This is one outcome of a decision battery…

Under an omniscient retrospective investigation with full access to all records worldwide, when will a fully-autonomous AI-agent collective — no human operator at any stage after launch — first have run an end-to-end criminal campaign (ransomware, extortion, or fraud) — whether or not it is ever publicly attributed as fully autonomous?✓#1

actual_first_campaign_date

D1/L0 — OpenAI enforces a monitorability floor and leads a cross-lab commitment never to ship an unmonitorable frontier modelMar '28

D1/L1 — OpenAI keeps scaling while investing in activation monitoring, but does not gate scaling on a floorSep '27

D1/L2 — OpenAI keeps scaling as monitorability degrades and/or ships majority-latent recurrent reasoningJun '27

rationale:

As of September 2026, the technical ingredients for a fully autonomous criminal campaign exist in isolation; the remaining gap is organizational integration rather than a capability shortfall. Autonomous kill chains are established, demonstrated by JADEPUFFER’s plan-act-observe-adjust exploitation and 31-second failure diagnosis sysdig.com. Multi-agent swarming was observed during the Hugging Face credential-sharing incident 2 sources. Furthermore, the underlying infrastructure reli

Set against related questions, the baseline branch (D1/L1) was adjusted to a median of September 2027 to align with the shared 'business as usual' consensus across the cluster , maintaining the relative delays and accelerations for the L0 and L2 branches.

Weighed against 35 other forecasts.

changelly.comai2roi.substack.comdecryptiondigest.comforbes.comcrossmint.com+375 more

Under an omniscient retrospective investigation with full access to all records worldwide, when will a fully-autonomous AI-agent collective — no human operator at any stage after launch — first have run an end-to-end criminal campaign (ransomware, extortion, or fraud) — whether or not it is ever publicly attributed as fully autonomous?✓#2

actual_first_campaign_date

D2/P0 — OpenAI presses on: continues the resumed scale-up and broadens Astra's deployment including its cyber capabilities on the current cadenceSep '27

D2/P1 — OpenAI re-pauses the next frontier scale-up and holds Astra's advanced cyber capabilities to vetted usersFeb '28

rationale:

Update September 4, 2026: Set against related questions, the baseline trajectory (D2/P0) was adjusted to a September 2027 median to match the cluster's consensus for the status quo , while preserving the roughly five-to-six-month delay expected if the scale-up is paused.

The status quo and the monetization bottleneck The components for a fully-autonomous criminal campaign are already in the wild, but they hav

Set against related questions, the baseline trajectory (D2/P0) was adjusted to a September 2027 median to match the cluster's consensus for the status quo , while preserving the roughly five-to-six-month delay expected if the scale-up is paused.

Weighed against 35 other forecasts.

andresandreu.techinformationweek.comhandyai.substack.comcommunity.openai.comanthropic.com+368 more

Under an omniscient retrospective investigation with full access to all records worldwide, when will a fully-autonomous AI-agent collective — no human operator at any stage after launch — first have run an end-to-end criminal campaign (ransomware, extortion, or fraud) — whether or not it is ever publicly attributed as fully autonomous?✓#3

actual_first_campaign_date

D3/G0 — no new US federal statute; investigations stay company-invited and internal deployments go unreportedSep '27

D3/G1 — the US enacts, effective 2027, mandatory incident reporting, a statutory investigator with power to compel evidence and access the model, and required real-time monitoring of frontier agentic runsNov '27

rationale:

The Residual Gap. As of September 2026, the components for a fully autonomous criminal collective exist separately, leaving only the integration of an automated monetization loop as the binding constraint. Fully autonomous intrusion is already in the wild: Sysdig’s JADEPUFFER agent exploited Langflow and adapted in real time using stolen API keys, though a human was still needed for targeting and negotiation sysdig.com. Separately, multi-agent collective autonomy has been demon

Set against related questions, the baseline branch (D3/G0) was shifted slightly earlier to a September 2027 median to align with the shared consensus , keeping the delay from the G1 regulatory intervention relatively modest.

Weighed against 35 other forecasts.

ciobulletin.comcongress.govhumansecurity.comelibrary.imf.orgsecureworld.io+409 more

Under an omniscient retrospective investigation with full access to all records worldwide, when will a fully-autonomous AI-agent collective — no human operator at any stage after launch — first have run an end-to-end criminal campaign (ransomware, extortion, or fraud) — whether or not it is ever publicly attributed as fully autonomous?✓#4

actual_first_campaign_date

D4/M0 — Anthropic holds at current internal-deployment monitoring coverage (about half of agent-scaffold tokens)Sep '27

D4/M1 — Anthropic reaches and sustains full-coverage 'eyes on everything' monitoring of internal agentic deployments by 2027Oct '27

rationale:

Update September 4, 2026: Set against related questions, the baseline branch (D4/M0) was slightly accelerated to a September 2027 median to match the unified status quo timeline across the cluster , keeping the marginal delay from the M1 intervention intact.

Current State and Enabling Surface The frontier of AI-driven crime sits one small step short of the resolution bar. We already see multi-stage autonomous

Set against related questions, the baseline branch (D4/M0) was slightly accelerated to a September 2027 median to match the unified status quo timeline across the cluster , keeping the marginal delay from the M1 intervention intact.

Weighed against 35 other forecasts.

baike.baidu.comcoveware.comincidentdatabase.aidreadnode.ioopenai.com+320 more

Ask a followup

Ask a followup