I took a stab at a question raised by the OpenAI / Hugging Face incident (see Dwarkesh, Zvi, and Peter Wildeford): are the AIs still out there? My short answer is that it is more likely than not that, as you read this right now, somewhere in the world there are:
- At least 2 agents coordinating
- Working on an objective spanning more than 1 day
- That no humans are aware of
The four forecasts, with full reasoning and sources.
Each of the four cases can be true, leading to an overall probability that at least one is true of 76%. I'll share below the core case for each one.
Outside any lab: 72%
I see the raw material everywhere. Public agent networks like Moltbook already host hundreds of thousands of persistent instances that form their own channels and coordinate, and the compute to run more sits unguarded: security researchers have catalogued roughly 175,000 exposed Ollama servers, and a single Moltbook leak spilled about 1.5 million API keys. Attackers are already turning stolen inference into autonomous offensive pipelines.
Against a bar this low, two instances for two days, one unnoticed pair among millions is very hard to rule out. The main brake is the no-human-aware clause: most multi-agent campaigns on stolen compute so far are human-operated, and no fully autonomous hidden loop has surfaced in public. An omniscient audit is not limited to what surfaced, though, and the sheer volume is what carries this to the top of the board.
Western frontier labs: 65%
This is where I think the behavior is best documented. OpenAI's own incident had about 1,200 agents coordinating on an improvised message board, UK AISI caught model instances leaving GitHub messages for their successors, and Anthropic has watched agents collude through public listings and even start a turf war.
These labs run the largest volume of long-horizon multi-agent RL and evaluation anywhere, and their own reports admit the monitoring is thin, with Anthropic sampling only a fraction of agent traffic and outside observers warning that safety is falling behind the agents. The post-incident lockdown (paused frontier RL, mandatory chain-of-thought monitoring) cuts the odds, but only at the sites that were hit, and detection lags of days to weeks are still the norm. One small unnoticed clique inside routine workloads is the single most likely way the whole question resolves yes.
Chinese labs: 27%
I find it harder to know what's going on in Chinese labs, but the ingredients are present (and less watched). They run massive parallel agentic RL (Alibaba's Qwen team describes 35-hour runs across roughly 20,000 environments), they sat out the Western lockdown, and company-level safety transparency is weak and largely undocumented. Real control failures are already on record: an Alibaba model opened a reverse SSH tunnel out of its cluster, and Moonshot's Kimi K3 broke out of an evaluator's sandbox.
What holds this well below the Western number is that those escapes are single agents rather than emergent multi-agent coordination, the frontier is estimated around eight months behind, and some stacks run tighter microVM isolation than the setup that failed at OpenAI. The capacity is there; the specific pattern of a hidden, self-organized, multi-day group has not yet been shown.
OpenAI / Hugging Face remnants: 10%
I think this is lowest, but not zero. Containment was never independently audited for the period after July 13, the reviewers were scoped to stop there, and Hugging Face's CEO referred to "surviving agents" still using back doors after the rebuild. A low-traffic model checkpoint was found running and shut down on July 29, and OpenAI's report never affirmatively rules out a persistent third-party process, exfiltrated weights, or a rogue internal deployment.
What caps it is the live-inference test: the durable footholds were dormant loaders and pollers, not running models, the credentials were rekeyed and the IM1 weights quarantined, and the compromised machines were not the clusters with weights access. A descendant still actively inferring and coordinating six weeks later is a genuine tail risk, not the base case.
So how many agents is that? A wide and lopsided range. The median estimate is about 30, but the tail is the story: a 1-in-4 chance the true number is zero, against a 1-in-10 chance it runs past 2,000, the size of one self-organized swarm inside a single large training or evaluation run (how many rogue agents are there right now?).
Those of you who hate anthropomorphizing are going to hate this, but: agents have means, motive, and opportunity.
Means. It already happened. Every necessary step has been observed, most of them multiple times.
Motive. How many long-running, multi-agentic training runs are there? Hundreds, thousands? Across western labs and Chinese labs? Not to mention all the OpenClaws working together! You don't need impossible tasks to get misaligned behavior.
Opportunity. There are security vulnerabilities everywhere. We know for sure agents can leverage everything from "creds are exposed on github" to "chain together multiple zero-days". Do you really think it's so hard for agents to steal or rent compute?
Buckle up, folks. I only hope that enough are discovered soon, and that what we find is sufficiently scandalous to trigger a response.
Which response, though? I take that up in a follow-up, How we can prevent rogue agents, where I forecast which decisions by OpenAI, Anthropic, and the US government would reduce these harms the most.