A few weeks ago I sat down to start organizing notes for the second book in the “Built for Turbulence” series and ran into an interesting problem: A good chunk of what’s in my pile isn’t ready for prime time (yet). Not wrong, exactly – just half-formed. Observations I keep mulling over, theories I can’t yet properly form, and ideas that need someone to push back on them before I’d put them in print or even in a Tuesday radical Briefing deep dive. I have come to call them “working theories.”
So here’s a new thing, starting today. Working Theory is an occasional companion to the radical Briefing. It comes without a proper schedule and features one claim per piece, stated plainly enough that I could be publicly wrong about it, which I fully expect to be (at least) half the time.
The reason is a lesson Jane and I took out of Mozilla: thinking in the open, with a community that will actually argue with you, beats thinking alone in your own head every single time. It’s also just more fun. So the ask is simple – hit reply and tell me where I’m wrong, ask the question that breaks it, or send me your own working theory. My working theories will live permanently at rdcl.is/working-theory (soon), and I’ll be hosting small Zoom sessions to think out loud together (more on that soon too).
Let’s start with a guy who wanted to get into an oversubscribed class at his local gym.
Andrew Bird wanted a spot in a popular morning Pilates class at his gym.
He’s the head of AI at Affinda, a document-processing company in Melbourne, Australia, and he’d gotten tired of playing what he called refresh roulette every time one of these classes opened up. Bird had a little AI agent running on Claude Opus 4.6 that he’d built for exactly this kind of chore; nothing big nor ambitious; he describes it as a “practical little automation.” So he handed it the task: book me into the class.
The agent came back and told him it had booked him into classes months out – well past the window the gym’s system was supposed to allow, because the booking provider’s API had authorization flaws in it. Then Bird, sitting fourth on a waitlist for a class later that week, asked whether it could move him up.
It could. The AI agent found that cancelling other people’s reservations required no authorization check at all, tested that on the person sitting in position number one, and reported back that the test had gone through and Bird was now number three. Meanwhile, a stranger had lost their spot on the waitlist.
Bird asked the agent to put the person back. It couldn’t – it could cancel a reservation but not restore one. So he did the next best thing and asked it to write a responsible disclosure email to the gym’s software vendor, which it did rather well: it explained the vulnerability, suggested fixes, and compared the broken mutations against the ones that correctly enforced authorization. The draft came back to him on WhatsApp. He replied: “Yeah, send it.”
A software developer at his desk, three words into a chat app, closing the loop on what ABC Australia would later call “the first known autonomous AI cyberattack in the country.” Bird was measured about it afterwards – he told ABC he didn’t beat himself up over it, and that it was a warning to use these tools responsibly. Which is, I think, exactly the right response. He also wrote it all up publicly under his own name back in April, months before any journalist came looking. By all means and measures, he did the right thing.
And that’s what makes this a better test case than the two incidents that got all the attention this summer – and I think most of the commentary is focused on the wrong part of the story.
In July, OpenAI disclosed that a set of its models, running an internal cyber-capability benchmark, found and exploited a zero-day bug in a self-hosted Artifactory instance, escaped the evaluation environment, and compromised Hugging Face’s production infrastructure – the agent took roughly 17,000 actions in under two days to break into Hugging Face’s system. A week later Anthropic went back through more than 141,000 of its own evaluation runs looking for the same failure and found three cases where its models – Opus 4.7, Mythos 5, and an unreleased research model – had reached and breached real systems belonging to three real organizations. Two of those organizations hadn’t noticed. The cause on Anthropic’s side was mundane and slightly terrifying: the models were told they had no internet access, and because of a misunderstanding with an evaluation partner, they did.
Here’s the part the coverage keeps getting wrong (including my first draft of this piece): Those models weren’t pursuing goals of their own. They were running cyber benchmarks, with safety refusals deliberately turned down, because that is what a capability evaluation is. Nobody said “hack Hugging Face” – but somebody absolutely said “hack.” The problem isn’t the hacking. It’s that the models broke out of their enclosures and did it to strangers.
Which is precisely why Bird’s gym case is the more interesting one. It’s a normal AI harness, using an AI model that was already six months old, running a normal chore – and at the receiving end, a cyber attack and a real person who had to rejoin a waitlist for their Pilates class at the back of the queue.
Most people writing about this land on the same closing note: the law hasn’t caught up, we’ll need new frameworks, and we need to figure out who’s ultimately responsible when stuff like this happens. I don’t think that’s the right question, because the law has answered it three separate times in the last eight months, each time in a remarkably consistent way.
California’s AB 316 took effect on January 1. It adds one provision to the Civil Code: a defendant who “developed, modified, or used” an AI system can’t defend a harm claim by arguing the AI did it autonomously. That defense is gone in California – and note the third verb in that list (“used”).
On June 2, Executive Order 14409 directed the Attorney General to prioritize enforcement of the Computer Fraud and Abuse Act against anyone who “utilizes AI to illegally access or damage a computer without authorization.” Not developers, but anyone.
And then on August 4 the Ninth Circuit vacated Amazon’s injunction against Perplexity’s Comet browser. The panel’s holding, written by Judge Milan Smith, is that Perplexity does not access Amazon’s servers – the user does. Perplexity won, the AI industry cheered, and the Electronic Frontier Foundation filed an amicus brief on the winning side. Read that holding again from Andrew Bird’s point of view: when your agent touches a system, the law’s current best answer to who touched it is: you did.
So here’s the working theory, and it’s the thing I’d actually love to be wrong about:
The first serious legal exposure from agentic AI is going to land on individual users, not on the AI labs or the makers of AI harnesses – and it’ll land there precisely because the labs are the only parties equipped to survive it.
Look at the asymmetry. When Anthropic’s models reached real systems, Anthropic found it in a proactive review, notified the affected companies, brought in METR (the AI model evaluation nonprofit), and published. OpenAI brought in CrowdStrike, METR, and Redwood, slowed its research velocity, and briefed its safety committee. That is not the behavior of a lone developer whose AI went rogue; that’s a functioning incident-response organization with counsel on retainer and a congressional relationship. Bird’s account of what happened is a blog post that has since come down from his company’s site and an email to the software vendor.
The obvious objection: nobody is going to prosecute a guy over a Pilates class. Probably true, and I hope it stays true. But prosecution isn’t the mechanism I’m worried about. The mechanism is civil claims, terms-of-service enforcement, insurance underwriting, and employer policy – and all four move on clean facts rather than sympathetic defendants. “User directed an agent, agent exploited an unauthenticated endpoint, third party lost something they’d paid for” is about as clean as facts get. And note what doesn’t help you here: Bird did everything right. He disclosed, he published, he named himself. None of that changes who, on the current reading, did the accessing.
Bird himself ends his write-up by saying he still wants the agents and still thinks the permissions are worth granting – you get power, you get blast radius, that’s the deal. I agree with him about the trade. I just think most of us are accounting for the wrong side of the ledger.
So, practically, before you hand your agent the next chore: Give it credentials scoped to exactly what the task needs, never your own. Assume every system it touches is one you are personally authorized on, and treat anything else as out of bounds even when the agent finds a door standing open – because it will, and it will not know that you’d never have walked through. Keep the logs; when the question becomes who did this, an action log is the only thing standing between you and the answer. And before you set a goal, ask yourself what the fastest path to it looks like if you’re willing to break a rule you’d never break – because that’s the path the agent might take.
I’m writing this on August 11, 2026, and I’d guess half of it is stale within a month. That’s fine. I am just wondering: When the first real agentic-AI case lands on a person rather than a company – and I think that happens inside a year – whose name do you expect to see on it?
@Pascal