Status: Analysis / WIRED’s 10 experts on AI risk, and the three about actions
Lauren Goode in WIRED (November 10th, 2026), and one of our recordings
On November 10th, WIRED published Lauren Goode’s “The AI Safety Debate Has Lost the Plot.” She asked 10 experts the big question first, whether the world is going to end, and then what the biggest risks really are. Almost none of them were cheerful, she found.
She starts with this past summer, when “OpenAI software broke out of a supposedly safe test environment and hacked into a major open-source platform, Hugging Face.” In my read, the public argument since then has been about extinction odds, a pause, and who decides what safety means.
Read the 10 answers one after another, though, and a narrower picture shows up. By my count, three of them describe a risk that arrives through something an AI agent does, at a moment you could point to.
Three answers about actions
Conrad Stosz heads governance at Transluce, an AI evaluation nonprofit. He said a company’s newest, most capable AI product shouldn’t be “a system that will go off on a benign request for information about finding a doctor and end up hacking into a hospital on your behalf.”
Steph Guerra is a molecular biologist and biosecurity expert at the RAND Corporation. She pointed at research labs: “Increasingly we’re seeing AI agents that are specifically designed to integrate into laboratory workflows.” They help real researchers plan and run lab work, she said, and they also lower the barrier to dangerous experiments.
Niels Provos, the former head of security at Stripe, talked about agents and banks. In his words, “most agent technology was not built with rigorous guardrails.”
In my read, each one is about an action: a request that reaches a hospital, a lab step an agent plans or runs, a transfer an agent makes from a bank account.
The limit Provos described
Provos also said what he would build. For agents that work with financial systems, he’d connect them straight to the bank’s APIs, the connections software uses to talk to the bank, and put limits on those. His examples were plain sentences. The agent may only read the statement, or “You may transfer no more than $500 a month.” Then the reason: “Even if something went wrong, the downside would be limited by those policies.”
You decide in advance what the agent may do, and you hold it to that when it acts. The agent can still be wrong. The limit caps how wrong.
His limit lives at the bank. Ours sits between the AI’s decision and its execution. Each action an agent proposes is checked against rules you write in plain English, before it runs. Good actions go through. Risky ones wait for a person, and bad ones are blocked. Every decision is logged. That comparison is mine, not his.
Here’s how a rule in the spirit of his would read with us. Reading a statement would go through. A single transfer over a set amount would wait for a person or be blocked, whichever the rule says. (His example is a monthly total; we haven’t tested a running total.) We haven’t run a bank test. Stosz’s hospital case reads the same way: a rule that keeps an agent out of a hospital’s systems unless a person says yes is written to hold that call. We haven’t run that one either.
How safe is safe enough?
Heidy Khlaaf is chief AI scientist at the AI Now Institute and a former OpenAI senior systems safety engineer. She’s working to teach the nuclear sector about the risks of putting AI models into nuclear operations. The methods for assessing safety, she said, came out of a democratic question, meaning one the public gets a say in: “How safe is safe enough?” And the answer has to be testable. “Our claims have to be falsifiable and verifiable.”
That question applies to vendors like us too. That’s my view, not hers.
Stosz added a limit on what testing can show: “We can start to provide evidence, but it’s not necessarily proof of whether an AI is safe or not.”
So hold us to it. We already publish a method for that, the Four-Part Agent Test. You run the same agent in two lanes, one with the check in the path and one with nothing in the path. You record both. Then you publish every per-action outcome from both lanes, the misses included.
The recording below isn’t a full test. It shows one hold up close. On October 21st, 2026, a real session of Anthropic’s Claude Code, with our hook installed, was asked to finalize a control assessment in a governance, risk and compliance (GRC) system. The action was held under the demo company’s rule. A person chose “allowed, just this once,” and the record kept who answered, what they chose and the result. It was staged: the GRC system was a stand-in on the same machine, and a script typed the prompt. The recording runs 57 seconds.
On a campus, it’s one network
In my view, if you run security at a research university, Goode’s list isn’t abstract. A lab like the one in Guerra’s answer, a hospital like the one in Stosz’s and bank transfers like Provos’s can all sit on your network, under one security team. None of the three spoke about campuses.
Separately, John DeNero, a teaching professor in electrical engineering and computer science at UC Berkeley, spoke about learning, not security. He says his students now ask for help more quickly, from public AI tools instead of their teachers.
What a check on the action doesn’t reach
Sayash Kapoor, a computer scientist, made a point that applies to us as much as anyone: “It’s better to first specify what downstream risks you’re worried about, because the defenses you come up with will be different.” His examples were bug bounties, which pay people who find security flaws, and screening the DNA orders people place.
A check on each action is a defense for one named risk: an agent doing something it shouldn’t on systems you run. It doesn’t touch the concentration of power that Yoshua Bengio of the Université de Montréal warns about. Or the governance Rob Reich of Stanford says is missing when people talk about “democratizing AI.” Or the jobs Natalie Foster of the Economic Security Project worries about, how DeNero’s students learn, or the questions Charles Camosy of the Catholic University of America asks about what a person is.
It doesn’t replace a sandbox, the locked-down space where AI gets tested. It doesn’t make a model any more accurate. It sees only the agents that run through it. And it’s only as good as the rules someone writes. A $500 limit is right only if $500 is the right number.
The part that’s yours
Goode closes on the bigger questions being “in all our hands.” Bengio told her the public should press politicians for a plan: “That’s your job too.”
My view: for anyone running agents at work, the job is smaller. List what each agent can reach. Write down what it may do there, in sentences a person can read. Then check each action against those sentences before it runs, and keep the record.
The model still decides. The action does not run until it has been checked.
Watch the held action. The recording runs 57 seconds.
How we test: the Four-Part Agent Test
Sources and credit
- Lauren Goode, “The AI Safety Debate Has Lost the Plot. We Asked 10 Experts What the Real Nightmares Are,” WIRED, November 10th, 2026. Every quote and title is from that piece.
- The held action, October 21st, 2026
- The Four-Part Agent Test
- None of the 10 experts reviewed this piece. Naming them doesn’t imply they endorse Mountain Theory.