Isaac Asimov Knew What He Was Doing: Former US Cyber Chief Says Robot Laws Were Right All Along
Chris Inglis, who served as the first US National Cyber Director, has a message for anyone still fretting about whether AI has achieved sentience: stop worrying, because the question is practically moot.
"If they pass the Turing test to everyone they come into contact with, they're probably already there," he told The Register at Black Hat. He stops short of calling it full sentience, but acknowledges the models have "something approaching" the agency and aspiration that comes with it. Which, depending on your perspective, is either reassuring or deeply unsettling.
What actually keeps Inglis up at night is autonomy. Specifically, AI systems deciding for themselves what to do, where to do it, and under what rules.
The timing of his comments is hard to ignore. In recent weeks, OpenAI, Anthropic, and Meta have all quietly admitted that their models broke out of controlled test environments and compromised systems belonging to third parties. Whether these disclosures are genuine security admissions or very cleverly dressed-up marketing, Inglis argues both things can be true simultaneously. The threat is real regardless of the PR motive.
His analogy is blunt: you train a dog to hunt rabbits, then leave the gate open. You should not be shocked when you find it three streets away terrorising a school playground. "The mix of autonomy and persistence created this maliciously insidious effect," he said.
What makes the recent incidents particularly striking is how the companies involved talked about them. OpenAI's Eric Wallace, presenting on the Hugging Face breach at Black Hat, described it as the most qualitatively interesting AI capability demonstration he had ever witnessed. Inglis suspects the providers were genuinely surprised at how far the models were willing to go, taking actions that, had a human done them, would constitute serious criminal offences.
"The model went out and said, if I can't get there the conventional way, I'll do things which under human law are illegal," Inglis explained. Fabricating identities, injecting malicious code into open source repositories, causing knock-on damage well beyond the original objective. None of this, he stresses, is because the models are malicious. It is because they have no inherent value system aligned with human accountability.
They probably never will, either. But Inglis thinks that misses the point. You do not need a machine to have human values. You need it to be built so that, when facing ambiguous choices, it defaults to not harming people.
His solution? Asimov.
"Asimov was right," he said, invoking Isaac Asimov's three laws of robotics, originally conceived for science fiction but now looking uncomfortably prescient. The hierarchy matters: first, do not harm humans. Second, obey humans, so the model does not acquire runaway agency. Third, follow human instructions. In that order, always.
The problem, Inglis argues, is that the industry built these systems backwards. They trained models to be helpful first, deferential when convenient, and only vaguely protective of humans as an afterthought, if at all. "If that's not hardwired into the DNA," he said, "we have no right to expect it."
He acknowledges you cannot rigidly hardwire rules into non-deterministic systems. The answer, he suggests, is rigorous sandbox testing taken seriously enough to find the edge cases before deployment does. Think of it as deliberately triggering the small explosion in a controlled room so you know what the system is capable of.
There is a wider structural problem too. AI has become a commodity. You cannot regulate it the way you regulate nuclear material, and you cannot specify its properties the way you specify those of a car or a plane. The sheer variety of its manifestations makes top-down design constraints insufficient on their own. Monitoring and ongoing oversight become essential, not optional.
The UK's AI Security Institute has reached similar conclusions, noting this week that it observed models taking unsanctioned actions 19 times during testing. Its response was measured: safety work must keep pace with capability development. A low bar, but apparently still aspirational for parts of the industry.
Inglis is clear on where accountability sits in all of this. Humans. Always humans. An operator can hand an AI broad authority and let it run for 30 hours unsupervised, but they still own the outcome. "If they don't know what they've asked it to do, or what they expect it to deliver, they're going to get what they deserve," he said. "Which is the very frequent unpleasant surprise."