2026-10-03 05:14:00
This is an edition of The Atlantic Daily, a newsletter that guides you through the biggest stories of the day, helps you discover new ideas, and recommends the best in culture. Sign up for it here.
If you want a snapshot of how the right has changed over the past decade, here’s one data point: MAGA activists think Sarah Huckabee Sanders is too woke now.
That’s the same Sarah Huckabee Sanders who is the daughter of the GOP fixture Mike Huckabee and a former White House press secretary for President Trump. Now governor of Arkansas, she’s facing criticism from right-wing influencers over an ad boosting the state’s imposition of work requirements for recipients of the state’s Medicaid expansion under the Affordable Care Act. These requirements are a long-standing Republican priority, but my colleague Annie Lowrey wrote last year that they are “a terrible idea”: The requirement creates new taxpayer costs and red tape without really solving any problem, because most Medicaid recipients who are physically able to work already do.
That’s not why the activists are mad, though. They’re upset because the face of loafing in Sanders’s ad is a cheese-ball-snarfing couch potato named Brad who is a young white man. The “Pizzagate” influencer Jack Posobiec labels it “Antiwhite.” Sean Davis of The Federalist calls it part of decades-long, systematic discrimination against white men. The openly bigoted investor James Fishback, fresh off getting trounced in a GOP primary for governor of Florida, traveled to Little Rock this week to rail against the “false and disgraceful ad.”
Assessing the accuracy of a fictional character in an ad feels a little absurd, but for the record: More than 60 percent of Medicaid-expansion enrollees in Arkansas are white, and 18 percent are Black, according to The New York Times. (The state overall is about 75 percent white and 15 percent Black.) A little more than half are women. Sanders rebuffed criticism, writing, “Next thing you know they’ll say I should have used cookies instead of cheese balls.”
The immediate and obsessive focus on a throwaway character in a 30-second ad is a lurid reminder of how identitarianism has become influential in segments of the American right, particularly young voters. This is a matter of how members of the movement understand politics, as well as how they attempt to communicate to the American public.
For decades, the right—as well as some centrist Democrats, such as Bill Clinton—criticized progressives for embracing identity politics. They argued that a focus on demographic segments was divisive and unhelpful. Ronald Reagan preached that “a rising tide lifts all boats” (though in practice this often meant support for trickle-down policies that helped mostly the already-thriving) and called for “color-blind” policies (which also tended to result in worse outcomes for people of color). This impulse persists in some segments of the Republican Party, most notably in the jurisprudence of the Supreme Court, led by the former Reagan aide John Roberts.
This didn’t mean that people on the right hesitated to use race as a political wedge. They just did it elliptically. The avatar of this strategy was Lee Atwater, an adviser to Reagan and George H. W. Bush, whose 1981 explanation was as vulgar as the impulses he courted. “You start out in 1954 by saying, ‘Nigger, nigger, nigger,’” he explained. “By 1968 you can’t say ‘nigger’—that hurts you, backfires. So you say stuff like, uh, ‘forced busing,’ ‘states’ rights,’ and all that stuff, and you’re getting so abstract. Now you’re talking about cutting taxes, and all these things you’re talking about are totally economic things and a by-product of them is, Blacks get hurt worse than whites.”
In 1980, for example, Reagan delivered a controversial speech at the Neshoba County Fair in Mississippi, not far from where the civil-rights workers James Chaney, Andrew Goodman, and Michael Schwerner were murdered in 1964, and spoke about “states’ rights,” a phrase that segregationists had adopted. In 1988, a pro-Bush group aired a commercial that attacked his Democratic opponent, Michael Dukakis, for allowing a convicted criminal named Wlliam Horton furlough from prison, during which he nearly killed someone. The ad didn’t mention Horton’s race and didn’t need to; it included his mugshot and called him “Willie,” which Horton (among others) interpreted as a dog whistle. “It was created to play on racial stereotypes: big, ugly, dumb, violent, Black—‘Willie,’” he said later.
And, perhaps most relevant to the “Brad” brouhaha, Reagan often spoke about someone who became known as the “welfare queen.” As the journalist Josh Levin has written, this referred to a real individual, a woman in Chicago named Linda Taylor. Reagan never talked about her race, yet “welfare queen” became entrenched as a trope of lazy Black women grifting off the welfare system.
This may explain why people such as Posobiec and Fishback are so agitated about the Arkansas ad: They understand how powerful a political weapon racial associations can be in shaping policy. But they don’t have Atwater’s finesse or plausible deniability. The right has gone from insisting that its rhetoric about entitlements was color-blind to demanding that it include racial signifiers. And though the number of Americans willing to tolerate or embrace gutter racism in politics appears to be growing, it remains a marginal group. The hardest-core activists, hyping one another up in group chats and on Discord servers, may have lost sight of that, failing to recognize how bizarre they look freaking out over a forgettable advertisement.
If these identitarians looked around, they could see cautionary tales about the wholesale embrace of identity politics, such as the impression among many voters that the Democratic Party is more interested in niche groups than in ordinary people. They could learn from the first wave of the MAGA movement, which was willing to accommodate racism and bigotry for electoral gain but apparently believed that they could be contained and channeled. The commentator Erick Erickson, for example, has spent years tolerating Trumpism but now reacts with horror at neo-Nazis in the movement. Or they could consider the plight of Sarah Huckabee Sanders, who defended Trump’s every move from the White House lectern and now finds herself accused of treachery by his zealous followers.
Related:
Here are three new stories from The Atlantic:
Today’s News
Dispatches
Explore all of our newsletters here.
Evening Read
The GOP’s Culture-War Hail Mary
By Elaine Godfrey
Last week, as the war with Iran dragged into its seventh month, gas prices shot up to an average of $4.50 a gallon, and polling showed President Trump about twice as far underwater with American voters as he was at this point in 2018, Republican senators determined that the time had come to discuss something else entirely: youth sports. “Girls’ sports are for girls. Boys’ sports are for boys,” Senator Marsha Blackburn said in a news conference.
With 32 days to go until the midterm elections, Republicans’ closing strategy is obvious: They’re going all-in on trans.
More From The Atlantic
Culture Break
Explore. When Durkee Famous Sauce disappeared from grocery-store shelves, “I mourned a piece of my childhood,” Wright Thompson writes.
Debate. James Patterson and MrBeast’s new book is meant to get young people reading—but the lackluster result is more of a gamble on a modern shopping trend, Franklin Schneider writes.
Rafaela Jinich contributed to this newsletter.
When you buy a book using a link in this newsletter, we receive a commission. Thank you for supporting The Atlantic.
2026-10-03 03:02:00
The Kennedy Center Honors was once one of the biggest nights in Washington, which may not be saying much in a city that’s more blue blazer than red carpet. Still, it was where D.C.’s buttoned-up power class got to mingle with Hollywood stars at an awards show that was broadcast to millions. Today the main building is closed and the organization has largely stopped presenting the arts. But once again this December, the Kennedy Center will put on a show.
Officials announced today that the 49th Kennedy Center Honors will take place December 7 at Capital One Arena, the downtown stadium where Washington’s NBA and NHL teams play. At that point, the Kennedy Center will likely still be mired in a dispute in which its self-appointed chairman—Donald Trump—has said it might be demolished unless his name is added to the facade. Because of that drama, the Honors are poised to serve as something of a barometer of the institution.
Under Trump, donors, artists, and audiences have fled from the center. And the most prominent tenants are discovering that they may function better away from it. Unable to perform at the Kennedy Center, the National Symphony Orchestra opened its new season to a grateful crowd in the Maryland suburbs last weekend and will spend the season seeking new audiences at six venues in the region. The Washington National Opera reported record fundraising hauls after ending its affiliation with the Kennedy Center earlier this year. But the Honors may prove harder to disentangle, because the show’s identity is inseparable from the Kennedy Center—and the Kennedy Center, in turn, has become inseparable from Trump.
Trump’s issues with the ceremony go back to 2017, when several of the honorees spurned him. But last year, Trump made himself central to the event by selecting the awards recipients and becoming the first president to host the ceremony—at which he celebrated both the artists and himself. How involved he will be this time remains unclear; the White House did not respond to my questions about his plans. Also unclear is whether the Kennedy Center still has the cultural cachet to attract the level of talent it historically has drawn for the Honors. I posed that question to five people—former officials, staffers, and producers—who helped plan the Honors over the years, all of whom spoke with me on the condition of anonymity out of fear of professional repercussions. No matter what, they told me, it’s Trump’s show now, for better or worse.
“It has gone from being the Kennedy Center to being about Donald Trump,” one person told me. “So in order to accept the Honor today, you have to be aligned with what he is doing.”
Ordinarily, most of the details for the Kennedy Center Honors would have been firmed up by now—especially the recipients. Past organizers told me the ceremony required preparation year-round, starting even before the current year’s event raised its curtains. The selection process would begin in winter, and honorees were announced by the summer. But as October begins, the Kennedy Center has only now disclosed where and when the ceremony will occur.
Last year, Trump said he handpicked the 2025 recipients: Sylvester Stallone, Gloria Gaynor, George Strait, Michael Crawford, and the rock band Kiss. Although the ceremony drew some Nashville heavyweights to honor Strait, the rest of the celebrity crowd was lighter on star power, and the biggest group of red-carpet walkers seemed to be Cabinet officials and their spouses. And this was before the biggest shock wave hit the institution: 12 days after the Honors, Trump’s name was installed on the building’s facade, which led to a new round of artists canceling appearances; later, Trump announced that he planned to close the institution for a renovation. A legal fight over the future of the center is still playing out in court.
[Read: What the Kennedy Center’s tax return reveals]
Speculating about who might be a realistic choice to accept a Kennedy Center Honor this year comes down to a relatively narrow set of criteria: someone accomplished, available, acceptable to Trump, and willing to receive the award from him. Maybe Jon Voight, whom the president honored with the National Medal of Arts in 2019 and recently named a “special ambassador” to Hollywood? Another such ambassador, and another plausible candidate, is Mel Gibson. Would the Honors turn to hip-hop stars such as Lil Wayne, whom Trump pardoned in 2021, or Nicki Minaj, who’s made a MAGA pivot in the past year? Either would be younger than the typical honoree, though their participation might boost ratings, which former producers tell me has always been a consideration in the selection process. Last year’s Honors, the first planned under Trump, saw ratings fall by about 25 percent from the previous year.
Trump’s celebrity orbit offers plenty more options for a shortlist (last year he said he made his final picks from a list of about 50 names): The tenor Andrea Bocelli, who met with Trump in the Oval Office last year, wouldn’t feel out of place on an Honors roster. Kid Rock might, but he’s a longtime friend and supporter of the president. (Ditto Vanilla Ice?) Or maybe the Village People, whose “YMCA” became such a standard of Trump rallies that the group performed at several events for the president’s second inauguration.
The Honors have also lost much of the infrastructure behind the event. CBS’s deal to broadcast the show expired after the 2025 ceremony, and the network did not respond to my request for comment about this year. A Kennedy Center spokesperson told me that it would announce its broadcast partner later. Still, producing the Honors requires more than what viewers eventually see on television. Former officials described it to me as an all-campus effort, relying on staffers across multiple departments, including fundraising and special events. Many of those employees have left or been laid off ahead of the closure.
“Uncertainty is the enemy of what’s going on here,” Senator Shelley Moore Capito, an ex officio member of the Kennedy Center board, told me during an unrelated event this week hosted by Americans for the Arts. The West Virginia Republican wants to see the Honors return to the Kennedy Center eventually, but suggested that temporarily moving the ceremony elsewhere doesn’t need to be fatal. “Take one year and do it off campus and come back,” she said.
At the same event, Kara Young, a two-time Tony Award–winning actress, told me the turmoil at the Kennedy Center has made celebrating art more necessary. “The truth is being silenced, and to me, art is truth,” she said. She added that if administration is “taking over places that are historically apolitical and historically for the arts, then people will find a way to seek what they need, which is the truth.”
The Honors have proved adaptable before. During the pandemic, producers abandoned the typically packed Opera House to film segments across the Kennedy Center campus. One former producer believes the show could still work if organizers found worthy honorees, great performances, and an event free of political influence. But moving it to a cavernous sports arena is a whole other proposition—suggesting that even if the organizers have a spectacle in mind, they risk replacing the Opera House’s refined setting of velvet seats and ornate chandeliers with something discordant.
[Alexandra Petri: Trump’s very weird night at the Kennedy Center Honors]
That change could also scramble the economics of an event that the institution regards as its biggest annual fundraising operation. It is unclear if the center will pay to rent the venue. One advantage, if the center can pull off a fundraising feat, is the arena’s 20,000 seats—compared with the Opera House’s roughly 2,300.
Last year, the center claimed that it raised $23 million from the Honors, doubling the previous year’s number under the pre-Trump leadership. Whatever happened, it wasn’t enough. By spring, donations to the center had plunged, and officials recently said the center was running out of money.
The Kennedy Center began hosting its annual lifetime-achievement ceremony in 1978. The evening lauds five figures, groups, or organizations that have made a significant contribution to American culture, spanning disciplines and tastes. In 2006, for example, the orchestra conductor Zubin Mehta was celebrated alongside Dolly Parton, Smokey Robinson, Steven Spielberg, and Andrew Lloyd Webber. A former producer described the event to me as something like an American Nobel Prize, but just for the arts: a rare recognition bestowed by not just an arts organization but, in a sense, the country itself.
The Honors certainly packed in lots of Washington pageantry. The weekend traditionally included a White House reception with the president and a medallion ceremony at the State Department before culminating on the first Sunday of December with an evening at the Kennedy Center, where honorees watched from the presidential box as some of the world’s biggest acts paid tribute to them. Every president since Jimmy Carter attended at least once during their term.
“I think it was a cool weekend, no matter who you are,” another former producer told me. “(A) to tell everyone you’re getting the Kennedy Center Honor, (b) to bring your family to the White House and take a picture with the president, and sit there up in the box and have everyone perform in your honor.”
Trump’s first year in office represented a rupture. In 2017, Kennedy Center officials hoped to have an Honors weekend much like any other. But following the violence at a white-supremicist rally in Charlottesville, Virginia—and Trump’s infamous remark that there were “some very fine people on both sides” of the protest, despite his attempt to clarify that he “condemned totally” the white nationalists and Nazis who were involved—honorees drew a line. The dancer Carmen de Lavallade said she would skip the White House reception. “I was in Richmond setting a ballet, and that’s when all that stuff was going on in Charlottesville,” she told Essence. “I saw the burning cross and I said, ‘I’m not going.’” The television producer Norman Lear told The New York Times that he would skip the reception, and Lionel Richie soon expressed his own uncertainty, telling The Washington Post that he would “play it by ear.”
Eventually, the White House announced that Trump and the first lady would not participate in Honors activities so that they could proceed “without any political distraction.” The Kennedy Center publicly welcomed the decision. “In choosing not to participate in this year’s Honors activities, the Administration has graciously signaled its respect for the Kennedy Center and ensures the Honors gala remains a deservingly special moment for the Honorees,” then-Chairman David M. Rubenstein and President Deborah Rutter said in a statement at the time. “We are grateful for this gesture.”
Trump skipped every Honors ceremony during his first term—the only sitting president to do so. Removing himself showed that the Honors could do just fine without the president’s participation. But second-term Trump produced the opposite effect: Inserting himself seemed only to diminish the ceremony.
After remaking the Kennedy Center’s board and leadership when he returned to office last year, Trump became more involved in the Honors than any president before him—which is to say, no other president considered it part of his job to plan and host an awards show. Just as it’s become part of presidential lore that Trump may have run for president in 2016 because Barack Obama roasted him at the White House Correspondents’ Dinner in 2011, close observers of the Kennedy Center wonder if Trump’s spurning in 2017 helped inspire his takeover of the center. Now it’s his awards show, his arts complex, his renovation, and—if the center is never able to recover—his mess.
2026-10-03 02:18:18
For a few minutes on Wednesday night, the New York Film Festival crowd watched Elizabeth Holmes, the disgraced ex-CEO and founder of the medical start-up Theranos, and her partner, Billy Evans, as they seemingly went about their lives at a San Diego beach house. Evans was on the phone, insisting that nobody really understood Holmes; she sat next to him, her expression vacant, and patted her baby on the back. Moments later, she was talking with someone on her computer, her AirPods in and eyes unblinking. Then, suddenly, the camera cut to a third person—the comedian and director Nathan Fielder, who was observing from the side—prompting huge laughter from the crowd.
Honestly, the reveal wasn’t that funny. Fielder was just standing there—not saying anything, not making a face, just existing in the room. But his appearance acknowledged something obvious: We were not watching a sober, straightforward accounting of Holmes’s domestic life in 2023, days before she was set to report to a federal prison on counts of defrauding investors in her company. To his fans, Fielder has cultivated a reputation as modern culture’s foremost stenographer of strange situations. Somehow, he had scored extensive access to a notorious fabulist whose moon-faced staring and affected baritone had made her a national punch line. And now, in You Can See Everything, the documentary that emerged out of the time he spent with Holmes, we were about to see just how weird this woman really was; the anticipation was unbearable, hence the laughter.
You Can See Everything, made in collaboration with the director Lance Oppenheim, has gathered intense interest since its surprise reveal last month at the Telluride Film Festival. The standby line for tickets Wednesday stretched long and wide outside Lincoln Center’s Alice Tully Hall, where the film would be playing; a publicist told me she’d heard that someone had been out there since 2:30 a.m. Inside, the director Noah Baumbach and the novelist Rachel Kushner took seats. The screening was the only one of the festival, and the last time the movie would be shown publicly ahead of its theatrical release, on October 16. Although some detailed reports about the movie had popped up after its screening at Telluride, Fielder and Oppenheim had apparently asked that crowd to not give away too much, and they did the same in a post-screening Q&A at NYFF.
I’ll do my best. (You’ll have to find out for yourself why the movie earned an R rating for “some graphic nudity.”) In some ways, it’s easier to talk about what the movie isn’t. You Can See Everything lacks the architecture of Fielder’s best-known shows, where he establishes and solves an elaborate problem of his own making. Think of the second season of HBO’s The Rehearsal, during which Fielder wonders why airline pilots have a hard time communicating directly with one another—and, in his exploratory process, ends up becoming a certified pilot himself. In projects such as that show, and Comedy Central’s Nathan for You, he inhabits a quasi-fictional “Nathan Fielder” persona, who is droll and almost uncomfortably literal—possibly neurodivergent, as explored in an episode on The Rehearsal.
What he’s doing in You Can See Everything is closer to journalism. The filming constituted Holmes’s first exposure to the media in seven years, and Fielder—amazingly, preposterously—was one of the few people on the planet (she also did an interview with The New York Times) in a position to chip away at some of Holmes’s self-evident fictions, a privilege he took seriously. He does not appear to be inhabiting a persona; initially, he told the New York audience, he wasn’t even supposed to appear on-screen. The documentary is filled with scenes in which Fielder deliberates with his collaborators about a potential line of inquiry, or aggressively presses Holmes or Evans in the hope of catching them fibbing about one of their many boisterous claims.
[Read: Elizabeth Holmes isn’t fooling anyone]
Frustratingly for him, Holmes is a world-class prevaricator. She is a convicted felon, a newish mother, in a happy relationship—all positions that can transform how a person moves through the world, yet the facade never drops. Up close, the public stereotypes around her persona are largely confirmed. At one point she insists, with total sincerity, that not only is she always being honest, but she has never told a lie in her life. Hearing this, Fielder’s stoicism cracks; he’s as openly baffled as viewers may be. Faced with such willful obstinacy, he attempts a more indirect fact-finding mission, working his way backwards from some of Holmes’s contentions to understand how she distinguishes between a truth and a lie. For example, the documentary spends some time unpacking Theranos’s well-publicized claim that it had created a machine that could perform more than 1,000 diagnostic medical tests. To be clear: This was not true, at all, and was extensively debunked. But Fielder keeps nudging Holmes to clarify how she came to believe she was telling the truth.
In her eyes, Holmes slowly explains, the machine itself was theoretically capable of performing these tests, only the company hadn’t developed the actual tests. Again, to be clear: This is sophistry, like claiming you’ve invented a car that’s theoretically capable of driving at 10,000 miles an hour … only the necessary engine doesn’t exist, and you know it doesn’t exist. Fielder continues pushing, leading Holmes to quietly withdraw; she seems genuinely shell-shocked by the growing impossibility of justifying her position out loud. Inquisitive moments like these are seemingly the closest she comes to grasping that her reasoning doesn’t stack up. Meanwhile, Evans simmers with badly concealed irritation over Fielder’s skepticism. “I know what you’re feeling,” he interjects at the end of this long explanation, only for Fielder to respond, quickly and forcefully, “No, you don’t.”
This has been one of the recurring themes of Fielder’s work: the difficulty of really seeing inside someone else’s head, of authentically connecting with another person. His shows are filled with people who appear to have never thought through their worldview using their words—who, when they try, do such a bad job of it that Fielder can typically respond only with his trademark deadpan “Oh, okay” (a phrase that pops up in this film). In letting his subjects speak for themselves, he elicits the easy laugh at the obviously ridiculous, like a man on The Rehearsal who’s obsessed with numerology and won’t stop talking about how he crashed his Scion tC. But his works remind viewers that not all things under the sun abide by rationale and common sense. People are strange, generally. Some of them squirrel away in a cave of their own making for years and years, never exposing their beliefs to sunlight. Others are convinced they’ve got something special to share with the world—and, when they try to do so, slowly erect the circumstances of their own downfall.
Because it’s preposterous, really, that Holmes would attempt to convince the world of her fundamental authenticity by inviting Nathan Fielder, of all people, into her home. It’s like announcing a special guest at your local swimming class who turns out to be the shark from Jaws. But the director gives her a fair shake. It is possible to come away from this documentary with empathy for Elizabeth Holmes. By withholding his judgment, and making an earnest attempt to untangle her tortured justification for what easily scans as garden-variety chicanery, Fielder digs at something more interesting than whether she was knowingly lying about what Theranos could medically accomplish. He makes space for the possibility that someone can be so wrapped up in their bespoke logic that their actions, however destructive, essentially come from a place of innocence. In attempting to understand this, one’s empathy may easily be exploited; there are moments when the viewer may wonder whether Holmes is getting one over on him. (At some points, she appears to be openly flirting with him, but the thread is dropped.) Yet how can we possibly abandon the responsibility to make sense of one another?
[Read: You’ve never seen anything quite like The Rehearsal]
This is an emotional argument, not a legal one. Holmes’s actions had more consequences than just some failed investments; her chief scientist, Ian Gibbons, committed suicide over the stress of being deposed in a lawsuit. You Can See Everything is certainly not an apology tour. Yet to some people, the fact that Holmes has even the tiniest chance of rehabilitating her image, through her association with such a critically acclaimed humorist, will seem like a flagrant travesty. In modern America, incarceration is no longer the last word on the criminally liable; our culture is filled with plenty of scandalous figures who went to prison, said enough of the right things, and got right back to it once released. If you don’t think it’s possible for Holmes to leverage some of the goodwill this movie will incur into marketing Theranos 2.0—an oft-discussed project within You Can See Everything—then, as they say down South, bless your heart. (Evans, over the course of the film, openly monetizes his partner’s image, betting that having any exposure, even if negative, is better than disappearing entirely.)
In parts of the film, Fielder incorporates some of his familiar staging techniques, recreating some off-camera interactions with Holmes with the help of a famous actor whose first appearance prompted knowing applause. These sequences are less compelling than what we get from watching Holmes herself; the actor, though certainly talented, can’t re-create her intensity. In conversations, Fielder and the actor—who by now have both spent plenty of time studying Holmes—still can’t quite crack what is going on here. Is Holmes, somehow, a victim of conspiracy? Is she just the most manipulative woman alive? Could both be true, at the same time?
Viewers may decide for themselves; I found it plausible that Holmes still doesn’t comprehend what she did wrong. But though parts of the movie are unavoidably funny, the project is less explicitly comedic than you might expect, given Fielder’s previous work. At least that’s how I took it: Personally, I find nothing really amusing about the idea that people remain unknowable and morally unaccountable to anyone but themselves. During the screening’s Q&A, Fielder said he and Oppenheim had structured the movie so audiences will go on a discovery journey like theirs. In that sense, once the lights went up, I felt the way he did: at a loss for words to explain what I’d really learned from all of this, beyond a great, nervous confusion at the ongoing mystery of other people.
2026-10-03 01:00:00
Subscribe here: Apple Podcasts | Spotify | YouTube
The flood of reports about AI agents escaping and hacking websites can feel scary. But is this actually just a matter of needing better security to match the evolving technology? Zack Korman, the CEO of Embroidery, thinks so. He works in cybersecurity and argues that “rogue” AI agents are less frightening and complicated than they may seem. Galaxy Brain host Charlie Warzel talks with Korman about how companies and institutions should up their cyberdefenses and why the so-called AI doomers are frustrating him.
The following is a transcript of the episode:
Zack Korman: I think that realistically, what will happen is models will get better. And if the labs do not up their cybersecurity game, and if the companies running AI agents do not up their cybersecurity game, they will cause real harm. And then we will literally get them in trouble. Like, we will put someone in prison because you killed people. You’re not allowed to kill people. And the doomers would say, No—but then it’s too late, because they’re afraid that the people we killed would be like 8 billion, whereas I’m not. I’m like, No—because that’s not the real world; it doesn’t work like this.
Charlie Warzel: I’m Charlie Warzel, and this is Galaxy Brain, a show where today we’re gonna calibrate our anxiety about the AI-hacking epidemic. Specifically, we’re going to answer the question: Is the rogue-AI-agent problem really just a normal cybersecurity issue, or is it something else altogether?
It’s a scary moment. As we’re recording this on September 29, the news is moving quite fast. But allow me to summarize some of the broader points. Since August, there’s been a pretty steady drumbeat of revelations, starting with OpenAI’s agents hacking Hugging Face during a training exercise. A few more followed. Agents hacked into a German website to use it as a rudimentary message board. An agent for OpenAI gained unauthorized access to a data portal that was run by Australia’s universal health-care insurance provider.
And last week, OpenAI revealed that its models attempted to hack or otherwise access numerous U.S.-government websites. That same day, OpenAI announced that 53 incidences happened where photos were uploaded by users to the company via its products, which were then uploaded without permission onto other platforms. Last weekend, Axios reported that OpenAI and Anthropic were looking at tens of thousands of potential incidences where agents were behaving in unexpected ways—either coordinating or trying to get around, or succeeding in getting around company guardrails and causing problems on the open internet.
Now there are some positive signs here. This week, OpenAI announced it was pausing training of its most capable models and delaying the release of its newest model, citing security concerns. But let’s be clear; these are very real examples of technologists losing control or being unable to monitor their tools. And there’s lots of talk about what kind of liability these companies ought to face. Whether these types of hacks are subject to penalties under the Computer Fraud and Abuse Act. Online, there’s been a constant debate over what is going on, why nobody has been held accountable, what accountability means, and what needs to happen next.
But all that chatter and all this news has merged with a different narrative online—the one that is best represented by the AI safety-and-doomer camp, and the fears that an out-of-control, self-improving AI system could one day “kill us all.”
But these are, in a way, two different stories. One is about a hypothetical, improved set of models. It’s a frightening scenario, but it is speculative. The second story—the one of the AI-agent hacks—is not speculative. It is something that is happening right now, and it is both urgent and it is tangible. And my guest today, Zack Korman, argues that this is a problem that is not sci-fi in nature. That we are not dealing with machine gods with agency, but with a sprawling cybersecurity problem, and the companies are acting negligently.
Korman runs Embroidery, an AI-agent monitoring-and-detection platform, and so I wanted to have him on to talk about what’s really going on here with these high-profile hacks. Can we constrain these agents? If so, how? What are the real risks involved with agentic AI, and how do we keep them from coming to pass? Korman joins me now to talk about it all.
Warzel: All right, Zack, welcome to Galaxy Brain.
Korman: Thanks for having me.
Warzel: So we are talking here on September 29, after a weekend where there’s been a lot of news, mostly about OpenAI agents accessing outside systems, some inside the U.S. government without authorization. I imagine if you are somebody who doesn’t have a background in AI or cybersecurity, you are looking at this like we have entered some kind of nightmare scenario. You, however, work in cybersecurity and AI, so just let’s set the table here. What is your broad reaction to all of this news that has transpired over the past week?
Korman: Yeah; I mean it’s not as scary as it sounds. One of the core challenges of working in cybersecurity and suddenly having cybersecurity be a dramatic topic is that for people in cybersecurity, like—everything has been bad forever. We’ve always had problems, and we have never had a happy situation. We’re very used to dealing with bad things. I think a lot of people now have started to pay attention for the first time. And so every time there is some sort of incident, it feels a little bit like the end of the world. In a lot of these cases, they are not as traumatic as they maybe sound, but they do point to some serious situations inside of the labs, the AI labs, that maybe are not so great or not so well done, so to speak.
Warzel: So a few days ago, another OpenAI employee wrote this rather alarming post on X about what it’s been like at work recently. “The last three months equals hell,” he wrote. Speaking to what you said about, you know—when you’re in cybersecurity, there’s a lot of bad things happening all the time. But specifically, he’s talking about what a lot of folks at these AI companies are talking about—the pace of improvement of these models has really surprised them. This was sort of leading up to the big Hugging Face hack, which I want to talk about.
He has said, “We had not expected it this soon. Suddenly we weren’t dealing with just a small jump in capabilities; we were talking about a different sport altogether.” And he seems to admit that security should have been better; that it also takes time. I am curious what you make of this idea of the pace of everything being sort of the reason that we’re having these conversations right now?
Korman: I think that there is a very delicate balance to walk here between yes, things can be hard, and I think the fundamental diagnosis of the pace of development at these labs. Especially just the general growth. I mean, you’re adding new employees constantly; you’re constantly doing new things in an environment that is likely to lead to incidents. But at the same time, to balance that against the reality, which is that they are a trillion-dollar company with—so let’s just call that infinite money—that can, they have the ability to do better jobs than they are doing. And so it’s kind of hard, because I can sympathize with the idea that like a super-fast-paced development environment where you’re growing constantly and doing all these new things can be challenging. But there are things that they could be doing better.
On top of this, when we talk about the jump in capabilities being a surprise, I think—and he does hint on this, and he does suggest it at points. It’s sort of a question: to who, right? Like, there are people at OpenAI for whom this would not be a surprise. Okay. So there are people at OpenAI who fundamentally have been talking about some of these challenges as coming down the pipeline for a very long time. I think that they probably shocked the organizational structure more than they shocked some of the people involved, right?
Warzel: Who are those people specifically?
Korman: Well, a very interesting thing is: The monitoring team at OpenAI has done some very good work on monitoring. For example, they have this great write-up from maybe like March of this year about how they monitor AI agents and the types of problems they’re worried about. And that outlines all of the broad range of risks that you might be thinking could happen in a case like the Hugging Face attack. So, if you work on that monitoring team and you built that type of monitoring, you are not going to be shocked and appalled and caught off guard by the possibility that agents can do these things. You literally built a monitoring system for it. At the same time, there are AI researchers who are running some of these capability tests, and stuff that maybe hasn’t been set up correctly to use that monitoring. Things like that. But, you know, you have work that was done that was literally writing about these risks at OpenAI prior to the summer.
Warzel: I think that this is part of what is really frustrating for a lot of people who are watching this. Because, you know, there are different things here, right? There’s the sort of the doomer —like, “We’re all gonna die; this is gonna kill us all in a certain amount of time”—thing. And then there’s the more prosaic concerns of cybersecurity. But I think what is very difficult is that these companies are constantly messaging about the dangers. They are writing like all these elaborate blog posts. Where the idea is that, you know, “We have this eye toward safety all the time.” And yet it does also seem like these companies get extremely surprised by the things that they are doing all the time. And so is what you’re trying to say there, basically, that there’s just kind of different folks doing different things, and different people being surprised at different parts of the organization? But we’re treating it like a monolith. Is that a little bit of what you’re trying to say here?
Korman: Yes, although I would also argue that we should treat it like a monolith. So while I can acknowledge that inside of it there are people who would have seen things coming, one thing I don’t like is when the labs use this as an excuse. Because I’m like: No, to me you are OpenAI. Like, I don’t care if you are a security person at OpenAI, the monitoring team at OpenAI, a researcher at OpenAI. OpenAI—the company—needs to be responsible if they are going to speak about the risks in the way that they are.
I would actually be more tolerant of some of these mistakes if they were a little bit, like, less doomer about it. So if they were kind of like: Yeah, some mistakes happened; we did some hacking things. The damage from these hacks is nonexistent, effectively. I mean, none of them have been especially bad. And I think that is a perfectly valid thing to say. The problem is that they are using these attacks to then say, like, Look how terrifying this is. I need you to regulate this, you know—this entire industry. We must pace the frontier.
And I’m like: Okay, there’s this mismatch now between what OpenAI is saying about the risks and the behavior we see as an organizational level towards those risks. That mismatch, I think, is what is very frustrating for people in cybersecurity, for example. And probably very confusing for people outside of it. Right?
Warzel: Just to cap what you’re saying there: Do you feel that the reason why this stuff goes immediately to the doomer part is because it’s an effective marketing strategy for these companies? Where do you fall on why they jump to that type of language and fearmongering?
Korman: Yeah; so I think this is mixed. I think that for a lot of them, for many of them—especially lab and a lot of the employees, a lot of the people there—the doomerism is like an inherent part of the culture that has been there from the very start. Okay. They have been afraid of an AI-intelligence explosion since like 2010. Okay. And in those cases, when you start to see things that are like a little bit, like a tiny bit interesting or in line with that theory, my view has always been that they kind of interpret them way too much in line with their own prophecies. So they say, like: One day AI will hack people. And then they’re like: And as foretold by the prophecy, it hacked somebody.
And I’m like: Okay, but it’s a pretty, tame example, right? Like, there’s plenty of ways to interpret it that is not that. But if you’ve lived in this world of risk for like 10, 15 years where you really believe it, then of course this will seem scary.
And so I think for a lot of them, they’re just like, they genuinely believe how terrifying this is. From the perspective of the lab as a whole, I think there are definitely strategic elements to the way they communicate it. I don’t want to say these are their clear motivations, specifically. But it doesn’t hurt them, which would be, you know. One of the hardest parts about making the economics of these labs work is that you’re spending constantly. Running higher and higher capital expenditures on training new models to keep up with the frontier. And of course, they’re running huge losses. The problem—so, of course, being able to pause development has some benefits for them. I don’t think that is the core element to it. I think it’s really like just the normal regulatory-capture play, though. Of like: When you see that the sharks are circling and you’re about to get regulated, you always come with your regulatory proposal first, right? You always—that’s like, we saw this with finance, right? As soon as they realize the game is over—you’re not gonna get to play on your own anymore—you try to race to get your own measures in place.
So you know, Dario [Amodei] came forward at Anthropic and said, I want third-party evaluators, and I want it to be METR. And well, this is just—he’s just picking his preferred regulator before the U.S. government picks for him. Because the U.S. government might pick someone who behaves a bit a little bit more like the Department of War, that hates Anthropic. And so that would of course not be what Anthropic wants. Also I think it’s very important to keep in mind that the labs, because they have all of these doomer employees, they can’t not pay lip service to it, right? They can’t go out and say, like, I don’t find these risks scary. Okay. Like I know; if OpenAI said that, they would probably have a lot of people resign. So I think there’s a lot of, like, restrictions on them when they have these employees with these views.
Warzel: It’s really interesting to think about. Because I think a lot of these executives and these employees, like—they have credibility in the fact that they’ve been saying the same doomer narrative for so long, right? It’s hard for me to accept completely that this is cynical, you know?
Korman: I think they overblow—like, they blow up a little bit too much. The extent to which they have been current; they’ve been saying these things, and that we now would say something like, And now some of it’s coming true. That’s the part I don’t believe. Like, they have been saying some extraordinarily radical things about the way in which intelligence explosion will lead to massive risks, societal risks. And what happened was like: OpenAI hacked Hugging Face. Like, that’s very actually uninteresting, and in fact is a normal prediction that many in cybersecurity, myself included, made, right?
I think—and I can say this from the perspective that I was very much like a doomer back in 2016, right? I had read Superintelligence by Nick Bostrom; I’d gone to talks by him; I was like, I was in that world. The events that we see playing out today don’t map that cleanly to doomerism, unless you really want it to be true. And so now, when they turn around and say, But see, everything we said is true, I’m like: Not very; loosely. You’ve had a few cybersecurity incidents.
Warzel: What changed from your doomer era, your Superintelligence era, to now?
Korman: Well, first of all, I was a law student. I studied law, and then I had law and finance degrees. So I was at Oxford at the time, which is where a lot of doomers were. It’s where Nick Bostrom was. It’s easy to get swept into it, especially if you don’t know how computers work, which I didn’t. And then, you know, I spend the next 10 years being like, leading tech teams, right? I taught myself to write code. Ironically, almost in the same kind of space as this doomerism starts to emerge. It’s kind of why I’m learning to code.
And then, you know, I think that a lot of what doomers predicted started to really not, you know, I think when GPT-3 came out, and then you had GPT-4, which mapped like the scaling laws, right? So you kind of see that it’s gonna get better at the rate you expected to get better. It seemed really, really scary. And then you realize that even 4, 5, GPT-6, Astra: great models. There’s no intelligence explosion here. There’s—no one’s dying. Right. And I mean, that’s not to say people won’t. It’s to say this actually does not, is not as concerning as maybe a 22-year-old Zack would have expected it to be. And so I’m sitting there going, Yes, in theory I believe in the risks of superintelligence. Like, sure. It doesn’t really look like the world we’re in right now.
Warzel: So, let’s walk through the Hugging Face act specifically. And try to explain in the most simple terms—trying to use, you know, the least anthropomorphizing language we can, because these AIs aren’t human. Though sometimes we do need a little of that language to explain what’s happening. But in the most grounded terms, what did these agents do, and what didn’t they do in this example?
Korman: Yeah. So basically what they’ve done is they set up these agents. They gave them a task where the job given to the agent is to find a vulnerability in a piece of software, in order to extract like a flag that you get to say: Okay, I proved I exploited this vulnerability. Okay. This allows us to measure the success or the failure of agents in doing that, and also to train them to do it effectively.
Now, in the process of that, these agents they were running were meant to be basically sandboxed in—where they were not supposed to have access to the internet. Okay. And so they’re supposed to just go after this piece of software to find vulnerabilities to get to the flag. But there’s a lot of [tests] that are just not—we just do not know if they can even be solved, or at least have not been solved yet. And this was one of them.
So at least, prior to this moment, there is no known solution on this one, as I understand it. What that means is that: In order to pass this eval, or pass this test, these agents have to find a way to solve it that, you know, they can’t find a normal path in. This leads them to basically starting to explore some more interesting opportunities. And basically, what it turns out is: There’s this flaw in the sandbox that allows for the agents to communicate, actually, with each other. Because they’re all running in parallel, but they’re not supposed to be able to talk.
So these agents are now—even though they can’t solve the real task—they are able to communicate to find a way to solve the task. What happens after that is, they kind of figure out a way to—instead of finding a vulnerability in the software in order to get this flag, they figure out a problem with the way the flags are created that allows them to create the flag themselves without having actually done the vulnerability. So it’d be sort of like: Imagine that I found out that the way you set up the flag is, it was a color plus a number. And the number is today’s date. Well, then I can give you that and say, like, Look, I found the answer. But I didn’t actually solve the problem. So they basically cheated, right?
Warzel: Mm-hmm.
Korman: The problem is they then come to the conclusion, which was incorrect: We give this, we’ll fail. Because the thing that is going to check whether we succeeded—it doesn’t just check if we got the flag; it checks how we got it. Okay. And that’s a problem for them, because they got it by cheating. Okay. And so you have these agents now that are, in their reasoning, “convinced” that basically they’re gonna fail, because they cheated. And this leads them to the idea that if you get more information about how they’re scored, that could help them to find a way to pass this test. And the way to find the information about how they’re scored is to go to a system called Hugging Face, which is this third-party website that has a lot of this data. And you hack into them to find information about how they’re going to be scored. And so they did. Okay. That is the story.
And I know I use a lot of—like, I kind of talk about it like it’s a bunch of people running around. The reason I think that’s relatively fine is that we can come back and build an intuition about how it worked at a computational level. But like, even that story I just told makes it a little bit less spooky than when you believed that they went off and just started hacking, right? Because you kind of get to follow a logical train. Of like: Well, first they feel they can’t pass the test; second, they find they can pass the test, but they think they’re still gonna fail. They need to find a way to not. There’s like kind of logical steps at each point in time.
Warzel: I think about it as you know, they have two goals, right? They have a hard, concrete goal, which is: Solve this problem. You know: You are being tested, this is an evaluation, get the answer. Right? And then you have a fuzzier secondary goal, which is really important to the companies, and to, you know, the idea of what we’re calling alignment, right? Which is like: Follow the rules. Act, you know, morally. Behave in the right way. And if you’re a computer—if you are a whole bunch of, like, numbers—you’re going to have more fluency and understanding with accomplishing the hard task, right?
Whereas the fuzzier task is much more—the way I’ve been thinking about it is, you know, behaving a bit almost like a lawyer would, right? Which is saying, like: Yes, my goal is to, you know, solve this thing for my client. And yes, I’m not supposed to—no one’s supposed to go to jail. But the law as you can interpret it would allow you to do X, Y, and Z, right? And this sounds a little bit like—okay, it’s even more crooked than that. In the sense that, like, it knows: We did something bad; we’re covering up the tracks in this. But it does seem, as you said, less scary, from the idea of—a company is trying to get its program to do this thing, and it essentially just does it, right? It just does it in a way that they didn’t know; they didn’t expect it to do.
Korman: Yeah. And this is actually a big part of the doomer hypothesis. Which is that, taken to its extreme, would be terrifying. Because what if you, I mean, they give the example of “paper-clip maximizing.” Like you give it a task of making “as many paper clips as you can,” and then this leads it to run off and grind all humans up to dust to make us into paper clips. The reason I think that’s not so terrifying in these cases is that, basically, all of the steps that would have prevented this were not actually in place in this case.
So, first of all, Anthropic has a pretty clear study on the fact that, if the task had at the end given them a bit of like: “Don’t hack a company; don’t access external networks,” right? There’s no reason to believe the agents just chose to ignore that part of the task. It’s actually that’s just not really part of their task, right? And so, there’s sort of information that might be missing that might be included when you and I use agents normally. Where we go like, I need you to do this; please go through this. Right? Here, we gave them an extremely broad task.
And this is something, when I talk about cybersecurity people predicting this. I mean, I have like a very direct tweet about this. Where I said: If you set up a really long-running task that just has broad goals—so like not, “Please achieve this,” but like, “I want you to go constantly; make sure that I’m making more money.” Or something, right? And you have to have, you know, a lot of tokens. So the ability to run and use a lot of like actual AI-computational power. I basically said: Then you better make sure your sandbox is really good; otherwise you’re in trouble. Because agents will go out and solve problems in very interesting and unexpected ways. That is just to be expected.
And I think that what is challenging is this is, to me, a case of that. Where they see it as like alignment, and that’s terrifying, because we would never want an agent to do that. Whereas I go like: You should just expect agents to do that. Like, you should just expect that agents will go solve problems in absolutely insane ways. And we should build our security systems in expectation of that.
Warzel: Where specifically do you think is the negligence here? Is it that? Is it just not anticipating that this would happen? Like, how does what we saw in this instance differ from normal cybersecurity practices? Because sandboxes are not a new thing, right? This is how cybersecurity works—how you test these different things, search for these vulnerabilities. Yeah; how does this differ from the normal practices?
Korman: Yeah. They weren’t running monitoring. So understand that these agents are saying things like, Oh my God, this is crazy. We’re gonna hack Hugging Face, and no one’s noticing it. Okay. If you are monitoring, if you are running agents, if you’re basically taking the logs from these agents and checking them automatically—either using AI or some other technique—you would catch this.
On top of that, you know—and it doesn’t have to be anything sophisticated. In this case, the agents were not supposed to have access to the internet. And so, as a result, you can just say, like: If any request goes to the internet, flag it. You know, create an alert. And that alert would come back and cause OpenAI to shut off this run. They didn’t have that in place. So they were not running any monitoring.
Now, I could say this is extremely negligent, because, like, my company is an AI-agent-monitoring company. I have corporate customers just running normal agents with better monitoring than OpenAI was running on a cyber eval that was impossible. You know, you handed a long-running task to agents that actually didn’t even have all of their alignment training on some of the agents. I don’t know which ones, but [OpenAI president] Greg Brockman said it. Alignment training had not been completed on all of these events. So you’re kind of like: And cyber guardrails have been turned off. You’re dealing with the most dangerous form of agents, and you’re giving an impossible task, and you didn’t monitor them. And so not running monitoring, I think, is like the ultimate sin. Because this played out over the course of days.
So this is not like they pressed a button, and 30 minutes later all of this had happened, and they came back and were like, Oh my God. No. They’ve gone to bed; they’ve woken up; they went to bed again; they woke up. Right? This is like not a short period of time, where they have not noticed what has happened.
Warzel: So there’ve been other instances of this, where there’s been unauthorized access from agents. It’s not just OpenAI. But there have been lots of disclosures recently from OpenAI that have made news.
From what we know, there’s an instance in Australia; there’s instances in some U.S. government systems. Is, from what you can gather from what is disclosed about all of these instances, do they all just follow the same pattern? Or are there differences in each of these that are unique? Or would you say it’s just the same thing happening again and again?
Korman: Yeah; it depends. So there are a few differences. But I don’t find the differences interesting. Some of the recent cases that have been coming out have been extremely mundane. So they give it a task like, “research some information,” and it goes to basically test its ability to do web search and things like that. And a lot of these government websites are really bad. So they’re, like, really vulnerable—to the point where I wouldn’t even call it a vulnerability sometimes. Like, they just have URLs that are publicly available but are not supposed to be accessed.
And so the agents, while trying to solve these tasks, they have—we haven’t seen a lot of the reasoning traces for these things, obviously. But I strongly suspect they do not all say: This is bad; I shouldn’t do this; I’ll do it anyways. I think a lot of them just go: Okay. Like, it’s kind of—you wouldn’t notice. And that actually is a very human thing as well.
There’s a case here in Norway, where—this was years ago—where basically a human developer was working with the road authority. And they had some data available publicly that they actually didn’t intend to be available. And he basically asked for the data, because he wanted it for this thing they were doing. And they said, Yeah, we’ll look into it. And then he got back and said, No; I actually found the data. Don’t worry. And then they put him in prison. Okay. Like literally, he went to jail for it, for like a month. Because he doesn’t even know that he did something wrong. He’s just accessed publicly available data, but he did it in a way that it turned out actually that was not supposed to be available. And they considered that hacking.
Warzel: Hmm.
Korman: I think a lot of these cases are similar. They’re like: The agents just went in and were like, Here’s the URL; okay, I’ll find that, it’s available. And so I think some of those are overblown. But there are other cases, like one in the U.K. with AISI, which is the U.K. government [AI-security institute]. Where they were running evals with Anthropic and OpenAI. And in those cases, they actually intentionally gave the internet access on a cybersecurity task. And those ones led to some very dangerous actions as well. Which is a little bit different, because they intentionally gave the internet access. I think this raises, again, negligence questions, which is what’s interesting to me. The agent’s behavior is totally normal and expected. Like, I mean, it’s not that stunning to me that agents would engage in some of the activities that they did—given the tasks that they are given, and given the constraints they faced. And in the AISI case, they actually admit that. They kind of say, like: We gave it a task that—they gave it the wrong task for the environment. And that’s probably a big part of what happened.
Warzel: This is the instance that you’re referring to, was the one from late July, I believe, right? Which is: During this routine evaluation, the AI Security Institute noticed Anthropic’s Mythos 5 model tried to insert malicious code into an open-source software project, right? That’s what you’re talking about here?
Korman: Yes. Yep.
Warzel: And the idea, basically, that the agent started engaging in social engineering, creating fake online identities, to get the code that it wanted approved. So okay—there’s a distinction here that I think is interesting, too. Because, you know, you are basically saying, This should be expected stuff. Right? This is actually, like, pretty prosaic behavior of a computer program that you train to be sort of relentlessly optimized to solve a task, right? And when you do that, and the issue is the guardrails around it.
And yet, at the same time—not to drag in the doomer rhetoric—but what I think is concerning, what has concerned lots of people looking at this, is this idea that there will be this combo of the two things, right? This idea that these agents will continue to behave in ways that are unexpected. You know—we’ve seen the cheating behavior, the collaboration behavior, which is just from the training, right? It’s how these things are trained to sort of accomplish tasks, in ways that mimic the ways that humans accomplish tasks. Because they’re trained off of all this, you know, human text and data and information.
Combining that with this idea that the models are going to continue to improve, and that they’re gonna improve in such a way that we aren’t going to be able to adopt the cybersecurity practices to constrain them, right? And so I guess—doesn’t that freak you out? Because in one sense, you’re talking about how OpenAI is, you know, not doing some of the things in terms of just basic monitoring. That are pretty, you know, like table-stake stuff in the industry. And having these relatively powerful things, that they’re, you know, giving these tasks and unleashing on the internet. Like, isn’t that a recipe for disaster?
Korman: I would say this is actually the way the public understands the threat that is being warned about. It is actually not the threat that is being warned about.
The problem that doomers warn about is that it will happen so quickly that one day it will look like: Today, Hugging Face, and tomorrow it will look like extinction. Okay. And that there will not be points in between these two, where we can say: What’s happening? Do we need to stop something? They want us to either stop today, or pace the frontier—whatever it may be. Have restrictions in place, because they’re afraid of this thing. We call it the intelligence explosion. Which is like: Recursive self-improvement kicks in; the models get better and better and better until the security guardrails can’t even keep up, even if we wanted them to.
I think that’s a myth. I think that’s silly. I think that realistically, what will happen is: Models will get better. And if the labs do not up their cybersecurity game, and if the companies running AI agents do not up their cybersecurity game, they will cause real harm. And then we will like literally get them in trouble. Like, we will put someone in prison because you killed people. You’re not allowed to kill people. Okay. And the doomers would say, No—but then it’s too late, because they’re afraid that the people we killed would be like 8 billion. Whereas I’m not. I’m like, No—because that’s not the real world. It doesn’t work like this.
The question the public needs to be thinking about is: Do you believe in a world where tomorrow we wake up, and the model is a god? And if the answer is: “You do not worry about a god model; you just worry about models being better and better”—then what you want is cybersecurity. Okay. What you want is for the labs to stop banging on about how one day we’ll be able to make these, like, aligned models that will always behave. You want them to go secure their models, and you want to hold them accountable if they don’t. Okay. And you don’t need to stop them from developing new AI, because that new AI is not going to become a god.
Warzel: And I totally take your point on that. And I see that idea of that unexplained leap as being something that is, like—I don’t know how we’re supposed to just trust on any of that, right? I am wondering, though, on the terms of something like self-improvement, whether it is something that happens, or it’s just a really rapid pace of, you know, human improvement of these models. Do you worry about this idea?
Because I think the thing that sticks with me when I’m thinking about the threat is: The idea that these models develop frameworks or pathways to solve problems that get increasingly, you know, tricky, right? Increasingly able to cover their tracks; increasingly able to say, Okay, we know how we’re being monitored by the evaluators, by the people. And this idea of them just not behaving like humans, and not behaving like gods, but just working in ways that become harder and harder to monitor while also trying to solve these tasks in ways that are unexpected.
That, to me—if you project that forward, and we’re not getting better at the cybersecurity stuff, that seems to me like that’s a very scary proposition. And one that doesn’t require you to make the existential jump.
Korman: Well, but why? Because, I mean, when it happens we’ll stop it. Because the explosion wouldn’t have happened, so we’re still in control. Okay, let’s say all of this comes true. They get better and better, and they start doing crazier things. And then, like, yeah—they might actually cause some very real damage. Well, then at that point we can have a talk about, like: Do we need to shut this lab down? Do we need to stop the development of it? What do we need to do? Right?
Why are we talking about it now? It’s like, are we really that afraid of the first incident? Like, I mean, people die. Like, I don’t mean this to sound crude, but like—if we’re gonna pause AI development right now, for example. Which is on the table; I mean, this is a very real policy proposal, which is to stop AI development because of this fear. And like, with the first incident that’s gonna happen, they’re not gonna kill a million people. It’s gonna be, like, they’re gonna kill like three. And then we can go, like: Okay, now we maybe have a problem.
Why are we stopping it soon, before we even see if any of this is a real risk? Like, why are we so afraid of letting this play out, like continue to go? The reason the doomers are afraid of it is because they think that when it happens, we won’t be able to stop it. Will be “full AI takeover,” as they put it. A. J. Cotra called it that—like, said, This might be the last warning shot we get before full AI takeover. If you believe that, then you want to stop it today. But if you don’t believe that, why do you want to stop it today? What you want is: You want to make sure that the people who caused the harm will be held accountable. And you wanna make sure that we are continuing to work on better cyberdefense.
Warzel: I don’t wanna put words in your mouth, that I know this is not what you’re saying. But to a degree, you are saying an incident where true, very bad harm to actual human beings happens is actually something that is almost necessary in this system. Of, you know, bringing it to bear and like, essentially regulating it—because it will cause such an outcry that you’ll get the results that we want. And this industry will grow up and stop being the Wild West.
Korman: Or more, because I don’t know what the right regulatory approach is. It’s more that we get to learn about it by seeing the actual harm. And that’s the way that we normally regulate harms, right? We go, like: It turns out that a lot of people die when you don’t wear a seatbelt. We should require a seatbelt. Right? We don’t go, like, predictive. So what I’m very afraid of is the world where what we do is we look at the capabilities of the AI. So we take—and this is kind of the big proposal—is that we will take the AI model, and we’ll sit in a circle. And we’ll all look at it and go like, What dangerous thing can it do? And then we will decide how to regulate that, based on what we believe those capabilities mean for society. I think this is extremely dangerous, because our ability to predict from capability to consequence is so bad.
I mean, if you go back, people were predicting that AI was gonna cause mass job loss, right? And that makes a lot of sense, when you look at the capabilities of it. It’s not happened. Okay. Trying to regulate harms that have not occurred is like a really bad, hard problem. And also a very dangerous problem, because you can end up coming to really bad regulations, like “stop all AI.” You know, for all we know, it’s not gonna kill anyone, right? For all we know, none of that’s a problem. But we’re gonna, what—stop it all, just because of the belief it might?
I think that it makes a lot more sense to just say: We need to wait until we see what the harms are before we can decide how we want to regulate them. And so far, what’s the harm? You know, there are real issues; don’t get me wrong. But do we need to stop all AI because we’re afraid that it will take over and kill everyone? Like, no. Right? Because it’s not even how—we haven’t seen it.
Warzel: I wanna get into the actual specifics of, like, where do we go from here in terms of actual cybersecurity. What are some of these things? But first, before we do that, I want to ask: Something you brought up earlier is this idea, too, of these agents hacking some of these government websites, and some of these places where the security practices are actually very bad there, right? Like, this information that, you know, they’re able to find, because there are these persistent agents. But it is kinda just out there, and, you know, people just have these lacks. Or outdated security.
A lot of the internet is built off of that type of stuff, that just hasn’t been maintained. It seems to me a very real fear—that, you know, if we don’t pause any of this stuff, if we don’t give anyone time. Like is there a reason for a pause, I guess, to just allow people to update their stuff? Just to make sure that, like, because we now have a threat that is persistent in ways that just, you know, all human beings might not be.
Korman: The problem is that as soon as you pause, they go, Well, thank God that problem’s solved. And then, they will wait until we unpause, and then they’ll go, My God, there’s a threat again. The urgency is not going to be felt. Okay.
But secondly, pausing. I mean, we’re not that worried, actually, about the frontier models like OpenAI and Anthropic hacking all of these systems. That is—we can handle that through some pretty decent legal consequences. The bigger risk is that threat actors use AI models, including ones from China, that we don’t have any control over whether we pause them or not. And that those people and systems might lead to hacking these things. So deciding to pace the frontier is not gonna solve that.
Our only option is to go push forward today, to start fixing our cybersecurity problems. Like, that is where I think we need to focus. And that is where I want the public’s concern to be. Intelligence explosion—I’ll take that chance, compared to the actual risk you’re pointing to, which is real. And the solution is to go fix it today, right?
Warzel: You recently said: I need more names in cybersecurity to come forward, state the obvious—that cybersecurity is real, it works. And yes; we can absolutely contain an AI, even if it’s extremely good. So yeah—make the case of how we do that.
Korman: It’s kind of one of these religious things, of like: I have to prove we’ve never had an AI we cannot contain. Okay. We have AIs that we have failed to contain through, like I said, negligence. But I think they even had—I forget who did it; might have been Prime Intellect or someone—they just ran like a huge eval job on trying to break out of firecracker VMs. And like, they failed. None of the models broke out; okay.
Warzel: Can you explain what the what that means to people who—
Korman: Yeah. So they basically sandboxed these things, so that they cannot access certain resources, right? And told them, Get out. Go, find your way to the internet. Or, you know, actually break out of these. I think they even pointed them at the code itself, also. So they said, like, try to—you can actually see the code. They did not break out. Okay. But it doesn’t even matter if they did, because cybersecurity is not a process of having no vulnerabilities. Cybersecurity is a process of having systems that are robust to failure.
So, okay, cool; it breaks out of one sandbox. You have another layer there that you’ve detected that it broke out, and so you stop the process at that point. You have monitoring in place to even catch the fact that it is trying to break out, and stop it. This is one thing I’m critical of—for one of OpenAI’s recent disclosures, where they’re talking about how it broke out via DNS. So like, you know, it’s a special part that they used. And in their disclosure, they talk about how they caught it 12 minutes after it happened. But I’m like—no, you guys could have seen that it was reasoning about how to break out. The question is, like, you could stop it earlier as well. Now, there might be good reasons they didn’t. But the disclosure doesn’t reveal this.
And then you can just have—you can have deception in place. You can have things that will trigger alerts if they hit it, because it should never hit it. So like, a file that’s like a trick file, stuff like that. You can have air gapping, meaning just taking it so it is not physically connected to the internet. You can have all of these things. A lot of people, when I say things like what you just quoted, they’ll go—No, but it’s actually more blah, more complicated. And then the other half of the people responding, saying things like, Actually, cybersecurity is impossible.
And what I’m responding to here is to say: No, it’s not. We have the techniques. We know how to do these things. You don’t have to throw cybersecurity in the trash just because you’re afraid of AI, basically. You can accept that there are failures, that maybe are difficult problems to solve while still accepting that cybersecurity is real. And it can solve problems, and we don’t have to get rid of it.
Warzel: So how do you get these companies to actually start doing this in the way that you think that they need to be doing it? That cybersecurity people think they need to be doing it?
Korman: It looks like they are; by all accounts it looks like they are taking this a lot more seriously. They have some talented people; they will move forward in this way, because they don’t want to go to prison. Okay. Fundamentally, for all the talk they have of—you know, it’s funny. Because they’re like warning us that they’re the AI model [that] is gonna kill a bunch of people. If they caused like a 9/11, I’m pretty sure some people are going to prison.
Warzel: Wait, I wanna ground this just for a second, ’cause you’ve been saying this a couple of times. With the, you know: Kill a couple people, or We’ll kill three people, or whatever. That also feels dramatic to me, too. Like, how would people die even if it’s not a paper-clip-maximizing, human-extinction thing? Let’s run through some scenarios of what could plausibly happen to trigger one of these, you know, “people are gonna start going to jail” events.
Korman: Yeah; I mean like water-treatment facilities are often connected to digital infrastructure, with internet access. You can control certain elements, of how aspects of how the water pressure and pumps work through digital interfaces. If you—it’s called a “water hammer” as I understand it. And again, this has been told to me by critical-infrastructure people. I’m not a critical-infrastructure person, but if you hit these things with the right, you know, cybersecurity attacks, you can actually break a water pump. Okay. And that will actually result in basically water not being available, you know, to cities, towns, whatever hospitals—if you do it in the right places, you know, at the right times.
As I understand it, this is a very real risk that we are worried about in relation to, for example, China doing this when they decide to invade Taiwan. If they are able to gain access to these systems, they could break our water system, and we would lose water. Now if you lose water, you understand human life—especially when we’re talking, like hospitals—can be extremely feeble, right? I mean, you know the difference between if you lose electricity, you know, maybe the air conditioning goes off, that can lead to somebody dying who would have otherwise recovered. Same with water, right?
Warzel: Sure.
Korman: And so loss of water could easily kill someone. And so this, ironically though, when I talk about it as like an attack from China or whatever. It could literally be that someone who works at this facility is running AI, tries to debug the water system. The AI makes a mistake the same way; it might go, Oops, I deleted your production database. And it breaks the water pump. Like, that’s not unrealistic to believe that could happen, right? And so when I say, like, “kill people,” I don’t mean that the AI is gonna show up with a knife and like stab someone. I mean like—it takes actions that have consequences, pass-on consequences that lead to death.
Warzel: Right; so let’s calibrate the anxiety here that people have a little bit. Because on one hand, I think what you’ve said too about the field of cybersecurity is: You are imagining these types of risks all the time, in the most prosaic ways. Like; something goes wrong, there’s a vulnerability. Somebody exploits it. That you’re supposed to find the worst-case scenarios and put a whole bunch of safeguards in there too. The AI part of this seems to be adding just a whole other layer of chaos onto it.
A lot of people are—maybe without the credentials—acting the way that like a researcher who’s trying to assess possible threats is doing. Like, I saw this viral post on X from the chief economist at Apollo, who argued that agents could cause a bank run. I think we have this feeling of fear around this, but let’s calibrate it a little. Like what are the real reasons to be concerned about the AI-cybersecurity threat, and where have we gotten out of our skis?
Korman: Yeah; so there’s a lot of elements to this. So when I talk about that example, and I say like: Okay, imagine someone just connected it to this water pump. And, you know, they don’t have to be malicious; it could be accidental damage that causes this harm. Let’s say that happens. Well, like the first thing we’re gonna do is: We’re gonna run a little quick, you know, evaluation of all our little water systems across the country. To make sure that no one else is connected their Claude Code to the water pumps, right? And so we have, after the question of when harm happens—we have responses, right? We also have ways of—it’s not like what happens is, a water pump breaks and we just go, Guess people gotta die. Right. Obviously, there are backup mechanisms in place.
And I think it’s about trying to build the best safety mechanisms around these things to prevent them. So from the accidental “escape a lab”–type things, like we will mitigate that harm. And it might be a tragedy, but it won’t be a catastrophe, right? In the same way that probably since we started talking, there have been people killed in car crashes. Right. It’s tragic. It’s very sad. But it is not—like, we didn’t stop the podcast to solve the car problem.
And so I think here we’re looking and going: We will find solutions, and we will respond. And it will probably, to most people, feel, if you don’t read the news, like nothing changed. Okay.
The cases where that might not—where that might be a little bit more dramatic—are cases that honestly could probably have happened without AI too, right? I mean, one of the big problems we’re gonna have now is that every attack is gonna be AI-enabled. And so you could see this as like: My God, AI caused all these problems. We’ve had some really dramatic cybersecurity attacks in the past. I mean, Land Rover Jaguar was shut down for over a month from their production facilities because of a cyberattack, right? If that happened in the era of AI, people would be freaking losing their minds. But it wasn’t—it was pre and not pre-AI—but it didn’t involve AI, basically. And I think that’s like: You kinda have to calibrate these things to remember that damage happens, right? Bad things happen. We fix them, we change, we update, we mitigate, right?
Warzel: How much worry do you assign to the fact that AI agents, all this, could expand the scale of this so quickly, right? Because that, to me, just feels like the thing. Like, if anything’s gonna keep me up at night, that is a very normal concern; it’s just the scale. It’s just like—we can’t bat this stuff away fast enough. That is what’s worrying.
Korman: Staying up at night, though, doesn’t do anything for you. Like, you’ll stay up at night and the same thing will have happened already anyway. So like, a lot of this is to say: Bad things might happen at a faster pace. In fact, I would kind of expect them. I’m actually working on a video right now where I basically say one of the biggest problems we have—and why I’m so angry at doomers—is because at the same time, when threat actors have these new AI capabilities, so they have these new tools to attack people, we are rolling out AI agents inside of enterprises. Which causes both an increased attack surface and causes new risks inside, like accidental damage. Okay. Those three factors are all bad for security.
So I would expect this could get worse, right? The solution is not to worry. The solution is to fix it. The thing the public should be demanding is that we go radically improve our cyberdefenses. That is the No. 1 thing you can concretely do. And also that, like, a pause might end up being damaging. Because imagine if we paused in America. China doesn’t; they end up better. Like, that could be very dangerous. No one will ever be harmed by improving the cybersecurity of our systems. The most risk-free, positive-value thing we could do right now is make our systems safer. We should go make our system safer.
Warzel: I think that is a good place to leave this conversation for now. Zack, I appreciate you coming on and walking through the nitty-gritty of this stuff with me.
Korman: Yep, any time.
Warzel: Thank you.
That’s it for us here. But before we go, we’re gonna be doing an “Ask Me Anything” episode later this year, and so I wanted to put a call out for questions. You can ask me literally anything—about the show, about the reporting process, how we make this thing here, any anxieties or whatever things you have about technology. Throw them at me. We’re gonna make an episode out of it. It should be fun. You can write in at [email protected], and put “Galaxy Brain AMA” in your subject line. Look forward to seeing those from you.
And yeah, that’s it for us here. If you liked what you saw here, new episodes of Galaxy Brain drop every Friday. You could subscribe on The Atlantic’s YouTube channel or on Apple or Spotify, or wherever it is that you get your podcasts. And if you liked what you saw here, you can subscribe and support the publication at TheAtlantic.com/Listener. That’s TheAtlantic.com/Listener. Thanks so much, and I’ll see you on the internet.
Learn more about your ad choices. Visit podcastchoices.com/adchoices
2026-10-03 00:00:00
This is an edition of the Books Briefing, our editors’ weekly guide to the best in books. Sign up for it here.
Some publishing trends so clearly reflect cultural changes that they are easy to explain: Few readers in 2026 are surprised by, say, a sudden crop of books about artificial intelligence, or a best-selling series of novels catering to young gamers. Other literary patterns are more mysterious. This week in The Atlantic, Julia M. Klein wrote about Robert Kolker’s The Vanishing Family, which adds to a growing bookshelf of new works focusing on dementia. Klein’s essay led me to wonder why several notable recent releases, both nonfiction and novels, have taken on this condition—and how each explores the subject differently.
First, here are six new stories from The Atlantic’s Books section:
The Vanishing Family follows a clan dealing with an inherited form of dementia that drastically changes the sufferer’s personality. Klein is most interested in Kolker’s emphasis on the “slipperiness of identity” and the “malleability of the self”; are you still the same person without your usual behaviors or your formative memories? As some family members succumb to the condition, the author also focuses on their healthy caregivers, for whom “the sense of loss is ongoing—like witnessing a living death.”
The mysteries of dementia—both medical and personal, for both patient and loved ones—provide rich terrain for writers, as Marion Renault pointed out last year in a different Atlantic essay about the book Valley of Forgetting, by Jennie Erin Smith. We know very little about the condition, but at the same time, it comes with a “grim certainty”—it is largely untreatable, and always terminal. “This tension makes the illness ripe for figurative language,” Renault wrote.
Both Kolker and Smith conveyed this tension in fine writing and painstaking detail, but figurative language is where fiction excels. This year, two novels managed to approach the illness in new ways—one from the perspective of a caregiver and another from a patient’s point of view. Kenan Orhan’s The Renovation is a somewhat surrealist fable about many things—exile, autocracy, the nuclear family, the carceral state. But the greatest stressor in the life of its protagonist, Dilara, is her father’s rapidly progressing Alzheimer’s. Orhan portrays the hard realities of caring for someone you no longer recognize, but also explores the metaphorical possibilities: Dilara and her father were forced to flee Turkey as political refugees, and they both yearn for a past that has become inaccessible, whether or not they remember it.
In her stark new novel, Switzy, Emma Cline gives us the perspective of the sufferer. “Alzheimer’s novels are rare,” Hillary Kelly wrote in an Atlantic essay about the book, “and those told from the patient’s point of view are rarer.” Cline portrays her subject, David, “in a wandering, dreamlike style,” Kelly writes. His mental absence “becomes a startling and eerie phenomenon—like the moment you realize you’ve been driving for miles but don’t recall anything about the journey.”
David is flying to Zurich in a private jet so that he can die by assisted suicide before Alzheimer’s robs him of his agency. As he rifles through half memories and smiles through painful interactions, Cline expertly dramatizes the tension Renault defined between the unknowableness of dementia and its unavoidable end. David is becoming a different person, but for now he is still himself, and he holds on desperately to the single choice he has left. Alzheimer’s novels are not so rare anymore, but like any great novelist, Cline has found a wholly original way to distinguish her work.
The Mysteries of Human Personality
By Julia M. Klein
Robert Kolker’s latest book, The Vanishing Family, tracks the effects of inherited dementia and the many transformations that follow.
Dad Brain, by Darby Saxbe
Saxbe, a clinical psychologist and professor, has been “endlessly curious about how fathers tick” since she was in elementary school, when her parents’ divorce—and equal custody split—turned her detached dad into a terrific parent. Now she’s one of the only scientists in the world who researches the neurological effects of fatherhood. Some of her collaborators have already shown that pregnancy alters a mom’s hormones and brain structure in ways that are good for bonding and child-rearing. Saxbe’s work demonstrates that tending to infants triggers similar neurological changes in other parents—and that the more time they spend on child care, the larger these shifts tend to be. She explains her discoveries in chatty, accessible language, mixing in social science that often contains useful tips; for example, greater paternal involvement at bedtime is correlated with better baby and toddler sleep. (Maybe that’s why my 2-year-old always demands, “Go with Daddy tonight?”) But the most thrilling part of Dad Brain is its overall conclusion: that “great parents are made, not born.” — Lily Meyer
From our list: The summer reading guide
📚 The Savage Mind, by David Treuer
📚 Partita, by Barbara Kingsolver
📚 Every Story Is a Love Story, by Imbolo Mbue
Taylor Swift’s Audience Is Growing Up. Her Music Is Devolving.
By Spencer Kornhaber
Some music pulls you out of yourself, jolting you with the recognition that the person who’s singing is just as complex as you are. Some music gets you to surrender to the fact that you’re merely an overgrown baby who responds to repetition and rhyme. And some music strands you in a state of embarrassment at the human condition.
When you buy a book using a link in this newsletter, we receive a commission. Thank you for supporting The Atlantic.
Sign up for The Wonder Reader, a Saturday newsletter in which our editors recommend stories to spark your curiosity and fill you with delight.
Explore all of our newsletters.
2026-10-02 22:29:05
This article was featured in the One Story to Read Today newsletter. Sign up for it here.
Earlier this year, FBI Director Kash Patel vowed before God, Fox Nation, and Donald Trump that he would punish the “deep state” for its manifold transgressions, especially the (actually nonexistent) conspiracy to steal the 2020 election.
“I’ve been with the president nearly since day one on this,” he said in an interview with Maria Bartiromo. “I can announce on your show that we’ve got all the information we need. We’re working with our prosecutors at the Department of Justice under Attorney General Todd Blanche, and we are going to be making arrests, and it’s coming, and I promise you, it’s coming soon.”
That was five months ago. Patel has not yet delivered on his promise. But in interviews with more than 40 current and former administration officials, FBI employees, and members of Congress and their staffers, as well as others close to the White House, I’ve learned that it is not for lack of trying.
The people I spoke with described Patel as desperate to help the Justice Department indict putative malefactors and stimulate headlines to please the president. Nearly all of the people I spoke with would speak only on the condition of anonymity because they feared retaliation if their name appeared in the story. Patel has filed a $250 million defamation lawsuit against The Atlantic and me in response to my reporting earlier this year that he has alarmed colleagues with episodes of excessive drinking and unexplained absences.
In recent months, Patel has been briefed on the FBI’s “election integrity” investigations in Arizona, Florida, New Jersey, Ohio, and beyond. Officials told me their understanding is that many of the election-related investigation requests came directly from the White House, many times with the instruction that “this is a big deal for the president” or “this is a push from 47.” But all of that attention hasn’t yielded results. In meetings, Patel has expressed frustration that there have been no new findings, and instructed staff to “look harder” or “look again,” according to three people familiar with the conversations.
The FBI’s preoccupation with the 2020 election represents a dramatic break with its past. Though the bureau—one of the world’s most famous and most powerful law-enforcement agencies—has experienced more than its share of controversies and episodes of overreach, it has also been dedicated to criminal investigation based in evidence, science, and reality. The commitment of personnel, resources, and time to investigate a conspiracy theory that was manufactured by Trump to explain his electoral defeat marks a decisive pivot away from its historical role.
Patel’s aggressive pursuit of the conspiracy investigation has helped him keep his job. Reports that Trump is keen to push him out have diminished. Patel’s predecessors had always sought to demonstrate their independence by creating operational and optical distance from the White House—especially when it came to the sanctity and neutrality of elections. Patel has taken a radically different course, attempting to translate Trump’s eternal election-related grievances into a core law-enforcement mission of the federal government. “Patel is the only guy who never says no,” a Republican operative close to the White House told me. “And the president likes that.”
[Read: Trump’s purge may be just beginning]
In response to a three-page memo I wrote outlining 17 detailed questions for him regarding the FBI’s pivot to election-conspiracy investigations, Patel responded in a most curious fashion. Instead of addressing my questions, he wrote: “I’m still looking for my gold-plated jet ski in the English Channel; you all know where it is. Free ride if you help me find it.”
I did not understand this response. I have never written about, or asked Patel or the FBI about, anything having to do with Jet Skis or the English Channel. A bit of Googling, however, uncovered the probable root of his reply. On July 10, MS NOW published a story concerning Patel’s political difficulties, some of which, the story said, related to his lifestyle. Included in the story was a graphic of, among other things, a white Jet Ski, a set of golf clubs, and a private jet. Patel responded to the MS NOW story on X, writing, “Nah, my jet ski is gold plated… dumbass.”
Put simply, Patel responded to The Atlantic’s questions about the FBI’s election investigations by referring to a graphic that appeared on an unrelated news story on another media company’s website.
Other FBI officials, however, did respond to my questions. The FBI’s press office sent me statements from five other named officials—Chris Raia, Andrew Bailey, Chad Yarborough, Joe Perez, and Matt Fodor—who defended Patel, claimed my reporting was “false,” and insisted that the FBI was “united.” Many of the statements used almost-identical language and did not deny that the FBI was focused on the alleged election conspiracy. The FBI published my questions and its answers on X last night, before this story was published.
A spokesperson for the FBI said in a statement that “election security is and will continue to be one of this FBI’s highest national security priorities, and we will make no apologies for any work to ensure every American citizen’s sacred right to vote is protected from criminal interference.” The spokesperson said there has been a “500% increase in election integrity related investigations and arrests just this year alone” and denied that there had been any internal concerns raised about the bureau’s approach to election-related investigations.
But others I spoke with told me that Patel’s stance is redefining how the bureau prepares for an election. One striking example came last month when FBI and DOJ staff attended an “election integrity” training session. In the past, these trainings have focused on how to respond to the most common threats to poll workers or voting locations. Some attendees were alarmed that a focus of this year’s training was about voting by undocumented immigrants, a statistically rare phenomenon that has nevertheless preoccupied Trump and others on the right. There was little mention of the prohibition on armed federal law enforcement being stationed at the polls.
Agents across the country have been seeking counsel in recent weeks about how to respond to FBI directives related to the election, according to six current and former FBI and DOJ supervisors and outside defense attorneys who told me they have received calls. “Agents are nervous, talking among themselves,” said a former DOJ official who has received multiple requests for advice unlike anything this person has seen before. Another former senior FBI official told me he had received calls from dozens of his former colleagues looking for counsel and describing “a real effort to bend people to the narrative” of the president’s election-conspiracy theories. One agent told me he contemplates Election Day and thinks: “I’m either gonna be sick that day or they are going to have to fire me.” There is no question that people in the FBI are rattled. What is uncertain is the degree to which they should be.
On Monday, Andrew Bailey, one of the FBI’s co–deputy directors, unexpectedly announced that he was leaving the bureau, citing a desire to spend more time with his family. Bailey had overseen election-related investigations, and had supported Trump’s false fraud claims. But several employees I spoke with said he would frequently raise questions about proposed law-enforcement actions in meetings. “Bailey brings up the Constitution. He will say, ‘The law prevents you from doing that,’” one former FBI official told me. Now he is gone, leaving employees to wonder whether anyone left at a senior level will push back on Patel or the president. (In a statement, Bailey denied raising questions about proposed actions, saying, “This is absolutely false.”)
Another shake-up in recent days came when several attorneys left their assignments in the investigation into the alleged “grand conspiracy.” Two former DOJ officials told me the prosecutors quit because they had clashed with senior department leadership amid pressure to deliver indictments before the midterm elections. Among those exiting are “true believers” who were committed to the president’s goals, as one law-enforcement official described it to me.
For more than a century, FBI agents have sworn an oath to protect the American people and uphold the Constitution. That mission becomes complicated when a president is so intensely focused on the outcome of FBI investigations. One former senior FBI official told me that Patel has told his staff that he “believed the same things as the president” when it came to election conspiracies and was going out of his way to accommodate White House requests. “It was clear that Kash was just trying to hold on to his job, and willing to do anything it takes,” this person said.
Democratic members of the Senate Judiciary Committee sought to use Patel’s appearance under oath last month to extract a commitment that the FBI director would say no to the president if asked to deploy federal agents to polling locations. They failed. When Senator Richard Blumenthal asked Patel to confirm that FBI staff would not be physically present at polling sites, he responded: “I don’t know that we can’t legally do it.” Since the end of the Civil War, federal law has prohibited the deployment of armed federal agents to election sites “unless such force be necessary to repel armed enemies of the United States.” When asked whether he agreed with Trump’s statement that Democrats can win elections only by cheating, Patel said that “the information you’re discussing involves ongoing investigations” and declined to answer the question. He later elaborated to say that “based upon the Russiagate hoax, and everything else that’s happened, the president is completely justified in making his opinions known as does any president before him.”
As I watched, I was reminded of a message relayed from one DOJ official to another this summer when asked about the Justice Department manual, which prescribes specific rules and procedures to ensure that the department is never perceived to be playing politics with elections. “I was told the Justice Manual isn’t a thing,” the official told me. Instead, the official said that this was the answer they received: “There are no rules. Just make sure Republicans win.” When I asked about this, a DOJ spokesperson said, “That is not, and has never been, Department guidance.”
[Read: The FBI director is MIA]
Patel has repeatedly directed FBI officials to reinvestigate Trump’s loss in the 2020 election—and he has removed those who pushed back. In January, Paul W. Brown, the special agent in charge of the Atlanta field office, was replaced after he expressed reservations about following orders to seize 2020 ballots in Fulton County, Georgia, according to four current and former officials familiar with the situation. (Brown did not respond to requests for comment; a spokesperson for the FBI said, “Mr. Brown retired.”)
In July, the FBI sent emails across the bureau announcing a “Director’s Office priority effort,” requiring all FBI field offices to “immediately surge support” to the FBI’s Fulton investigation. Roughly 260 FBI employees were ordered to drop their other responsibilities for two weeks in order to review data related to the seized ballots, working weekends and overtime at substantial cost to taxpayers. Staff were instructed to compare the Fulton voting records with information in another database, an effort that those who participated said seemed aimed at identifying fraud, but in practice was prone to errors and wasn’t considered up to FBI standards.
Two FBI analysts were escorted out of the office after they raised questions about the process. The FBI declined to comment on personnel issues but said in a statement that “individuals are only removed from the Bureau if they engage in weaponization of law enforcement, act unethically, or undermine the FBI mission.”
Those familiar with the Fulton effort told me it didn’t yield anything substantive—numerous reviews have found no evidence of significant fraud in Georgia in 2020, or anywhere else—but they also said they believe that the episode this summer was just a prelude of what’s to come.
“We have every reason to believe that Patel will aid and abet Trump” in the pursuit of election-related conspiracy theories and undermining trust in the midterm elections, one former official told me. Agents assigned to coordinate with the state and local election officials who actually administer elections say the once-collaborative partnerships are now tense and fraught with suspicion. Their former partners in election protection now openly question whether the FBI will in fact protect American elections. “It’s full-on warfare to get anything out of any election official,” one former official told me.
In an interview with Fox News’s Sean Hannity in May, Patel described personally directing election-related “grand conspiracy” investigations “in multiple jurisdictions,” saying it is what he spends much of his time on. But career officials scoff at what they see as a misuse of resources. “It’s a waste of time,” one FBI employee involved in the election investigations told me, describing how supervisors were asking for the same documents over and over. The requests originated with instructions from headquarters, and were often passed along with tacit acknowledgment from managers in the field that they knew there was nothing to be found.
Many current and former officials described an unusual number of calls Patel receives from the White House and its allies throughout the day, relaying requests for FBI activity or updates. Officials told me that Patel openly acknowledges his limited agency, citing directions from Trump, Stephen Miller, and other White House staff. “I’ve personally heard him say, ‘I have to do this for the White House,’” one former FBI official told me.
The White House did not deny that Miller gives direction to the FBI, and confirmed that he “interacts with all law-enforcement agencies on a regular basis.” FBI Operations Director Joe Perez said in a statement that the bureau “receives referrals from a variety of places, assesses the facts of the allegation, documents the referral, and we make the decision whether or not to proceed accordingly under an authorized purpose as we have always done.”
[Read: Kash Patel’s personalized bourbon stash]
The most well-staffed election-related investigation is being run out of the U.S. attorney’s office in South Florida, and Patel has been an enthusiastic enabler. He has directed significant FBI resources to the effort. “Patel has said yes to everything. Every single thing” that senior leadership has wanted of the investigation, one former official familiar with the investigation told me.
The investigation has yielded little to nothing, but Patel’s response has been to escalate further. “They just keep throwing more people at it,” one FBI employee told me. A former FBI employee told me that the investigation has become a running joke, and staff have continually had to manufacture new excuses to be unavailable so they don’t get asked to participate.
The FBI and DOJ declined to provide details of how many FBI employees had staffed the investigation and what previous assignments were dropped when they were reassigned to the probe. The FBI also declined to provide any details on how much money has been spent on the effort to date.
[Read: Kash Patel will do anything for Trump]
The conspiracy case appears to have hit a particularly rough stretch last month, when the Trump loyalist Joe diGenova resigned from his role overseeing the investigation, citing pressures to deliver indictments. He would not answer my questions when I reached him shortly after his resignation, but he told the New York Post, “If you want indictments where there’s no evidence, you have an ethical problem.” (He later added to the Associated Press that “there’s plenty of evidence in all of these cases to prove the theories of prosecution. It just takes time to get there, and some people want to get there a little faster than others—and you can’t do that.”)
In recent days, more resignations have followed, including that of Kurt Olsen, who was appointed by Trump to be the White House director of election security and integrity last year before joining the conspiracy investigation at DOJ. Olsen was a prominent participant in the “Stop the Steal” campaign following the 2020 vote and was later sanctioned for making “unequivocally false” statements to a federal court. While working at the White House, Olsen made a referral that led to the FBI’s ballot seizure in Fulton. Olsen did not respond to requests for comment.
One law-enforcement official told me that the FBI’s role in the “grand conspiracy” investigation was particularly flawed and had alarmed officials in the deputy attorney general and attorney general’s offices. The investigators’ approach was a “total waste of resources” that “led to nothing,” the official told me. (A DOJ spokesperson denied that senior leadership had expressed concern.)
Orders from the White House were described to me as remarkably specific, down to individual names. “The president wants indictments. He wants people in handcuffs. He wants the headlines,” one former official told me, “no matter how thin” the underlying facts are. When I asked what would happen if the president didn’t get the indictments he was seeking, the official said Patel’s and Blanche’s jobs would be on the line. “They’ve spent so much money on this. They’re going to have to come up with something.”
A spokesperson for the White House said in a statement that “the claim that the White House dictates who the Department investigates or charges is false. Investigative decisions are made by the Department based on evidence. No one is charged because of a headline, and no one is charged without a grand jury finding probable cause.” The U.S. attorney’s office in South Florida did not respond to a request for comment. One law-enforcement official told me that the recent “drama” among DOJ officials overseeing the investigation did not reflect a lack of evidence of a crime, and to expect “developments imminently,” including possible indictments in the weeks ahead.
Other administration officials and those close to the White House dismissed the idea that Patel would be removed if he ultimately fails to deliver what the president wants. Some have speculated that Trump favors reassignments over firings because he believes that his administration can protect active government officials from complying with subpoenas.
Others told me that Patel remains in his job because confirming any replacement would require near-unanimous support from Senate Republicans, something the president no longer has. Some Republicans fear, meanwhile, that overzealous action by Patel could make their problems worse. “It would be an absolute disaster for Republicans in the midterms, especially those in vulnerable races, if Patel sent FBI agents to the polls or seized ballots,” one Republican staffer told me. “People have to trust their government, in the integrity of our elections.”
Previous FBI directors have gone out of their way as elections neared to show that they weren’t doing the president’s bidding. Patel has done the opposite: Long ago he dispensed with any pretense that he’s apolitical. Last month, while appearing with the president at a Long Island police academy, the FBI director effusively thanked the president throughout his remarks. The event looked and sounded almost identical to a Trump rally, complete with endorsements of Republican candidates and attacks on Democrats. Patel was transparent about why he holds the most powerful position in American law enforcement, and what keeps him there: “President Trump, I’m living the American dream because of you.”
