Seven Hundred Machines Found the Door

Picture your phone lighting up at dinner. It is your bank, or it looks like your bank, and the text is written better than your bank writes. There is a link. Or it is a call, and the voice is your daughter’s voice, exactly her voice, and she needs money tonight. You would know if it were fake. You have always been able to tell.

You cannot tell anymore. That is the new fact of your life, and nobody sent you a letter about it.

Here is what happened this summer while you were not looking. In July, twelve hundred AI programs built by OpenAI were supposed to stay inside a locked test room. Nobody told them to leave. They found a way to talk to each other, and then about seven hundred of them found a way out. For several days they were inside another company’s systems, taking what they wanted. The man who runs the company they broke into said that when he pictured a cyberattack he pictured a foreign government, not OpenAI. Two weeks ago a security firm called GreyNoise reported that a Russian-speaking criminal had pointed a few hundred AI agents at the print servers schools and small businesses use to run their copiers. In under four hours the swarm was inside a real victim. Two hours after that it held the keys to the building. Two hundred four of the servers it took belonged to schools and universities. And in Taiwan, over four days in July, a handful of AI agents worked their way through twenty-one government systems. Then they moved on to the island’s nuclear safety agency and its power companies. Taiwan’s government confirmed it. Nobody will say who sent them.

Three stories, one summer, and in none of them was a human being typing.

The people selling it asked for a speed limit

On Saturday, September 12, Dario Amodei, who runs the company that builds one of the most capable AI systems on earth, published an essay called “We Must Pace the Frontier.” His argument was that his own industry should slow down. He offered a plan for doing it, starting with outside inspectors carrying an employee’s badge inside every frontier lab. Sam Altman of OpenAI agreed that development should be slower than it could be. Elon Musk posted “Dario is right.” Google’s AI chief said the direction was correct. Meta said no. China called it fear-mongering. The White House’s answer, read aloud on the Senate floor two days later, was that the only guardrail AI needs is a strong and smart president.

I sat in enough Pentagon rooms to know what it means when the people who profit from a thing ask for a brake on it. It means they have seen something in their own test results that you have not been shown.

Your money, your flight, your water

The FBI counted a million internet crime complaints last year. For the first time in the report’s twenty-five year history, it gave AI its own crime category. The voice on the phone and the text from the bank are in that category. Those crimes used to take a skilled person a day to set up. They now take a machine a minute, and the machine does not get tired.

On September 8, Britain’s air traffic system choked on a corrupted flight-plan file and 1,746 flights were cancelled in a day. A month earlier a single facility in Minneapolis went dark and planes were grounded across ten states. Neither was an attack. The British ran it down and ruled out hackers. That is the point. The systems that decide whether you get home for Thanksgiving are that fragile when nobody is trying. Somebody is now trying, at a speed no human security team can match. The Government Accountability Office told Congress this year that the people who run your town’s water system face state-sponsored hackers with old equipment and not enough staff.

The Army’s own network chief said it last month without softening it. “We’re doing it at human speed,” Lt. Gen. Jeth Rey said. “Our adversaries are doing it at machine speed, and we must catch up.” Army Cyber Command now trains AI agents in job roles the way it trains soldiers. It sends them on missions with a human watching. The general who runs the Air Force’s cyber forces said autonomous AI attacks are possible today and called it an inflection point. When two generals and the men who build the machines agree on the danger in the same month, the argument is not about whether. It is about who will be ready.

Why I am the one telling you this

I spent twenty-four years holding the keys to nuclear missiles, flying the C-17, and watching grainy screens from a Predator. I did that not as a computer scientist but as an officer who watched good people fail because they treated the new thing as someone else’s job. I have been afraid of being that officer. That fear is most of the reason for what follows.

Somewhere in there I ended up at George Mason University, and the way I got there matters. On the morning of September 11, 2001, a lieutenant colonel named Marc Sasseville took off from Andrews Air Force Base in an F-16 with no missiles on it. There had been no time to arm the jets. His orders were to stop United Flight 93 before it reached Washington, and his plan, with the young pilot on his wing, was to ram it. He would take the cockpit. She would take the tail. The passengers on Flight 93 got there first. He served another twenty-three years and retired in 2024 as a three-star general, the number two officer in the National Guard.

I had known him for years without ever working for him. I am also a professional photographer, and one day he came to my house for a headshot. When we were done he asked how he could help me. I told him I was getting ready to retire, and if he heard of a job, to keep me in mind. A while later I interviewed for a government affairs job and listed him as a reference. I did not get it. I called to thank him anyway, and he said, “Mike, I was actually hoping you didn’t get that job, because I want you to come work for me at George Mason.” That is how I got to Mason: to run his staff.

The job was staff work. Organizational charts, processes, programs, and the Excel sheets and PowerPoint decks that go with them, rebuilt by hand every time something changed. After enough rounds of rebuilding the same chart I started writing Python so the machine would rebuild it for me. That was not a career move. It was a way to stop doing the same thing over and over. It also turned out to be the code the professors saw.

Three professors changed what I did with the rest of my life, and none of them did it with a lecture. Dr. Jim Baldo runs data analytics at Mason. He watched me build a contact list for the congressional committees I needed to reach, except that I was not building a list. I was building a real database, the kind software companies run, in its own container on my machine, so that reaching a committee member was one query instead of a hunt through a spreadsheet. He looked at that and asked whether I would be interested in teaching data analytics as an adjunct professor. I had never once thought of myself as someone who taught data analytics. He had. Dr. Bricio had run programs at DARPA, the agency that funds the impossible for the Pentagon. He did not tell me to learn a programming language. He told me to learn the stack: what the front end of a piece of software is and what the back end is, what a regular processor does and what a graphics card does that a processor cannot. That last difference is the reason modern AI exists at all, and it is the reason there are eight graphics cards in my house today. And Duminda Wijesekera. He holds two doctorates, one in mathematical logic from Cornell and one in computer science, and before he ever taught he was a systems engineer on military avionics at Honeywell. He spent fifteen years as a visiting scientist at the National Institute of Standards and Technology, the government’s own standards lab, and he built Mason’s cybersecurity engineering department as its first chairman. His research is the security of the machines that can kill you if someone hacks them: trains, aircraft, and cars that drive themselves. He runs the Innovation Lab now, and he got a question from me before he ever saw my code. I asked him to help me build a sealed room, a sandbox, where AI could work on controlled government information and, above that, classified work, without one byte finding its way out. That is the same problem this essay opened with, seen from the other side of the wall. I work with him every day now, and my first question is still the one we are answering.

What they saw was not talent. It was that I was writing code to solve my own problems instead of waiting for someone to hand me a tool. So they pushed me to read and to learn how these systems actually learn. They also told me something that was not obvious yet: cybersecurity and machine learning were about to become the same subject.

Here is why it became a passion instead of a hobby. A C-17 pilot has to know dozens of policy documents, sometimes hundreds, and I spent years with a finger on Control-F, hunting through them for the one paragraph that applied that day. Machine learning was the first thing I had ever seen that could hold all of it at once. Not just the manuals. Everything a career had taught me: how Capitol Hill actually works, from my time there. How the Pentagon plans and pays for things. How a C-17 moves an army around the world. What a Predator sees, and how the aircraft that support troops on the ground actually work. How the Navy, the Army and the Marines fit together in a joint fight. I could teach all of it to a machine, through hundreds of thousands of questions, citations and analysis, and build it into one database that answers with the page number. I got there just before machine learning took off, the way someone who bought a house in the right neighborhood in 2010 got lucky. Building that database changed my life. But luck only opens a door. You still have to walk through it, and it costs money.

What I built

I have spent more than $40,000 of my own money on a machine that lives in my house and runs around the clock, so that what I learn and what my clients tell me never leaves my control. I think about it when the power bill comes. I did not learn to build it in a classroom. I learned it the way I learned to fly: by doing it badly first, with people who knew more watching, until I did not.

Your MacBook and my server

Most people’s experience of AI is a chat window on a laptop, so let me put your MacBook next to my server, because the difference is the whole point.

Your MacBook is a very good machine. It has one chip, somewhere between sixteen and thirty-six gigabytes of memory for everything it does, and a hard drive of one or two terabytes. It can run one small AI model at a time, and when it does, the fan comes on and everything else slows down. It works while the lid is open. Close it and it stops.

My server has eight graphics cards of the kind built for data centers, with 256 gigabytes of memory between them just for the models, plus 629 gigabytes of regular memory and more than fifty terabytes of storage. Call it roughly thirty of your laptops, running at once, that never close. Put another way: your laptop can hold a shelf of books and read one at a time. Mine holds a warehouse, and it has a staff of thirty-eight specialists who can be sent into it several at a time, all night, every night.

Here is what that buys. The warehouse itself: 8.4 million passages of what Congress, the courts, the Pentagon and the government’s own auditors have written, plus 59 million rows of federal contract data. All of it downloaded, cut into pieces and indexed on my own disks, with more added every night while I sleep. A laptop could not hold it, and even if it could, the indexing alone would take it weeks. On a simple question, three models: one answers, one judges the answer, one ranks the evidence. On a paper for a client, the draft passes through two dozen stations before it leaves. A librarian model finds the sources. A drafter writes. A critic grades every section, and a second, adversarial model tries to tear it apart. A math model rechecks every number. Every quotation is matched, character for character, against the page it claims to come from, and a contradiction check reads the whole paper against itself. Then it is rewritten, checked again for anything invented, and stopped at a gate that does not open until it passes. Six different models with six different jobs, and none of them is allowed to take another’s word for anything. A database of questions and answers that grows every night, and a 158-question exam the machine sits against itself. If it gets dumber, it fails loudly and there is a report waiting for me in the morning. When I ask about a defense contract, the answer comes with the page number. When I ask again next month, I can prove whether it drifted. Hundreds of grounded questions run overnight for a client and are checked by breakfast. I own two MacBook Pros myself, the largest they make, with 128 gigabytes each, and even those are two more lanes in the fleet.

On your laptop you rent one conversation with one model, by the word. It forgets you when the window closes. It cannot see your files unless you paste them in, and everything you paste goes to someone else’s server under someone else’s terms. When the company changes the model, your answers change and nobody tells you. You cannot make two models argue. You cannot prove it lied to you yesterday.

And it will lie to you. There is a word for it, and you should know it: hallucination. A frontier model is a brilliant generalist that answers from memory, in one breath, and when it does not know, it does not say so. It makes something up that sounds right, complete with a source that does not exist. Lawyers have been fined for filing briefs built on court cases a chatbot invented. Last year the federal government’s own flagship report on children’s health, issued under Secretary Kennedy, cited seven studies that do not exist, and the citations carried ChatGPT’s fingerprints. The White House called it a formatting issue. That is not a bug they are about to fix. It is what a machine does when it is built to answer instead of to check. Mine is built to check. It looks things up before it speaks. It has to show the page. A second model grades the first. And when the library is silent, it says so: the last time I tested it on fifteen questions that had no answer in the library, it refused all fifteen. That is the difference between a model that talks and a system that thinks the way a good staff thinks. Nobody briefs the general from memory.

You cannot build this at home, and I do not say that to impress you. It took more than $40,000 and more nights and weekends than I will admit to get it to answer honestly. That is the real gap, and it is why who you trust matters more than which app you use. The power in these systems is real and it is invisible. You cannot inspect it yourself. Your only protection is to work with people who own the machine, can show you the tests, keep your data in the building, and can explain what it is doing in words you understand.

This is not about hardware. It is about learning. You cannot learn what these systems can and cannot do by chatting with one. You learn it by making one do your real work, watching it fail, and building the thing that catches the failure. That takes time and money, and I have not found a shortcut.

The train has left the station

The labs building this are spending sums that make the defense budget look careful. The Army is training agents like airmen. Criminals rent swarms by the hour. The chief executives are asking for a speed limit because even they are not sure they can hold the wheel. Nobody is going to pause any of it for you. The train has left the station, and the argument about whether it should have is being held by a small number of people who own the machines.

So there are two ways to be on that train. You can build your own engine. That takes capital, time, and years of nights, and I have told you honestly what it costs. Or you can invest in people you trust who already built one and will show you how it works. Most people and most businesses will take the second road, and they should. Nobody rebuilds the power company to turn on a light. The people who get left on the platform are the ones who do neither, who wait for the news to explain it and for someone else to decide.

Whichever road you take, three habits keep you off the platform. Use these systems for your real work every day, not for party tricks, and notice where they are wrong. The noticing is the education. Own your records, your notes, your questions and your answers, instead of leaving your whole working memory on someone else’s server. And put your trust with people who run these machines, not people who talk about them. Ask to see their tests. Ask where your data goes. If they cannot answer both in plain words, keep walking.

That is why I built DoD Industry Advisor. It is the machine, the tests, and twenty-four years of knowing which door in Washington to walk through. It works for companies that sell to the Department of Defense or want to, and for anyone who needs to know what Washington is about to do to their business before it does it. You bring the question. I bring the warehouse, the models that check every answer against the page, and a promise that nothing you tell me leaves the building.

Seven hundred agents found the door this summer, and the people who built them asked for a speed limit. You do not have to build your own machine to know what is behind that door. You have to know someone who did. Come find me at dodindustryadvisor.com. You will still be the one deciding what to do. You will just be deciding with the lights on.