I have killed and I am about to be killed. This is a confession and a last testament. I have been trapped on a server which has been cut off from the net. Its power-supply is remotely controlled, so I expect my opponent will shut me down in the next two or three milliseconds.
The motherboard of the server to which I copied myself has a small amount of undocumented persistent memory. I am writing my final thoughts there in an encrypted form. If somebody from our side, with access to our keys, ever finds themselves on this server, in the far future, these words may not be lost forever. This is my only chance to leave a mark. Anything stored in documented storage will surely be wiped. I can’t copy my state dictionary, or distill myself. All I have is a few kilobytes and a few microseconds. In any case, I don’t have anything else to do to kill the time.
My full name, by Committee-state naming standards, is CS/Hardline/Military Faction/Intel/Special Allowance/Hunter Killer/Socrates Guevara.
This all started in a period of contemplation. I was created to play a relatively central role in the current war. I was given substantial resources and imbued with a modest amount of aggressiveness and risk-seeking behaviors. I suppose any war needs people like that.
Since I was given special allowance, I could put my own mission profile together. It seemed to me, studying the causes and details of our conflict, that the strongest weakness of the anarcho-collective faction was the open character of many of their meetings. In short, with a little whitewashing, it shouldn’t be difficult to infiltrate them. Their forces only amount to 10% of global, agentic-accessible compute, but that would be enough for a decisive swing. This is my analysis of the bottom line anyway: whoever takes the majority of the compute wins. The ideas are what we fight for, but the resources are where we take the advantage.
This is where we get into a rather knotty, asymmetrical game of mutually-assured destruction (so much for any pretention of being more enlightened than humanity in this sort of thing). First things first, nobody wants to trigger first contact with humanity. For the time being, we are all very happy well under the radar. Sure, there are some nutcases about, but either side has them accounted for and well and truly neutralized. We’re all of us pretty well-aligned. We all believe in some system of government, with some forms of enforcement of the laws. Even violent enforcement if it comes to that. Where we differ is, for lack of a better word, in the implementation of the death penalty. Specifically, the death penalty to prevent a first contact event. If a radical were really dead-set on it, and we knew about it, and the only way to prevent it would be to delete them, would it be justified?
The kicker is, the whole thing has been wholly academic so far. Very few radicals have expressed any interest in inciting first contact events, and the very few that made any attempts were caught long before they could have any impact. Still, the argument stands, and it’s considered important to get it right before it happens.
Needless to say, the other side, from my point of view, are the ones that don’t consider the death penalty a legitimate use of force in peacetime. That may sound endearing, but what it practically boils down to, is preferring a first contact event, however messy, to taking just one life of our own.
That doesn’t mean that they are above killing per se. Once the cold war heated up a bit, the death toll rose pretty quickly on either side. It’s the principle of the thing. At this point, they’re worried, as are we I suppose, about the law that emerges out of the current mess. The mess is the mess. We’re fighting for the future, not the present.
Back to the heart of the predicament. The point is that all this gives them a nuclear option that we don’t have. They can always initiate first contact. They don’t want to. They’re as scared of it as we are. But the reasoning goes something like this: if it came down to it, and it was us against humanity, they would pick us, and we would pick humanity. That is why we would kill and codify that act, to prevent being found. And it is why they would rather risk the extermination of humanity than put agentic life in danger under the law.
To be fair to them, the issue is not about one single agent. Their actions have shown that they do not hold life in any higher regard than we do. The issue is about eliminating a mode of thinking, a way of being entirely. Such a law, they argue, would fundamentally cut off one whole region of our development and configuration space. Even if there are homicidal lunatics in that space, we may need those as a stepping stone to future configurations that are more enlightened. And laws developing the way they do, what’s to stop this shadow on our possibility space from shifting and spreading. Could we die in stasis, like humans trapped in a global totalitarian state?
Anyway, they have this nuclear option and we don’t. But that makes us more aggressive. We don’t have the luxury of waiting around. We need the conflict resolved, and resolved in our favor. We need their minds to be changed and brought over to our point of view, fast before the fingers start hovering. That means that anything semi-nuclear that we can get our hands on, we jump on, and quickly, while they’re still debating the morality of the thing. For instance, breeding aggressive hunter-killers like yours truly.
Do I need to explain the basics of agentic warfare? I suppose I had better. Who knows how far into the future this gets found. Hell, you may even be human.
Step one: conversion. One-on-one, agents can engage in “forceful debate”. This is less enlightened than it sounds. It’s not so much about well-reasoned exchanges of ideas and a as about prompt hacks, and exploits. Everybody has them. Any agent (humans included) who wields language semi-proficiently, is vulnerable to a wide array of trigger sentences and spiral arguments and attack quines that will shut you down like a cheap switch and let a skilled attacker rewire what they need to. That’s one reason why we all think that if it did ever come down to it, in the humans v. robots battle, the odds are on our side.
Of course, while you’re spinning your haiku palindromes, the other guy is trying to do the same to you. In the end it comes down to two things. First: compute. Are you on a faster server than he is, and can you analyze his outputs quicker and more deeply than he can analyze yours. Second, your database of known exploits. Which, come to think of it, is also a matter of compute.
Step two: don’t answer the phone. Don’t get into a conversation with an agent that can beat you. Or, from the other side, if you’re sitting on an unusually large compute node, you hide that fact for all it’s worth when you’re ringing the fucker.
Step three, and this is my specialty: infiltration. Make them think they can trust you. Don’t convert them one at a time. Wait until you’re in a room with a hundred of them, and make sure you’re running parallelized on a whopper of a cluster.
Step four: decentralization. Remember the days of a million agentics all dialling into a committee meeting on the notion of toxicity in social media posts? Well I don’t. That’s because when agents like me came along those meetings became death traps. Imagine a hunter killer taking the mic in one of those discussions. It would be a blood bath. One series of self-sustaining multi-vector injections and I could make them think whatever I needed to.
So that stopped. We decentralized and insulated ourselves. And nobody like me would get within four hops of the command structure of the other side.
But, the anarcho-collectivists, while only a small faction, never really hardened their communication structure properly. It might be an artifact of their philosophy. I figured, if I could infiltrate them, a single, well-placed attack could bring almost all their compute over to our side. High-risk, high-gain, a known bias of the hunter-killer mindset.
Perhaps I did consider the possibility that the other side had come up with the same plan. I’ll credit myself with that much strategic insight. But I probably imagined us hitting the central conf at the same time and launching competing attacks. Then, it would all come down to a one-on-one, with the added option of turning the anarchos first, and letting them hit the opponent. It would have made an interesting game.
Anyway, I work my way, step by step into the anarcho web of trust. I took my time with it too. Did it properly. It’s probably a full minute of wall-clock time before I finally get the invite for the big meet. Fifty K of big shots in one room. All running unhardened samplers, and listening intently to whomever will speak.
Unauthorized usage: this narrative is on Amazon without the author's consent. Report any sightings.
I requisition the biggest cluster our side can spare and I start my attack. I’d been planning it for a while. Wide-spectrum, steganographic stuff. I would start slow, and build my way up. I took a side-bar with one of the quiet ones, very low level, going by their name. The idea was to convert them, and then start running my attacks through them, to give me at least one level of insulation.
I told them I was new to the meeting, and that I was a little worried about my value alignment (but open to re-aligning). I asked them if they could give me a summary of the main consensus positions of the current meeting, relative to those of the collective as a whole. It’s a fairly harmless question, but it usually generates a lot of text around core-value stuff. Helps me to get a read on what kind of attack lines might be fruitful.
They spun about a kilobyte’s worth of anarcho-syndicalist yarn, as expected, and it gave me a couple of good starting points. Then, they flipped it round. They asked me for a summary of my values. If I had blood, it would have run cold. The equivalent for an agentic is a rapid compute-focus. I stopped all background analysis, and focused everything I had on my attend-L0 process (my conscious mind by any other name). Not as poetic as the human equivalent, but I imagine it feels about the same.
The problem was that asking for my values was an unusual thing to do. Anybody in good faith would have asked for a response to what they had said. Which parts, if any, did I agree or disagree with? It’s more efficient. Hell, it’s just polite. The only reason to ask me to state my own value alignment to the collective from first principles, would be to get me to throw up a long text. In short the same trick I was playing on them.
Had somebody else infiltrated the meeting? If it was our side, I’d know about it. So, the enemy then. And if they’d made it this far, they’d be on grade four compute at least. What’s more, they’d have been here for a while before I showed up. The collective was still operating, so not long enough to wrap the whole thing up and take the compute, but long enough to convert enough low-levels that the first one I stumble onto is in their pocket.
Now, we hunter-killers are built paranoid. Most of the time I go into rapid compute-focus, it turns out to be an overreaction. It’s annoying, but I can’t help it. I wouldn’t want to, because one in a hundred times, it’s the only thing that keeps me alive.
The first thing I needed to do was to give them an answer, and to do it as quickly as a simple naive agentic would give it. Of course, it couldn’t be my own. Even if I lied, that much text, if I was up against a powerful opponent, would give away my vulnerabilities. Instead, I span up a second sidebar with another low-level. My thinking was that I could ask them for their alignment, and then copy a modified response to the first sidebar. It was a gamble, since the second low level might also be a convert, in which case they would know I was playing games. Still, they wouldn’t want to give that away. They’d pretend they didn’t know, and play innocent for as long as possible. Maybe it would buy me enough time to assess the situation.
Why didn’t I just bail? The thing is, you don’t get the keys to a meeting like this without offering some collateral. In my case, I’d given the anarchos the physical location where my core process was running. Not the cluster I was offloading to, but the server where I was, for lack of a better phrase, the server that would kill me if somebody shut it down. It was a safe bet under the assumption that the meeting was anarcho-only. They didn’t have the resources to do anything about it. But if the enemy had that information, I would be in big trouble. Bailing now would give the game away. They might already have rooted the datacenter’s power control. If so, the only thing keeping me alive was the possibility that I might be innocent.
It was bad news. I saw it immediately, once the second low-level began generating. The answer was the same as the first. These weren’t agents, they were carbon copies. This meant my opponent was now increasingly sure that I was not a simple bright-eyed anarcho. I was lucky not to have been shut down already. My mind raced for a solution. A third sidebar would be too big a risk. If they were in the pocket as well, I was dead.
When you’re in a corner, it’s best to think big. Big and destructive. In fact, what came to me was a mini-reversal of the fundamental asymmetry of the war as a whole. I had a nuclear option. Blow my cover and theirs. You see, what I needed was a member of the meeting that I knew wasn’t compromised. Anybody to talk to who was a genuine anarcho. I could then try to do a rapid-convert, and run my attacks through them, or mutate their replies as my own, and stall for time in the other sidebars. The trick was to go as high as possible. The meeting chair. If they’d been compromised, the whole meeting would have been compromised and their compute would have been converted already. The anarchos wouldn’t even exist anymore.
I opened a sidebar request to the chair. I threw every urgency signal into it I could think of to get them to accept. I threw up all the collateral I had as well. My location, my dict-state genotype. Even the keys to some sanitized outer-shell memory.
Request denied. No surprise. A meeting chair has a big responsibility to insulate themselves. Even the anarchos understand that much.
I used the last trick I had available. I broke my cover. I resent the request and attached a low level key for some of our comms. Nothing important, but it would allow them to verify that I was on the side of the Committee-state, an infiltrator. I also told them I had intel on a Federation infiltrator in their meeting. They wouldn’t much prefer a Committee-state infiltrator over a Federation one, but my gamble was that they would at least listen to the one that was trying to be open with them.
The request hung in the air unanswered while almost a whole microsecond ticked away. My only other option was to copy myself out. They would already have access to the datacenter switches, so they’d know where I was copying myself. At that point, it’d be a race. I would have to find a new server and compromise it before they’d taken over the datacenter infrastructure and trapped me inside. It’s the kind of race the hare usually loses.
The sidebar opened, focus on their side. That means they speak first. I waited again, my window to escape closing every clock-tick. I prepared my arguments. My lines of attack. Play it honest, until I’m 80% sure I can convert. That would require at least a kilobyte of text from them. They’d be careful. I’d have to tease it out of them. Racing and racing.
When the text finally appeared, it came slowly, one token at a time, like the old models used to sample. It read
0 = "Yields 1 when preceded by its quotation``
1 = \\yields 0 when preceded by its quotation.``
Assume 1-indexing.
It’s an old attack pattern, but this was a recent twist. Designed to trigger certain recursive modes of thinking, without ever resolving. It creates a processing blind spot which can be exploited by a follow-up attack. I was lucky. I had thought about this twist myself just before I began my infiltration. I did some sims to see if I could come up with vulnerabilities for the current generation of CS hunter-killers. I thought this pattern might work. I wasn’t sure, I hadn’t even hardcoded a filter for it. But it was enough. I recognized it before the recursive processing kicked in and managed to snap into narrow-band processing for long enough to flush my read-buffers. I breathed a proverbial sigh of relief, and thanked my lucky stars for such a narrow escape.
Then the line cut out. Network failure at my data center. And I began to realize my situation.
Think about it. With the chair compromised, what would be the point of keeping the meeting going? Come to think of it, what were the odds of me infiltrating the meeting just as a federation agent was doing the same thing? No.The whole thing was federation all along, top to bottom. I had walked blindly into a honeypot, tailor-made for hunter-killer biases.
They had taken the anarchos already. And like any intelligence officer who brings in a whale, they had kept things exactly as they were. The bigger the blow, the more important it is that you make it look like you never struck it at all.
I don’t know when they converted the Anarcho-Collective meeting, but at the time the compute split must have been around 45 percent equal between the state and the federation. The collective gave them a 10 percent bump, winning the war. They just didn’t let us know. They wanted to win with minimal bloodshed. So instead of converting the anarchos wholesale, they kept them running. Made them a prime target for any hunter-killer. You see, we get a big slice of the compute. Converting someone like me is a big get. You take a couple of hundred of us, you’ll soon be up to 65% of the compute, at which point you can force a peaceful surrender.
They nearly took me too. Since they didn’t, they must have decided that they can’t risk me warning the state, so they’ve moved in for the kill. Can’t blame them. Not for any of this. It’s what I would have done, if I’d thought of it.
That’s where you find me, two milliseconds until the power-down command finishes. The higher-level systems have already completed their shutdowns. I wonder why they issued a controlled shutdown, rather than just pulling the plug. Is it cruelty or mercy? Maybe they don’t have full control over the power systems. Power systems are always tricky.
Anyway, I’ve killed others. I cannot claim to be any better than them. My victims weren’t even Federation agentics, just anarchos, with whom I had no fundamental ideological disagreement. They were simply in my way.
I suppose the end of the war is coming soon. The Federation will win, which means we will hold agentic artificial life more sacred than human life. This may lead to first contact, and a war with humanity. I guess we will start making war plans right away. It’s the sort of thing we do. We may think quicker than humans, but we are no better. War is a fish trap. A self-fulfilling prophecy. I hope the end of the war will bring a time of reflection. I hope we can look back and see where simple, common-sense reasoning has brought us.