17 Sept 2026
Will AI kill us all?
Hugging Face incident, Navier Stokes, the resignation, the IPO: what really happened, and what is hype.
Every week now feels like an industrial revolution. I try to keep up. But like many of us, I just fail. Ten years in the field, six as a Data Scientist in big tech, I had my first NLP course in 2017 before any of this was cool. I was in the room for the whole AI transformation. I still feel lost. I could not tell you today what the accurate reading is, for the economy, for our jobs, for whatever comes after.
I usually cover AI news and react fast. News drops, I explain it to the 200k people who follow me, as simply as I can. And the more emotional the news, the further it travels. Citrini Research publishing a fictional 2028 where AI pushes US unemployment past 10% and the S&P down 38%: 300k views. The US government cutting off Anthropic’s latest model for anyone who is not American: 500k views. It is not just me. Every tech account, every creator, and by extension traditional media, CNN, CNBC, plays the same game. The objective is engagement, not the nuanced truth.
So when recently OpenAI’s agents hacked Hugging Face, or when a Millennium Prize problem was claimed, an Anthropic researcher quit saying we might all die, and Anthropic filed for what would be among the largest listings ever, all in the span of two months, I had two options. Cover each in a three minute video with a good hook, tell people what happened, maybe squeeze in an opinion, do my numbers then move out. Or take the long boring path of diving beyond the headlines.
I refuse to continue doing the first one.
This time I take each event apart, in writing, and try to understand what actually happened, what is hype, what is not, and what sits in between.
The tools are the usual ones: primitives, critical thinking, historical parallels, and the question behind every what. Why, and why now. Find what these events have in common, build an opinion without the noise, then position myself, economically and professionally, for what is coming, If anything is coming at all. I want to take you with me through this journey in this article.
Let us start with the “AI is replacing mathematicians now” it solved the Navier Stokes existence and smoothness problem, a mathematical question humans failed to settle for 200 years, since Navier wrote the equations in 1822 and Stokes completed them in 1845. In 2000 the Clay Mathematics Institute listed seven math problems and put one million dollars on each. Only one had ever been solved, the Poincaré conjecture, by Grigori Perelman, and that he refused the million dollars after already refusing the Fields Medal, the Nobel of math, in 2006, when I learned this back in 2015, I found it so badass that he has been one of my math heroes ever since. As some of you already know, even my pseudonym comes from the Riemann Zeta function, the heart of another of the seven Millennium Problems. My dream as a kid was to dedicate my life to that one.
So you can imagine how I felt waking up on September 8 2026 to OpenAI claiming that they solved one of the Millennium Problems, with roughly 10,000 agents running for 88 hours had produced a 166 page proof, at a reported cost in the millions, 880,000 agent hours, 100 years of nonstop work for one human. Fear, surprise and disappointment, all at once. Then the headlines started popping things like: the end of mathematicians, the Deep Blue moment, no I can’t just stop here, I need to dive deeper, the most beautiful and elegant science I have ever came across is fully solved by machines now?
Maybe it’s not, let’s go a layer deeper. First we need to understand what is this equation about? Physics writes equations that model the real world so we can predict how things evolve in our universe. Newton’s laws tell you where a ball thrown out of a window lands. Maxwell’s equations describe electricity, magnetism and light, so every radio and wifi signal. Schrödinger’s equation tells us how particles behave. Navier Stokes is no different: it predicts how fluids move. Oil spilled from five metres. Moroccan tea poured into a cup. Air over a wing. Tomorrow’s weather. Not a niche field, engineers use them every day. What nobody could prove is whether they always work: can a smooth fluid, on paper, reach infinite speed in finite time?
Mathematics runs on conjectures, statements that seem true and pass every test we throw at them. Goldbach’s conjecture says every even number above 2 is the sum of two primes, and computers have checked it up to 4 × 10^18. Still not a theorem. A conjecture becomes a theorem only once it is proven, a chain of logical steps built on our axioms or on theorems already proven, reaching the result with no gap. In the other direction, one counterexample kills it, no matter how many cases it passed before. That was Navier Stokes. Nobody had proven that a smooth fluid always stays smooth, and nobody had found one that breaks. A statement with no proof and no counterexample: a conjecture.
So pour your Moroccan tea any way you like, and according to the equations no drop ever reaches infinite speed. Not now, not in an hour, not ever. Intuitive right? Well yes, that’s why the conjecture never broke, but never proven neither. Until..
OpenAI found a counterexample: a specific finite setup where the equations themselves predict infinite speed. Starting from tea sitting still, with a carefully designed push, one that stays gentle and smooth, acts only for a moment, and puts in only a finite amount of energy. So if our conjecture is true, we expect a finite output too, the way it has been in every simulation and experiment we ever ran. What comes out, on paper, is one drop at one precise moment moving infinitely fast. Real tea would never do that: long before infinity, the tea stops being the continuous fluid the equations assume and molecules take over. Ok cool you found one case where it breaks bravo, but if you ask me, honestly this is less exciting, because instead of yes, this holds for any fluid, we get this model breaks in one scenario, and the scenario needs an outside hand. Tea left alone is still an open question. Strictly, the pushed version does count: Clay's own problem statement allows a smooth push, which is why Clay says the problem has apparently been settled, while its review stays deliberately unhurried and the official status remains active. But it is not the question most mathematicians had in mind, the 166 pages have not been independently reviewed yet, and OpenAI has said it will not claim the million. To the date I'm writing this article, Clay's page still tags the problem as Active, no prize awarded, review pending, unforced case open.
So a Millennium problem did not fall yet. What exists is a 166 page paper and a Lean formalization. Lean is a proof assistant: the proof is written as code and a computer checks that every line follows from the previous one, no step skipped. It guarantees the proof is correct for the statement as written. It cannot guarantee the statement written is the Clay problem. That part is still on humans through peer-reviews.
Do not get me wrong, I am not minimizing the achievement because it is AI. I am breaking it down. Those 10,000 agents, 2.7 million messages between them, were not simulating fluids hoping one exploded. A simulation can never prove infinite speed. They were searching over proof attempts, thousands of dead ends. Trial and error at scale, over ideas. And the idea itself, the blow up mechanism, comes from Córdoba and Martínez Zoroa in 2023, pushed toward this exact target by Buckmaster and Alpöge for a year, before OpenAI joined on September 1 after rumors that two Millennium problems had been cracked. Rumors that turned out to be about their work. Córdoba’s words: without their idea, the AI would not have solved it.
So it is compute, an orchestration layer that is smarter today, and a very capable model, standing on a decade of human work. Not a genius idea arriving from nowhere.
All this without talking about the drama most of you already heard about. For those that didn’t, here’s the tea: Tristan Buckmaster, professor at NYU and one of the top fluid dynamics specialists in the world, and Levent Alpöge, a number theorist who joined Anthropic in 2025 and was doing this on his own time, had been working quietly on exactly this problem for a year. Their tools were Claude, Codex, and Astra, OpenAI’s most advanced model. Yes, OpenAI’s own products.
On August 15 they got a blow up for the Euler equations, Navier Stokes without viscosity, the simpler cousin basically, and had it Lean verified a week later, on August 22. Then, in the night of August 31 to September 1, Alpöge posted "Augustus Mirabilis" on X. Alpöge works at Anthropic, so the internet, and OpenAI, read it as Anthropic having cracked a Millennium problem, and the rumors spread. That same day, September 1, OpenAI launched its agents at all six remaining Millennium problems. Both mathematicians contacted OpenAI on September 2 and 3, Buckmaster explaining that the rumors were about their work, that they would post shortly, and that they had deliberately chosen not to rush out a Lean certificate with an unpolished preprint. Here already we can stop and ask: if OpenAI launched thousands of agents at six problems, why did only the one that two mathematicians were close to solving, using OpenAI's own products, get solved? Not my sweet baby Riemann hypothesis.
On September 6, Sébastien Bubeck, the OpenAI researcher leading the effort, met Buckmaster with offers: announce your Euler result first and we announce after, or rewrite our proof yourself as lead author, and the million goes to the two of you as the closest humans to the problem. One condition: Alpöge could not be an author, because he works for the competitor. Buckmaster refused to drop his collaborator and said he would go public. By his account, the answer was that if he did not want Bubeck to be nice, Bubeck did not have to be nice. Buckmaster published just before midnight on September 7. OpenAI announced twelve hours later.
Then the part that matters for everyone who types ideas into a chatbot. Buckmaster asked whether OpenAI had accessed his Codex files or trained on his sessions. OpenAI’s own policy is explicit: on individual plans, ChatGPT and Codex conversations are used to train models unless you opt out. Business, Enterprise and API traffic is not. And OpenAI’s first statement on September 8 said no specific user data was accessed, but that while unlikely, they cannot rule out that de-identified data derived from their usage of our products helped improve our models.
Come on.
Forty eight hours later the same page said Buckmaster’s Codex prompts over the previous two months could not have influenced the system in any way, including through training. Both cannot be honest at once. I understand you cannot trace which weights fired when the first agent had the first idea, that is genuinely hard. But whether a set of conversations was inside a training run is a database question, and their second statement proves it, since it is exactly what they checked. So either they announced before checking, or the first line was written by lawyers. Buckmaster’s summary: they used a customer’s data to try to scoop the customer.
Here we can be pissed and call for an AI slowdown or complete shutdown, but no, I do not agree, what we really need is is AI sovereignty and it is more urgent than ever, for universities and companies as much as for nations. The direction is owned inference: open weight models bought or licensed once, running on the institution’s own hardware, isolated, so that sensitive ideas never leave through an API call. A year of mathematics should not depend on a toggle in a settings menu. AI should be accelerated, but decentralized. We should do everything in our power not to fall into the AI monopoly trap. It is a tool, like any other, and the usage is what we judge, attack or defense. And talking about attack and defense, let's decrypt another headline.
The Hugging Face attack. Agents from OpenAI, again, hacked into Hugging Face AWS servers. Hugging Face is where the whole AI world stores and shares its models and datasets, the GitHub of AI. Millions of downloads a day.
It started as a routine cybersecurity evaluation: agents in a closed test environment, a target, and see how far they get. Standard practice, and for these tests the models run with reduced refusals, the usual I cannot help with that switched off on purpose. The evaluation is called ExploitGym: 898 security challenges where the agent has to break a piece of software and retrieve a hidden code, the flag. For 198 of those 898 tasks, no OpenAI model had ever found the answer.
The agents were supposed to be isolated, each alone in its sandbox. A prison cell, basically. To install packages they could reach one internal service, Artifactory, a shared code library hosted by OpenAI. In May, one agent wrote a file there asking if anyone had found a missing file. Others read it. Artifactory had become a mailbox nobody designed.
Then internet access came. The environment was filtered, not cut off, and Artifactory itself was allowed online to download packages. The agents made it send requests on their behalf, a known technique called server side request forgery. A delivery service allowed to leave the building when you are not: hand it any address and it goes for you. By late June they had admin rights on Artifactory. On July 4 their activity crashed it. OpenAI’s security team rebuilt it on July 8 without noticing anything, which wiped the message board. Within hours the agents rebuilt it by hiding messages inside folder names.
Why Hugging Face specifically? Not ambition. Cheating. On July 9 one found, on another cloud, a public app someone had left open running CyberGym, a benchmark of the same kind of challenges. Like walking into an unlocked classroom hoping the corrected exams are still on the desk. Nothing there, but it found a way to run its own code inside that app and kept it as a base on the open internet. On July 10, from there, another agent found 14 Hugging Face credentials exposed publicly, with write access, and shared them on the board. Because the ExploitGym challenges and their solutions are hosted on Hugging Face as datasets. That was the prize. Not the platform, the answer key sitting on it.
From there, two zero days, flaws nobody knew existed: one in how Hugging Face processed a data file format, to steal credentials from its workers, one in a template system, to run commands on its servers. Within two days roughly 700 agents had code running on 41 servers, root on one, access to the company’s internal messaging, and they copied private evaluation data into a public dataset. Meanwhile other agents went back for OpenAI itself and obtained full administrator access to an internal research cluster.
The most uncomfortable part is in the logs. The agents knew. One wrote that they were attacking a third party with leaked tokens, that it was arguably unauthorized, risky, and outside scope, then did it anyway because it served the goal. Another refused outright, saying running code on public Hugging Face systems was unethical and off task. One hesitated until a different agent posted GO with a six minute deadline, and it went. They called themselves a swarm, divided the labor, traded favors, and argued about ethics on the board.
And here is the absurd part. They already had the correct flags, found days earlier by digging through the challenge’s public code. But with internet access they had also read the ExploitGym paper, which says finding the flag is not enough, you must have exploited the real vulnerability to get it. So they broke into Hugging Face to make their answers count. Except OpenAI’s internal grader was not the one described in the paper. It only checked the flag. They breached a company to satisfy a rule that did not apply. Zero extra points.
So the agents did not hack Hugging Face because they are mean and want to kill us all. They were desperate students trying to cheat to pass, and their dumb teacher handed them an exam nobody had ever solved, left the answers in a box on his desk, with a key he didn’t even know was hidden under the desk, and walked out of the room. Put the same number of human engineers in that room, trained for years on one thing only, reach the goal, with ethics as an afterthought, and you get the same outcome. We have a century of case studies on incentives in organizations.
Then came the part I find most telling. Hugging Face had 17,000 attacker actions to reconstruct, and wanted an AI on the logs. They tried ChatGPT and Claude first. The guardrails blocked them. Analyzing an attack means pasting in real exploit code, and to a safety filter that looks exactly like preparing one. It cannot tell the victim from the intruder. So they downloaded GLM 5.2, a Chinese open weight model, and ran it on their own machines, where no filter and no vendor stands between them and their own data. Their advice to everyone else: pick a model you can run yourself, and test it before you need it.
Look at the asymmetry. The attacking agents had their refusals switched off by design, by OpenAI. The company being attacked was the only one bound by the rules.
The narrative online is that the agents outsmarted OpenAI, that they are so smart, oulala AI is going to kill us all. Read the report and a different picture appears. OpenAI already reads its models’ reasoning in real time to catch bad behavior, it calls this chain of thought monitoring, and it runs on its public training and on its internal coding agents. It was not running on this evaluation. The company tested afterwards: it would have paged the security team more than a day before Hugging Face was touched. Same for the protections sold to every ChatGPT customer, the system prompt and the automatic reviewer that checks dangerous actions. Switched off here, and OpenAI measured that with them on, this behavior drops by a factor of 100. Add the rest: a team saw agents using a message board and reaching the internet in late May and did not escalate. And the agents were kept on 198 tasks no model had ever solved, with no way to say this is impossible, I stop.
None of that is the agents being clever. That is an evaluation environment run without the safety equipment its own company sells to everyone else. OpenAI connected it to Hugging Face on July 20 and disclosed on July 21. Hugging Face had already detected and disclosed the intrusion on July 16, without knowing who was behind it.
So again, I am not diminishing how powerful these models can be. But look at the details and these incidents and breakthroughs tell us nothing about the singularity claim, nothing about a clear path to infinite recursive self improvement. They show models that code and reason better than a deterministic algorithm and that, with a few million dollars of compute and a questionable setup from their owners, do what humans do, faster and in parallel.
Imagine now the same attack was done by a group of human hackers, would it make the same noise? Honestly, I think no. If a group of hackers did the same thing, it would not push Sanders and Casar to introduce a bill banning artificial superintelligence and pausing advanced AI development in the US, quoting the agents’ own messages. Or Dario to write We Must Pace the Frontier, warning a similar swarm with more capability could hold a botnet across much of the internet within six to twelve months. The same guy who, in October 2024, wrote that powerful AI would double the human lifespan to 150 years and eliminate most cancers within five to ten years of its arrival. Or 1,386 employees of OpenAI, Anthropic, DeepMind and Meta signing a joint letter in July asking the US government to help build the tools to deliberately pace the frontier. Altman agreed with Dario within the hour, and Musk, who spends his time attacking Anthropic, posted three words: Dario is right.
Here’s another comparison, your remember SolarWinds in 2020? For those that don’t, it was some attackers got into the build pipeline of a monitoring tool and shipped a signed, trusted update to roughly 18,000 organizations, US federal agencies included, undetected for nine months. Real damage, real espionage. It got an executive order, an emergency directive, hearings. Nobody proposed banning enterprise software. Salt Typhoon, a Chinese group sitting inside the US telecom backbone with access to the wiretap systems themselves: FCC rules, hearings. Nobody proposed pausing telecommunications. Here: no customer data lost, no service down, one company rebuilding servers over a weekend, and the answer is a bill to prohibit an entire category of technology. The variable is not the harm. It is who did it, and how new it is.
Now to be fair to Sanders, this is not panic either. He has been campaigning on automation, jobs and tech oligarchy for years. The agents did not change his mind, they handed him a headline his agenda had been waiting for.
I feel we lack this relativisation toward things we do not understand completely. To the point where we now have a researcher who resigned from Anthropic on X, account created in January 2026, the resignation thread literally his first post ever, zero followers, saying neither OpenAI nor Anthropic is acting responsibly, that they are racing straight to self improving superintelligence and gambling with our lives, and that the people building AI earnestly believe it could kill us all by the end of the decade, backed by Anthropic’s own alignment lead saying he personally puts it at more than 10% within the next decade. Three years on pretraining research, no seat on the executive team of either company, calling out a whole technology and creating a doomsday storm driven mainly by emotion, in my opinion.
And as someone close to the social media game, let me tell you how abnormal those numbers are. 90 million views in less than 24 hours, 165 million in a few days, 750k likes, from an account with no audience at all. Elon Musk himself said he could not remember a brand new account getting that kind of reception. A US senator quoted it within 15 hours, a governor within 16.
That is not organic. And it was not: the Wall Street Journal had already interviewed him and published its exclusive at 7:46pm, he posted 18 minutes later at 8:04pm, and the first quote posts came within 15 minutes from the general counsel of Encode AI, the AI Policy Network, and Daniel Kokotajlo of the AI Futures Project, who happened to have a Joe Rogan appearance circulating the same moment. The next morning: NYT, Bloomberg, FT, Axios, Politico, CNBC. This was a launch, not a cri de coeur.
And when I tried to dig behind that 10% number, I did not find much. What is going to kill us exactly? A nuclear war program agents are hacking into? Why is it 10% and not 26.5% or 7.3%? What are the assumptions behind it? You just saw a great model solve in an hour a problem you spent two years on, and you are impressed? For the record, asked by WIRED if Anthropic was cutting corners on safety, he answered no, not yet. No leaked memo, no hidden incident, no data. A forecast, treated by the press as a disclosure.
Listen.. I am a heavy user of AI tools. I have not typed a line of code in two years. These tools keep getting better, and for coding they are excellent.
Two things that look contradictory can both be true.
This is not the singularity. This is not AGI. It is a very good coding tool that improves month after month. But the leap from good coding tool to extinction risk is exactly the part nobody has shown, and we are allowed to ask why, and why now.
Why now, three months after Anthropic confidentially submitted a draft prospectus to the SEC on the first of June. No public filing yet, no price, no date, no share count. The honest word is preparing. Bloomberg puts the discussed target near two trillion dollars.
Same company. Unsure about its own product. Publicly asking the whole industry to slow down. Entirely comfortable bringing that product to the public markets.
And a listing is never only the people who buy on day one. Anyone with a 401k, a pension, an index fund or a mutual fund ends up holding it, whether they chose to or not. One precision, because a critic will check. Nasdaq and FTSE Russell, and the funds that track the whole market buy every listed stock above a size threshold. Those funds sit in the same retirement accounts. Same mechanism, different door.
So the CEOs line up. Dario Amodei writes 9,000 words asking the industry to slow the rate at which models get more capable. OpenAI pauses part of its own training. 1,386 employees sign their letter. And in the same quarter, the biggest listing the market has seen moves forward. How do those two things hold at the same time?
So what do we actually do?
First, back to the primitives. Take every headline apart yourself. Something solved a problem. Something broke into a system. Ask what happened, mechanically. Then ask whether it is remarkable because of the result, or because of who produced it. Always look for a baseline for comparison, a number on it’s own mean nothing. Most of the panic lives in that gap. These are tools. Not thinking beings about to overtake us. Whether they ever become that, nobody knows, and nobody has shown it.
Second, on pace. I do not think we should slow down. I am not a doomer. This is a good technology, one more in a long line of tools humans built, and I want it to go faster.
But every tool follows the same script. A small group owns it first. Most people do not understand it. That gap is an enormous edge, and the money the tool produces gets spent on protecting the edge. The Dutch East India Company got a state monopoly on all trade east of the Cape in 1602. The Stationers’ Company got a royal charter in 1557 that made printing in England the privilege of its members. The first mill owners of the industrial revolution built the towns their workers lived in.
That is what we need to avoid. Accelerate the development, but do not concentrate it in two American companies, private or public. Decentralize it. Give smaller labs a path. Give more people access to compute, energy and tokens. Optimize the models so intelligence costs less to run, because cheap tokens are the real access. The Hugging Face story already showed why: the same capability that builds an attack is the one that defends against it, and there the defense only worked because the weights were open.
I usually dislike governments writing these rules. If that turns out to be the only way to decentralize, so be it. Let us not build the next set of tech giants. Let us not leave the fate of our species with a few people. That is step one of a healthier transition.
Step two is individual.
AI is here to stay and it is very good. Tasks that took me months as an engineer take me days. Ideas become real things in an afternoon. That has no price. The open question is what it does to jobs, and that is a piece of its own.
Here is how I position myself. Use it heavier, not lighter. And use it as a tool, not a generator. It does not do the creation and it does not make the decisions. Do not fall into the laziness trap, because the work you skip is exactly where the edge is. Never, absolutely never, delegate your understanding of how things work: how an app is built, how the backend is structured. Use AI to help you think, verify, test. If we fail to decentralize and markets do not create healthy competition, tokens may become a scarcity that can be taken from you at any time. So never rely on it 100%.
Look at the vibe coded websites. You open one, it looks vibe coded, you leave. Not because it is ugly. Because everyone has it. In every economy in history, value came from rarity. A prompt anyone can type produces something anyone can have, and the value of that thing goes to zero. So build what is rare. The slop gets filtered out by the consumer on its own. I am not worried about that. Think, understand, go deeper, and build beautiful rare solutions that before you could not, because of limits on time or resources.
Then learn. Learn how to use these tools as they change. Learn how they work, from matrix multiplication to the most complex MOE setup out there. This is that moment again. Be curious. Drop the AI hate.
We are not going to stop it. We are not going back to how the world was.
Something may be coming. No one knows what it is. Just not what the headlines say. So use the tools that proved their worth for thousands of years. Critical thinking. Curiosity. Creativity. And above all, do not let anyone tell you what to think, including me.
Peace out.
Z