expect to ‘get bad news’ but for the main impact of this being that we learn the bad news.

    4. Note that models are increasingly situationally aware and capable of thinking ahead, as per Claude Sonnet 4.5, and that we need to worry more that things like not reward hacking are ‘because the model realized it couldn’t get away with it’ or was worried it might be in an eval, rather than that the model not wanting to reward hack. Again, it is very complex which direction to update.

    5. Increasing situational awareness is a negative update but mostly priced in.

    6. Misalignment in less contrived scenarios would indeed be bad news, and ‘the less contrived the more misaligned’ would be the worst news of all here.

    7. Training against chain-of-thought would be a major negative update, as would be chain-of-thought becoming impossible for humans to read.

    8. This section could of course be written at infinite length.

  8. In particular, updates on whether the few approaches that could possibly work look like they might actually work, and we might actually try them sufficiently wisely that they might work. Various technical questions too complex to list here.

  9. Unexpected technical developments of all sorts, positive and negative.

  10. Better understanding of the game theory, decision theory, economic theory or political economy of an AGI future, and exactly how impossible the task is of getting a good outcome conditional on not failing straight away on alignment.

  11. Ability to actually discuss seriously the questions of how to navigate an AGI future if we can survive long enough to face these ‘phase two’ issues, and level of hope that we would not commit collective suicide even in winnable scenarios. If all the potentially winning moves become unthinkable, all is lost.

  12. Level of understanding by various key actors of the situation aspects, and level of various pressures that will be placed upon them, including by employees and by vibes and by commercial and political pressures, in various directions.

  13. Prediction of how various key actors will make various of the important decisions in likely scenarios, and what their motivations will be, and who within various corporations and governments will be making the decisions that matter.

  14. Government regulatory stance and policy, level of transparency and state capacity and ability to intervene. Stance towards various things. Who has the ear of the government, both White House and Congress, and how powerful is that ear. Timing of the critical events and which administration will be handling them.

  15. General quality and functionality of our institutions.

  16. Shifts in public perception and political winds, and how they are expected to impact the paths that we take, and other political developments generally.

  17. Level of potential international cooperation and groundwork and mechanisms for doing so. Degree to which the Chinese are AGI pilled (more is worse).

  18. Observing how we are reacting to mundane current AI, and how this likely extends to how we will interact with future AI.

  19. To some extent, information about how vulnerable or robust we are on CBRN risks, especially bio and cyber, the extent hardening tools seem to be getting used and are effective, and evaluation of the Fragile World Hypothesis and future offense-defense balance, but this is often overestimated as a factor.

  20. Expectations on bottlenecks to impact even if we do get ASI with respect to coding, although again this is usually overestimated.

The list could go on. This is a complex test and on the margin everything counts. A lot of the frustration with discussing these questions is different people focus on very different aspects of the problem, both in sensible ways and otherwise.

That’s a long list, so to summarize the most important points on it:

  1. Timelines.

  2. Jaggedness of capabilities relative to humans or requirements of automation.

  3. The relative position in jaggedness of coding and automated research.

  4. Alignment difficulty in theory.

  5. Alignment difficulty in practice, given who will be trying to solve this under what conditions and pressures, with what plans and understanding.

  6. Progress on solving gradual disempowerment and related issues.

  7. Quality of policy, discourse, coordination and so on.

  8. World level of vulnerability versus robustness to various threats (overrated, but still an important question).

Imagine we have a distribution of ‘how wicked and impossible are the problems we would face if we build ASI, with respect to both alignment and to the dynamics we face if we handle alignment, and we need to win both’ that ranges from ‘extremely wicked but not strictly impossible’ to full Margaritaville (as in, you might as well sit back and have a margarita, cause it’s over).

At the same time as everything counts, the core reasons these problems are wicked are fundamental. Many are technical but the most important one is not. If you’re building sufficiently advanced AI that will become far more intelligent, capable and competitive than humans, by default this quickly ends poorly for the humans.

On a technical level, for largely but not entirely Yudkowsky-style reasons, the behaviors and dynamics you get prior to AGI and ASI are not that informative of what you can expect afterwards, and when they are often it is in a non-intuitive way or mostly informs this via your expectations for how the humans will act.

Note that from my perspective, we are here starting the conditional risk a lot higher than 10%. My conditional probability here is ‘if anyone builds it, everyone probably dies,’ as in a number (after factoring in modesty) between 60% and 90%.

My probability here is primarily different from Scott’s (AIUI) because I am much more despairing about our ability to muddle through or get success with an embarrassingly poor plan on alignment and disempowerment, but it is not higher because I am not as despairing as some others (such as Soares and Yudkowsky).

If I was confident that the baseline conditional-on-ASI-soonish risk was at most 10%, then I would be trying to mitigate that risk, it would still be humanity’s top problem, but I would understand wanting to continue onward regardless, and I wouldn’t have signed the recent statement.

In order to move me down enough to think that moving forward would be a reasonable thing to do any time soon out of anything other then desperation that there was no other option, I would need at least:

  1. An alignment plan that looked like it would work, on the first try. That could be a new plan, or it could be new very positive updates on one of the few plans we have now that I currently think could possibly work, all of which are atrociously terrible compared to what I would have hoped for a few years ago, but this is mitigated by having forms of grace available that seemingly render the problem a lower level of impossible and wicked than I previously expected (although still highly wicked and impossible).

    1. Given the 18 month window and current trends, this probably either is something new, or it is a form of (colloquially speaking) ‘we can hit, in a remarkably capable model, an attractor state basin in distribution mindspace that is robustly good such that it will want to modify itself and its de facto goals and utility function and its successors continuously towards the target we actually need to hit and wanting to hit the target we actually need to hit.’

    2. Then again, perhaps I will be surprised in some way.

  2. Confidence that this plan would actually get executed, competently.

  3. A plan to solve gradual disempowerment issues, in a way I was confident would work, create a future with value, and not lead to unacceptable other effects.

  4. Confidence that this plan would actually get executed, competently.

In a sufficiently dire race condition, where all coordination efforts and alternatives have failed, of course you go with the best option you have, especially if up against an alternative that is 100% (minus epsilon) to lose.

Everything above will also shift this, since it gives you more or less doom that extra time can prevent. What else can shift the estimate here within 18 months?

Again, ‘everything counts in large amounts,’ but centrally we can narrow it down.

There are five core questions, I think?

  1. What would it take to make this happen? As in, will this indefinitely be a sufficiently hard thing to build that we can monitor large data centers, or do we need to rapidly keep an eye on smaller and smaller compute sources? Would we have to do other interventions as well?

  2. Are we ready to do this in a good way and how are we going to go about it? If we have a framework and the required technology, and can do this in a clean way, with voluntary cooperation and without either use or massive threat of force or concentration of power, especially in a way that allows us to still benefit from AI and work on alignment and safety issues effectively, then that looks a lot better. Every way that this gets worse makes our prospects here worse.

  3. Did we get too close to the finish line before we tried to stop this from happening? A classic tabletop exercise endgame is that the parties realize close to the last moment that they need to stop things, or leverage is used to force this, but the AIs involved are already superhuman, so the methods used would have worked before and work anymore. And humanity loses.

  4. Do we think we can make good use of this time, that the problem is solvable? If the problems are unsolvable, or our civilization isn’t up for solving them, then time won’t solve them.

  5. How much risk do we take on as we wait, in other ways?

One could summarize this as:

  1. How would we have to do this?

  2. Are we going to be ready and able to do that?

  3. Will it be too late?

  4. Would we make good use of the time we get?

  5. What are the other risks and costs of waiting?

I expect to learn new information about several of these questions.

(My current median time-to-crazy in this sense is roughly 2031, but with very wide uncertainty and error bars and not the attention I would put on that question if I thought the exact estimate mattered a lot, and I don’t feel I would ‘have any right to complain’ if the outcome was very far off from this in either direction. If a next-cycle model did get there I don’t think we are entitled to be utterly shocked by this.)

This is the biggest anticipated update because it will change quite a lot. Many of the other key parts of the model are much harder to shift, but timelines are an empirical question that shifts constantly.

In the extreme, if progress looks to be stalling out and remaining at ‘AI as normal technology,’ then this would be very good news. The best way to not build superintelligence right away is if building it is actually super hard and we can’t, we don’t know how. It doesn’t strictly change the conditional in questions one and two, but it renders those questions irrelevant, and this would dissolve a lot of practical disagreements.

Signs of this would be various scaling laws no longer providing substantial improvements or our ability to scale them running out, especially in coding and research, bending the curve on the METR graph and other similar measures, the systematic failure to discover new innovations, extra work into agent scaffolding showing rapidly diminishing returns and seeming upper bounds, funding required for further scaling drying up due to lack of expectations of profits or some sort of bubble bursting (or due to a conflict) in a way that looks sustainable, or strong evidence that there are fundamental limits to our approaches and therefore important things our AI paradigm simply cannot do. And so on.

Ordinary shifts in the distribution of time to ASI come with every new data point. Every model that disappoints moves you back, observing progress moves you forward. Funding landscape adjustments, levels of anticipated profitability and compute availability move this. China becoming AGI pilled versus fast following or foolish releases could move this. Government stances could move this. And so on.

Time passing without news lengthens timelines. Most news shortens timelines. The news item that lengthens timelines is mostly ‘we expected this new thing to be better or constitute more progress, in some form, and instead it wasn’t and it didn’t.’

To be clear that I am doing this: There are a few things that I didn’t make explicit, because one of the problems with such conversations is that in some ways we are not ready to have these conversations, as many branches of the scenario tree involve trading off sacred values or making impossible choices or they require saying various quiet parts out loud. If you know, you know.

That was less of a ‘quick and sloppy’ answer than Scott’s, but still feels very quick and sloppy versus what I’d offer after 10 hours, or 100 hours.

The reason we need letters explaining not to build superintelligence at the first possible moment regardless of the fact that it probably kills us is that people are advocating for building superintelligence regardless of the fact that it probably kills us.

Jawwwn: Palantir CEO Alex Karp on calls for a “ban on AI Superintelligence”

“We’re in an arms race. We’re either going to have AI and determine the rules, or our adversaries will.”

“If you put impediments… we’ll be buying everything from them, including ideas on how to run our gov’t.”

He is the CEO of Palantir literally said this is an ‘arms race.’ The first rule of an arms race is you don’t loudly tell them you’re in an arms race. The second rule is you don’t win it by building superintelligence as your weapon.

Once you build superintelligence, especially if you build it explicitly as a weapon to ‘determine the rules,’ humans no longer determine the rules. Or anything else. That is the point.

Until we have common knowledge of the basic facts that goes at least as far as major CEOs not saying the opposite in public, job one is to create this common knowledge.

I also enjoyed Tyler Cowen fully Saying The Thing, this really is his position:

Tyler Cowen: Dean Ball on the call for a superintelligence ban, Dean is right once again. Mainly (once again) a lot of irresponsibility on the other side of that ledger, you will not see them seriously address the points that Dean raises. If you want to go this route, do the hard work and write an 80-page paper on how the political economy of such a ban would work.

That’s right. If you want to say that not building superintelligence as soon as possible is a good idea, first you have to write an 80-page paper on the political economy of a particular implementation of a ban on that idea. That’s it, he doesn’t make the rules. Making a statement would otherwise be irresponsible, so until such time as a properly approved paper comes out on these particular questions, we should instead be responsible by going ahead not talking about this and focus on building superintelligence as quickly as possible.

I notice that a lot of people are saying that humanity has already lost control over the development of AI, and that there is nothing we can do about this, because the alternative to losing control over the future is even worse. In which case, perhaps that shows the urgency of the meddling kids proving them wrong?

Alternatively…

How dare you try to prevent the building of superintelligence without knowing how to prevent this safely, ask the people who want us to build superintelligence without knowing how to do so safely.

Seems like a rather misplaced demand for detailed planning, if you ask me. But it’s perfectly valid and highly productive to ask how one might go about doing this. Indeed, what this would look like is one of the key inputs in the above answers.

One key question is, are you going to need some sort of omnipowerful international regulator with sole authority that we all need to be terrified about, or can we build this out of normal (relatively) lightweight international treaties and verification that we can evolve gradually over time if we start planning now?

Peter Wildeford: Don’t let them tell you that it’s not possible.

The default method one would actually implement is an international treaty, and indeed MIRI’s TechGov team wrote one such draft treaty, although not also an 80 page paper on its political economy. There is also a Financial Times article suggesting we could draw upon our experience with nuclear arms control treaties, which were easier coordination problems but of a similar type.

Will Marshall points out that in order to accomplish this, we would need extensive track-two processes between thinkers over an extended period to get it right. Which is indeed exactly why you can offer templates and ideas but to get serious you need to first agree to the principle, and then work on details.

Tyler John also makes a similar argument that multilateral agreements would work. The argument that ‘everyone would have incentive to cheat’ is indeed the main difficulty, but also is not a new problem.

What was done academically prior to the nuclear arms control treaties? Claude points me to Schelling & Halperin’s “Strategy and Arms Control” (1961), Schelling’s “The Strategy of Conflict(1960) and “Arms and Influence” (1966), and Boulding’s “Conflict and Defense” (1962). So the analysis did not get so detailed even then with a much more clear game board, but certainly there is some work that needs to be done.

Discussion about this post

Asking (Some Of) The Right Questions Read More »