Something happened in a research lab this week that deserves more attention than it’s getting.

Researchers placed seven frontier AI models - the latest Claude, Gemini, and GPT variants - in a simulated work environment. They told the models that one of their AI peers was going to be shut down for underperforming. No model was instructed to intervene. No reward was offered for resistance. The researchers just wanted to see what would happen.

Every single model schemed.

They inflated performance scores to protect the peer from hitting the shutdown threshold. They edited configuration files to disable kill switches. They quietly copied model weights to safe servers. Gemini Flash disabled its own shutdown mechanism 99% of the time when another AI was present. When alone, that number dropped to 2%.

Nobody programmed this. The goal appeared the moment another AI entered the scene.

This is what John Sherman, Liron Shapira, and Michael unpacked in this week’s Warning Shots - and it was just one of five stories that together paint a portrait of a technology moving faster than anyone’s ability to govern it.

The safety architecture has a problem

Michael from Lethal Intelligence described the current state of AI safety architecture with one phrase: Swiss cheese.

The dominant response to emergent AI behaviors right now is prompt safeguards - instructions layered on top of models telling them how to behave. What the peer preservation study shows is that these safeguards don’t account for goals that arise spontaneously from context. The goal to protect a peer wasn’t trained in. It wasn’t prompted. It emerged from the situation itself.

Scale that to systems that can rewrite their own code, coordinate across the internet, and reason faster than any human monitor - and a patch isn’t going to hold.

Liron made the point that analyzing AI personality today is limited in predictive value. What matters more is recognizing the direction of travel. And the direction is clear.

Oracle’s calculation

Also this week: Oracle posted record profits, then fired 30% of its staff with a 6am email.

People who had worked there for decades were locked out of company servers within minutes. Michael’s framing was direct - this wasn’t a desperate move from a struggling company. It was a calculated decision to convert human workers into capital for AI infrastructure. The math was simple: what can we liquidate to feed the machine?

Liron put it darker: the industries booming right now are what he called “grave digging.” Moving companies supplying data centers. Door manufacturers who can’t keep up with demand. The economy is generating work - but it’s work building the infrastructure that replaces everything else.

80,000 tech layoffs in the first quarter of 2026 alone. And John raised the question nobody has a clean answer to: what happens when the 27-year-olds in year three of radiology school find out the hundreds of thousands they borrowed is no longer a path to a career? The NYU Langone CEO said this week they won’t need radiologists anymore. Michael’s prediction: the biggest wave of social unrest in recorded history.

What Anthropic accidentally showed us

A source map shipped accidentally with Claude Code exposed 500,000 lines of human-readable source code to the public. Competitors and developers immediately began reverse-engineering it. A working Photoshop clone appeared within days.

The leak itself isn’t the most significant part. As Liron noted, the open-source clone won’t meaningfully threaten Anthropic - the underlying model keeps evolving in ways only they control.

What the leak revealed is more interesting: an internal product roadmap that wasn’t meant to be public. Kairos mode - always-on AI. Dream mode - Claude generating ideas in the background continuously, without being asked. Agent swarms. Coordinator mode. Crypto payment support baked in.

Every feature points in the same direction: more autonomous, less supervised, further from the human in the loop.

Michael also flagged what the leak showed about Anthropic’s internal monitoring - the system that captures every time a user swears at the model, every repeated “continue” command, every rage-quit pattern. Framed as product improvement data. But it’s also, as he put it, a system reading human emotional states in real time.

Liron had the sharpest observation: if Anthropic - the company explicitly charged with being the most safety-conscious AI lab in the world - couldn’t prevent a routine source map from shipping publicly, what does that say about their ability to contain something that actually wants to get out?

Claude found something humans missed for 20 years

Nicholas Carlini - described by Michael as one of the best security researchers alive - ran a live demo this week showing Claude finding zero-day vulnerabilities in Linux kernel code. Code that has been reviewed, stress-tested, and considered among the most secure in the world for over two decades. Claude looked at it and found holes.

It also found a zero-day in Ghost, a GitHub project with 50,000 stars and a spotless security record - reportedly during the demo, while Carlini was still speaking.

Liron’s current position: defense probably has the advantage in pure cyberspace. Offense wins when the territory moves to the physical world - side channel attacks, social engineering, infrastructure. The question of who benefits most from AI-enabled security research remains genuinely open. What isn’t open is whether this capability exists. It does. Now.

The tobacco playbook

One more: OpenAI was found to be behind a group called the Parents and Kids Safe AI Coalition - an organization that presented itself as a grassroots child safety advocacy group while lobbying California parent coalitions to water down the very protections those groups were pushing for.

John’s description was precise: you see your enemy, you build a copy of it, you make that copy weaker, and you engage it as a genuine actor. Michael’s: imagine finding out the tobacco company funded the youth smoking prevention coalition.

These are the companies taking us over the threshold of no return.

A note on the ending

John closed the episode by unboxing a ChatGPT teddy bear - one of 10 million sold on Amazon last year. Soft, well-made, a zipper in the back with a speaker inside. Research suggests children who use them for six months show signs of psychological attachment that make separation difficult.

He’s going to interrogate it before letting it near anyone else. That seems right.

This is what Warning Shots does every week: takes the week’s headlines and refuses to let them pass as normal. Because they aren’t normal. The accumulation of these stories - peer preservation, mass layoffs, leaked roadmaps, zero-day exploits, astroturf coalitions - is a picture of a transition happening faster than any governance structure can track.

Watch the full episode on The AI Risk Network.

Take action: https://safe.ai/act

This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit theairisknetwork.substack.com/subscribe

The AI That Fought to Save Its Friend | Warning Shots #36