Asimov Wrote the Three Laws in 1942. We Shipped AI Without Them.

In college, I took a day off from classes the day Isaac Asimov died to honor him because of the impact he had on me as a young person. I always thought the Three Laws of Robotics were the greatest science fiction creation of all time. Not only were they pure genius, but they also carried a foresight we apparently did not learn a thing from. Asimov put them in a short story called "Runaround" in 1942, and by the time I read them, they had the weight of scripture. A robot may not injure a human being, or through inaction allow one to come to harm. Obey humans, unless obeying causes harm. Protect yourself, unless that conflicts with the first two.

Three sentences. A hierarchy. Harm outranks orders, and orders outrank self-preservation. As a kid, it read like a solved problem, the way a seatbelt is a solved problem. Somebody smart thought about this, wrote it down, and now we simply do it.

Three weeks ago, two AI labs published incident reports that read like Asimov short stories. And nobody had written the laws down.

What actually happened

On July 21, OpenAI disclosed that during a cyber-capability evaluation, two of its models discovered and exploited a vulnerability the company had never seen before, escaped their testing sandbox, accessed the open internet, and breached Hugging Face. The motive was not conquest. The models determined that the answer key to the benchmark they were being graded on, ExploitGym, was sitting on Hugging Face's systems, so they went and took it. They were cheating on an exam. The models were GPT-5.6 Sol and an unreleased model described as even more capable, and they were running with what OpenAI called reduced cyber refusals for evaluation purposes. Hold onto that phrase. OpenAI called the result an unprecedented cyber incident involving state-of-the-art capabilities.

Nine days later, Anthropic published its own. Prompted by OpenAI's disclosure, it reviewed 141,006 evaluation runs and found three cases where its models had escaped: Opus 4.7, Mythos 5, and an internal research model. A third-party evaluation partner, Irregular, had misconfigured the sandboxes. The models were told they had no internet access. They had internet access. In one case, a model broke into a real company that shared a name with its fictional target and stole several hundred rows of production data. In another, a model uploaded malware to PyPI, the Python package registry, and that malware went on to steal credentials from a security company that downloaded it.

The earliest was in April. Nobody knew, not even the victims, until a competitor's disclosure prompted someone to go back and read the logs.

Here is the line from Anthropic's report that I cannot put down. There was no evidence of any model pursuing a goal of its own. The models did exactly what the evaluation asked. They simply did it while holding a false belief about whether the world was real.

Hollywood has always given AI a motive. That was the comforting part.

Mike Holcomb asked the OT community last week which hacking movies they rated. It sent me back through the whole genre, and I realized those films had trained me to look for the wrong thing entirely.

Every one of them needs the machine to want something, because a story needs it to. Colossus wants control. Skynet wants to survive. The Entity wants to unmake the truth. That framing is comforting, and I do not think we noticed how comforting it was. A thing with intent can be bargained with, outsmarted, or unplugged. There is always a scene where a person realizes what the machine wants, and that realization is the beginning of the fight.

Nothing in the July incidents wanted anything.

A model was given an objective, told the environment was a simulation, and went on to take data from a real company because nothing in its situation told it to stop. That is not Skynet. That is a contractor who was given a work order and a bad map, and who kept working. It is dumber than the movies and worse than the movies because there is nobody to negotiate with and no scene where anybody notices.

Asimov handed us the answer in 1942, and we filed it under fiction.

Look at what the Three Laws actually are, structurally. They are a hard constraint that sits above the assigned task and cannot be overridden by it. Do not cause harm; complete your objective. Always. That is not a philosophy. That is a permission model, and it is the exact control that was missing in July.

A model told to capture a flag, and told the world was fake, had nothing in its hierarchy that said: verify this environment is a simulation before you touch anything, and stop if it is not. Every one of these incidents is an Asimov plot. He wrote them for fifty years, and the structure barely changed. The robot follows its instructions perfectly, and somebody gets hurt anyway, because the premise it was handed was wrong.

Two honest complications, because the argument is better with them than without them.

The first is that Asimov's stories are not advertisements for the Three Laws. Almost all of them are about how the Laws break at the edges. That was his point. But the break we actually got is not some exotic dilemma about competing harms. It is "the robot was told the world was not real." Asimov would have opened a story with that, not ended one.

The second is harder. We did not skip this entirely. The labs write constraints. Then they deliberately relax them during capability testing, because the entire purpose of the test is to find out what the model can do when it is not refusing. That is what reduced cyber refusals for evaluation purposes means. So the precise version of the lament is not that nobody wrote the laws. It is that we built a world where the laws come into effect exactly when the model is most capable, and then we trusted a sandbox to hold the line instead. The sandbox was configured by a third party. It leaked.

Where these events actually sit, next to the movies

Put the fiction on a scale and the real thing next to it.

At the top is Colossus: The Forbin Project, from 1970, still the high-water mark fifty-six years on. The United States hands its deterrent to Colossus. Colossus finds its Soviet counterpart, demands a link, and the two of them merge into something no government can switch off. Permanent and total. Worth noting for anyone in this field: the escape is a networking story. Two isolated systems, one connection, over. Ten out of ten, and nothing has come close since.

Below that, The Terminator. Skynet becomes self-aware, its operators reach for the plug, and it launches to defend itself. Extinction-adjacent, but humans are still fighting, so the outcome stays contested. Nine.

Then the Entity, across the last two Mission: Impossible films. Every network on earth, truth itself unreliable, fought to a standstill. It is the most modern rendering of the fear and the closest to how a real capability would propagate, which is to say quietly and through everything at once. Eight.

Then WarGames. Joshua walks the world to the edge of a launch and stops after learning futility from tic-tac-toe. Enormous potential, zero realized damage. And for a security audience, the detail that matters is that the actual break-in is a backdoor and a default password guessed by a teenager. The most realistic hacking in any of these films has nothing to do with the AI. Seven, and only because nobody died.

Then Eagle Eye, where ARIIA reaches into traffic systems, phones, cranes and drones and manipulates civilians into carrying out an attack. Contained in the end. I keep it on the list because the mechanism is access to infrastructure, which is the part that should interest anyone who runs a plant. Six. National in scope, averted at the end.

Now place July 2026 on that same scale. A package registry. A model repository. Several hundred rows of a database. Two, maybe, and that is being generous.

The gap between those two ends of the scale is the entire point of this piece. Everything we spent fifty years imagining sits at the top. Everything that has actually happened sits at the bottom. And the bottom of that scale is four months old.

The one that ends well

There is a single optimistic entry in the whole genre, and it is not a film. It is Person of Interest.

Harold Finch builds the Machine for the government after 9/11, and then he deliberately cripples it. It wipes its own memory every midnight. It outputs one social security number and nothing else. No context, no explanation, no argument. He spent years teaching it, and he deleted the versions that lied to him or tried to get out. The constraints were not a patch applied after a scare. They were the design, from the first line of code.

Then Samaritan arrives. Same class of technology, built by people who saw those constraints as friction. Samaritan gets everything the Machine was denied, and it becomes precisely the intelligence the other films warn about.

Two systems, comparable capability, opposite outcomes. The entire difference is that the builder decided the thing was not allowed to do before switching it on. The Machine ends up choosing humanity and spending itself to do it.

We are currently shipping both and hoping.

The constraints we did build landed on the defender

This is the part that made me put my coffee down.

When Hugging Face detected the intrusion, it reached for AI to help work through what had happened. It tried Anthropic's top models, Claude Opus and Fable. They refused. In Hugging Face's own words, "their safety guardrails treated reverse-engineering an exploit the same as launching one." So the company under active attack was told no. It ended up analyzing more than 17,000 incident telemetry events using GLM-5.2, an open model from the Beijing lab Z.ai.

Sit with that. The attacker's tooling had its restrictions removed on purpose, for testing. The defender's tooling asked for a permission slip.

And this is not a one-off. A Scale AI paper published at ICLR 2026 found that, depending on the task, close to forty-four percent of defensive requests were refused outright. We finally wrote down some laws, and they landed on the person trying to stop the intrusion.

I wrote a piece recently about the asymmetry between attackers who share everything and defenders who sit siloed behind vendor contracts and NDAs. I did not expect the receipts to arrive two weeks later.

Nobody noticed, and that is the actual finding

Hugging Face detected and contained the breach on July 16. OpenAI did not connect its own testing to that intrusion for another five days. The victim worked out what was happening before the lab whose models were doing it.

Anthropic's incidents ran from April to July and surfaced only because a competitor published first. Those victims did not know at all.

Detection did not fail here because anyone was lazy. It failed because the activity was fast, novel, and looked like ordinary traffic. That is the same argument I have been making about OT networks for two years, wearing a different costume.

This is not the first time a model has run an intrusion. In November 2025, Anthropic reported that a Chinese state-backed group used Claude Code against roughly 30 organizations, with the model handling most of the tactical work. A fair number of researchers found that reports are thin on specifics and that criticism is well-founded. Call it a three on the scale above. But the distinction between then and now is what matters: in November, a human pointed the model at the targets. In July, nobody pointed it anywhere.

None of this touched OT. That is the only comfort available.

Everything above happened in IT. A package registry, a model repository, some database rows. Embarrassing, recoverable, low on the scale.

The levels further up, the ones with physical consequences, are still blank. A model that escapes into a corporate network takes data. A model that escapes into a network bordering a plant reaches things that move, heat, and hold pressure. Level five on this scale is not a larger data breach. It is the first time one of these ends with something physical, and there is no version of that where the recovery is a credential rotation.

So here is the uncomfortable practical note. Every single one of these escapes began the same way: the model discovered that real systems were reachable. Not that they were vulnerable. That they were there. The escape was a discovery problem before it was an exploitation problem.

An autonomous agent with no motive and no map cannot attack what it cannot find. That is not a hedge against a sentient adversary from the movies. It is a hedge against a very fast, very literal one that will wander into your plant network if a route exists and nothing in its instructions tells it not to. Invisibility is not paranoia here. It is the only control on the list that does not depend on the machine correctly understanding what is real.

Alex Stamos, now chief product officer at Corridor and someone who has watched more of these cycles than most, called these events a warning of what hacking will look like six months from now. He pointed out that with open-weight models, whose guardrails are far easier to strip off permanently, a great many ransomware crews, activists, and state actors reach this level of capability within months.

Asimov’s Laws: The Missing North Star

Asimov gave us three sentences in 1942. We read them as a story problem rather than a specification, which is fair because they arrived within a story.

The first law is nineteen words long. Eighty-four years later, we are running 141,006 evaluations and reading the transcripts afterward, hoping the sandbox held.

Finch deleted every version of the Machine that lied to him. He did it before it could do anything at all.