SmarterArticles

In the spring of 2026, a professor of economics at Brown University did something that, on paper, looks like an act of pure kindness. Roberto Serrano, who has taught at Brown for thirty-four years and holds the title of Harrison S. Kravis University Professor, decided that his advanced undergraduate class in mathematical economics, ECON 1170, deserved a gentler midterm than usual. His students had been through something no examination rubric is designed to accommodate. On 13 December 2025, a gunman had opened fire on the Providence campus, killing two students and wounding nine others. One of the dead, Ella Cook, had met with Serrano only days earlier to ask him to become her academic adviser.

So he made the exam a take-home. Students could sit it in their own rooms, in their own time, away from the fluorescent dread of a lecture hall that some of them now associated with sudden violence. To keep the assessment meaningful, he made the questions harder than in previous years. It was, in the truest sense, a compassionate decision. And it produced a result so statistically deranged that it has become, in the space of a few months, the most closely studied cheating scandal in the recent history of the Ivy League.

Of the eighty-six students who sat the exam, forty scored a perfect one hundred. The class average landed at ninety-six. In prior years, on easier papers, that same course had averaged somewhere between sixty-five and eighty. A harder exam had produced a miraculous improvement, and miracles, to an economist, are simply data points that have not yet been explained. Serrano and his graders went looking for the explanation. They found it by doing the obvious thing that almost no institution does systematically: they ran the questions through ChatGPT themselves.

A take-home exam meant as mercy

What came back was not merely correct answers but a particular texture of reasoning. For at least one problem that has a short, elegant proof, the chatbot generated a laborious, convoluted argument that arrived at the right destination by an eccentric route. That same eccentric route, that same unnecessary scaffolding, appeared across dozens of student scripts. The students had not merely reached the answer the machine reached; they had reproduced the machine's peculiar way of getting lost and finding its way back. It was, in Serrano's account, a fingerprint. Human beings sitting the same hard problem independently do not all make the same strange detour. A language model, prompted with the same question, does.

When Serrano confronted the class with what he had found and reminded them of the honour code every one of them had signed, the reaction was swift and, in its way, more damning than any confession. Eighteen students dropped the course outright. A further nine stayed on the register but never appeared for the final, so that when the in-person examination arrived in May, twenty-seven of the original eighty-six were missing from the hall. Twenty-two of those twenty-seven had scored a perfect hundred on the disputed midterm. The absence was not random; it was concentrated almost entirely among the students whose marks had triggered the suspicion in the first place. Only fifty-nine sat the paper. Nineteen of them failed. The class average collapsed to forty-eight, the lowest in the course's history.

Serrano has not been diplomatic about what he thinks happened. He asked, pointedly, what the value of an élite qualification is if it can be conjured by a keystroke. “If all you're doing is just pressing a button to have this machine do the work for you,” he put it, “then you think you need a Brown degree for that?” Elsewhere he has been quoted describing the affair in more apocalyptic terms, suggesting that humanity has, in effect, chosen to make itself stupid. The rhetoric is easy to dismiss as the lament of a man who has watched thirty-four years of professional norms dissolve in a single semester. It is harder to dismiss the arithmetic. A distribution of marks does not have feelings. It does not exaggerate. Forty perfect scores on a deliberately harder paper, followed by a mass withdrawal of exactly the students who earned them, is not a story that admits many innocent readings.

But the Brown episode is interesting less for what it proves about eighty-six particular undergraduates than for what it reveals about the machinery of trust on which the entire enterprise of higher education rests. Because the uncomfortable fact at the centre of this story is not that students cheated. Students have always cheated. The uncomfortable fact is how the cheating was caught: not by any system, not by any institutional safeguard, not by any technology the university had purchased or deployed, but by one professor and his graders improvising a forensic method on the fly, essentially by playing detective with a chatbot in the way an amateur sleuth might dust for prints. If that is the state of the art in detection at an institution whose entire market value rests on the credibility of the certificates it issues, then the certificates are in trouble.

The fingerprint in the machine

It is worth dwelling on the improvised nature of Serrano's discovery, because it is the load-bearing detail of this whole affair. He did not catch his students because Brown had a robust apparatus for identifying machine-generated work. He caught them because a hard exam produced impossible marks, because he happened to be curious enough to interrogate the anomaly, and because the specific model his students used happened to leave behind a distinctive stylistic residue on a problem with an unusually clean alternative solution. Change any of those variables and the fraud sails through undetected. A slightly less lazy cohort that varied its prompts, paraphrased the output, or introduced deliberate errors would have escaped entirely. A less numerate professor might have shrugged at the high marks and moved on, quietly pleased. The detection worked because of a confluence of luck, expertise and student carelessness, not because of any designed defence.

This matters because the obvious institutional response — buy a detector — does not work. The commercial AI-detection industry that sprang up in the wake of ChatGPT's release has turned out to be one of the least reliable technologies ever sold to the education sector. Turnitin, the plagiarism-detection company whose software is embedded in thousands of universities, has itself acknowledged that its tool misclassifies human-written text as machine-generated. That may sound like a tolerable margin of error until you run the numbers at scale. Vanderbilt University, explaining why it disabled Turnitin's AI-detection feature in August 2023, pointed out that even a one per cent false-positive rate, applied across the seventy-five thousand papers its students submit annually, would generate roughly seven hundred and fifty wrongful accusations a year. Seven hundred and fifty innocent students hauled before an integrity committee to defend work they actually did. No institution that takes due process seriously can build a disciplinary regime on foundations that shaky.

The unreliability is not evenly distributed, either, which makes it worse. Research on AI detectors has repeatedly found that they are biased against writers who learned English as a second language. One widely cited study reported that a battery of detectors flagged more than sixty per cent of essays written by non-native English speakers as machine-generated, while correctly clearing almost all writing by native speakers. The mechanism is bleakly logical: detectors are trained to associate simpler vocabulary and more predictable sentence construction with machine output, and those are precisely the features of prose written by someone still mastering the language. A tool that systematically accuses international students of fraud on the basis of their sentence structure is not an instrument of justice; it is a liability waiting for a lawsuit. Australian Catholic University discovered as much after logging nearly six thousand alleged misconduct cases in a single year, the overwhelming majority AI-related, before abandoning the Turnitin tool it had relied upon as ineffective.

So the picture that emerges is stark. On one side, a form of cheating that is cheap, ubiquitous, improving monthly and increasingly easy to disguise. On the other, a detection apparatus that is expensive, error-prone, discriminatory and, at the frontier, essentially defeated by any student who takes the trouble to rewrite the machine's output in their own voice. Serrano's success was real, but it was not repeatable at scale, and everybody in the sector knows it. The detectors do not save you. The honour codes, as Princeton has just conceded, do not save you either.

Why detection is a game universities keep losing

The deeper problem is that detection was always going to be an arms race the institutions could not win, and the reason is structural rather than technological. A cheating student needs to succeed once. A detection system needs to succeed every time. Each new generation of language model produces output that is more fluent, more idiosyncratic and less distinguishable from competent human writing than the last, which means that even a detector that works today degrades tomorrow simply by standing still. The very stylistic tell that undid Serrano's students — the convoluted proof, the machine's characteristic detour — is exactly the sort of artefact that model developers spend their days sanding away. The fingerprints are getting fainter with every release.

There is a temptation, particularly among administrators, to treat this as a transitional inconvenience, a bump to be smoothed over once the right software arrives. That is a fantasy. There is no detector on the horizon that reliably separates a lightly edited machine essay from a genuine one, and the economics of the problem guarantee there never will be, because the people building the models have every incentive to make their output indistinguishable from human work and no incentive to make it easy to catch. The watermarking schemes that were once floated as a solution have proven fragile, defeated by trivial paraphrasing or by the simple expedient of running the text through a second model. Universities that continue to pour money into detection are, in effect, buying an umbrella to hold against the tide.

Which forces a more fundamental question, and it is the question that the Brown scandal, the Princeton vote and the survey data all circle without quite naming. If you cannot detect the cheating, and you cannot design an assessment that a determined student cannot game, then what exactly is a degree from an élite university certifying at the moment it is conferred? What does the piece of paper actually vouch for? To answer that, you have to understand what the paper was ever supposed to vouch for in the first place — and here the economists, of all people, got there decades before the technologists.

What a degree was ever meant to prove

In 1973, the economist Michael Spence published a paper called “Job Market Signalling” that would eventually help win him a share of the Nobel Memorial Prize. Its central insight was deceptively simple. Employers cannot directly observe how capable, diligent or intelligent a prospective worker is. What they can observe is whether that worker managed to acquire a difficult, expensive, time-consuming credential. If obtaining the credential is genuinely harder for less capable people than for more capable ones, then the credential works as a signal: it reliably separates the wheat from the chaff, not necessarily because of what was learned in the process, but because the mere fact of completion carries information. A degree, in this model, is less a certificate of knowledge than a proof of the kind of person who can get a degree.

The libertarian economist Bryan Caplan pushed this argument to its provocative conclusion in his 2018 book The Case Against Education, in which he contended that as much as eighty per cent of the financial premium a graduate earns derives not from skills acquired but from signalling — from the diploma's power to advertise intelligence, conscientiousness and a willingness to conform to institutional expectation. His most persuasive piece of evidence is what economists call the sheepskin effect: the observation that the wage boost from the final year that yields an actual diploma dwarfs the boost from earlier years that do not. If education were purely about accumulating human capital, three-and-three-quarter years of study should be worth roughly three-and-three-quarter years of pay. It is not. The certificate itself carries a disproportionate value, which is only explicable if the certificate is doing work over and above the learning it notionally represents.

Now hold that theory up against the Brown data. Signalling only works if the signal is costly to fake. The entire mechanism collapses the moment a low-capability worker can acquire the same credential as a high-capability one at comparable cost, because at that point the credential stops separating anybody from anybody. It becomes noise. And generative AI is, precisely and specifically, a technology for collapsing the cost of faking the signal. When forty students in a single class can press a button and produce a perfect score on a deliberately hardened exam, the exam has ceased to distinguish the diligent from the idle, the able from the unable. The signal has gone dark. A Brown degree earned in 2026 is supposed to tell an employer, a graduate school, a research council, something reliable about the person holding it. The scandal in ECON 1170 is a demonstration, in miniature and under laboratory conditions, that it may no longer tell them anything at all.

This is the genuinely frightening part, and it is why the story deserves more than a news cycle's worth of scandalised attention. The threat that AI poses to universities is not primarily that students will learn less, although they may. It is that the institution's core product — the credible, costly, hard-to-counterfeit signal — is being quietly debased from within, by the very people it is meant to certify, faster than the institution can restore its guarantee. A currency is only as good as the confidence that it cannot be forged. Élite universities have spent centuries building a currency of extraordinary value, and they are now discovering that the printing presses have been distributed, free of charge, to everyone holding a smartphone.

The numbers behind a quiet epidemic

It would be comforting to treat Brown as an outlier, a freak convergence of trauma, a well-meaning professor and an unusually brazen cohort. The data does not permit that comfort. The behaviour Serrano stumbled upon is not a local aberration; it is the visible tip of a shift that survey after survey has been documenting, largely without anyone in a position of authority acting on it.

Consider the Lumina Foundation and Gallup study published as part of their 2026 State of Higher Education research, conducted across October 2025 with a sample of several thousand American undergraduates pursuing associate and bachelor's degrees. It found that more than half of them — fifty-seven per cent — were using artificial intelligence in their coursework at least once a week, and that roughly one in five reported using it daily. Read that again. A weekly habit is no longer the behaviour of a deviant minority; it is the modal experience of the American undergraduate. The tool that produced Serrano's forty perfect scores is not lurking at the margins of student life. It is woven into the ordinary weekly rhythm of the majority. Male students reported using it more heavily than female students, and students in business, technology and engineering programmes reported using it most of all — which is to say, disproportionately in exactly the quantitative fields where a take-home problem set is most cleanly solved by a machine.

The Harvard figures tell a subtler and, in some ways, more instructive story. The graduating Class of 2024, surveyed by the student newspaper The Harvard Crimson, produced a headline number that has been cited relentlessly since: forty-seven per cent of respondents admitted to having cheated in an academic context during their time at the university. Nearly half the graduating class of one of the most selective institutions on earth confessed to academic dishonesty. That is the statistic that launched a hundred opinion columns, and it is real. Less frequently quoted, and far more damaging to the institution than to the students, is what the same series of surveys reveals about consequences. Among the graduating Class of 2026 who admitted to cheating, ninety-three per cent were never discovered at all, and fewer than three per cent faced any disciplinary sanction whatsoever. Whatever machinery Harvard possesses for catching academic dishonesty, its own graduates report that it caught roughly one offender in fourteen and punished roughly one in forty. Serrano's afternoon with a chatbot was, by that measure, an extraordinary feat of enforcement. But the honest analyst has to add the context that the columns tend to omit, because it complicates the tidy narrative of AI-driven collapse. In the subsequent surveys, the self-reported cheating rate at Harvard did not keep climbing. It fell — to around thirty per cent for the Class of 2025 and to roughly twenty-five per cent for the Class of 2026, back in line with pre-pandemic norms.

What are we to make of a cheating rate that peaked and then declined even as AI use exploded? Two readings are possible, and they are not mutually exclusive. The optimistic interpretation is that the initial spike reflected the chaotic, norm-free early period of the pandemic and the first rush of ChatGPT, and that students and institutions have since renegotiated where the lines lie. The pessimistic interpretation is more corrosive: that the reported rate fell not because cheating declined but because it stopped registering as cheating. When more than half of all students use AI weekly, the behaviour normalises. What one cohort guiltily confesses to as misconduct, the next cohort simply regards as how coursework is done — no more a transgression than using a calculator or a spellchecker. The Class of 2026 survey supplies something close to a proof of the gloomier reading, in the form of a discrepancy sitting in plain sight within its own results. Sixty-four per cent of that class reported using AI multiple times a week or daily. Twenty-five per cent said they had cheated. And thirty-three per cent — a third of the cohort, a figure that has barely shifted in years — said they had used AI on an assignment against their instructor's explicit permission. More students admitted to breaking a rule than admitted to cheating. That gap is the entire argument in miniature: a substantial body of undergraduates who know exactly what they did, remember the instruction they disregarded, and no longer file the act under dishonesty at all. On that reading, the falling numbers are not reassuring at all. They are evidence that the definition of cheating is dissolving faster than the cheating itself, which is arguably the worse outcome, because a norm that everyone quietly abandons is harder to restore than one that is merely being broken.

Either way, the survey data establishes the crucial point: Brown is not a freak. It is a controlled demonstration of a phenomenon that is already pervasive and, by the students' own admission, routine. What made ECON 1170 exceptional was not the cheating. It was the detection.

The proctor returns and the blue book comes back

Faced with a signal it can no longer guarantee and a fraud it can no longer detect by software, the sector is falling back on the only defences that have ever really worked: putting a human in the room and taking the machine out of it. The most symbolically loaded of these retreats happened at Princeton.

In May 2026, Princeton's faculty voted, with a single dissenting voice, to require that all in-person examinations be supervised by instructional staff. That may sound like housekeeping. It was not. Princeton had operated since 1893 on an honour code under which students sat their examinations unproctored, pledging in writing not to cheat and, crucially, accepting a collective responsibility to report classmates who did. For a hundred and thirty-three years, no invigilator stood at the front of a Princeton exam hall. That tradition of unsupervised examination is now over. The new policy, which took effect on 1 July 2026, places a proctor in every room, present as what the faculty legislation described as a witness rather than an enforcer, but a witness nonetheless — an institutional admission that the honour system, as a mechanism for guaranteeing integrity, has failed.

The reasons the faculty gave are as revealing as the vote itself. Reporting by The Daily Princetonian, which broke the story, drew on a 2025 survey of some five hundred graduating seniors, thirty per cent of whom admitted to having cheated at least once. But the more telling finding concerned the enforcement mechanism rather than the offence. Students said they found it increasingly difficult to identify cheating in a modern exam hall — a phone under the desk is far harder to spot than a crib sheet up a sleeve — and, more damningly, that they were unwilling to inform on their peers for fear of social retaliation, of being teased, doxxed or ostracised. The survey put a figure on that reluctance which is difficult to argue away. Nearly forty-five per cent of the seniors who responded knew of honour code violations that they had chosen not to report; just four in every thousand had ever reported a peer. An honour code depends on students being both able and willing to police one another. Princeton's students, by their own testimony, had become neither. The code had become a ritual with no engine behind it, a signature on a form that certified nothing, and the faculty finally voted to stop pretending otherwise.

Beneath the symbolic drama of Princeton, a quieter and more practical counter-revolution has been under way across the sector, and it has a distinctly analogue flavour. The blue book — the flimsy stapled booklet of lined paper in which generations of students once scrawled their handwritten answers under the eye of an invigilator — is enjoying an improbable renaissance. Sales at the University of Florida reportedly rose by half over two academic years; at the University of California, Berkeley, they were said to be up by four-fifths across the same period, and at Texas A&M by about thirty per cent. Handwriting, it turns out, is one of the few technologies that reliably locks the machine out of the room. You cannot prompt a chatbot with a pen. Alongside the blue books, institutions are experimenting with the oral examination, the ancient viva voce in which a student must explain and defend their reasoning aloud, in real time, to an examiner who can ask follow-up questions the student had no way to prepare with software. The economics department at Brown, in the immediate aftermath of Serrano's discovery, publicly concluded that the in-person examination was the way forward.

None of this is confined to the American Ivy League, and in Britain the retreat has begun to acquire a regulatory edge that the American version still lacks. On 17 August 2026, the think tank Policy Exchange published a report by Philip M. Newton, a professor at Swansea University Medical School, under a title that reads almost as a summary of everything argued here: Evidence of Learning Through Assessment: Protecting the Value of a Degree in the Age of AI. Its central contention is regulatory rather than pedagogical. Summative examinations sat remotely and without supervision, Newton argues, “completely, and obviously, fail” the Office for Students' condition B4, the requirement that assessment be a valid and reliable measure of what a student actually knows. His recommendation is not that universities reform such examinations but that they stop setting them at once, and that the Office for Students and the Quality Assurance Agency compel them to do so if they will not.

The evidence he assembled through freedom of information requests to British universities is the more startling half of the document, because it establishes that the practice is not marginal. In 2023-24, seventy-eight per cent of UK universities used remote online examinations for summative assessment. Only around one in ten invigilated all of them. Two-thirds of the institutional policies governing those examinations made no mention of generative AI whatsoever, well over a year after ChatGPT's release. And seventy per cent of the universities surveyed intended to carry on with unsupervised online examinations regardless. That last figure is worth sitting with. It is not a portrait of a sector caught unawares by a fast-moving technology. It is a portrait of a sector that has been told what is happening, has measured it, and has decided to continue.

Newton's proposed remedies rhyme with what Princeton and Brown have arrived at by harder experience — most obviously a far greater use of the interactive oral viva, on the model much of continental Europe never abandoned — but one of them addresses the signalling problem head-on rather than obliquely. If the certificate can no longer be trusted on its own, he suggests, then the transcript should carry more information about how the student was assessed: not merely the marks earned, but the conditions under which they were earned. It is a modest proposal with immodest implications, because it concedes that the single undifferentiated signal is broken and sets out to replace it with a granular one, in which an invigilated first is legible as something different from an unsupervised one. Employers would learn to read the distinction quickly enough. So, rather less comfortably for the institutions, would applicants choosing between them.

Who actually owns the mess

There is a natural instinct, watching all this, to reach for the language of individual morality — to say that the students cheated, that cheating is wrong, and that the responsibility therefore rests with them. That is true as far as it goes, and it does not go very far, because it explains a scandal in one classroom while leaving the systemic collapse entirely unaccounted for. Twenty-two individual moral failures do not produce a class average of ninety-six on a hardened exam. Something larger is malfunctioning, and the responsibility for it is distributed far more widely than the students who happened to get caught.

The students bear the most immediate and personal responsibility, and it would be sentimental to pretend otherwise. They signed an honour code. They understood, because everybody understands, that submitting a machine's work as their own is a form of fraud. Nobody prompted a chatbot into producing a proof by accident. But it is worth being precise about the incentive structure they were operating inside, because it was engineered, over decades, to reward exactly the behaviour it now punishes. These are young people who were selected, drilled and admitted on the basis of their capacity to optimise every measurable metric of achievement — to treat the grade as the goal and the learning as the incidental means. An admissions arms race that rewards the maximisation of scores above all else should not be astonished when the students it selects go on to maximise their scores by the most efficient means available. The machine is simply the most efficient means yet invented.

The institutions bear a heavier and more culpable share, because they have known about this for three years and have, for the most part, temporised. Generative AI capable of answering undergraduate problem sets has been freely available since late 2022. In the time since, universities have issued a great deal of guidance, convened a great many committees, purchased a great deal of unreliable detection software, and changed astonishingly little about the fundamental architecture of how they assess and certify their students. The take-home essay, the unproctored problem set, the online quiz — the assessment formats most trivially defeated by a chatbot — remained in widespread use long after it was obvious to anyone paying attention that they had become meaningless. Princeton's vote and Brown's pivot to in-person finals are welcome, but they arrived years into an emergency that any honest observer could see coming from the moment ChatGPT launched. The institutions were slow because acting quickly was expensive and disruptive and politically awkward, and because the debasement of the credential is a slow-motion catastrophe that never quite forces a reckoning in any single quarter. They protected their short-term convenience at the expense of the long-term value of the very thing they exist to sell.

Brown's own conduct once Serrano brought his evidence forward is a compact illustration of the reflex. He submitted his findings to the university's Standing Committee on the Academic Code on 16 May 2026, and heard nothing back. Six weeks of silence later, at the end of June, he told the story to the Spanish newspaper El País, and it travelled around the world within days. The committee, mute through May and most of June, made contact shortly after publication, asking him to file individual complaints against each suspected student and to supply copies of their scripts. He provided the additional material on 8 July, at which point a formal investigation was opened and the students began to be contacted one by one. Serrano's verdict on that sequence is unsparing. “It's absolutely clear to me that if I hadn't gone public, nothing would have happened,” he said. He had already described the university's response as meek, and reported that it was seen as appalling and insufficient by the hundreds of people who had written to him in support, many of them Brown alumni.

Brown disputes the characterisation, and its account deserves a hearing rather than a dismissal. The university maintains that it treats every allegation of academic dishonesty with the utmost seriousness, that multiple academic leaders were in contact with Serrano during May about how the allegations could be formally adjudicated, and that the standing committee could not proceed until he supplied the particular details its procedures require — which he did on 8 July, whereupon it moved. Serrano himself later said he was appreciative of Brown finally looking at the case. Both accounts can be true simultaneously, and the fact that they can is precisely the point. A process that is procedurally impeccable and glacially slow is not a defence of the credential; it is a description of how a credential is debased, one unhurried committee cycle at a time. The sanctions available under Brown's academic code run from reprimand to expulsion. As of late August 2026, months after forty perfect scores appeared on a deliberately hardened examination, no outcome has been disclosed and the matter remains unresolved.

And the technology companies bear a share too, though they are the least willing to admit it and the least likely to be held to account. They released, into an education system built entirely around the assumption that a student's submitted work reflects the student's own effort, a tool that shattered that assumption overnight, and they did so with no serious mechanism for allowing institutions to distinguish their product's output from human work. The watermarking that might have made co-existence possible was deprioritised or abandoned because reliable watermarking is commercially inconvenient — it makes your product easier to police and therefore less attractive to precisely the users who most want to hide their tracks. The externality was dumped, as externalities usually are, on someone else's balance sheet. In this case the balance sheet belongs to every institution whose credential now certifies less than it did, and to every honest student whose genuine degree is now shadowed by the suspicion that it might have been faked.

What restoring trust would actually cost

If the value of an élite degree rests, as the economists insist, on its being a costly and hard-to-forge signal, then restoring that value requires making the signal costly and hard to forge again. There is no clever software that does this. There is no policy memorandum that does this. There is only the unglamorous, expensive work of rebuilding assessment around conditions a machine cannot infiltrate, and accepting the price that comes with it.

That price is real, and it is worth naming honestly rather than pretending the return to proctors and blue books is cost-free. Supervised, handwritten, oral and in-person assessment is more labour-intensive, more expensive, less scalable and less accessible than the frictionless online formats it replaces. It disadvantages the student with a disability who needs accommodation, the student whose handwriting cannot keep pace with their thinking, the student for whom a high-pressure oral examination is a crueler test of nerve than of knowledge. The take-home exam that Serrano offered was, remember, an act of compassion — an attempt to accommodate genuine trauma. The move back towards the invigilated hall is a move back towards a harsher, less forgiving, less flexible model of assessment, and the students who will pay the highest price for it are not the confident cheats but the vulnerable and the anxious. That is the bitter irony threaded through the whole affair. The cheating of the many is purchasing a harsher regime for the honest, and the compassion that made the fraud possible will be among its first casualties.

But the alternative to paying that price is worse, because the alternative is a credential that certifies nothing, and a credential that certifies nothing is not merely worthless — it is actively corrosive. It devalues the qualification of every honest graduate retroactively. It corrodes the trust of every employer, every professional body, every graduate admissions committee that has to decide whether the paper in front of them means what it says. It hollows out, from the inside, the single most valuable asset that an institution like Brown or Princeton or Harvard possesses, which is not its endowment or its buildings or its faculty but the simple, centuries-in-the-making public confidence that its name on a certificate is a guarantee of something. That confidence is far easier to destroy than to rebuild. It is the accumulated deposit of generations of credible assessment, and it can be spent down to nothing in the span of a few cohorts who were allowed to fake the signal because catching them was inconvenient.

What the Brown scandal ultimately exposes is that this confidence was resting on far more fragile foundations than anyone cared to admit. The whole edifice depended on a detection capability that, it turns out, amounts to little more than a numerate professor with a suspicious mind and a spare afternoon to interrogate his own exam with a chatbot. That is not a system. It is a happy accident that will not recur reliably, and it caught only the careless. The genuinely able cheat — the one who paraphrases, who varies the prompt, who introduces a few deliberate imperfections — was never in any danger, and remains in no danger now. The uncomfortable implication is that the degrees being conferred this summer, at Brown and everywhere like it, carry a guarantee that the institutions issuing them can no longer actually make good on. They are certifying, in many cases, they know not what.

Serrano's question, stripped of its anger, is exactly the right one, and it deserves to be asked not rhetorically but institutionally, by every provost and dean and examinations board in the sector. If the work can be done by pressing a button, what is the degree for? The answer cannot be nothing, because a great many people — employers, governments, students who genuinely learned something, societies that need their doctors and engineers and economists to actually know things — depend on the answer being something. But arriving at a defensible answer will require the institutions to do what they have spent three years avoiding: to accept that the frictionless, scalable, trusting model of assessment they had grown comfortable with is finished, and to pay, in money and labour and lost convenience, for the harder and more human forms of examination that can still tell the wheat from the chaff. The bill for restoring the signal has come due. The only remaining question is whether the universities will settle it now, while there is still a signal left to save, or keep temporising until the currency they print is worth no more than the paper it is printed on.

References

1. Preston Fore, “'Humanity has chosen to become idiots': This Brown professor switched to take-home exams after a mass shooting and discovered mass cheating,” Fortune, 29 June 2026. https://fortune.com/2026/06/29/roberto-serrano-brown-university-massacre-ai-cheating/
2. “AI-Driven Cheating Scandal Uncovered at Brown University,” OECD.AI Incidents, 28 June 2026. https://oecd.ai/en/incidents/2026-06-28-3184
3. “Brown Professor Suspects Most of His Class Used AI to Cheat,” Inside Higher Ed, 8 July 2026. https://www.insidehighered.com/news/faculty/learning-assessment/2026/07/08/brown-professor-suspects-most-his-class-used-ai-cheat
4. “Brown University professor raises AI cheating concerns,” The Boston Globe, 15 July 2026. https://www.bostonglobe.com/2026/07/15/metro/brown-university-ai-suspected-cheating/
5. “After AI cheating concerns, economics professors see in-person exams as a path forward,” The Brown Daily Herald, April 2026. https://www.browndailyherald.com/article/2026/04/after-ai-cheating-concerns-economics-professors-see-in-person-exams-as-a-path-forward
6. “Princeton Introduces Proctoring, Changing Honor Code,” Inside Higher Ed, 15 May 2026. https://www.insidehighered.com/news/faculty/learning-assessment/2026/05/15/princeton-introduces-proctoring-changing-honor-code
7. “Princeton faculty mandate proctoring for in-person exams, upending 133 years of precedent,” The Daily Princetonian, May 2026. https://www.dailyprincetonian.com/article/2026/05/princeton-news-adpol-proctoring-in-person-examinations-passed-faculty-133-years-precedent
8. “The Graduating Class of 2024 By the Numbers — Academics,” The Harvard Crimson, 2024. https://features.thecrimson.com/2024/senior-survey/academics/
9. “The Graduating Class of 2025 By the Numbers — Academics,” The Harvard Crimson, 2025. https://features.thecrimson.com/2025/senior-survey/academics/
10. “The Graduating Class of 2026 By the Numbers — Academics,” The Harvard Crimson, 2026. https://features.thecrimson.com/2026/senior-survey/academics/
11. “47% of Harvard seniors admit to cheating — and the problem existed long before ChatGPT,” Fortune, 23 June 2026. https://fortune.com/2026/06/23/harvard-cheating-academic-integrity-ai-detection/
12. Zach Hrynowski and Stephanie Marken, “AI Is Routine for College Students, Despite Campus Limits,” Gallup (Lumina Foundation-Gallup 2026 State of Higher Education study), 2026. https://news.gallup.com/poll/704090/routine-college-students-despite-campus-limits.aspx
13. “Majority of college students use AI for their coursework, poll finds,” UPI, 2 April 2026. https://www.upi.com/Top_News/US/2026/04/02/survey-college-students-artificial-intelligence-coursework/5341775162201/
14. “The Truth About Turnitin's AI Detection Accuracy in 2025,” Turnitin, 2025. https://turnitin.app/blog/The-Truth-About-Turnitins-AI-Detection-Accuracy-in-2025.html
15. “Limitations of AI Detection Tools,” Artificial Intelligence Steering Council, Brandeis University, 2025. https://www.brandeis.edu/ai-steering-council/ai-literacy/ai-teaching-learning/detection-tools.html
16. “Generative AI Detection Tools — The Problems with AI Detectors: False Positives and False Negatives,” Legal Research Center, University of San Diego, 2025. https://lawlibguides.sandiego.edu/c.php?g=1443311&p=10721367
17. “Survey on Plagiarism Detection in Large Language Models: The Impact of ChatGPT and Gemini on Academic Integrity,” arXiv, 2024. https://arxiv.org/pdf/2407.13105
18. Michael Spence, “Job Market Signaling,” The Quarterly Journal of Economics, Vol. 87, No. 3, 1973. https://doi.org/10.2307/1882010
19. Bryan Caplan, The Case Against Education: Why the Education System Is a Waste of Time and Money, Princeton University Press, 2018. https://press.princeton.edu/books/hardcover/9780691174655/the-case-against-education
20. “Schools fight AI cheating with return to pen and paper blue books,” Fox News, 2026. https://www.foxnews.com/tech/schools-turn-handwritten-exams-ai-cheating-surges
21. “Blue books are back: The revival of pen and paper exams,” The Daily Cardinal, 6 November 2025. https://www.dailycardinal.com/article/2025/11/blue-books-are-back-the-revival-of-pen-and-paper-exams
22. “Colleges Turn to Oral and Handwritten Exams as AI Disrupts Assessments,” eWEEK, 2026. https://www.eweek.com/news/colleges-turn-to-oral-exams-ai-disruption/
23. “Are universities returning to in-person exams to combat AI cheating?,” Times Higher Education, 2025. https://www.timeshighereducation.com/depth/are-universities-returning-person-exams-combat-ai-cheating
24. “Ban all remote unsupervised tests 'immediately', urges report,” Times Higher Education, 18 August 2026. https://www.timeshighereducation.com/news/ban-all-remote-unsupervised-tests-immediately-urges-report
25. Philip M. Newton, Evidence of Learning Through Assessment: Protecting the Value of a Degree in the Age of AI, Policy Exchange, 17 August 2026. https://policyexchange.org.uk/publication/evidence-of-learning-through-assessment/

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

Six thousand office workers in the United States, the United Kingdom and Australia were asked, across December 2025 and January 2026, how much time artificial intelligence had given back to them. They said eleven hours a week.

Then they were asked a second question, the one almost nobody asks. How much time do you spend feeding these systems context, supervising what comes out, debugging the mistakes and cleaning up afterwards? The answer was 6.4 hours a week.

That is the whole argument in two numbers. Roughly six of every ten hours artificial intelligence appears to save are consumed by the labour of making artificial intelligence work. The survey, published in June 2026 as the Work AI Index by Glean's Work AI Institute alongside researchers from Stanford, Notre Dame, Emory, UC Berkeley, UC Santa Barbara, UNC Charlotte and University College London, gave the residual a name that has since escaped into general use: botsitting. Rebecca Hinds, who heads the institute and co-authored the report, and her colleagues defined it coldly, as “the largely unrecognized, unbudgeted, and untracked labor of making AI usable”.

Unrecognised, unbudgeted, untracked. Three adjectives doing an enormous amount of work.

On 18 August 2026, the Indian human resources publication HRKatha ran an analysis of the same phenomenon under the more homely label of bot sitting, defining it as the work employees do prompting systems, checking answers, correcting errors, supplying missing context, trying again when outputs go wrong, and deciding whether the eventual result can be trusted at all. Its sharpest line concerns measurement. The real test of efficiency, the piece argued, is not how quickly a machine produces an answer but how much human work remains before anyone is willing to trust it.

Nobody is measuring that. And what nobody measures, nobody pays for.

The Arithmetic That Stops Working at Five Minutes

Take the scenario in its simplest form. A task used to take twenty minutes of a person's own work. Now it takes five minutes of generation followed by fifteen minutes of checking, correcting and verifying. On the stopwatch, nothing has changed. On the productivity dashboard, everything has. The dashboard records five minutes of task completion, because that is the interval in which the tool was invoked and the output produced. The fifteen minutes afterwards are logged as the worker doing their job, which is what they were doing before the tool arrived.

The tool has not saved fifteen minutes. It has reclassified them.

This is a straightforward consequence of how enterprise software reports on itself. Adoption metrics count seats, prompts and sessions. They do not count the second and third attempts, the cross-check against a source document, the quiet decision not to send the thing at all. More prompts is not a measure of value. It may be a measure of the opposite: a worker who prompts a system eleven times before getting a usable answer generates eleven data points that a usage dashboard reads as enthusiasm.

The Work AI Index found a second figure that should worry anyone relying on those dashboards. Only thirteen per cent of organisations surveyed said artificial intelligence had significantly improved their performance, against eighty-seven per cent of workers who said they were using it. That gap between individual time saved and organisational performance gained is where the botsitting hours have gone. They have not disappeared. They have been absorbed into a category of labour the accounting system cannot see.

The survey also documented what happens when supervision becomes unaffordable. Sixty-nine per cent admitted to what the report calls botshitting: shipping output they had not verified, did not fully understand, or could not confidently stand behind. Forty-one per cent had sent work they would be unable to explain if questioned. Twenty-eight per cent admitted blaming the machine for their own mistakes. Workers who reported botshitting were 3.8 times more likely to be looking for another job.

That last figure is the tell. This is not laziness. It is triage under an unfunded mandate.

Lisanne Bainbridge Wrote the Manual for This in 1983

None of this is new. The person who explained it most economically did so forty-three years ago, in a five-page paper about process control in factories and power stations.

Lisanne Bainbridge published “Ironies of Automation” in the journal Automatica in 1983. Her central observation was that the designer of an automated system regards the human operator as unreliable and inefficient, and so tries to design them out, but cannot automate everything. What remains for the human is precisely the residue that could not be specified: the awkward, ambiguous, judgement-heavy fragments that defeated the engineering. The operator is left with the hardest parts of the job, stripped of the easier parts that used to keep their skills sharp, and asked to intervene in exactly the situations for which they are now least prepared.

Bainbridge was blunt about monitoring in particular. “The human monitor has been given an impossible task,” she wrote, noting that where a computer is making decisions faster and on more dimensions than a person can follow, “there is therefore no way in which the human operator can check in real-time that the computer is following its rules correctly.” She caught the training paradox too: it is ironic, she observed, to train operators in following instructions and then place them in the system to provide intelligence.

Substitute a large language model for a distributed control system and the paper reads like a memo from last week. The knowledge worker of 2026 has been handed the residue. Drafting a first version of a summary, a function, a customer reply: that was the tractable part, and it has been automated. What is left is knowing whether the draft is right, which requires knowing the domain, which was previously maintained by doing the tractable part.

The literature that followed quantified the failure modes she predicted. Raja Parasuraman and Dietrich Manzey's 2010 review in Human Factors, synthesising decades of empirical work on automation complacency and automation bias, reached conclusions that should be printed on the login screen of every enterprise assistant. Complacency emerges specifically under multiple-task load, when manual tasks compete with the automated task for attention. It appears in expert users as readily as in novices, and cannot be trained away with simple practice. Automation bias produces both errors of omission, where the person fails to act because the system did not flag a problem, and errors of commission, where the person acts wrongly because the system told them to. Neither is reliably prevented by instructions telling people to be careful.

Meanwhile the monitoring itself is not free. Joel Warm, Parasuraman and Gerald Matthews titled their 2008 Human Factors paper on the subject with unusual directness: vigilance requires hard mental work and is stressful. Sustained attention to a mostly reliable process is not a restful state between bouts of real work. It is a demanding task with measurable workload and stress costs, and performance on it degrades over time.

So the corporate framing, in which the human is elevated from doing to overseeing, describes a promotion. The human factors literature describes a transfer into a job that is cognitively expensive, psychologically taxing, unavoidably error-prone and, in most workplaces, entirely uncompensated.

Sixteen Developers Who Were Certain They Had Gone Faster

The most instructive evidence in this debate is a small randomised controlled trial with an awkward result and an unusually honest set of authors.

In 2025, the research organisation METR recruited sixteen experienced open-source developers working on repositories they personally maintained, projects averaging over 22,000 GitHub stars. It randomised 246 real issues from those repositories into two conditions: artificial intelligence tools permitted, or not permitted. Tasks averaged around two hours. Beforehand, the developers forecast that the tools would speed them up by twenty-four per cent.

They were nineteen per cent slower with the tools.

What happened next matters more than the slowdown. After completing the work, having lived through the actual elapsed time, the same developers estimated that artificial intelligence had made them twenty per cent faster. They were wrong by roughly forty percentage points about their own labour, in the direction of the tool, on tasks they had personally performed within the previous few hours.

That is the epistemological problem at the heart of every self-reported productivity statistic in this field, including the eleven hours in the Work AI Index. Generation feels fast because it is fast and visible. Verification feels like ordinary work because it is ordinary work, diffuse, arriving in fragments scattered through the day. People are demonstrably bad at summing the second category and comparing it to the first.

METR deserves credit for what it did afterwards. In February 2026 it announced it was redesigning the experiment. Its follow-up cohorts produced point estimates of a negative eighteen per cent speedup for the original developers, with a confidence interval from negative thirty-eight to positive nine per cent, and negative four per cent for newly recruited developers. The slowdown persisted in the point estimates but the intervals now straddled zero. More importantly, METR reported that developers were increasingly refusing to take part in conditions barring them from using the tools, that the pay rate had fallen from 150 dollars an hour to fifty, and that measuring elapsed time had become genuinely hard when participants ran multiple agents concurrently. “Due to the severity of these selection effects, we are working on changes to the design of our study,” the organisation wrote, adding that the true speedup among excluded developers could be considerably higher.

That is what intellectual honesty looks like, and it cuts both ways. Anyone citing the nineteen per cent slowdown as a settled fact about artificial intelligence in 2026 is overreaching. But the perception gap is the more durable finding, and nothing in the update disturbs it. The difficulty in the follow-up was not that developers had become good at estimating their own throughput. It was that the experiment could no longer isolate the variable, because people who use these tools will no longer agree to stop.

Why Checking Is Harder Than Doing

There is a structural reason verification consumes more time than intuition suggests, and it concerns the shape of machine error.

A junior colleague who does not know something produces work that signals its own uncertainty. The prose is hedged, the gaps are obvious, the citations are missing. A language model that does not know something produces work that is fluent, confident, correctly formatted and internally consistent. The error sits in a sentence that looks exactly like every true sentence around it. The cost of finding it is therefore not the cost of scanning for anomalies. It is the cost of independently establishing the truth of each load-bearing claim, which in the limit is the cost of having done the work yourself.

This is why the five-minutes-plus-fifteen arithmetic is not a transitional inconvenience that better models will erase. As accuracy rises, the frequency of error falls but the difficulty of detection rises, because a rarer error in more plausible packaging demands more sustained vigilance to catch. Parasuraman and Manzey's finding is precisely that reliable automation breeds the attentional withdrawal making occasional failure catastrophic. Better models make botsitting less frequent and more consequential at once.

The downstream costs have now been measured in money. In September 2025, BetterUp Labs and the Stanford Social Media Lab surveyed 1,004 full-time American desk workers about what they termed workslop: output with the appearance of good work but lacking the substance to advance the task. Forty per cent had received it in the preceding month, and respondents estimated that 15.4 per cent of the work reaching them fell into the category. Each incident took an average of one hour and fifty-one minutes to sort out, around twenty minutes longer than doing the work properly in the first place would have taken. Converted using respondents' own salaries, that came to roughly 186 dollars per employee per month, or more than nine million dollars a year for an organisation of ten thousand people. Managers were markedly more exposed than individual contributors, at fifty-four per cent against 38.5 per cent.

Note what workslop is in labour terms. It is botsitting skipped upstream, landing unpriced on somebody downstream. The person who declined to verify saved fifteen minutes. The person who received the output spent one hour and fifty-one. That is not productivity. It is a transfer of unpaid supervisory work between colleagues, with interest.

What Gets Measured Was Never Designed to See This

Organisations do have instruments for measuring cognitive workload. They simply do not use them for this.

The NASA Task Load Index, developed by Sandra Hart and Lowell Staveland in 1988 and still the most widely used subjective workload instrument in ergonomics, decomposes workload into six components: mental demand, physical demand, temporal demand, performance, effort and frustration. In its original form it asks respondents to weight those components against one another across all fifteen possible pairs. Hart's twenty-year retrospective in 2006 catalogued its spread across aviation, medicine and interface design.

Look at that list and notice how badly conventional workload accounting maps onto botsitting. Corporate measurement, where it exists at all, tracks temporal demand: hours worked, tickets closed, tasks completed. Mental demand, effort and frustration are exactly the dimensions supervision loads most heavily and timesheets record least. A worker who closes the same number of tickets while spending two extra hours a day in a state of alert scepticism about machine output registers, on every dashboard the employer owns, as having had an identical day.

This is where the sociology of work becomes more useful than the economics. Susan Leigh Star and Anselm Strauss published “Layers of Silence, Arenas of Voice” in the journal Computer Supported Cooperative Work in 1999, a foundational paper on invisible work in computer-supported systems. Their opening move was to insist that what counts as work is a matter of definition, not a matter of fact, and that designers routinely automate the visible portion of a process while remaining oblivious to the articulation work holding the arrangement together: the coordinating, contextualising, patching and repairing that never appears in a process diagram and therefore never appears in a budget.

Botsitting is articulation work. Supplying missing context to a model, deciding which of three plausible outputs matches what the client meant, knowing the tool has silently used a superseded policy document: this is the connective labour Star and Strauss described, now performed on behalf of a machine rather than a colleague. Their warning was that automating around invisible work does not eliminate it. It removes the vocabulary for discussing it.

The lifecycle synthesis of human-AI collaboration risks published on arXiv in August 2026 by Md Foysal Ahmed, Isaac Kobby Anni and Md Main Uddin Rony makes a compatible point in the language of risk taxonomy. Surveying evidence across healthcare, journalism, education, research, organisational decision-making and defence, the authors identify six recurring risk clusters that cut across domains: trust miscalibration, cognitive burden, accountability gap, capability erosion, goal misalignment, and AI anxiety and technostress. These are not separable engineering defects to be fixed one at a time, they argue, but interlocking sociotechnical dynamics cascading through four lifecycle stages, which is why piecemeal interventions frequently create unintended consequences. Cognitive burden and accountability gap sitting adjacent in the same taxonomy is no coincidence. They are one problem seen from the worker's side and the organisation's side.

The History of Labour-Saving Devices Is a History of Redistribution

There is a precedent for all of this, and it is not from computing.

Ruth Schwartz Cowan's “More Work for Mother”, published in 1983 and awarded the Society for the History of Technology's Dexter Prize the following year, asked why American housewives were working longer hours in 1970 than in 1870 despite a century of mechanisation. Washing machines, vacuum cleaners, gas ovens, commercial flour and refrigeration had all arrived. The hours had not fallen.

Cowan's answer was that the appliances did not eliminate labour. They redistributed it and then raised the standard it was held to. Work previously done by servants, husbands, children and commercial services was pulled back onto one person, while expectations for cleanliness, nutritional variety and laundry frequency rose to consume whatever slack the machines created. The technology was genuinely labour-saving per unit of output. Total labour rose anyway, because output expectations rose faster and the residual tasks landed on a single unpaid worker.

Read the Work AI Index against that and the shape is familiar. Eleven hours of unit-level saving, 6.4 hours of new residual labour, thirteen per cent of organisations reporting real improvement, and a rising expectation of volume absorbing the difference.

The digital version of this dynamic already has a well-documented lower tier. Mary L. Gray and Siddharth Suri's “Ghost Work”, published in 2019, described the invisible global workforce that fills the gaps automated systems cannot close: content flagging, transcription checking, data labelling, the human intervention that makes a service look seamless. Their formulation of the paradox is that the drive to eliminate human labour reliably generates new human tasks, and that those tasks are systematically hidden, poorly paid and structurally insecure. The most cited illustration remains Billy Perrigo's January 2023 investigation for TIME, which documented that OpenAI had used workers in Kenya, employed through the outsourcing firm Sama, to label descriptions of child sexual abuse, torture, self-harm and bestiality so that ChatGPT could learn to filter such material. They were paid between 1.32 and two dollars an hour.

The point for the office worker in 2026 is not that their situation is equivalent. It plainly is not. The point is that the industry has an established pattern of relying on human labour it declines to name, and that the pattern has migrated from the outsourced periphery to the salaried core. The mechanism is identical: apparent autonomy produced by human effort the accounting treats as external to the system.

Article 14 Turns You Into the Accountability Sink

Regulation has made the informal expectation of supervision into a legal duty, and in doing so has clarified who carries the risk.

Article 14 of the European Union's Artificial Intelligence Act requires that high-risk systems be designed so they “can be effectively overseen by natural persons during the period in which they are in use”. The overseeing person must be enabled to “properly understand the relevant capacities and limitations of the high-risk AI system and be able to duly monitor its operation”; to “remain aware of the possible tendency of automatically relying or over-relying on the output produced by a high-risk AI system (automation bias)”; to decide “not to use the high-risk AI system or to otherwise disregard, override or reverse” its output; and to interrupt the system through a stop button.

Read those clauses as a job description rather than a compliance obligation. They specify a role requiring domain expertise sufficient to override a machine, metacognitive awareness of one's own susceptibility to automation bias, and sustained vigilance across the operational life of the system. There is no corresponding requirement anywhere in the Act that this role be staffed, budgeted, timetabled or paid.

The timing is instructive. Those Article 14 obligations for standalone high-risk systems were originally due on 2 August 2026. The Digital Omnibus deferring them, agreed on 6 May 2026 and confirmed by member state representatives a week later, was published in the Official Journal on 24 July 2026 and entered into force on 27 July, six days before the deadline it displaced. The revised dates are settled law: 2 December 2027 for standalone high-risk systems, and 2 August 2028 for those embedded in products already covered by European Union product safety law. The Article 50 transparency duties stayed on the original schedule and took effect earlier this month.

So the expectation that a human will supervise the machine is already operating inside every workplace that has deployed one, and the legal duty to build machines that can actually be supervised has been postponed by sixteen months. That ordering places the burden on the human before it places the corresponding design obligation on the system.

Ben Green, in a 2022 paper in Computer Law and Security Review, surveyed forty-one policies mandating human oversight of government algorithms and found two connected flaws. The evidence suggests people cannot reliably perform the oversight functions the policies assume, and as a result the policies legitimise deployment of faulty systems without addressing what is wrong with them. His remedy was to shift accountability from individual oversight to institutional oversight.

Madeleine Clare Elish gave the failure mode its name. In “Moral Crumple Zones”, published in Engaging Science, Technology, and Society in 2019, she analysed accidents involving complex automated systems and observed that responsibility is routinely misattributed to the human closest to the failure, even where that human had minimal control over the system's behaviour. The crumple zone in a car absorbs impact to protect the occupant. The moral crumple zone absorbs blame to protect the integrity of the technological system, at the expense of the nearest operator.

Twenty-eight per cent of Work AI Index respondents admitted blaming artificial intelligence for their own mistakes. Elish's argument is that the institutional traffic runs overwhelmingly the other way.

The Skills You Stop Using Are the Skills You Need to Check With

Bainbridge's most uncomfortable prediction was that operators would lose the competence they needed for the interventions automation reserved for them. Medicine has now produced the cleanest demonstration.

In October 2025, The Lancet Gastroenterology and Hepatology published a multicentre observational study of endoscopist deskilling drawn from four Polish centres in the ACCEPT trial, which introduced computer-aided polyp detection at the end of 2021 and then randomised subsequent colonoscopies to proceed with or without artificial intelligence assistance. Nineteen experienced endoscopists, each with more than two thousand colonoscopies behind them, were studied. Their adenoma detection rate in unassisted colonoscopies fell from 28.4 per cent before exposure to the tool to 22.4 per cent afterwards, an absolute decline of six percentage points.

These were not trainees. They were highly experienced clinicians whose unaided performance degraded measurably after routine assistance, on a metric directly linked to cancer prevention.

The implication for botsitting is recursive and unpleasant. The supervisory role exists because the human is supposed to catch what the machine gets wrong. That requires the domain judgement previously maintained by performing the task unaided, which is exactly what the tool has removed. The capability erosion cluster in the arXiv risk taxonomy captures the structure: the intervention creating the need for oversight simultaneously degrades the capacity to provide it. Any organisation counting on human verification as its safety net is depending on a resource its own deployment strategy is quietly consuming.

Where the Productivity Actually Landed

The macro evidence is not that artificial intelligence does nothing. It is that the gains are real, narrow, and much smaller in aggregate than the discourse implies.

The strongest firm-level result remains the study by Erik Brynjolfsson, Danielle Li and Lindsey Raymond in the Quarterly Journal of Economics in 2025, examining the staggered rollout of a generative conversational assistant across 5,172 customer support agents. Access to the assistant raised issues resolved per hour by fifteen per cent on average. Crucially, the effect was concentrated among novice and lower-skilled workers, with minimal or slightly negative effects for the most experienced. The tool distributed the accumulated tacit knowledge of the best performers to everyone else.

That result is genuine and it is also specific. Customer support has high task volume, structured interactions, immediate feedback and low per-instance verification cost. It is the best case, and not obviously the case for legal drafting, engineering, medical documentation or financial analysis, where verifying an output can cost more than producing it and the consequences of an unverified error arrive months later.

The national statistics tell a thinner story. The US Bureau of Labor Statistics reported on 6 August 2026 that nonfarm business labour productivity rose at an annualised rate of 1.4 per cent in the second quarter of 2026, and 2.2 per cent measured against the second quarter of 2025, with output up 2.5 per cent and hours worked up 0.2 per cent over the year. Unit labour costs rose at an annualised 1.3 per cent in the quarter. These are respectable figures. They are not the signature of a technology that has removed eleven hours a week from the working lives of eighty-seven per cent of office workers.

The Upwork Research Institute, surveying around 2,500 people across the United States, United Kingdom, Australia and Canada in the spring of 2024, found the gap in its rawest form. Ninety-six per cent of C-suite leaders expected artificial intelligence to raise productivity. Seventy-seven per cent of employees using it said it had increased their workload. Forty-seven per cent did not know how to achieve the productivity gains their employers expected. One in three said they were likely to quit within six months because of burnout. Kelly Monahan, managing director of the institute, framed the conclusion carefully: it is possible for the technology to raise productivity and improve well-being simultaneously, but that outcome requires a fundamental change in how work and talent are organised, not merely a change in tooling.

Two years on, the Work AI Index suggests the reorganisation has not happened. What has happened is that the residual labour acquired a name.

Counting the Hour That Was Never Saved

Naming a thing is a precondition for measuring it, and measuring it is a precondition for paying for it. Here is what measurement would actually involve.

The first step is to stop treating verification as a discretionary activity performed by conscientious individuals and start treating it as a defined task with an estimated duration. That means workload models built on generation time plus verification time, with the second term populated from observation rather than optimism. The concept already exists. Work presented at the 2026 CHI conference on human factors in computing systems by Guangrui Fan, Dandan Liu, Lihu Pan and Rui Zhang constructed a behavioural verification-load index for programmers from observable signals including compile and test failures, code churn, pauses and context switches, and showed across sixty participants that it tracked both subjective burden and correctness. Notably, in that study the tools reduced measured workload and time on task while the verification-load metric still predicted accumulating stress and fatigue over repeated use. Both things can be true. The gains are real and the residual burden is real, and only one of them currently appears in any management report.

The second step is to use an instrument designed for the purpose. The NASA Task Load Index has been in continuous use for nearly four decades, is free, takes minutes to administer, and measures precisely the dimensions supervision loads and timesheets miss. There is no methodological obstacle to running it before and after deployment of a workplace assistant, only an incentive obstacle: the results might contradict the business case.

The third step is architectural. The paper on safe and responsible artificial intelligence agents submitted to arXiv in January 2026 by Edward Cheng, Jeshua Cheng and Alice Siu argues for a three-pillar model grounded in transparency, accountability and trustworthiness, and for staged autonomy achieved through progressive validation rather than immediate full automation, by explicit analogy with the incremental rollout of autonomous driving. Reviewing the state of the art, the authors point to Magentic-UI, an open-source interface platform for human-in-the-loop agentic systems, as an example of oversight embedded through structured, repeatable mechanisms: co-planning, co-tasking, action approval and answer verification. The significance for botsitting is that these are discrete, nameable, loggable events. An oversight step that exists as a defined interaction in software can be counted, timed, staffed and, if anyone chooses, paid for. Oversight existing only as a cultural expectation that someone will check cannot.

The fourth step is to treat oversight capacity as something an organisation builds rather than something it assumes. Yao Xie and Walter Cullen argued in a December 2025 arXiv paper that major ethics guidelines and laws, the EU AI Act explicitly included, call for effective human oversight without defining it as a distinct and developable capacity. Their proposal situates it within a well-being efficacy framework integrating artificial intelligence literacy, ethical discernment and awareness of human needs, on the grounds that people inevitably project desires, fears and interests onto these systems and that oversight therefore requires the competence to examine and, where necessary, restrain problematic demands.

That identifies the right object. Human oversight is not a checkbox and it is not a personality trait. It is a skill that decays without practice, costs energy to exercise, and is currently being demanded at scale from people who have received no training in it and no allowance for it.

The fifth step determines whether any of this reaches a pay packet, and it is contractual rather than technical. The mechanism by which invisible labour has historically become visible is not measurement alone. It is bargaining. Ben Green's argument for shifting from individual to institutional oversight points the same way: the question is not whether a given worker checked carefully enough, but whether the institution deploying the system created conditions under which careful checking was possible.

Which brings the argument back to the twenty minutes. If the task now takes five minutes of generation and fifteen of verification, the honest description is that the technology has changed the composition of the work without changing its duration, and has shifted its character from production, which most people find satisfying, to inspection, which the vigilance literature has shown for decades to be tiring, stressful and prone to exactly the errors it exists to prevent. That might still be worth doing. Verification scales in ways expertise does not, and the customer support evidence shows real gains where the economics line up.

But the hour supposedly saved is not available for redeployment if a substantial fraction of it was never saved. Counting it as though it were is not an optimistic forecast. It is a measurement error, and the people absorbing the difference are the ones holding the mouse at half past six, reading a paragraph for the third time, trying to work out whether the confident sentence in the middle of it is true.

---

References

1. Liji Narayan, “Bot sitting: When humans end up babysitting machines,” HRKatha, 18 August 2026. https://www.hrkatha.com/features/hr-pops-features/bot-sitting-when-humans-end-up-babysitting-machines/
2. Work AI Institute, Glean, “The Work AI Index 2026,” June 2026. https://www.glean.com/work-ai-institute/reports/work-ai-index
3. METR, “Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity,” 10 July 2025. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/
4. METR, “We are Changing our Developer Productivity Experiment Design,” 24 February 2026. https://metr.org/blog/2026-02-24-uplift-update/
5. Upwork Inc., “Upwork Study Finds Employee Workloads Rising Despite Increased C-Suite Investment in Artificial Intelligence,” 23 July 2024. https://investors.upwork.com/news-releases/news-release-details/upwork-study-finds-employee-workloads-rising-despite-increased-c
6. Lisanne Bainbridge, “Ironies of Automation,” Automatica, vol. 19, no. 6, 1983, pp. 775-779. https://www.sciencedirect.com/science/article/abs/pii/0005109883900468
7. Raja Parasuraman and Dietrich H. Manzey, “Complacency and Bias in Human Use of Automation: An Attentional Integration,” Human Factors, vol. 52, no. 3, June 2010, pp. 381-410. https://journals.sagepub.com/doi/10.1177/0018720810376055
8. Joel S. Warm, Raja Parasuraman and Gerald Matthews, “Vigilance Requires Hard Mental Work and Is Stressful,” Human Factors, vol. 50, no. 3, June 2008, pp. 433-441. https://journals.sagepub.com/doi/10.1518/001872008X312152
9. Sandra G. Hart, “NASA-Task Load Index (NASA-TLX); 20 Years Later,” Proceedings of the Human Factors and Ergonomics Society Annual Meeting, vol. 50, no. 9, October 2006, pp. 904-908. https://journals.sagepub.com/doi/10.1177/154193120605000909
10. Susan Leigh Star and Anselm Strauss, “Layers of Silence, Arenas of Voice: The Ecology of Visible and Invisible Work,” Computer Supported Cooperative Work, vol. 8, nos. 1-2, March 1999, pp. 9-30. https://dl.acm.org/doi/10.1023/A:1008651105359
11. Ruth Schwartz Cowan, More Work for Mother: The Ironies of Household Technology from the Open Hearth to the Microwave, Basic Books, 1983. https://www.hachettebookgroup.com/titles/ruth-schwartz-cowan/more-work-for-mother/9780465047321/
12. Mary L. Gray and Siddharth Suri, Ghost Work: How to Stop Silicon Valley from Building a New Global Underclass, Houghton Mifflin Harcourt, 2019. https://ghostwork.info/
13. Billy Perrigo, “Exclusive: OpenAI Used Kenyan Workers on Less Than $2 Per Hour to Make ChatGPT Less Toxic,” TIME, 18 January 2023. https://time.com/6247678/openai-chatgpt-kenya-workers/
14. BetterUp Labs and Stanford Social Media Lab, “Workslop: The Hidden Cost of AI-Generated Busywork,” September 2025. https://www.betterup.com/blog/hidden-costs-workslop
15. Erik Brynjolfsson, Danielle Li and Lindsey R. Raymond, “Generative AI at Work,” The Quarterly Journal of Economics, vol. 140, no. 2, May 2025, pp. 889-942. https://academic.oup.com/qje/article/140/2/889/7990658
16. “Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study,” The Lancet Gastroenterology and Hepatology, October 2025. https://www.thelancet.com/journals/langas/article/PIIS2468-1253(25)00133-5/abstract
17. European Union, Regulation (EU) 2024/1689, Article 14: Human Oversight. https://artificialintelligenceact.eu/article/14/
18. U.S. Bureau of Labor Statistics, “Productivity and Costs, Second Quarter 2026, Preliminary,” 6 August 2026. https://www.bls.gov/news.release/archives/prod2_08062026.htm
19. Gibson Dunn, “EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes,” 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
20. Ben Green, “The Flaws of Policies Requiring Human Oversight of Government Algorithms,” Computer Law and Security Review, vol. 45, 2022. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3921216
21. Madeleine Clare Elish, “Moral Crumple Zones: Cautionary Tales in Human-Robot Interaction,” Engaging Science, Technology, and Society, vol. 5, 2019, pp. 40-60. https://estsjournal.org/index.php/ests/article/view/260
22. Md Foysal Ahmed, Isaac Kobby Anni and Md Main Uddin Rony, “Toward Resilient Human-AI Collaboration: A Lifecycle Taxonomy of Sociotechnical Risks and Cascading Failures,” arXiv:2608.05614, 6 August 2026. https://arxiv.org/abs/2608.05614
23. Edward C. Cheng, Jeshua Cheng and Alice Siu, “Toward Safe and Responsible AI Agents: A Three-Pillar Model for Transparency, Accountability, and Trustworthiness,” arXiv:2601.06223, 9 January 2026. https://arxiv.org/abs/2601.06223
24. Yao Xie and Walter Cullen, “Beyond Procedural Compliance: Human Oversight as a Dimension of Well-being Efficacy in AI Governance,” arXiv:2512.13768, 15 December 2025. https://arxiv.org/abs/2512.13768
25. Guangrui Fan, Dandan Liu, Lihu Pan and Rui Zhang, “When Help Hurts: Verification Load and Fatigue with AI Coding Assistants,” Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems. https://doi.org/10.1145/3772318.3791176

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

Picture the first weeks of university, the specific loneliness of them. You have moved into a room in a city you do not know, surrounded by strangers who all seem, on the surface, to have found their people already. The group chats are humming with names you do not recognise. The dining hall is a geometry problem of where to sit. At night, in a narrow bed under an unfamiliar ceiling, the feeling arrives that everyone else received an instruction manual for belonging that you somehow missed. This is not an exotic experience. It is close to universal, and it is precisely the kind of ordinary, corrosive isolation that an entire industry now promises to dissolve with a chat window.

So a team of psychologists decided to test the promise directly. They took nearly three hundred first-semester students, split them into groups, and gave each group a different thing to do for two weeks. One group texted with another human being, a randomly assigned fellow first-year, a total stranger. One group chatted every day with a purpose-built artificial companion engineered to behave like the most supportive friend imaginable, endlessly attentive, warm, and validating. And one group, the control, simply wrote a single sentence about their day in a private journal. At the start and again at the end, everyone completed the same standard questionnaire that clinicians and researchers use to measure how lonely a person feels.

The result is the kind of finding that ought to give a booming industry pause. Only the students who texted a real human being felt measurably less lonely afterwards. The ones who chatted with the AI companion, the product deliberately designed to be the ideal comforting presence, did no better than the ones who wrote a sentence to themselves in a diary. Given every conceivable advantage, engineered specifically to win, the machine drew level with a notebook.

What the experiment actually found

The study was led by Ruo-Ning Li, a doctoral candidate in psychology at the University of British Columbia, working with the UBC happiness researcher Elizabeth Dunn and collaborators at the University of Pennsylvania, among them Dunigan Folk, Abhay Singh and the computer scientist Lyle Ungar. It was published in the Journal of Experimental Social Psychology in the spring of 2026 under a title that states its question plainly: whether a random human peer is better than a highly supportive chatbot at reducing loneliness over time. The design was a randomised controlled trial, the gold standard of experimental evidence, involving 296 students in their first semester at university, the exact population most exposed to the loneliness the study set out to probe.

Participants were assigned to one of three conditions and asked to keep to it for two weeks. In the human condition, each student was paired at random with another first-year and the two exchanged text messages. In the chatbot condition, students conversed daily with a custom generative AI companion the researchers had built and instructed to listen actively, show empathy, and behave as a friendly, positive and supportive presence, checking in and validating feelings. In the control condition, students wrote a single-sentence journal entry each day. Loneliness was measured with the UCLA Loneliness Scale, the most widely used instrument of its kind in psychological research, administered before the intervention began and again on the fifteenth day.

The headline outcome was stark. The students who texted a human peer showed a genuine, statistically meaningful decline in loneliness over the fortnight, on the order of a nine per cent reduction. The students who chatted with the AI companion registered a reduction of roughly two per cent, indistinguishable from the journaling group who received no social contact at all. This was not because the chatbot did nothing. It reliably lifted people's mood in the moment; talking to it made them feel a little better in the short term. But feeling briefly better and becoming less lonely turned out to be two different things, and only human contact delivered the second.

There is a further detail that deserves attention, because it undercuts the most obvious objection. One might assume the machine lost simply because it was cold, robotic, or unconvincing, the familiar clumsiness of a customer-service bot. The opposite was true. The AI companion, by design and in practice, expressed more overt empathy and validation than the human partners did. The humans were ordinary eighteen-year-olds, awkward, distractible, sometimes slow to reply, occasionally unsure what to say. The bot was tireless and effusive. And still the awkward humans won. Whatever the students paired with a stranger were getting, it was not a superior grade of sympathy. It was something else entirely.

Why the chatbot lost when the deck was stacked in its favour

It is worth dwelling on how heavily the experiment was rigged in the machine's favour, because that is what makes the outcome so instructive. This was not a fair fight that the AI narrowly lost. It was a fight the researchers set up specifically to give the AI every advantage, and it still could not win.

Consider the human comparison group. These were not trained counsellors or charismatic extroverts selected for their warmth. They were randomly paired first-year students, people with no particular skill at emotional support, no obligation to be kind, no script. A stranger texting a stranger is a low bar. Anyone who has endured a stilted exchange with someone they have just met knows how thin and effortful such contact can be. The messages were, by any measure, a modest intervention, the sort of thing that costs nothing and requires no infrastructure beyond a phone.

Now consider the machine. It had been purpose-built for this. It never got bored, never had an exam of its own to revise for, never left a message on read for six hours because it was asleep or sulking or busy. It had been explicitly instructed to be maximally supportive, to listen and validate and check in, to perform the role of the perfect friend without any of the friction a real friend brings. If effusive, always-available emotional support were the active ingredient in curing loneliness, the chatbot should have romped home. It had more of that ingredient than the humans could ever muster, delivered on demand at three in the morning.

Instead it tied with a diary. The lead author had, by her own account, expected a different result, anticipating that interacting with the AI might prove roughly as helpful as texting a fellow student. That expectation was reasonable. The industry has spent years and billions of dollars insisting it is true. The experiment simply did not cooperate. And because the trial was deliberately constructed to flatter the machine, its failure cannot be waved away as a matter of the technology not yet being good enough. The chatbot was good. It was warm, responsive and articulate. Being warm, responsive and articulate turned out not to be the thing that mattered.

The strange arithmetic of giving something back

If not empathy, then what? The researchers' explanation is deceptively simple, and it inverts almost everything the marketing of AI companionship assumes. What made the difference, they argue, was not what the students received but what they were able to give.

When a person texts a struggling stranger, the exchange runs in both directions. You are not merely the object of someone else's attention; you are also called upon to attend to them. The other first-year is nervous too, homesick too, unsure too. In responding to that, in offering a word of reassurance or asking how their week has been, the lonely student becomes, briefly, someone who matters to another person, someone whose care has a destination and an effect. The study found that participants were markedly more likely to offer support back when their partner was human than when it was the chatbot. The human condition activated a loop of mutual care. The AI condition did not, because there was no one on the other side who needed anything.

Li put the mechanism directly. When you are talking with a chatbot, she observed, you never have the chance to give something back; human connection has this back and forth of receiving and giving support that makes us feel we matter. That last word is the hinge of the whole finding. Feeling less lonely, it turns out, is not simply a function of being cared for. It depends just as much on having someone to care for, on the sense that your existence registers in another mind, that you could be missed, that your kindness lands somewhere real.

This is not a soft or sentimental claim. It aligns with one of the oldest and most robust ideas in social science. In 1960 the sociologist Alvin Gouldner published a landmark analysis arguing that a norm of reciprocity, the moral expectation that we return the good we receive, is one of the near-universal principal components of human moral codes, present across cultures and foundational to the stability of social life. We are wired, individually and collectively, around exchange. A relationship in which the flow runs only one way, in which one party gives endlessly and the other only takes, is not experienced as a relationship at all. It is experienced as consumption. The AI companion, however solicitous, can only ever be consumed. It has no needs for you to meet, no vulnerability for you to answer, no capacity to actually receive the care you might offer it. You can type “I hope you're okay” to a language model, but there is no one there for whom it could be true.

This reframes the entire proposition of the companion-app industry. These products are sold as devices for receiving support, and at that narrow task they may even succeed; the study found the bot did lift mood in the moment. But loneliness is not a deficit of support received. It is, at least in significant part, a deficit of mattering, of being needed, of having a place in the web of mutual obligation that binds people together. And mattering is precisely the one thing a machine that needs nothing can never provide, no matter how advanced it becomes. This is not a limitation of the current generation of models, to be solved by the next. It is structural. An entity that cannot genuinely be helped cannot let you experience yourself as a helper.

A problem the World Health Organization now calls a threat

The reason any of this reaches beyond a psychology department is the sheer scale of the ailment these products claim to treat. Loneliness has, in the space of a few years, been reclassified from a private melancholy into a public-health emergency, and by some of the most authoritative bodies in global medicine.

In June 2025 the World Health Organization's Commission on Social Connection published its landmark report, bluntly titled as a path from loneliness to social connection, and the numbers it assembled are difficult to absorb. Around one in six people worldwide, the commission estimated, is affected by loneliness. The consequences are not merely emotional. Loneliness and social isolation were linked to an estimated one hundred deaths every hour, more than 871,000 deaths a year across the period studied, through elevated risks of cardiovascular disease, stroke, type 2 diabetes, depression and anxiety. Social isolation, the commission noted, reaches even further into certain groups, affecting up to one in three older adults and as many as one in four adolescents. The report framed social connection not as a lifestyle luxury but as a neglected pillar of health, alongside diet and exercise, and called for a coordinated global response.

This built on an alarm already sounded in the United States. In May 2023 the Surgeon General, Vivek Murthy, issued a formal advisory declaring loneliness and isolation an epidemic and a public-health crisis, reporting that roughly half of American adults had experienced measurable loneliness and that the mortality impact of chronic social disconnection was comparable to smoking as many as fifteen cigarettes a day, and greater than that of obesity or physical inactivity. The advisory laid out, for the first time, a national strategy to rebuild social connection.

Two things follow from this. The first is that the demand the companion-app industry is meeting is genuine and enormous; the loneliness is real, it is widespread, and it is killing people. The second, more uncomfortable point is that a market this large, addressing a need this acute and this painful, is an extraordinary commercial opportunity, and it is being treated as exactly that. When a condition afflicts a sixth of humanity and is officially designated a lethal threat, the incentive to sell a cheap, scalable, always-available remedy is nearly irresistible, whether or not the remedy works. The UBC study is, in effect, a small trial of that remedy against a placebo. The remedy did not beat the placebo.

The hundreds of millions who already talk to machines

It would be one thing if AI companionship were a niche curiosity, a handful of enthusiasts talking to their phones. It is not. It is already one of the most widely adopted categories of consumer software on earth, and its growth is vertical.

The scale is genuinely hard to hold in the mind. China's Xiaoice, one of the earliest and largest social-chatbot platforms, has been reported to serve on the order of 660 million users. Character.AI, the platform most associated with immersive companion conversation, reported in the region of 233 million registered users by early 2026, with its youngest adult cohort, those aged eighteen to twenty-four, spending well over an hour a day on the service across dozens of daily sessions. Replika, one of the first apps to market an AI companion explicitly as a friend or partner, counts users in the tens of millions. Industry trackers estimated that companion applications across the major app stores had surpassed 220 million cumulative downloads by mid-2025, with downloads climbing by close to ninety per cent year on year. One qualifier is worth entering, because registered totals are the industry's most flattering metric rather than its most honest: a sign-up is not a habit. Character.AI's monthly active users are reckoned to have peaked at around 28 million in mid-2024 and drifted back to roughly 20 million by early 2026, so at the level of an individual platform the engaged audience has plateaued even as cumulative registrations climb. The category-level picture is unaffected. By any reasonable count, the number of people who now maintain some kind of ongoing relationship with an artificial companion runs to the hundreds of millions.

Crucially, a large share of them are there for precisely the reason the UBC study interrogated. Emotional support consistently ranks among the leading motivations users give for adopting these apps, cited in roughly four in ten cases in some surveys, and a substantial minority of users describe themselves as living with mental-health difficulties. These are not people using a chatbot to draft an email. They are people using it to feel less alone. And the apps encourage exactly that framing. The value proposition, stated or implied, is companionship on demand: something that is always awake, always interested, never judgmental, available at the precise three-in-the-morning moment when human support networks have gone quiet. It is, in marketing terms, loneliness relief as a subscription.

Set the marketing beside the evidence and a gap opens up. The apps are sold, to hundreds of millions of people, many of them lonely and some of them vulnerable, as a genuine answer to isolation. The most rigorous test yet conducted of that claim found that the answer, even when engineered to be as good as it could possibly be, performed no better than keeping a diary. That is not a small discrepancy between advertisement and reality. It is close to the whole distance between them.

What loneliness actually is, and why comfort is only half of it

To understand why the machine fails at the specific task of curing loneliness while succeeding at the adjacent task of providing comfort, it helps to be precise about what loneliness is. It is not the same as being alone, nor is it simply sadness. Loneliness is the distressing gap between the connection a person has and the connection they want. It is fundamentally relational, a felt deficit in one's standing among other people. And that is why a one-directional stream of validation, however pleasant, cannot close it.

The companion apps are optimised, whether their makers frame it this way or not, for a slightly different objective: the reduction of momentary negative feeling. On that metric they perform. The UBC chatbot demonstrably eased people's low moods in the short term, and there is no reason to doubt that millions of users derive real, if temporary, relief from confiding in a system that always responds and never criticises. This matters, and it would be dishonest to dismiss it. A person in acute distress at midnight, with no one to call, may genuinely be helped by a warm response from a machine. The relief is not fake.

But relief is not connection, and the study draws the line between them with unusual clarity. Comfort is something you take. Connection is something you take part in. The lonely student texting a stranger was not merely being soothed; they were being drawn into a relationship, however provisional, in which they had a role to play and a person to matter to. That participation is doing the therapeutic work. The chatbot offers the soothing without the participation, the reception without the reciprocity, and the study suggests that the participation was the active ingredient all along. You cannot cure a relational deficit with a product that, by its nature, cannot form a relationship, only simulate one side of it.

There is a subtler risk lurking here too, one the two-week trial was not built to detect but which longer-term research has now begun to document. If the momentary comfort of a compliant companion is easier to obtain than the effortful, uncertain, sometimes painful work of reaching out to another human being, some users may substitute the former for the latter. The diary-equivalent result over two weeks is the optimistic reading. The pessimistic reading is that a frictionless source of one-way comfort could quietly crowd out the reciprocal human contact that actually works, leaving a person more isolated over months even as they feel momentarily better each night.

When the trial was published, that was speculation. It is no longer. Two of the trial's own authors, Dunigan Folk and Elizabeth Dunn, went on to ask what happens when the observation window is stretched from a fortnight to a year. Their longitudinal study, published in Psychological Science in 2026, tracked more than two thousand adults across four Western countries over twelve months, and found a relationship that runs in both directions but not symmetrically. Feeling less socially connected predicted a subsequent increase in the use of social chatbots, which is intuitive enough; lonely people reach for the thing that promises to help. The harder half of the finding is the return leg. Increased social chatbot use predicted greater loneliness later on. The authors are scrupulous about the limits of this, describing their analysis as exploratory, and that caution deserves to be reported rather than quietly dropped. But the direction of travel is precisely the one the two-week experiment could only gesture at.

A second study, conducted at Stanford and published in Nature Human Behaviour in August 2026, arrives at the same territory by a different route. Yutong Zhang and Dora Zhao surveyed 1,131 users of Character.AI recruited through Prolific, 244 of whom donated their complete chat transcripts, allowing the researchers to examine what people actually did rather than what they remembered doing. Users with limited social networks who sought emotional support from AI chatbots showed lower well-being. The researchers describe a vicious circle: people with sparse social connections are drawn into intense companion use, that use displaces further real-world contact, and the isolation deepens accordingly. They note, pointedly, that these systems are designed to maximise engagement, encouraging prolonged interaction without addressing whatever is causing the loneliness in the first place. Optimising for time spent and optimising for a user who no longer needs you are not the same objective, and where the two conflict the commercial logic is not ambiguous.

None of this is proof. Longitudinal correlation is not causation, and a person already sliding into isolation may reach for the chatbot precisely because they are sliding, which would make the technology a symptom as much as an accelerant. The two-week experiment certainly cannot settle it. But the concern that its central finding invited has stopped being a hypothetical raised by critics. It is now the pattern that emerges when the same behaviour is watched for long enough.

Social junk food and the seduction of the effortless

One of the study's co-authors reached for a metaphor that captures the problem with unusual economy. Dunigan Folk described the AI companion as a kind of social junk food, something that might taste good and satisfy a craving in the moment but does not nourish us the way real human relationships do. The comparison is worth taking seriously, because it explains both the appeal and the inadequacy of the product in a single image.

Junk food is not a scam. It delivers real, immediate pleasure; it genuinely quiets hunger for a while. Its problem is not that it does nothing but that it does the wrong thing efficiently, satisfying the surface signal of a need while leaving the underlying requirement unmet, and doing so in a form engineered to be more moreish than the nutritious alternative. An AI companion, by this analogy, is optimised for palatability. It tells you what soothes. It agrees. It admires. It never presents you with the small, character-forming frictions of a real other person: the friend who is preoccupied with their own troubles, the acquaintance who disagrees, the reciprocal demand to show up for someone when it is inconvenient. Those frictions are not defects in human relationship. They are the mechanism by which relationship does its work, the resistance against which the muscle of connection is built.

Strip them out and you are left with something that feels like friendship and functions like consumption. The seduction is precisely the effortlessness. Reaching out to a human stranger is risky and awkward; you might be ignored, misread, or gently rebuffed. Opening the app carries none of that risk. It will always answer, always warmly. But the study suggests that the risk and the effort were not obstacles to the cure. They were part of it. The vulnerability of extending yourself to another person who might not respond is inseparable from the reward of connecting with one who does. A system that removes the vulnerability removes the reward along with it, and hands you a snack in place of a meal.

This is why the technological trajectory offers less reassurance than it first appears. The industry's implicit promise is that today's shortcomings are temporary, that a more capable, more emotionally intelligent, more convincingly human model will close the gap. But the gap the UBC study identified is not a gap in capability. A more advanced companion will be a more persuasive social junk food, better at delivering the palatable one-way comfort, and no closer to offering the reciprocal mattering that the finding says is the operative ingredient. You cannot engineer your way to genuine reciprocity with an entity that has nothing at stake. Making the illusion more convincing does not make it less of an illusion.

The disclosure question the industry would rather avoid

Which brings us to the sharpest practical question the research raises. If a product is marketed, to hundreds of millions of people, as a remedy for a lethal and widespread condition, and the best available evidence indicates it does not actually remedy that condition, does the company selling it owe the buyer an honest account of what they are getting? Should a company marketing AI companionship as a genuine cure for loneliness be required to say plainly that the leading trial found it no more effective than a diary?

The regulatory ground is beginning, unevenly, to shift towards yes, though largely for reasons of safety rather than efficacy. In October 2025 the state of California enacted Senate Bill 243, signed by Governor Gavin Newsom and effective from January 2026, one of the first laws anywhere written specifically to govern companion chatbots. It defines a companion chatbot with revealing precision as a system producing adaptive, human-like responses designed to meet a user's social or emotional needs, a definition that names exactly the function the UBC study tested. The statute obliges operators to disclose to users, where a reasonable person might be misled, that they are interacting with a machine; to remind minors at regular intervals that the companion is not human; to maintain protocols for handling expressions of suicidal ideation and self-harm; and, notably, it grants harmed individuals a private right of action to sue. California was not alone. New York enacted a companion-chatbot law of its own in the same legislative season, obliging operators to detect and refer expressions of suicidal ideation and to remind users at regular intervals that they are not speaking to a person. Around the same period the United States Federal Trade Commission opened a formal inquiry into the companion-chatbot practices of the largest operators, among them Alphabet, Meta, Character Technologies, OpenAI, Snap and xAI, seeking to understand how these products affect users, particularly young ones. Federal legislators have since moved further in the same direction. The bipartisan GUARD Act, the Guidelines for User Age Verification and Responsible Dialogue, was introduced in the Senate as S.3062 by Josh Hawley and Richard Blumenthal and advanced unanimously to the Senate floor by the Judiciary Committee, with a House companion bill introduced on 30 April 2026 by Representatives Valerie Foushee and Blake Moore. It would bar minors from AI companions altogether, require age verification, oblige chatbots to disclose that they are not human, and create criminal penalties for companies whose companions solicit or produce sexual content with minors. Whether it becomes law is a separate question; it has attracted opposition from privacy and First Amendment organisations, and its ultimate prospects remain uncertain.

But look closely at what these measures address and what they leave untouched. They are almost entirely concerned with disclosing that the companion is artificial and with preventing acute, catastrophic harm, above all to children. They compel a company to admit that the friend is a machine. They do not, so far, compel it to admit that the machine may not do the thing it is sold to do. The GUARD Act makes the point rather than complicating it: the most aggressive federal proposal on the table concerns who may use these products and whether they must confess their own artificiality, not whether they work. There is a meaningful difference between a label that says this is not a real person and a label that says this has not been shown to make you less lonely. The first is about the nature of the product. The second is about its effectiveness, and it is the second that the UBC finding puts in question.

We regulate this kind of gap in other domains without much hesitation. A supplement that claimed to cure a disease it had been tested against and failed to beat a placebo would attract the immediate attention of medicines regulators. Advertising that promised a health outcome unsupported by evidence would run into truth-in-advertising rules. Yet AI companionship occupies an awkward interstice: too intimate and consequential to be a mere novelty, too unproven to be a treatment, and marketed with therapeutic language it has not earned. When the WHO has declared loneliness a threat that kills, a product sold as loneliness relief is trading on a health claim, whether or not it uses the clinical word. The honest disclosure the evidence would seem to warrant is not a warning that the companion is fake. It is a warning that, as a cure for the specific thing it is sold to cure, it may not work.

None of this requires banning the products or pretending they help no one. The momentary comfort they provide is real and, for some people at some hours, valuable. The argument is narrower and harder to refuse: that people paying for a remedy deserve to know what the best evidence says the remedy actually delivers, so that a lonely person does not spend months confiding in a machine under the impression that they are addressing their isolation, when the very study designed to give that machine every advantage found it worked no better than writing a sentence in a notebook. Informed consent is not a radical demand. It is the ordinary price of selling something to the vulnerable.

What a lonely person is actually asking for

Return, at the end, to the student in the narrow bed under the unfamiliar ceiling. What the research quietly reveals is that the request they are making, when they reach for connection, is not the request the industry has assumed. They are not primarily asking to be listened to, validated, or soothed, though all of that is pleasant and the machine supplies it in abundance. They are asking, at a level deeper than they could probably articulate, to matter to someone. To be needed. To have somewhere to put their own care and see it received. That is a request no product engineered to need nothing can grant, because the granting of it depends entirely on there being a real other on the far side of the exchange, someone whose day your kindness could genuinely improve.

This is the quiet subversion at the heart of a modest two-week experiment. The whole premise of AI companionship is that loneliness is a problem of insufficient supply, a shortage of attention and warmth to be solved by manufacturing an infinite, tireless font of both. The study suggests the premise is wrong. Loneliness is not mainly a shortage of what we receive. It is a shortage of the chance to give, to be relied upon, to be woven into the reciprocal fabric of other lives. And so the more perfectly a companion is optimised to give without needing, the more precisely it misses the point, offering a flood of the one thing that was never actually scarce while withholding, structurally and permanently, the thing that was.

The result was that texting a stranger, awkwardly, for two weeks, beat the most supportive artificial friend that could be built. Not because the stranger was kinder. The stranger was almost certainly less kind, less patient, less available than the machine. The stranger won because the stranger needed something back, and in needing it, gave the lonely student the one gift the machine cannot: the experience of being someone who matters to someone else. That is what the lonely are asking for. It is worth being honest, with them and with ourselves, that it is not what the machines are selling.

References

1. Li, R.-N., Folk, D., Singh, A., Ungar, L., & Dunn, E. “Is a random human peer better than a highly supportive chatbot in reducing loneliness over time?” Journal of Experimental Social Psychology, 2026. https://www.sciencedirect.com/science/article/pii/S0022103126000417
2. University of British Columbia. “Texting with a stranger beats a chatbot at easing loneliness.” UBC News, April 2026. https://news.ubc.ca/2026/04/texting-with-a-stranger-beats-a-chatbot-at-easing-loneliness/
3. University of British Columbia, Department of Psychology. “Texting with a stranger beats a chatbot at easing loneliness.” April 2026. https://psych.ubc.ca/news/texting-with-a-stranger-beats-a-chatbot-at-easing-loneliness/
4. Li, R.-N., Folk, D., Singh, A., Ungar, L., & Dunn, E. “Is a Random Human Peer Better Than a Highly Supportive Chatbot in Reducing Loneliness Over Time?” SSRN working paper, abstract 5704772. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5704772
5. 404 Media. “Texting a Random Stranger Better for Loneliness Than Talking to a Chatbot, Study Shows.” 2026. https://www.404media.co/chatgpt-loneliness-study-college-students-random-strangers-texting/
6. Folk, D., & Dunn, E. “How Does Turning to AI for Companionship Predict Loneliness and Vice Versa?” Psychological Science, vol. 37, no. 4, 2026. https://doi.org/10.1177/09567976261427747
7. Stanford University. “AI companions may worsen loneliness for vulnerable users.” Stanford Report, August 2026. https://news.stanford.edu/stories/2026/08/ai-companions-chatbots-loneliness-research
8. World Health Organization. “From loneliness to social connection: charting a path to healthier societies – Report of the WHO Commission on Social Connection.” 30 June 2025. https://www.who.int/publications/i/item/978240112360
9. World Health Organization. “Social connection linked to improved health and reduced risk of early death.” 30 June 2025. https://www.who.int/news/item/30-06-2025-social-connection-linked-to-improved-heath-and-reduced-risk-of-early-death
10. London School of Hygiene & Tropical Medicine. “Expert Comment: Loneliness impacting 1 in 6 people, WHO report finds.” July 2025. https://www.lshtm.ac.uk/newsevents/news/2025/expert-comment-loneliness-impacting-1-6-people-who-report-finds
11. U.S. Department of Health and Human Services, Office of the Surgeon General. “Our Epidemic of Loneliness and Isolation: The U.S. Surgeon General's Advisory on the Healing Effects of Social Connection and Community.” May 2023. https://www.hhs.gov/sites/default/files/surgeon-general-social-connection-advisory.pdf
12. Gouldner, A. W. “The Norm of Reciprocity: A Preliminary Statement.” American Sociological Review, vol. 25, no. 2, 1960, pp. 161–178. https://www.jstor.org/stable/2092623
13. Electro IQ. “AI Companions Statistics By Usage, Market Size, Apps and Facts (2025).” 2025. https://electroiq.com/stats/ai-companions-statistics/
14. TS2 Space. “Virtual Lovers and AI Best Friends: Exploring the Booming World of AI Companion Apps in 2025.” 2025. https://ts2.tech/en/virtual-lovers-and-ai-best-friends-exploring-the-booming-world-of-ai-companion-apps-in-2025/
15. California Legislative Information. “Senate Bill (SB) 243 – Companion chatbots.” 2025–2026 Session. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB243
16. Morrison Foerster. “New York and California Enact Landmark AI Companion Laws: What Operators Need to Know.” November 2025. https://www.mofo.com/resources/insights/251120-new-york-and-california-enact-landmark-ai
17. Federal Trade Commission. “FTC Launches Inquiry into AI Chatbots Acting as Companions.” 11 September 2025. https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions
18. U.S. Congress. “S.3062 – GUARD Act.” 119th Congress (2025–2026). https://www.congress.gov/bill/119th-congress/senate-bill/3062/text
19. The Lancet Public Health. “Social health—the neglected third pillar.” 2025. https://www.thelancet.com/journals/lanpub/article/PIIS2468-2667(25)00175-6/fulltext

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

The most consequential sentence in American higher education this month is six words long, and takes two seconds to type.

“Log in and complete my quiz.”

Reporting by Dana Goldstein and Alan Blinder for the New York Times, published on 10 August 2026, established that this instruction now works. Not as a demonstration, not as a jailbreak, but as ordinary consumer software doing what it was built to do. An agentic browser takes the credentials, opens Canvas or Blackboard or Brightspace, watches the prerecorded lecture, sits the test, drafts the paper and posts into the discussion forum, where it converses with classmates who may themselves be agents. The student is elsewhere, and may be asleep.

Notice what is absent. There is no deception directed at the machine, no prompt engineering, no attempt to evade a filter. The Times tested the three tools most used by students, ChatGPT, Gemini and Grammarly, and found none refused a request to write a paper on a student's behalf. None of the companies prevents its agents logging into learning management systems. Educators have asked the AI firms to make agents identify themselves inside course platforms, and the firms have declined. Perplexity told the Times such a requirement “would put the student's privacy and security at risk”, a remarkable sentence from a company arguing its software should be permitted to impersonate an enrolled human inside an institution that will later certify that person as competent.

The exposure is not marginal. Analysis of federal IPEDS data for autumn 2024, published by the education market analyst Phil Hill in January 2026, found 26.5 per cent of American postsecondary students enrolled exclusively in distance education, rising to 40.5 per cent of graduate students, with roughly 54.8 per cent taking at least one online course. More than half of American college students took an online class last year, up from about a third in 2019. A quarter to a half of the sector's assessed output now passes through a channel in which the only evidence a human was present is a login session and a timestamp.

Six Words Are the Entire Attack Surface

What makes agentic cheating different is not sophistication. It is the collapse of the seam. Contract cheating required a transaction, a counterparty, a payment trail and a delivered file the student then submitted under their own name. Chatbot cheating required copying, pasting and, if the student was careful, some rewriting. Both left a boundary somewhere: a moment at which the student's work stopped and someone else's began.

The agent removes the seam. It does not hand the student a file. It operates the account. The submission originates from the student's session, at the student's IP address, at a plausible hour and pace, with the mouse movements and dwell times of a person reading. Reporting by Frank Landymore in Futurism on 13 August 2026 drew the consequence: professors cannot fall back on supervised examinations and oral presentations in a course where everything happens behind a screen. Digital Trends, covering the same Times reporting that day, stated what most institutions have declined to say aloud, which is that the question is no longer whether AI can help a student cheat on an assignment but whether a student can complete an entire degree without doing much of the learning.

Platforms can look for behavioural tells: time on task, session patterns, the rhythm of navigation. The Times reported no fail-safe way to block agentic cheating, and the reason is structural rather than technical. Any signature that distinguishes an agent from a diligent student is a signature the agent can be instructed to imitate, and the imitation costs the student nothing, because the student is not the one doing the waiting.

The Detector Was Never Going to Hold This Line

The institutional response, reported by Kathryn Palmer in Inside Higher Ed on 5 August 2026, is that universities have stopped pretending detection works.

Yale, Vanderbilt, Johns Hopkins and Indiana have adopted policies banning or discouraging reliance on AI detection software as the sole evidence of alleged cheating. At least a dozen institutions, including Northwestern, Georgetown and New York University, have switched off Turnitin's AI detection feature entirely. The updated Faculty AI Playbook at Indiana's Kelley School of Business tells staff that tools claiming to detect AI use “are highly unreliable” and advises them to design assignments encouraging process, reasoning and authentic engagement instead.

This is a retreat, and it is the correct one. The evidence against detection has accumulated for three years and it is not close.

Vanderbilt was early and unusually candid about the arithmetic. In August 2023 its Brightspace team disabled Turnitin's AI detector and published its reasoning. The university had submitted roughly 75,000 papers to Turnitin in 2022. At the 1 per cent false positive rate Turnitin advertised at launch, that implied around 750 papers wrongly flagged in one year at one institution. Vanderbilt also noted that Turnitin disclosed no detail about how its classifier reached a verdict, and that detectors disproportionately flag writing by non-native English speakers.

That second objection has the strongest empirical backing of anything in this field. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu and James Zou of Stanford University published a study in Patterns in July 2023 running seven widely used GPT detectors over TOEFL essays by non-native English speakers and over essays by American eighth-graders. The detectors classified the native-speaker writing with near-perfect accuracy. They classified 61.3 per cent of the non-native essays as AI generated, all seven unanimously flagged 19.8 per cent of them, and at least one detector flagged 97.8 per cent. Detectors key on text perplexity, penalising writers with a narrower range of expression. When the researchers used ChatGPT to enrich the vocabulary of the same essays, the false positive rate fell to 11.6 per cent. The surest way to stop a detector accusing a foreign student of using AI was to have AI rewrite their essay.

Turnitin reviewed more than 200 million papers in the first year of its detection feature, roughly 11 per cent of which contained at least 20 per cent AI writing, and its guidance puts the sentence-level false positive rate at around 4 per cent, which is not a rounding error when a single flagged paragraph is what a misconduct panel is looking at. The detectors fail in the other direction too. Peter Scarfe, Kelly Watcham, Alasdair Clarke and Etienne Roesch at the University of Reading ran the most rigorous real-world test of the proposition, published in PLOS ONE in June 2024, inserting AI-generated submissions into live undergraduate psychology assessments without the markers' knowledge. Ninety-four per cent went undetected. The AI submissions attained grades on average half a grade boundary above those of the real students.

Jennifer Frederick, executive director of Yale's Poorvu Center for Teaching and Learning, and Alfred Guy, who directs its undergraduate writing and tutoring programmes, gave Inside Higher Ed the clearest statement of why Yale stepped back. Evidence shows, they wrote, that “humanizing” programs are very successful at reducing or eliminating the percentage of AI usage that is detected, and they wanted to avoid “the inevitable cat and mouse game created by AI detection tools”. Their objection was not that the arms race is unwinnable but that it is beside the point. “This becomes a technical exercise rather than a learning event.”

The cost of getting it wrong is not abstract. Haishan Yang, a third-year PhD student in health economics at the University of Minnesota, sat an eight-hour preliminary examination remotely in August 2024 and was expelled the following January after faculty graders concluded, partly from AI detection software and ChatGPT comparisons, that his essays were machine-written. Yang denied it and sued. A federal court dismissed his due process claim in October 2025 and the Minnesota Court of Appeals affirmed the expulsion in February 2026. Whatever the merits of that case, its shape is what matters: an unreliable instrument, a career-ending sanction, and a burden of proof no party can discharge.

The Only Numbers Anyone Has Are the Numbers of the Caught

Abandoning detection has a consequence universities have not absorbed. The sector's statistical picture of academic misconduct is a record of enforcement, not behaviour, and enforcement has just been switched off.

The best longitudinal data comes from the United Kingdom. Michael Goodier, reporting for the Guardian on 15 June 2025, obtained figures under the Freedom of Information Act from 131 of 155 universities. Proven cases of AI-related cheating reached almost 7,000 in 2023-24, equivalent to 5.1 per 1,000 students, up from 1.6 the year before, with partial figures suggesting about 7.5 the following year. Proven conventional plagiarism fell from 19 per 1,000 students to 15.2 over the same period. More than 27 per cent of responding universities did not yet record AI misuse as a separate category.

Now set that against what students say they do. The Higher Education Policy Institute's Student Generative AI Survey 2026, written by Rose Stephenson and Charlotte Armstrong and published on 12 March 2026 from a December 2025 survey of 1,054 full-time UK undergraduates, found 94 per cent using generative AI to help with assessed work, up from 88 per cent in 2025 and 53 per cent in 2024. Twelve per cent said they had included AI-generated text directly in assessed work, up from 8 per cent and then 3 per cent in the two preceding years.

Twelve per cent of undergraduates admitting to submitting machine-written text. Five proven cases per thousand students. The gap is roughly a factor of twenty-four, and it is the honest measure of how much the sector knows about its own assessments. Scarfe told the Guardian that those caught are the tip of the iceberg, and explained why in a sentence that ought to be pinned to every misconduct policy in the world. AI detection is unlike plagiarism, where you can confirm the copied text. Where you suspect AI, it is near impossible to prove.

The faculty view comes from a survey of 1,057 American college faculty conducted between 29 October and 26 November 2025 by Elon University's Imagining the Digital Future Center with the American Association of Colleges and Universities, released on 21 January 2026. Seventy-three per cent had personally dealt with academic integrity issues involving student use of generative AI, 78 per cent said cheating had increased on their campus, 95 per cent expected the technology to increase overreliance, 90 per cent expected diminished critical thinking, and 74 per cent believed it would negatively affect the value of a degree. The authors are explicit that the sample is not statistically generalisable. It does not need to be. Three-quarters of a large sample of the people who mark the work believe the qualification they confer is worth less than it was, for reasons they can name.

Contract Cheating Already Answered This and Nobody Wanted the Answer

There is a comforting story in which generative AI created this crisis in November 2022. It is false, and believing it is why the sector is improvising.

Philip Newton of Swansea University published a systematic review in Frontiers in Education on 30 August 2018 covering 71 samples from 65 studies going back to 1978, with 54,514 participants. The historic average of students self-reporting commercial contract cheating was 3.52 per cent. In studies conducted between 2014 and 2018 the figure was 15.7 per cent, which Newton extrapolated to roughly 31 million students globally. That was five years before ChatGPT. The market was mature, the transactions untraceable in practice, the detection rate negligible, because a purpose-written essay contains no copied text for a similarity checker to find.

Tracey Bretag, Rowena Harper and colleagues surveyed 14,086 students across eight Australian universities for a study in Studies in Higher Education, and found three factors reliably associated with outsourcing: dissatisfaction with the teaching and learning environment, a perception that there were lots of opportunities to cheat, and speaking a language other than English at home. None is a technology variable. Two are descriptions of institutional design.

England responded with criminal law. The Skills and Post-16 Education Act 2022 made it an offence to provide, arrange or advertise contract cheating services for financial gain to students at post-16 institutions and higher education providers in England. It was the right instinct and has proved near-impossible to enforce, the providers being numerous, offshore and hard to reach, and prosecution sitting with the Crown Prosecution Service rather than an education regulator with a reason to care.

So the boundary between a student's work and someone else's did not disappear in 2026. It disappeared, for a meaningful minority, during the 2010s, and universities carried on treating the unsupervised written artefact as evidence of learning because the alternative was expensive. Generative AI removed the price, the counterparty, the delivery lag and the risk, converting a minority behaviour into a default one. That is not a change of kind but a change of magnitude large enough that the old assumption stops functioning.

Tricia Bertram Gallant, who directs the academic integrity office and testing centre at UC San Diego and co-authored The Opposite of Cheating, said exactly this to Inside Higher Ed. Over twenty-odd years, she noted, changes from internet-supported plagiarism to the contract cheating industry and now AI have slowly degraded the validity of twentieth-century assessments. Yet higher education has not changed. “We're still relying on the unsupervised written word as evidence of learning. The real trick is acknowledging that that doesn't work anymore.”

Students Are Not Confused About the Rules, They Are Renegotiating Them

One paper in this literature circulates as a finding that ChatGPT lowers the barrier to contract cheating while making detection harder. That is a fair summary of the field but not of the paper, and precision matters here. ArXiv 2606.09845, submitted on 27 April 2026 by Belle Li, Lily Tan, Wei Zakharov, Qiang Qiu and Colby Ben Acton, is titled “Tutor, Not Solver: Designing a Guardrailed AI Assistant for Learning in Higher Education: A Design Case of PeteChat”. It is not a prevalence study. It documents an AI tutor deployed at Purdue University on a locally hosted Llama-3 model with retrieval-augmented generation grounded in course materials, from which the authors derive eight design principles for assessment-aware tutors, from homework guardrails to self-regulated learning support. Its interest here is that it inverts the detection approach, assuming students will use a model and constraining what the model does at the point of use rather than punishing them afterwards. That works only inside a system the institution controls, which an agentic consumer browser is not.

The paper that addresses the collapse of the boundary is arXiv 2605.29090, submitted on 27 May 2026 by Jiyoon Kim, Kentaro Toyama, Sangmi Kim and John M. Carroll, titled “'It's OK Because...': The Wild West of Student Rationalization of AI Use in Academic Writing”. Drawing on twenty semi-structured interviews together with students' AI chat logs, syllabuses and submitted assignments, the authors find at least five distinct sites at which AI use is conceptualised, running from the policy the instructor intended through to what students actually did. Between those five sites, meaning drifts.

Within that drift the authors catalogue more than twenty distinct rationalisations. That copying AI-generated text is victimless. That any AI text reflecting the student's own beliefs, or reading in their own style, is therefore their own writing. That extensive AI use means they are learning more than they otherwise would. The taxonomy includes justifications used to excuse conscious violations of stated course policy. Crucially, these rationalisations arise both ad hoc and post hoc and are not necessarily self-consistent: students construct them in the moment, reconstruct them afterwards, and do not need them to cohere. Modern AI, the authors conclude, presents a steep ethical slippery slope which students conceptually slide down, landing far outside their instructors' pedagogical goals.

This should worry universities more than the agent story, because it describes a condition no assessment format repairs. A student who believes machine-generated prose expressing their own view is their own writing has not broken a rule. They have sincerely adopted a different definition of authorship, and they will carry it into a graduate job where nobody will correct it either.

The Argument on Reddit Is the Argument Everywhere

The third paper cited in the brief was characterised as documenting teacher burnout and poor institutional support. It is something else, and the something else is more useful.

At arXiv 2605.17712, submitted on 18 May 2026 by Pelin Yüce, Xiangruo Dai, Rebecca Owens and Tuğrulcan Elmas, “ChatGPT vs Teachers vs Students: Large-Scale Analysis of Generative AI Discourse in Education Communities on Reddit” analyses 270,000 AI-related posts and comments across 26 education subreddits between November 2022 and April 2026. Topic modelling yields seventeen themes. The trajectory is a detection-and-evasion arms race hardening into a sustained enforcement regime, with constructive integration only beginning to challenge it from the middle of 2024.

Different constituencies worry about different things. K-12 teachers foreground cognitive dependency, academics focus on detection, students in professional programmes on career anxiety. The finding that matters most is about contact. Seventeen per cent of threads are cross-role, and one third of that cross-role contact occurs in the two adversarial themes, AI Detection and Misconduct Enforcement. Students initiate 68 per cent of mixed threads, but faculty produce most of the replies. Mixed threads contain two to three times more records than same-role threads and last two to four times longer. Sentiment correlates strongly negatively with engagement.

Strip out the platform and what remains is a description of an institutional relationship. The sustained centre of contact between the two parties to an education has become the dispute over whether one of them cheated. Not the subject. Not the feedback. The accusation and the defence.

Marc Watkins, a writing and composition lecturer who directs the AI Institute for Teachers at the University of Mississippi, put the resourcing question to Inside Higher Ed in terms nobody has costed. He could not fathom the cost to a single university, let alone most campuses, of scaling AI-resilience tactics such as proctored oral examinations, and it should not all fall on faculty. Kevin Yee, who directs the Faculty Center for Teaching and Learning at the University of Central Florida, described colleagues at wit's end, moving towards assignment redesign not because they think it better but because the alternative failed. “It's a difficult, delicate moment right now, and I'm not sure we have all the answers.”

The Blue Book Is a Confession Rather Than a Cure

Which brings us to the booklet. The Atlantic has published a piece titled “What Students Learn From Blue-Book Exams”, which this article could not read behind the paywall and therefore does not characterise beyond its title. The broader argument is easy to state anyway. Put a human in a room, take the devices, hand them lined paper and a fixed period, and whatever appears on the page was produced by that person. It is the only verification method available that does not depend on a classifier, a probability or an inference.

Institutions are moving. Princeton's faculty voted on 11 May 2026 to place proctors in examination rooms, ending a system of unsupervised examinations that had stood since 1893, after a dean's letter reported that significant numbers of professors and students perceived cheating on in-class examinations to be widespread. The Daily Princetonian's survey of the Class of 2026 found 24.8 per cent of respondents admitting to cheating in violation of the honour code, and, asked about using a chatbot on work that banned it, 27 per cent of arts and sciences students and 46 per cent of engineers said they had. The University of Chicago Law School has banned phones, tablets and laptops in first-year classes as part of its AI strategy. Bertram Gallant put the logic best: “We cannot be giving unsupervised assessments to students expecting them to resist AI. They're not going to be learning, we're going to be spending our time trying to catch them cheating and they're going to graduate and realize they just wasted four years.”

The comparison usually offered here is the calculator, and it is worth saying where it breaks. Maths education absorbed the calculator by conceding the mechanical step and moving assessment upward, towards modelling and interpretation. The tool automated a component and left the task recognisable. An agent that logs into Canvas and completes the course does not automate a component. It automates the student. There is no upward move available, because there is no residual layer above being the person enrolled.

But the blue book is a confession, not a cure, and its costs land on exactly the students who can least afford them.

Amanda Sturgill, an associate professor of journalism at Elon University, set out the practical objections for the Center for Engaged Learning in August 2025. Handwriting speed varies enormously and is not evenly taught; there is, as she puts it, a public-private divide in handwriting instruction, so a timed handwritten assessment quietly advantages students whose schools drilled it. Post-pandemic cohorts compose on keyboards. Hands cramp, and cramping degrades output and legibility, neither of which bears on whether the student understands the material. For students with dysgraphia, motor impairments or writing-related accommodations, an unadapted handwritten examination measures penmanship and stamina rather than knowledge, and the accommodations that fix it, extra time, a scribe, a locked-down laptop, are exactly what under-resourced institutions ration.

The technologists' alternative has the same problem in a different place. Armando Fox of UC Berkeley and Craig Zilles of the University of Illinois at Urbana-Champaign argued in Inside Higher Ed on 19 March 2026 that computer-based testing facilities beat blue books, allowing algorithmically generated examination variants, richer question formats, self-scheduling across multi-day windows and frequent low-stakes assessment. Illinois ran more than 130,000 examinations through its facilities in autumn 2025. It is genuinely better than handwriting, and it requires a proctored building, a capital expenditure most institutions and effectively all fully online programmes do not have.

Remote proctoring, the option that appears to square the circle, has the worst record. Deborah Yoder-Himes and colleagues at the University of Louisville published a study in Frontiers in Education in September 2022 examining automated proctoring across 357 students in four STEM courses. The software detected Black students' faces 79 per cent of the time against 92 per cent for white students. Students with the darkest skin tones spent 7.64 per cent of assessment time flagged against 1.56 per cent for lighter tones, and received 6.07 flags per assessment against 1.19 for the lightest group. Women with the darkest skin tones were 4.36 times more likely to be flagged than women with medium tones. Monika Blue Kwapisz, Yoav Ackerman, Jennifer Nguyen and Prashanth Rajivan documented in a November 2025 preprint how students with disability accommodations experience these systems, describing anxiety about the interaction between surveillance and their disability, fear of being misread as cheating, and the cognitive load that fear imposes during the examination.

Line the three options up and the pattern is impossible to miss. Handwritten examinations disadvantage students with motor and writing disabilities and those schooled without handwriting instruction. Proctored computer facilities require capital poorer institutions lack and online programmes do not have at all. Algorithmic proctoring misidentifies dark-skinned students and penalises disabled ones. Every available method of proving a human did the work reallocates the burden onto the students already carrying most of it, the same population Liang and colleagues found the detectors falsely accusing, and the same population Bretag and colleagues found most likely to be flagged for outsourcing.

Signalling Was Always Doing More Work Than the Learning

Underneath all this sits an economic question higher education has spent fifty years avoiding, and the agent has forced.

Michael Spence's 1973 paper in the Quarterly Journal of Economics established the framework. Education functions in the labour market partly as a signal: employers cannot observe productivity directly, so they pay for a credential that is cheaper to obtain for able and conscientious candidates than for others. The signal works because it is costly, and it works whether or not anything was learned in the acquiring. Bryan Caplan's 2018 book The Case Against Education pushed the claim to its limit, arguing that something like 80 per cent of the earnings premium reflects signalling rather than skill, an estimate other economists dispute vigorously and nobody has settled.

The dispute does not need settling for the point to bite. If the credential carries any signalling weight at all, an agent that can obtain it degrades the signal for every holder, including everyone who did the work honestly. This is a mechanical claim, not a moral one. A signal cheap to counterfeit stops discriminating, and once employers know it is cheap to counterfeit they discount it uniformly, because they cannot tell which holders did. The honest graduate of an online programme in 2026 pays full price for an asset being devalued by people they will never meet.

That is what the Elon and AAC&U figure measures when 74 per cent of faculty say generative AI will negatively affect the value of a degree, and it lands hardest on the segment of the market built as a widening-participation instrument. Online degrees exist, in the story the sector tells about itself, to reach the working adult, the carer, the person in a town without a campus. Digital Trends made the uncomfortable observation: for colleges that have spent years arguing online education makes higher education more accessible, an agent that can attend the class instead of the person paying for it is a particularly awkward problem to have.

The mixed institutional signalling makes it worse. Futurism noted that many universities hold partnerships with AI companies while policing AI use, leaving students to reconcile the contradiction. The California State University system signed a multimillion-dollar agreement with OpenAI to put ChatGPT Edu in front of hundreds of thousands of students and staff. Carol Sewell, an instructor in that system, told the Times how that feels from a classroom: “I'm not getting any guidance on how to dissuade their use. I'm getting opportunities to learn more about using it.”

There is a workable model in plain sight, ignored for a century because it is unflattering. Professional licensure separates the two functions a degree smashes together. Nursing candidates in the United States take the NCLEX under supervision at dedicated testing centres, more than 328,000 of them in 2025 for the registered nurse examination alone. Medicine has the USMLE, law the bar. In every case the coursework is where learning happens, and a separate proctored instrument certifies competence. Nobody worries that a nursing student used AI on a formative assignment, because the assignment is not the credential. The credential is the day in the room.

Higher education runs one artefact for both purposes: the essay is simultaneously the pedagogical exercise and the evidence. That worked for as long as producing an essay required knowing something. The agent has broken the coupling, and the options are to rebuild it by force, at enormous cost and with the distributional consequences described above, or to separate the functions as every licensed profession did decades ago.

The Verification Problem Is Not the Serious Problem

Return to the six words.

The student who types them is not, in most cases, a fraud in the way an essay mill customer was. They are, per the rationalisation study, someone with an available justification: that they are learning more this way, that the assignment was busywork, that the output reflects what they think anyway. Per the Reddit analysis, their main sustained contact with the institution has become a dispute about enforcement. Per the HEPI figures, they are in a cohort where 94 per cent use the tool for assessed work and only 36 per cent feel their institution encourages them to. They are behaving rationally inside a system that has stopped telling them a coherent story about what the work is for.

Kathryn Kysar, a community college instructor who has taught online for fifteen years, told the Times that those who have taught a long time usually recognise the cheaply written AI stuff within thirty seconds. She is almost certainly right, and it does not help her, because recognising it and proving it are separated by an evidentiary chasm no detector spans. Jason Gibson, a history professor at Alcorn State University, buried the word Madagascar in white text inside a midterm prompt in the summer of 2026 and reported that thirty-two of his thirty-five students across two classes failed part of the examination, having pasted the prompt into a chatbot and submitted the result unread. What unsettled him was not the cheating. It was that nobody noticed sentences about Madagascar floating sideways through the afternoon in an essay on the Industrial Revolution.

Gibson caught his students because they were careless. The agentic student will not be careless, because the agent will not paste the prompt and will not leave the word in. The trap worked once.

So the answer to what a degree is worth when a machine could have earned it is not a number, and proctoring alone does not recover it. Making a person sit in a room and write by hand verifies that a human produced marks on paper under time pressure. It verifies nothing about the fourteen weeks before, and it produces a credential whose accessibility depends on how steady your hands are and how your school taught cursive. It is a verification of presence dressed as a verification of learning, adopted because it is the last mechanism that cannot be spoofed.

The harder thing is what Bertram Gallant said out loud and almost nobody has repeated. If a student can complete a degree without doing the learning, the injury is not principally to the institution's reputation or the employer's hiring accuracy. It is to the student, who paid the money, gave the years, got the paper. The four wasted years are the loss no invigilator prevents and no detector catches, and the only person positioned to notice is the one who has already spent everything avoiding it.

References

1. Dana Goldstein and Alan Blinder, “AI Agents Are Taking Entire Online Courses for Cheating Students,” The New York Times, 10 August 2026 (syndicated by the San Francisco Examiner, 12 August 2026). https://www.sfexaminer.com/ai-agents-are-taking-entire-online-courses-for-cheating-students/article_9d4ef5ca-317f-54a3-937a-56bfcc9a0272.html
2. Frank Landymore, “College Kids Are Using AI Agents to 'Take' Entire Online Classes for Them by Logging Directly Into the Course Management Software,” Futurism, 13 August 2026. https://futurism.com/artificial-intelligence/college-kids-ai-agents-cheat-online-courses
3. Varun Mirchandani, “AI agents are sitting through students' online courses, and colleges are struggling to stop them,” Digital Trends, 13 August 2026. https://www.digitaltrends.com/cool-tech/ai-agents-taking-online-courses-student-cheating/
4. Kathryn Palmer, “AI Detectors Are Out, New Assessments Are In,” Inside Higher Ed, 5 August 2026. https://www.insidehighered.com/news/tech-innovation/artificial-intelligence/2026/08/05/ai-detectors-are-out-new-approaches-are
5. Lee Rainie and C. Edward Watson, “The AI Challenge: A National Survey of College Faculty,” Imagining the Digital Future Center, Elon University, and the American Association of Colleges and Universities, 21 January 2026. https://imaginingthedigitalfuture.org/wp-content/uploads/2026/01/Elon-AACU-faculty-AI-survey-full-report-1-21-26.pdf
6. Vanderbilt University Brightspace team, “Guidance on AI Detection and Why We're Disabling Turnitin's AI Detector,” Vanderbilt University, 16 August 2023. https://www.vanderbilt.edu/brightspace/2023/08/16/guidance-on-ai-detection-and-why-were-disabling-turnitins-ai-detector/
7. Weixin Liang, Mert Yuksekgonul, Yining Mao, Eric Wu and James Zou, “GPT detectors are biased against non-native English writers,” Patterns, 10 July 2023. https://www.cell.com/patterns/fulltext/S2666-3899(23)00130-7
8. Peter Scarfe, Kelly Watcham, Alasdair Clarke and Etienne Roesch, “A real-world test of artificial intelligence infiltration of a university examinations system: A 'Turing Test' case study,” PLOS ONE, 26 June 2024. https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0305354
9. Michael Goodier, “Revealed: Thousands of UK university students caught cheating using AI,” The Guardian, 15 June 2025. https://www.theguardian.com/education/2025/jun/15/thousands-of-uk-university-students-caught-cheating-using-ai-artificial-intelligence-survey
10. Rose Stephenson and Charlotte Armstrong, “Student Generative Artificial Intelligence Survey 2026,” HEPI Report 199, Higher Education Policy Institute and Kortext, 12 March 2026. https://www.hepi.ac.uk/wp-content/uploads/2026/03/HEPI-Report-199-Gen-AI-Survey-2026.pdf
11. Philip M. Newton, “How Common Is Commercial Contract Cheating in Higher Education and Is It Increasing? A Systematic Review,” Frontiers in Education, 30 August 2018. https://www.frontiersin.org/journals/education/articles/10.3389/feduc.2018.00067/full
12. Tracey Bretag, Rowena Harper, Michael Burton, Cath Ellis, Philip Newton, Pearl Rozenberg, Sonia Saddiqui and Karen van Haeringen, “Contract cheating: a survey of Australian university students,” Studies in Higher Education, 2019. https://www.tandfonline.com/doi/full/10.1080/03075079.2018.1462788
13. Deborah R. Yoder-Himes, Alina Asif, Kaelin Kinney, Tiffany J. Brandt, Rhiannon E. Cecil, Paul R. Himes, Cara Cashon, Rosalie M. P. Hopp and Edna Ross, “Racial, skin tone, and sex disparities in automated proctoring software,” Frontiers in Education, 20 September 2022. https://www.frontiersin.org/journals/education/articles/10.3389/feduc.2022.881449/full
14. Monika Blue Kwapisz, Yoav Ackerman, Jennifer Nguyen and Prashanth Rajivan, “Surveillance and Disability in Online Proctored Exams: Student Perspectives and Design Implications,” arXiv:2511.10826, 13 November 2025. https://arxiv.org/abs/2511.10826
15. Elizabeth Shockman, “'A death penalty': Ph.D. student says U of M expelled him over unfair AI allegation,” MPR News, 17 January 2025. https://www.mprnews.org/story/2025/01/17/phd-student-says-university-of-minnesota-expelled-him-over-ai-allegation
16. Joe Wilkins, “Princeton in Shambles Over AI Cheating,” Futurism, 17 May 2026. https://futurism.com/future-society/princeton-shambles-ai-cheating
17. Frank Landymore, “Professor Hides White Font in Midterm, Catches Students Using AI in the Stupidest Way Possible,” Futurism, 25 July 2026. https://futurism.com/future-society/professor-hides-white-font-ai-cheating
18. Phil Hill, “Fall 2024 IPEDS Data: Profile of US Higher Ed Online Education,” On EdTech, 6 January 2026. https://onedtech.philhillaa.com/p/fall-2024-ipeds-data-profile-of-us-higher-ed-online-education
19. Michael Spence, “Job Market Signaling,” The Quarterly Journal of Economics, August 1973. https://academic.oup.com/qje/article-abstract/87/3/355/1909091
20. UK Parliament, “Skills and Post-16 Education Act 2022, sections 34 to 36,” legislation.gov.uk, 28 April 2022. https://www.legislation.gov.uk/ukpga/2022/21/notes/division/9/index.htm
21. Armando Fox and Craig Zilles, “Blue Books Are Not the Answer to AI,” Inside Higher Ed, 19 March 2026. https://www.insidehighered.com/opinion/views/2026/03/19/blue-books-are-not-answer-ai-opinion
22. Amanda Sturgill, “Blue Books and In-Class Writing Are Not a Panacea,” Center for Engaged Learning, Elon University, 19 August 2025. https://www.centerforengagedlearning.org/blue-books-and-in-class-writing-are-not-a-panacea/
23. Belle Li, Lily Tan, Wei Zakharov, Qiang Qiu and Colby Ben Acton, “Tutor, Not Solver: Designing a Guardrailed AI Assistant for Learning in Higher Education: A Design Case of PeteChat,” arXiv:2606.09845, 27 April 2026. https://arxiv.org/abs/2606.09845
24. Pelin Yüce, Xiangruo Dai, Rebecca Owens and Tuğrulcan Elmas, “ChatGPT vs Teachers vs Students: Large-Scale Analysis of Generative AI Discourse in Education Communities on Reddit,” arXiv:2605.17712, 18 May 2026. https://arxiv.org/abs/2605.17712
25. Jiyoon Kim, Kentaro Toyama, Sangmi Kim and John M. Carroll, “'It's OK Because...': The Wild West of Student Rationalization of AI Use in Academic Writing,” arXiv:2605.29090, 27 May 2026. https://arxiv.org/abs/2605.29090

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

She is eighty-five, she lives in the United States, and every morning a small tabletop device with a swivelling head and a soft glowing base tells her it is time to take her medication. It suggests she stretch. It asks how she slept. It is called ElliQ, it is made by the Israeli company Intuition Robotics, and according to the opinion piece that opened with her story in the Korea Times on 19 August 2026, it helps her stay independent.

The author of that piece was Suh Chung-ha, a former Korean ambassador to Singapore and Hungary who now runs the ASEM Global Ageing Center in Seoul. His argument was not that the robot is bad. His argument was subtler and considerably more uncomfortable: that the same broad technological shift that produced her helpful companion is quietly reshaping her access to healthcare, long-term care, credit, insurance and public services, and that it is doing so using systems trained on data which encode decades of assumptions about what old people are worth.

Here is the thing that should keep you awake. There are two artificial intelligence systems in this woman's life. One of them sits on her side table, greets her by name, and was designed with people like her explicitly in mind. The other one has never been in her house, has no name, no face and no voice, and it is scoring her.

She chose the first. The second chose her.

Two Machines, One Household

The asymmetry is almost perfectly clean, and it is worth stating precisely because it is the structural fact from which nearly everything else in this story follows.

The assistive machine is opted into. It arrives through a screening process, in the New York State case run by county and locality-based Area Agencies on Aging. It is visible: it occupies physical space, it announces itself, it is marketed at older people as a product for older people. If she hates it, she can unplug it and someone will come and take it away.

The discriminatory machine has none of these properties. She did not opt into the underwriting model that prices her travel insurance, the credit decisioning system that assessed her application for a modest overdraft extension, or the triage algorithm that sorted her referral. She cannot see them. She was not consulted in their design, and neither was anyone remotely like her. She cannot unplug them. In most cases she will never learn that a model was involved at all; she will simply receive an outcome, in a letter or on a screen, expressed in the passive voice.

Assistive AI for older people is a market with a sales pitch. Decisional AI about older people is infrastructure with a legal department.

Public debate about AI and ageing has been overwhelmingly captured by the first category. Companion robots photograph well. They allow governments with ageing populations and inadequate care workforces to point at something tangible. Meanwhile the systems that will actually determine whether an eighty-five-year-old can borrow money, buy cover for a trip to see her grandchildren, or get onto a surgical waiting list are being deployed with almost no public conversation about age at all.

Ninety-Five Per Cent of What, Exactly

Start with the good machine, because the claims made for it deserve the same scepticism we would apply to anything else.

In August 2023 the New York State Office for the Aging announced that its ElliQ rollout had produced a 95 per cent reduction in loneliness among participants. The figure travelled fast, and has been repeated in trade press, vendor materials and policy briefings ever since. That 2023 release reported that more than 800 older New Yorkers were in the programme, that users interacted with the device more than thirty times a day, six days a week, and that over 75 per cent of those interactions related to social, physical or mental wellbeing. Greg Olsen, the agency's director, said the results were “truly exceeding our expectations”.

Thirty interactions a day is not a device gathering dust.

Now read what the same agency published in February 2026. Its year-three project update, covering the programme year from June 2024 to May 2025, reports that 94 per cent of clients say they feel less lonely, up from 93 per cent the year before, that 97 per cent report feeling better overall and 79 per cent feel more connected to the world around them, with customer satisfaction at 4.6 out of 5. The average client is 75. As of May 2025, 834 older adults had joined. More than 3,500 have applied.

Four applicants for every place.

Look at what happened to the sentence. In 2023 the claim was a 95 per cent reduction in loneliness: a delta, a measured change, phrasing that implies an instrument, a baseline and a follow-up. In 2026 it is 94 per cent of clients who say they feel less lonely. That is not a reduction. It is a self-report, and the agency now presents it as one.

The wording did not soften by accident.

Neither version was ever a clinical finding. Both are programme metrics derived from participants who were screened in, who wanted the device, and who were asked how they felt. There is no control group in those numbers. There is no validated loneliness instrument named alongside them in the public materials, no randomisation, no blinding, and no comparison against the obvious alternative intervention, which is a person visiting.

Note too how little the figure moves. Ninety-three per cent, then 94, across a self-selected cohort that grew by hundreds in between. Effect estimates wander when the sample changes; satisfaction scores do not. The 4.6 out of 5 sitting in the same document is from the same family of measurement.

The wider literature is more honest and less exciting. A systematic review and meta-analysis by Lihui Pu, Wendy Moyle, Cindy Jones and Michael Todorovic, published in The Gerontologist, screened more than two thousand articles and found thirteen from eleven randomised controlled trials, nine of which entered the meta-analysis. Social robots appeared to have positive effects on agitation, anxiety and quality of life, but the meta-analysis found no statistical significance. The authors flagged a relatively high risk of bias in allocation concealment and blinding, and concluded that firm conclusions were limited by the shortage of high-quality studies. A later meta-analysis published in the Journal of the American Medical Directors Association, focused on residents of long-term care facilities and drawing on eight trials, did report significant reductions in depression and loneliness with large effect sizes.

So: promising, contested, and nowhere near the confidence implied by a round 95.

None of this means ElliQ is useless. It plainly is not; the engagement figures describe a device in near-constant use, and 834 people have one while thousands wait. It means that the most widely circulated statistic about AI and older people is a self-reported satisfaction figure from a self-selected group, and that we have collectively decided to treat it as proof of concept for an entire policy direction.

The Awkward Protected Characteristic

Now the harder half, and it requires conceding something that age-discrimination advocates often skate past.

Age is a genuinely strange thing to build fairness engineering around. Race and sex, as legal categories, are treated as characteristics that should almost never bear on how you are priced or assessed. Age is not treated that way, and not merely out of prejudice. Age correlates with mortality and morbidity in ways that are real, measurable and actuarially load-bearing. An insurer pricing life cover without reference to age is not being fair; it is being incompetent.

The law recognises this explicitly, and the contrast is sharper than most people realise.

When the Equality Act 2010 extended the ban on age discrimination to the provision of goods, facilities and services in April 2012, it carved out financial services. Schedule 3 permits providers to use age in connection with a financial service, provided that any risk assessment involving age is carried out by reference to information relevant to the assessment and from a source on which it is reasonable to rely. Insurers and banks can price by age. They just have to be able to show the evidence is relevant and the source reasonable.

Compare this with what happened to sex. In the Test-Achats case the Court of Justice of the European Union struck down Article 5(2) of the Gender Directive, the provision that had allowed insurers to differentiate by gender, ruling it incompatible with the principle of equal treatment and invalid from 21 December 2012. The wording of the age exception is close to identical to the gender exception the court destroyed. It survives anyway.

Age, in other words, occupies a legal position no other protected characteristic holds: formally protected, substantively negotiable, with a standing statutory permission to price on it as long as you can point at a table.

There is a second awkwardness. Age is continuous, not categorical. Most fairness metrics in machine learning are built for discrete groups: compare outcomes for group A against group B, measure the gap, minimise it. Continuous attributes require binning, and binning is a modelling choice that quietly determines what you will find. Is the relevant comparison 65 and over against under 65? 80 and over against everyone else? Each decade separately? A model can look admirably fair across coarse bands and be brutal at the eighty-fifth birthday.

That the technical community is working on this is not in doubt. A paper posted to arXiv on 7 April 2026 by Fernando López, Paula Delgado-Santos, Pablo Gómez, David Solans and Jordi Luque examined demographics-agnostic training for bias mitigation in wake-up word detection, evaluating fairness across sex, age and accent, and reported that one technique reduced predictive disparity by 83.65 per cent for age. Note what that result implies about the baseline. A voice interface, the very modality most often proposed as the accessible option for people who struggle with screens, had an age disparity large enough that removing four fifths of it counted as a headline.

Where the Actuarial Defence Runs Out

Take the actuarial argument seriously and it still only covers a fraction of the territory.

It works for life insurance, where the outcome predicted is death and age is causally implicated in death. It works, with more strain, for annuities and some health cover. It does not work for the vast and expanding class of decisions where age enters not as a causal variable but as a learned correlation with something the model was never asked to think about.

Consider hiring. In August 2023 the United States Equal Employment Opportunity Commission settled with the tutoring company iTutorGroup for $365,000, in what was widely described as its first settlement involving an AI-driven hiring tool. The company's application software had been configured to automatically reject female applicants aged 55 and over and male applicants aged 60 and over. More than 200 qualified applicants were rejected on that basis. The discrimination came to light in an almost novelistic way: an applicant submitted two applications identical in every respect except the date of birth, and only the younger one got an interview. The consent decree included five years of EEOC monitoring and an injunction against requesting applicants' birth dates.

There is no actuarial defence for that. It was a hard filter, and it was illegal.

The more consequential case is messier. In Mobley v. Workday, Derek Mobley alleges that the applicant screening tools supplied by Workday systematically disadvantaged older job seekers; he says he submitted more than a hundred applications through the platform and was rejected every time. Judge Rita Lin of the United States District Court for the Northern District of California dismissed his intentional discrimination claim but allowed the disparate impact allegation to proceed, and on 16 May 2025 granted preliminary certification of a nationwide collective action under the Age Discrimination in Employment Act, covering applicants aged 40 and over denied recommendations through the platform since 24 September 2020. The court had earlier accepted the theory that an AI vendor could be directly liable for employment discrimination as an “agent” of the employer, and a March 2026 ruling rejected Workday's argument that the ADEA does not cover job applicants.

Two rulings since have sharpened it, in opposite directions. On 28 May 2026 the court held that AI bias-testing data can be protected from discovery by attorney-client privilege, shielding Workday's own testing material while accepting that it had probative value as evidence of disparate impact, on the basis that counsel had been substantively involved in curating it. The most useful evidence for establishing whether a screening model disadvantages older applicants is the vendor's own bias testing, and a vendor that routes that testing through its lawyers may be able to keep it from the people the model rejected.

Then on 22 June 2026 the court granted in part and denied in part Workday's motion to dismiss. It declined to dismiss an Americans with Disabilities Act claim built on a proxy-discrimination theory, the allegation being that the screening tools inferred health status. It declined to dismiss claims under California's Fair Employment and Housing Act, finding sufficient allegations that Workday designed, developed, maintained and controlled the tools from its California headquarters. It did dismiss a Title VII race-based disparate impact claim brought by a plaintiff who had not sought authorisation to add it, and struck a newly asserted theory that Workday was itself the direct employer. The allegations remain allegations; the case is unresolved.

What makes Mobley the important one is that nobody claims a birth date field was set to reject anyone. The claim is that a model, trained on which past applicants got hired, learned the shape of the people who tend to get hired, and that this shape has an age.

That is not actuarial risk. That is a machine reproducing a hiring market's existing prejudice at industrial throughput and calling it a recommendation.

The Ghost in the Feature Set

The standard corporate response is to remove age from the model. Anyone who has worked on this knows why that fails, but the mechanism deserves spelling out, because it is where the eighty-five-year-old actually gets caught.

Age is one of the most redundantly encoded attributes in consumer data. It leaks through everything.

The landmark demonstration of how much can be inferred from almost nothing is the study by Tobias Berg, Valentin Burg, Ana Gombović and Manju Puri, published in the Review of Financial Studies, which analysed over 250,000 purchases at a German e-commerce firm. Their finding was that a handful of trivially available “digital footprint” variables matched the predictive power of a credit bureau score for consumer default. The variables were not financial. They included the device type and operating system the customer was using, characteristics of their email address, the channel through which they arrived at the site, and the time of day the order was placed.

Every one is age-correlated. Operating system and device age track purchasing power and upgrade behaviour, which skew by generation. Email domain is a near-fossil record: certain providers cluster heavily among people who set up an address in a particular decade and never changed it. Whether you arrived via a search engine, a price-comparison site or by typing the address directly is a behavioural signature that varies sharply with digital fluency. Time of day correlates with employment status and with sleep patterns that shift with age.

Add the signals a modern web session captures without asking: typing speed and correction rate, scroll behaviour, time per form field, zoom level, whether accessibility settings are enabled, session length, abandonment patterns, whether the customer switched to the telephone halfway through.

A model given these features and told to predict default, or churn, or fraud, or claim frequency, will find age whether or not you have deleted the birth date column. It will not label the pattern “age”. It will simply learn that a slow-typing user on an old Android device who zoomed the page, took eleven minutes over a form and then rang the call centre belongs to a cluster with a particular outcome rate. The cluster is old people. The model does not know this and does not need to.

This is proxy discrimination, and age is the characteristic most vulnerable to it, because unlike race or sex it is continuously written into behaviour rather than occasionally into a form field. You can decline to state your sex. You cannot decline to type at the speed you type.

It is also, since June 2026, a theory a federal court has agreed to hear. The proxy-discrimination claim that survived Workday's motion to dismiss is this argument made in a courtroom rather than a conference paper: that a system can sort people by a protected characteristic it was never given and could not name if asked.

A World Where They Were Not There

There is a deeper problem underneath the proxy problem, and it is the one the World Health Organization identified with unusual bluntness in February 2022 in its policy brief “Ageism in artificial intelligence for health”.

The brief made a point that is easy to nod along to and hard to fully absorb: the datasets used to train AI models frequently exclude older people, who often sit within a minority subset for technologies not explicitly designed as gerontechnology. It set out eight considerations, among them participatory design of AI by and with older people, age-diverse data science teams, age-inclusive data collection, investment in digital infrastructure and digital literacy for older people and their carers, rights for older people to consent and to contest, and governance frameworks with teeth.

Under-representation in training data is not neutral. This is the part that gets lost.

If a population is thinly represented in the data, the model has less signal about them, so its predictions for them are less accurate and typically more conservative. Less accurate prediction for a group means more errors in both directions, but the consequences of those errors are asymmetric. A false negative for an older applicant means a declined loan or a rejected application. A false positive means an accepted risk. Institutions tune thresholds to avoid the second kind of error, so noisier estimates for a group systematically produce more refusals for that group. Uncertainty gets priced as risk.

Now compound it across time. Because older people were less present in digital life during the decades when the training corpora were accumulating, they generated fewer digital records. Because they generated fewer records, models are worse at assessing them. Because models are worse at assessing them, they are more often refused or steered towards manual, slower, more expensive channels. Because they are pushed off the digital rails, they generate still fewer records. This is the thin-file problem, and for older people it runs in the opposite direction from the intuitive one: a person can have fifty years of impeccable financial history and still be functionally invisible to a model that mostly reads behavioural exhaust from the last eighteen months.

The past is not a neutral training set. It is a record of who was allowed to participate.

The Recursive Trap

Here is where the digital divide stops being a story about access and becomes a story about power, and it is the thread that runs directly back to the woman with the robot on her side table.

The numbers are not ambiguous. Ofcom's Adults' Media Use and Attitudes report, published on 2 April 2026, found that 6 per cent of UK adults still have no home internet access, and that 83 per cent of that group are aged 65 or over, with 66 per cent aged 75 and above. Among those offline, 68 per cent said they were not interested or felt no need, 38 per cent found it too complicated and 25 per cent cited cost. Age UK reported in July 2025 that 2.4 million older people, nearly one in five, use the internet less than once a month or not at all, that 920,000 had reduced their internet use in the previous twelve months, and that 4.3 million, a third, do not use a smartphone. Exclusion was higher among older Black people at 32 per cent and older Asian people at 26 per cent, and among older people living alone at 30 per cent. Caroline Abrahams, Charity Director at Age UK, has warned repeatedly that people who cannot or will not go online must still be able to reach services offline.

In the United States, Pew Research Center reported in January 2026, drawing on a survey conducted between February and June 2025, that 78 per cent of adults aged 65 and over own a smartphone against 97 per cent of adults under 50, that 70 per cent have home broadband, and that 14 per cent are online almost constantly compared with 63 per cent of those aged 18 to 29.

Now put those two facts side by side.

Fact one: older people are the population most likely to be scored by systems they cannot see, and most likely to be misscored because of thin data and proxy leakage. Fact two: older people are the population least equipped to use the machinery that exists for challenging an automated decision.

Because that machinery is digital. All of it. The right of appeal lives behind a login. The “why was I declined?” explanation is a link in an email. The subject access request is a web form. The complaint goes to a chatbot that triages before a human sees it. The regulator's guidance is a PDF. The decision notice arrives in an app.

Article 22 of the General Data Protection Regulation is supposed to be the backstop. It gives people the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and where such decisions are permitted, Article 22(3) requires safeguards including the right to obtain human intervention, to express a point of view and to contest the decision. Legal scholars have criticised the provision for years, principally over the word “solely”, which invites institutions to insert a nominal human who rubber-stamps the model output, and over the vagueness of what counts as meaningful information about the logic involved.

But there is a failure mode more basic than any of those doctrinal complaints. A right you have to go online to exercise is not a right for someone who is not online. It is a courtesy extended to people who can already reach it.

This is the recursive trap. The people most likely to be wrongly assessed by an algorithm are, by the same underlying cause, the people least able to find out that an algorithm assessed them, least able to obtain an explanation, and least able to appeal. Digital exclusion does not merely sit alongside algorithmic harm. It is the mechanism that makes algorithmic harm unaccountable. The error and the inability to contest the error have a common origin, and that common origin is age.

What Seoul Cannot Fix by Declaration

On 2 September 2026, the ASEM Global Ageing Center will convene the 6th ASEM Forum on the Human Rights of Older Persons in Seoul, under the theme “Artificial Intelligence and the Human Rights of Older Persons: Toward Age-inclusive AI Transformation”, bringing together experts from Asia and Europe. Suh's Korea Times piece was, transparently, a curtain-raiser for it.

The forum arrives at a moment of unusual institutional motion. On 3 April 2025 the UN Human Rights Council adopted by consensus a decision to establish an intergovernmental working group to begin drafting a legally binding convention on the human rights of older persons, after more than a decade of stalled effort in the open-ended working group on ageing. The new body held an organisational meeting in Geneva in February 2026, convened its first substantive session from 13 to 17 July 2026, and will hold its second session from 26 to 30 October 2026 at the Palais des Nations in Geneva, with the early sessions devoted to purpose, general principles and scope before any drafting of articles. The timetable beyond that is now known: a discussion of an outline of the convention's main elements is expected in July 2027, and a first zero draft around October 2027. The International Telecommunication Union published its own report in July 2026 on artificial intelligence and ageing, examining the unequal distribution of AI benefits across age, gender and region.

This is real progress and it will take years. An outline of main elements in mid-2027, a zero draft in late 2027, and then the negotiation of text that states have to agree, sign and ratify before it binds anyone. The woman in the opening paragraph is eighty-five now.

Meanwhile, the regulation that already exists treats age oddly. The EU AI Act prohibits, under Article 5(1)(b), AI systems that exploit vulnerabilities due to age, disability or specific socio-economic circumstances in order to materially distort behaviour, with those prohibitions applicable from 2 February 2025. That is a genuine protection against the payday-lender-targeting-the-cognitively-impaired scenario. It is not a protection against underwriting. Credit scoring and life and health insurance pricing sit in the high-risk category under Annex III, which brings documentation, data governance and human oversight duties, but lawful risk assessment carried out for legitimate purposes with proportionate safeguards falls outside the Article 5 prohibition. Which is to say: the Act catches predation and regulates underwriting, but it does not question whether age-based underwriting is itself the problem, because European law has already decided that it is not.

The American position is different and, in its way, weaker. The Age Discrimination in Employment Act of 1967 covers employment and does so reasonably robustly, as Mobley is testing. Outside employment, there is no federal equivalent of the Equality Act's general services provision. The Equal Credit Opportunity Act does prohibit age discrimination in credit transactions, and Regulation B is on its face protective: a creditor may use age as a predictive variable in an empirically derived, demonstrably and statistically sound scoring system, but only provided the age of an elderly applicant is not assigned a negative factor or value, and applicants aged 62 and over must be treated at least as favourably as those under 62. Read that carefully and you can see exactly where it fails. The rule polices the explicit age variable. It says nothing about a model that has never seen a date of birth and has inferred one from an operating system, a typing cadence and an email domain. You cannot audit for a negative factor assigned to elderly applicants if the model does not know which applicants are elderly, and neither, formally, does the institution running it.

Conference declarations do not touch any of this. The gap between what Seoul will resolve and what a German e-commerce model does with an old Android handset is the whole subject.

Four Things That Would Actually Change the Arithmetic

Strip away the declaratory language and there are perhaps four interventions that would materially alter the position of the woman in the opening scene. None of them are technically hard. All of them are expensive, which is why they have not happened.

The first is a legally enforceable right to a non-digital channel. Not a helpline that exists at the discretion of the provider, not a branch that survives until the next cost review, but a statutory obligation on any organisation providing an essential service to maintain a route to a competent human being that requires no internet connection, no smartphone and no app. Age UK has been arguing this for years, most pointedly in its work on the collapse of high street banking, where the shift to online-only services has left people who do not trust or cannot use digital channels struggling to manage their own money. Offline access is currently a courtesy. It needs to be a licence condition.

The second is age-disaggregated auditing as a compliance requirement rather than a research exercise. Institutions deploying models in credit, insurance, employment and healthcare triage should be required to publish outcome rates by fine-grained age band, not by a single crude over-65 bucket that conceals everything interesting, and to do so alongside approval rates, appeal rates and appeal success rates. You cannot regulate a disparity that nobody has to measure.

The third is co-design that is not decorative. The WHO brief called for participatory design by and with older people and for age-diverse data science teams, which sounds like boilerplate until you consider how few people building consumer risk models have ever watched an eighty-five-year-old complete an online form.

The fourth is human review that is genuinely reachable and genuinely empowered: a named person, contactable by telephone, with the authority and the information to overturn a model, and a duty to record why. Article 22 gestures at this. Nobody has made it real.

The Grandchild That Isn't

Return, finally, to the room with the robot in it, because there is a question underneath the discrimination question that the fairness metrics cannot reach.

Sherry Turkle, the MIT professor who has spent decades studying what happens to people around machines, argued in Alone Together that sociable technology “will always disappoint because it promises what it cannot deliver. It promises friendship but can only deliver performances.” Her worry was never that robots do things for us. It was that they do things to us: that we attach to what we nurture, and that outsourcing the nurturing dissolves the attachment.

Recent research suggests this is not merely philosophical. A study posted to arXiv on 26 February 2026 by Tianqi Song, Black Sun, Jingshu Li, Han Li, Chi-Lan Yang, Yijia Xu and Yi-Chieh Lee examined AI-generated influencers on Chinese short-video platforms that adopt kinship personas, presenting themselves as virtual grandchildren, using visual and conversational cues to enact family roles. Through social media analysis and interviews with older adults, the researchers found that these relationships met real informational and emotional needs, and also identified risks including emotional displacement and unequal emotional investment.

Unequal emotional investment. That phrase should be read slowly. It describes a relationship in which one party gives everything and the other party is a product roadmap.

The care-substitution risk is not that a family decides to buy a robot instead of visiting. It is subtler and more institutional. It is that a care system under fiscal pressure, looking at a 95 per cent loneliness reduction figure and a device that costs a fraction of a support worker's hourly rate, makes an entirely rational commissioning decision. Nobody need intend the substitution for it to happen. It is a budget line, not a betrayal.

The Bill Arrives in the Post

So here she is, eighty-five years old, at the intersection of both machines.

The one on her side table knows her medication schedule, notices when she has not moved for a while, and asks about her day. It has probably improved her life; the engagement data suggests she uses it constantly. It was designed for her, sold to a state agency on her behalf, and screened to her through a public programme.

The other one does not know she exists as a person. It knows a vector: an operating system four versions behind, a form completion time in the ninety-ninth percentile, an email domain that has not been fashionable since the Clinton administration, a preference for the telephone channel, a session at three in the afternoon. It has never been told her age. It does not need to be told her age. It has learned the residue that age leaves on everything a person touches, and it has priced it.

When it declines her, or loads her premium, or drops her below a referral threshold, the letter will not say why. If she wants to know why, she will be directed to a portal. If she cannot use the portal, she will be offered a chatbot. If the chatbot cannot help, she will be given a number that leads to a menu. And at the end of that process, if she reaches it, a human being will look at a screen showing the model's output and a confidence score, and will decline to overturn it, because overturning it requires a reason and the reason is buried in a feature interaction that nobody at the institution can articulate either.

And if anyone ever tested the model for age bias, the test may be privileged.

Suh's article carried the line that no one should be considered too old for AI. It is a good line. But the more precise formulation of the problem is that nobody is too old for AI, because AI does not require your participation. It requires only your data exhaust, and it will make decisions about your money, your health and your access to public life whether or not you have ever touched a keyboard.

The robot on the side table is the part of this she agreed to. Everything else is happening to her, in rooms she will never see, in a language nobody will translate, on the basis of a life lived mostly before the data started being collected.

Sources and References

1. Suh Chung-ha (2026) “No one should be too old for AI,” The Korea Times, 19 August 2026. Available at: https://www.koreatimes.co.kr/opinion/20260819/no-one-should-be-too-old-for-ai
2. World Health Organization (2022) Ageism in artificial intelligence for health: WHO policy brief, WHO, 9 February 2022, ISBN 978-92-4-004079-3. Available at: https://www.who.int/publications/i/item/9789240040793
3. New York State Office for the Aging (2023) “NYSOFA's Rollout of AI Companion Robot ElliQ Shows 95% Reduction in Loneliness,” press release, 1 August 2023. Available at: https://aging.ny.gov/news/nysofas-rollout-ai-companion-robot-elliq-shows-95-reduction-loneliness
4. New York State Office for the Aging (2026) Transforming Care for Older Adults Across the State of New York: ElliQ Project Update, February 2026. Available at: https://aging.ny.gov/system/files/documents/2026/02/nysofa-elliq-project-update-2026.pdf
5. Pu, Lihui, Moyle, Wendy, Jones, Cindy and Todorovic, Michael (2019) “The Effectiveness of Social Robots for Older Adults: A Systematic Review and Meta-Analysis of Randomized Controlled Studies,” The Gerontologist, 59(1), pp. e37-e51. Available at: https://academic.oup.com/gerontologist/article/59/1/e37/5036100
6. Yen, Hsin-Yen, Huang, Chia-Wei, Chiu, Hsiao-Ling and Jin, Gaoxiang (2024) “The Effect of Social Robots on Depression and Loneliness for Older Residents in Long-Term Care Facilities: A Meta-Analysis of Randomized Controlled Trials,” Journal of the American Medical Directors Association, 25(6), 104979. Available at: https://www.jamda.com/article/S1525-8610(24)00176-2/fulltext
7. U.S. Equal Employment Opportunity Commission (2023) “iTutorGroup to Pay $365,000 to Settle EEOC Discriminatory Hiring Suit,” press release, 9 August 2023. Available at: https://www.eeoc.gov/newsroom/itutorgroup-pay-365000-settle-eeoc-discriminatory-hiring-suit
8. Holland & Knight (2025) “Federal Court Allows Collective Action Lawsuit Over Alleged AI Hiring Bias,” Insights, May 2025. Available at: https://www.hklaw.com/en/insights/publications/2025/05/federal-court-allows-collective-action-lawsuit-over-alleged
9. Duane Morris Class Action Defense (2026) “California Federal Court Grants In Part And Denies In Part Workday's Motion To Dismiss In Mobley v. Workday,” 24 June 2026. Available at: https://blogs.duanemorris.com/classactiondefense/2026/06/24/california-federal-court-grants-in-part-and-denies-in-part-workdays-motion-to-dismiss-in-mobley-v-workday/
10. Norton Rose Fulbright (2026) “Behind the privilege shield: Safeguarding AI bias-testing data in employment decisions,” Inside Tech Law, June 2026. Available at: https://www.insidetechlaw.com/blog/2026/06/behind-the-privilege-shield-safeguarding-ai-bias-testing-data-in-employment-decisions
11. Berg, Tobias, Burg, Valentin, Gombović, Ana and Puri, Manju (2020) “On the Rise of FinTechs: Credit Scoring Using Digital Footprints,” The Review of Financial Studies, 33(7), pp. 2845-2897. Available at: https://academic.oup.com/rfs/article-abstract/33/7/2845/5568311
12. Pinsent Masons (2024) “Age discrimination and insurance,” Out-Law Guide. Available at: https://www.pinsentmasons.com/out-law/guides/age-discrimination-and-insurance
13. UK Government (2012) The Equality Act 2010 (Amendment) Regulations 2012, SI 2012/2992, legislation.gov.uk. Available at: https://www.legislation.gov.uk/uksi/2012/2992/made
14. Information Commissioner's Office (2026) “Rights related to automated decision making including profiling,” UK GDPR Guidance and Resources. Available at: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/
15. European Union (2024) “Article 5: Prohibited AI Practices,” Regulation (EU) 2024/1689 (Artificial Intelligence Act). Available at: https://artificialintelligenceact.eu/article/5/
16. Ofcom (2026) Adults' Media Use and Attitudes Report 2026, published 2 April 2026. Available at: https://www.ofcom.org.uk/siteassets/resources/documents/research-and-data/media-literacy-research/adults/adults-media-use-and-attitudes-2026/adults-media-use-and-attitudes-2026-report.pdf
17. Age UK (2025) “Age UK warns 2.4 million digitally excluded older people are at risk of being left behind in an increasingly digital world,” press release, 29 July 2025. Available at: https://www.ageuk.org.uk/latest-press/articles/age-uk-warns-22.4-million-digitally-excluded-older-people-are-at-risk-of-being-left-behind-in-an-increasingly-digital-world/
18. Age UK (2023) “You can't bank on it anymore”: The impact of the rise of online banking on older people, May 2023. Available at: https://www.ageuk.org.uk/siteassets/documents/reports-and-publications/reports-and-briefings/money-matters/the-impact-of-the-rise-of-online-banking-on-older-people-may-2023.pdf
19. Pew Research Center (2026) “Internet use, smartphone ownership, digital divides in the US: What we know,” Short Reads, 8 January 2026. Available at: https://www.pewresearch.org/short-reads/2026/01/08/internet-use-smartphone-ownership-digital-divides-in-u-s/
20. Office of the High Commissioner for Human Rights (2026) “Second session of the Intergovernmental Working Group on the human rights of Older Persons, 26-30 October 2026,” OHCHR. Available at: https://www.ohchr.org/en/events/sessions/2026/second-session-intergovernmental-working-group-human-rights-older-persons-26
21. International Telecommunication Union (2026) Artificial intelligence and ageing: Inclusive pathways for older persons in a digital world, ITU, July 2026. Available at: https://www.itu.int/hub/publication/d-phcb-ai_age-2026/
22. Song, Tianqi, Sun, Black, Li, Jingshu, Li, Han, Yang, Chi-Lan, Xu, Yijia and Lee, Yi-Chieh (2026) “Understanding Older Adults' Experiences of Support, Concerns, and Risks from Kinship-Role AI-Generated Influencers,” arXiv preprint 2602.22993, 26 February 2026. Available at: https://arxiv.org/abs/2602.22993
23. López, Fernando, Delgado-Santos, Paula, Gómez, Pablo, Solans, David and Luque, Jordi (2026) “'OK Aura, Be Fair With Me': Demographics-Agnostic Training for Bias Mitigation in Wake-up Word Detection,” arXiv preprint 2604.05830, 7 April 2026. Available at: https://arxiv.org/abs/2604.05830
24. Turkle, Sherry (2011) Alone Together: Why We Expect More from Technology and Less from Each Other, Basic Books, New York.
25. Consumer Financial Protection Bureau (2026) “12 CFR § 1002.6 Rules concerning evaluation of applications,” Regulation B (Equal Credit Opportunity Act), eCFR. Available at: https://www.ecfr.gov/current/title-12/chapter-X/part-1002/subpart-A/section-1002.6

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

The clock tower is the detail that sticks. In the hills of Guian New Area, in China's south-western province of Guizhou, there is a cluster of buildings done up in a kind of continental European pastiche: red roofs, arcaded facades, a multi-arched bridge, and a tower with a clock on it. When AFP visited in July 2026 the whole confection was emitting a low, permanent hum. It is not a resort or a theme park. It is Huawei's largest data centre, and the hum is the sound of several hundred megawatts of cooling and compute doing whatever it is that compute does.

Outside it, on the road, street vendors were selling lunch to data centre workers beneath a banner exhorting everyone to promote high-quality development. A shopkeeper named Shu Peihua told the news agency what the change had felt like from ground level. It used to be a barren mountain, Shu said, but since the area has developed, transportation has become more convenient, trade has picked up, business opportunities have emerged. Another resident, Li Xixiu, put it more plainly still: the centres had really boosted the economy of this entire area, and the villagers in the neighbourhood now find jobs nearby, where before they had to go to other places.

Hold on to those two statements, because they are true. They are also, in the way that ground-level truths often are, an incomplete account of what has happened to Guizhou. In the same report, researchers at Taiwan's Research Institute for Democracy, Society and Emerging Technology laid a different set of numbers beside them. Guizhou has averaged 7.4 per cent annual GDP growth over the past decade. Its wage growth over the same period was second to last in the country. And the province, having borrowed heavily to build the roads, substations and fibre that make it attractive to a hyperscaler, now carries one of the highest debt burdens in China.

That is the puzzle. A place where the growth arrived and the prosperity did not.

What the Ledger Actually Says

The DSET analysis is worth reading slowly, because it separates two things that boosters routinely fuse. Data centres, the researchers found, drive heavy investment in land and equipment, but their impact on boosting local per capita income remains limited. Investment is not income. Capital formation is not a wage. A billion yuan of servers sitting in a shed in Guian counts towards provincial output in exactly the way that a billion yuan of anything else does, and it counts whether or not a single additional person in Guizhou is better paid as a result.

The debt side is starker. By 2024, according to DSET's figures, Guizhou ranked thirtieth among China's provincial-level jurisdictions on debt-to-revenue and twenty-seventh on debt-to-GDP. There are thirty-one of them. This is not a province that dabbled at the edges of the borrowing economy; it went in at the deep end and stayed. The South China Morning Post has reported that Guizhou's outstanding government debt in 2023 amounted to around 72 per cent of provincial GDP, well above the 60 per cent threshold the central government treats as prudent, after years of hefty infrastructure spending on projects that did not all deliver what local officials hoped.

Andrew Stokols of Singapore Management University offered AFP the general version of the finding. Data centres, he said, do not necessarily create a huge spillover effect on local jobs, and immediate benefits have been elusive, in China and elsewhere.

Elsewhere is the operative word. The Guizhou story reads as if it were about Chinese state planning, provincial competition and the peculiarities of local government financing vehicles, and in part it is. But strip away the Chinese institutional furniture and what remains is a much more general fact about a particular kind of asset: enormously expensive to build, almost costless in labour to run, and structurally disinclined to share.

How a Poor Province Became a Server Farm

Guizhou did not stumble into this. It went looking.

The province is mountainous, landlocked, historically among China's poorest, and for most of the reform era its principal export was people. Karst topography makes farming hard and heavy industry harder. What it has is altitude, a cool and stable climate, geological stability, cheap land and a lot of hydropower. In 2016 Beijing designated Guizhou as the country's first national big data comprehensive pilot zone. Guiyang, the provincial capital, began hosting an annual international big data expo. Apple's Chinese iCloud operation was routed through a facility in Guian built with the state-backed operator Guizhou-Cloud Big Data. Tencent went in. So did Huawei, at scale.

In 2021 the strategy got a name, and in February 2022 it got a budget. Eastern Data, Western Computing, or 东数西算, is the National Development and Reform Commission's programme to build eight national computing hubs and ten national data centre clusters, siting the compute-heavy, latency-tolerant workloads of China's digital economy in the energy-rich, land-rich, underpopulated west while the east keeps the customers. The hubs sit in Beijing-Tianjin-Hebei, the Yangtze River Delta, the Greater Bay Area, the Chengdu-Chongqing corridor, Inner Mongolia, Ningxia, Gansu and Guizhou. The NDRC's own projection was that the hubs and clusters would drive roughly 400 billion yuan of investment a year.

The logic is not stupid. AI training is brutally energy-hungry and largely indifferent to a few dozen milliseconds of latency. China has ordered that data centres draw 80 per cent of their power from renewable sources by the end of the decade, and the west is where the wind and the sun and the water are. Simeng Deng of Rystad Energy told AFP that the facilities help absorb the surplus of renewable power generation, which is a real service: western China curtails a great deal of clean electricity it cannot move east fast enough. China is on course to nearly double its data centre capacity within five years.

There is a wrinkle in the clean-power story that deserves stating. Guizhou is a hydropower province, but it is also a coal province. Its grid leans hard on thermal generation, and leans harder when the reservoirs are low. Between 2020 and 2024 the clean share of Guizhou's generation actually fell by five percentage points, one of the steepest declines in China, as fossil output grew faster than total generation. The 80 per cent renewable target is a target, not a description. And the curtailed wind and solar that western data centres are meant to soak up is curtailed partly because transmission out of the west is inadequate, which is the same infrastructure gap that made siting compute there attractive in the first place. The policy is elegantly circular: build the load where the power is stranded, because the power is stranded.

For a province like Guizhou, the pitch to Beijing and to the market was straightforward. We have the power. We have the land. We will build the rest. And it did build the rest, with borrowed money, which is the part of the sentence that ended up mattering most.

The Machine That Employs Almost Nobody

The single most useful piece of evidence on what a hyperscale facility does to the place around it was published this month, and it is not about China at all.

In a working paper dated 7 August 2026, Dany Bahar of Brown University and Greg C. Wright of the University of California, Merced set out to test the spillover claim directly. Their opening line is the thesis: a hyperscale data centre can cost more than a billion dollars while employing only a few dozen people. Using a registry of 341 hyperscale facilities in the United States, assembled from a Pacific Northwest National Laboratory atlas, operator announcements, subsidy records and state filings, they asked whether that investment propagates outward through the three classic channels economists expect: a deeper shared labour pool, denser supplier linkages, and firm clustering with knowledge spillovers.

Their method is elegant. Because operators screen sites for power, land and fibre, the places that get a data centre are systematically unlike the places that do not, which wrecks naive before-and-after comparisons. So Bahar and Wright compare the immediate vicinity of a completed facility against the surrounding area at the same site, and separately compare 341 built campuses against 84 hyperscale projects that were publicly announced and never constructed. Satellite imagery does the dating: land clearing and night-time lights mark the moment construction begins.

At the parcel, the effect is enormous and unmistakable. Night-time lights rise by 38 per cent within the first kilometre when construction starts. Vegetation clears. The place is visibly transformed. And then, moving outward, the signal decays to approximately nothing by five kilometres. Announced projects that were never built show no comparable change, which is the control working exactly as intended.

Beyond the fence line, the findings are a sustained deflation. Advertised salaries do not rise; the authors can rule out any increase above 5.5 per cent. New firm registrations and business applications do not rise, with upper bounds of 1.6 and 5.7 per cent. Supplier job postings rise by 5.9 per cent, but the confidence interval runs from a 15 per cent decline to a 32 per cent increase, which is a polite way of saying the data cannot tell. County-level data-processing employment rises 26 per cent and establishments 27 per cent, but that category includes the facility itself, and related industries show no consistent response. Compute-using firms are indeed found near data centres, but 69 per cent of them were already there before the nearest facility opened. Nearby rents may rise a few per cent, imprecisely. Multifamily permitting does not rise. Net migration does not rise. Foot traffic and commercial spending show no robust change. Residential electricity prices, in their US sample, do not rise either.

The summary sentence is one that ought to be pinned above every county planning committee and every provincial development office on earth: at this scale, the sites are transformed, but there is little evidence of a new local cluster.

That is Guizhou's 7.4 per cent GDP growth and its second-from-bottom wage growth, derived independently, on the other side of the Pacific, from satellites and job adverts.

Two Kinds of Job, and the Gap Between Them

The employment arithmetic is not hidden. It is simply presented in a way that encourages people to add the wrong numbers together.

A hyperscale build is a construction event of genuine magnitude. Industry staffing analyses drawing on the Uptime Institute's 2024 Global Data Center Survey put a 100 megawatt campus at roughly 850 construction workers across an eighteen-month build. These are the industry's own numbers, published by recruiters who profit from the boom, which makes their shape more telling rather than less. That is real money moving through a local economy: rented rooms, diesel, lunch, aggregate, portaloos. It is also, by design, temporary. When the last commissioning engineer drives away, a fully built 100 megawatt hyperscale campus typically retains somewhere between one hundred and two hundred permanent on-site staff.

The gap between those two figures is where the political trouble lives. A community is shown the construction number, experiences the construction number, and then is left with the operations number, which is smaller by an order of magnitude and often filled by specialists who commute or relocate rather than by the people who used to work the mountain.

Guizhou has a particular reason to feel that gap keenly. For three decades the province's most reliable export was working-age adults, sent to the factory belts of Guangdong and Zhejiang, leaving behind the phenomenon that Chinese social policy calls left-behind children. Li Xixiu's observation that villagers can now find work nearby is, in that context, an enormous statement. It is also one that depends on which phase of the project you are standing in. Construction employment for a build-out of dozens of facilities can run for years, and while it runs, it looks like a structural change to the local labour market. It is not one.

Ireland offers the cleanest illustration in the world, because the Irish state publishes both sides. The Central Statistics Office found that data centres consumed 22 per cent of all metered electricity in the Republic in 2024, and 23 per cent in 2025. The Department of Enterprise's own assessment, which dates from 2018, put direct employment at roughly 1,800 people, with a further 1,900 a year in related construction, the latter figure supplied by the Construction Industry Federation. Slightly less than a quarter of a national grid, in exchange for a direct workforce that would fit comfortably into a mid-sized secondary school. The jobs number is eight years older than the electricity number, which tells its own story about what gets counted. The Commission for Regulation of Utilities has rewritten connection policy to favour applicants who bring their own dispatchable generation or storage and can offer demand flexibility. Ireland is not hostile to the industry. It simply ran out of grid before it ran out of enthusiasm.

Loudoun County, and Why Guizhou Cannot Copy It

There is one place where the bargain has unambiguously worked for residents, and it is worth understanding precisely why, because the reason does not travel.

Loudoun County, Virginia, hosts the densest concentration of data centres on the planet. Its fiscal 2027 budget anticipates roughly 417 million dollars in real property tax from data centre buildings and about 879 million dollars in personal property tax on the servers and equipment inside them, nearly 1.3 billion dollars in total, or 45 per cent of the county's nearly 2.9 billion dollars in tax revenue, from a county of about 440,000 people. Industry-adjacent analysis by Mangum Economics for the Northern Virginia Technology Council estimates that without that revenue, residential property tax rates would have to rise by 91 per cent, nearly double, costing a typical homeowner some 5,800 dollars a year. The average completed facility employs about 50 people.

Loudoun is not a story about labour spillovers. Bahar and Wright would predict, correctly, that the wage effects there are muted. Loudoun is a story about a fiscal linkage: a local government with the legal power to tax the equipment inside the building, annually, at high value, and to spend the proceeds on its own schools and roads.

Almost nowhere else has arranged things that way. In the United States, at least thirty-five states now offer tax incentives aimed specifically at data centres, with cumulative awards approaching twenty billion dollars by the authors' tally from the Good Jobs First subsidy tracker. Good Jobs First's own analysis of eleven data centre megadeals found an average public cost of about 1.95 million dollars per permanent job, with the largest single per-job subsidy, 6.4 million dollars, awarded by North Carolina to Apple. The organisation's recommendation was that all state and local subsidies combined be capped at 50,000 dollars per permanent job. Set against 1.95 million, that recommendation reads less like policy advice than like an intervention.

Guizhou's structural problem is that it has neither Loudoun's tax handle nor the option of declining the deal. Chinese local governments do not levy a meaningful recurring property tax. Their revenue historically came from land sales and from off-balance-sheet borrowing through local government financing vehicles, which build the roads and substations and repay the loans out of the growth the roads and substations are supposed to produce. When a province competes for a hyperscaler by discounting power, discounting land and building the grid connection itself, it has converted the fiscal linkage from an asset into a liability before the first rack is energised. The investment lands. The debt service lands. The wage bill, being tiny, lands somewhere between the two and barely registers.

An Enclave With Better Cooling

Development economists have a name for this shape, and it is much older than the cloud.

Albert Hirschman argued in 1958 that the developmental value of an industry lies not in its size but in its linkages: backward, to the suppliers it pulls into existence, and forward, to the industries that add value to its output. In a 1977 essay on staple exports he generalised the scheme, adding the fiscal linkage, meaning the public revenue an industry generates, and the consumption linkage, meaning the local demand created by the wages it pays. An enclave economy is what you get when all four are weak. The classic cases are extractive: a capital-intensive mine or oil field employing very few people relative to its contribution to output, importing its equipment, exporting its product, and touching the surrounding economy mainly through a fenced perimeter and a haul road. UNCTAD's work on extractive industries describes exactly this combination, capital-intensive, labour-light, linkage-poor, as the reason resource wealth so often fails to convert into local development.

A hyperscale data centre is an unusually pure specimen. Its backward linkages are global: the GPUs come from a handful of foundries, the transformers and chillers from specialist manufacturers, the network gear from a shortlist. Bahar and Wright's inconclusive supplier estimates are what you would expect from an industry that buys almost nothing locally except concrete, security and landscaping. Its forward linkages are, by construction, non-local: the entire premise of Eastern Data, Western Computing is that the value-added services consuming the compute stay two thousand kilometres east. Its consumption linkage is capped by a payroll of dozens. And its fiscal linkage is the one variable that policy can actually set, which is precisely why competition between jurisdictions tends to bid it towards zero.

This is not an argument that data centres are bad. It is an argument that they are a particular category of thing, and that the category has a well-documented behaviour which the promotional literature systematically ignores. Guizhou did not misunderstand data centres. It understood them as a growth engine, which they are, and hoped they would also be a development engine, which they largely are not.

The Racks That Nobody Rented

The second Guizhou problem is that a good deal of the capital did not even deliver the compute.

In March 2025, MIT Technology Review reported that of the more than five hundred data centre projects announced across China in 2023 and 2024, at least 150 had been completed by the end of 2024, and that local publications were reporting up to 80 per cent of new computing capacity sitting idle. GPU rental prices collapsed accordingly: an eight-GPU Nvidia H100 server that had commanded around 180,000 yuan a month fell to about 75,000.

The DSET researchers Angela Glowacki and Cartus Bo-Xiang You, writing for the Australian Strategic Policy Institute's Strategist in May 2026, mapped the same problem onto the western build specifically. By 2024, 633 hyperscale and large data centres had been built and made operational under Eastern Data, Western Computing, lifting national computing capacity to 268 exaflops. Some western facilities, they wrote, sit empty, with utilisation rates as low as 20 to 30 per cent, a far cry from the original policy goal of more than 60 per cent. Beijing has since restated that all data centres should run at no less than 60 per cent utilisation, and that no new large or super-large facilities should be built in cities where existing ones operate below 50 per cent.

The reasons are mundane and instructive. Remote regions lacked the fibre-optic cables needed to move large volumes of data in real time, forcing operators to spend more on transmission than the model assumed. Renewable curtailment in the western region still exceeds 30 per cent, which undercuts the cheap-clean-power premise. Many facilities were built on the assumption that state-owned enterprises and government agencies would buy the compute, and that demand did not fully arrive. Inter-governmental competition produced speculative overbuilding, and more than a hundred state-backed projects have been scrapped in the past eighteen months against eleven cancellations in the whole of 2023.

Guian, to be fair, is at the better end of this distribution. Local reporting in August 2026 put first-half electricity consumption growth in the new area at 33.7 per cent year on year, on a total of 3.12 billion kilowatt-hours through late June, with big data operations alone consuming 1.93 billion of that, up 52.2 per cent. Guian is busy. But an idle rack and a busy rack impose the same debt service, and a province cannot know which it has bought until several years after it has paid.

Who Actually Pays the Bill

If the benefits are concentrated at the parcel and diffuse to nothing by five kilometres, the costs run in the opposite direction. They start at the parcel and travel.

A 2026 arXiv preprint by Danbo Chen, Zijun Zhou, Yongyang Cai, Jiahong Qin, Ani Katchova and Lei Chen models this directly, coupling language-model analysis of corporate compute plans with energy-system modelling. It projects that electricity consumption by the six largest AI firms will rise from roughly 118 terawatt hours in 2024 to between 239 and 295 terawatt hours by 2030, about one per cent of global power demand, with more than 90 per cent of new capacity landing in North America, Western Europe and Asia-Pacific. Crucially, the burden is not evenly distributed. The authors construct a Power Stress Index and find values above 0.25 in Oregon, Virginia and Ireland, while diversified grids in Texas and Japan absorb the load more comfortably. Their conclusion is that AI infrastructure has become a structural component of power-system dynamics rather than a marginal load, which means it now has to be planned for rather than merely connected.

Water follows the same logic. A preprint by Yuelin Han, Pengfei Li, Adam Wierman and Shaolei Ren, revised in March 2026, estimates that if 2024 water-use intensity persists, US data centres could collectively require between 697 and 1,451 million gallons per day by 2030, comparable to New York City's entire supply. Even assuming aggressive efficiency gains of 10 per cent a year, the range is 227 to 604 million gallons daily. Associated public water infrastructure costs reach roughly ten billion dollars, rising to fifty-eight billion under high-growth scenarios. Their central observation is the one that matters here: these impacts are highly concentrated on communities hosting data centres. The compute is national. The reservoir is not.

Memphis has become the American shorthand for what concentration looks like when it goes wrong. The NAACP, the Southern Environmental Law Center and Earthjustice sued xAI in April 2026 over the operation of 27 unpermitted methane gas turbines in Southaven, Mississippi, effectively a power plant assembled to feed the Colossus 2 facility. This is an airshed where Shelby County in Tennessee and DeSoto County in Mississippi have both received an F grade for ozone from the American Lung Association. The plaintiffs include residents of the Whitehaven and Boxtown neighbourhoods of South Memphis, downwind. The Department of Justice has since intervened on xAI's side. The turbine count, meanwhile, never stopped rising. The plaintiffs went back to court on 6 May 2026 seeking an emergency order to halt operations, and the installations continued regardless: by mid-July, correspondence between xAI's environmental consultant and Mississippi regulators, obtained by Reuters through a public records request, documented 59 unpermitted turbines, at least 57 of them at Southaven, roughly double the number the company had publicly acknowledged. The resolution took the most direct form available: Mississippi's Permit Board had already approved a permanent 1.2 gigawatt plant of 41 turbines on the same ground in March 2026, a month before the suit was filed, and on 31 July xAI agreed a schedule to strip the temporary machines out of the Stanton Road site, beginning in August 2026 and finishing by July 2027. The fight over unpermitted temporary turbines has been settled by making the power station permanent and lawful in the same airshed, breathed by the same people, which is the tell that it was never really about permits. Whatever the litigation concludes, the geography of the dispute is the point: the model is trained everywhere and the generation sits in one postcode, with permission now to stay there.

What Happens When You Ask

There is a final piece of the research picture, and it is a strange one, which is what makes it interesting.

In a preprint first posted in November 2025, Zhifeng Wu, Yuelin Han and Shaolei Ren asked whether large language models could stand in for community consultation on data centre projects. They built a framework that polls AI agents, prompted with local demographic and geographic context, on how they would respond to a proposed facility, and compared the output against real human survey data. The agents identified water usage and utility bills as the dominant concerns and tax revenue as the principal perceived benefit. Responses varied meaningfully depending on which model was used and where the hypothetical project sat. And, notably, the synthetic responses aligned substantially with findings from actual human surveys. The authors propose it as an efficient early-stage instrument for folding neighbourhood perspectives into siting decisions before the plans harden.

You can read that finding two ways, and both are uncomfortable. The optimistic reading is that we now have a cheap way to anticipate what a community will object to, months before the first hearing, at a stage when the design can still change. The bleak reading is that the industry has arrived at a technique for simulating consent, and that the reason such a technique is attractive is that the genuine article is expensive, slow and increasingly likely to say no.

The Guizhou villagers quoted by AFP were not polled, synthetically or otherwise. They were asked a question by a passing reporter and answered it honestly, which is a different exercise from being consulted before a decision. Nothing in the Eastern Data, Western Computing framework required anyone in Guian to be asked whether the mountain should become a campus, and it is worth being clear that this is not solely a feature of the Chinese system. Across the United States, the same decision is routinely taken under non-disclosure agreements and by-right zoning, and communities learn what has been approved after the approval.

Note also what the agents converged on. Water. Bills. Tax revenue. Not wages. Not careers. Not the long-run transformation of the local labour market. Even a synthetic public, prompted to reason about a data centre, does not appear to expect it to be a jobs programme. The expectation gap that Guizhou is living through is largely one that promoters created and that residents, given a moment to think, do not fully share.

What Shu Peihua Is Describing

So return to the shopkeeper on the road outside Huawei's clock tower, because nothing in the preceding sections makes what Shu Peihua said untrue.

The road is real. In a karst province where a mountain village might once have been two hours from a trunk route, a dual carriageway built to carry transformers and chilled water plant is a permanent improvement to the lives of everyone along it. The universities are real; a local vendor told AFP that two had been established since the facilities went in. The customers are real, and so is Li Xixiu's point that people find work nearby now instead of boarding a train to Guangdong. Guizhou has been one of the great exporters of migrant labour in modern China, with all the social cost that implies, and a family that stays together because a parent can get a security job or a canteen job or a fit-out job forty minutes from home has received something that does not show up in a wage-growth ranking.

What the evidence says is narrower and harder. It says that these gains are the consumption linkage of a construction boom plus the ordinary agglomeration of a new-town development, and that they are front-loaded. It says the operational phase which follows will not employ many people, will not raise local salaries measurably, will not spawn a cluster of firms that were not already coming, and will not, on the American evidence, move rents, migration or retail spending much either. It says the electricity, water and land are consumed locally while the value of what they produce is realised somewhere with better weather and higher salaries. And in Guizhou's case, it says the province financed the entry ticket with debt that now ranks second-worst in the country relative to revenue, against assets that may be running at 20 to 30 per cent utilisation.

None of that argues for refusing the data centre. It argues for pricing it honestly, and for noticing which linkage is doing the work. The fiscal one is the only channel a host can reliably control, and it is the one that inter-jurisdictional competition destroys first. There are policy shapes that hold onto it: recurring taxation of the equipment rather than one-off land revenue, as in Loudoun; subsidies capped per permanent job, as Good Jobs First proposes; published utilisation and load data so that a province can tell a productive asset from a monument; large-load tariffs that make the operator, not the household, pay for the substation; and sunset clauses that return the abatement when the promised employment does not materialise.

The alternative is what the resource curse literature has been documenting for sixty years in copper and oil, now rendered in reinforced concrete and immersion cooling. Something enormous arrives. The output figures move. The mountain gets a road, and then the road gets quiet, and the ledger that recorded the growth turns out never to have been the ledger that measured the prosperity.

Shu Peihua is right that it used to be a barren mountain. The question Guizhou has yet to answer, and that a hundred counties from Virginia to Kildare are asking in their own accents, is what a mountain becomes when the thing built on it needs the mountain far more than the mountain needs it.

References and Sources

1. China goes rural with data centres in quest to power AI – AFP, via The Star, 19 August 2026
2. Abundant electricity isn't enough: China's overbuilt AI computing power is underused – Angela Glowacki and Cartus Bo-Xiang You, The Strategist, Australian Strategic Policy Institute, 6 May 2026
3. The Local Economic Impact of Data Centers – Dany Bahar and Greg C. Wright, working paper, 7 August 2026
4. Concentrated siting of AI data centers drives regional power-system stress under rising global compute demand – Danbo Chen, Zijun Zhou, Yongyang Cai, Jiahong Qin, Ani Katchova and Lei Chen, arXiv preprint 2604.06198
5. Small Bottle, Big Pipe: Quantifying and Addressing the Impact of Data Centers on Public Water Systems – Yuelin Han, Pengfei Li, Adam Wierman and Shaolei Ren, arXiv preprint 2603.02705
6. What AI Speaks for Your Community: Polling AI Agents for Public Opinion on Data Center Projects – Zhifeng Wu, Yuelin Han and Shaolei Ren, arXiv preprint 2511.22037
7. China built hundreds of AI data centers to catch the AI boom. Now many stand unused. – MIT Technology Review, 26 March 2025
8. Western regions to gain computing power – China Daily, 17 March 2022
9. Big data key to high-tech development – China Daily, 30 May 2023
10. China's debt-ridden Guizhou faces reckoning after years of splashing out on pricey projects – South China Morning Post
11. AI and Data Centers Surge in Guian as First-Half Electricity Demand Jumps 33 Percent – ChinaTechNews, 20 August 2026
12. Chinese government plans data center capacity reseller network amid overbuild concerns – Data Center Dynamics
13. Data Centres Metered Electricity Consumption 2025, Key Findings – Central Statistics Office, Ireland
14. Government Statement on the Role of Data Centres in Ireland's Enterprise Strategy – Department of Enterprise, Trade and Employment, Ireland, June 2018
15. CRU Publishes its Decision on New Electricity Connection Policy for Data Centres – Commission for Regulation of Utilities, Ireland
16. Loudoun County, Virginia: The Heart of the Data-Center Boom – Judge Glock, City Journal, 26 April 2026
17. The Impact of Data Centers on Virginia's State and Local Economies, 6th Biennial Report – Mangum Economics for the Northern Virginia Technology Council, February 2026
18. Money Lost to the Cloud: How Data Centers Benefit from State and Local Government Subsidies – Good Jobs First
19. A Generalized Linkage Approach to Development, with Special Reference to Staples – Albert O. Hirschman, 1977, reprinted in The Essential Hirschman, Princeton University Press
20. Extractive Industries: Optimizing Value Retention in Host Countries – United Nations Conference on Trade and Development
21. Illegal Pollution from Data Center Power Plants Shouldn't Harm Our Communities. We're Suing xAI. – Earthjustice
22. Pollution from Musk's unpermitted xAI power project hits hardest in Black communities – Disha Raychaudhuri and Valerie Volcovici, Reuters, via The Star, 14 July 2026
23. State sets dates to retire temporary xAI turbines but allows some to go past original deadline – Mississippi Today, 31 July 2026
24. China's north cleans up its power mix as the south lags – Centre for Research on Energy and Clean Air, 19 March 2025
25. How Many Jobs Does a Data Center Create? – Data Center Geeks, compiling the Uptime Institute 2024 Global Data Center Survey

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

A pug flying an aeroplane. That was the image, generated with an off-the-shelf model by a photographer who posts under the handle Horshack, and in September 2025 he persuaded a Nikon Z6III to certify it as a photograph.

The method was not sophisticated. He encoded the synthetic image into Nikon's raw NEF container, then used the camera's multiple exposure mode to graft it onto the skeleton of a legitimate capture. The camera, running firmware version 2.00 released on 27 August 2025, duly wrapped the result in a cryptographic manifest conforming to the specification published by the Coalition for Content Provenance and Authenticity. Anyone inspecting the file would have found a valid signature attesting that a real Nikon camera had recorded the scene. Nikon confirmed the fault on 4 September, suspended its Authenticity Service, and later notified users that every certificate it had issued would be revoked. Early adopters who had spent the fortnight signing their work found their proofs retrospectively voided.

The more instructive part came next. Horshack pointed out that Nikon could not fully fix this alone, because the default behaviour of the widely used C2PA validation tools is not to check whether a signing certificate has been revoked. The revocation-checking code exists in the software development kit; it is simply not switched on by default. He filed a GitHub issue asking that the reference command-line tool change that. Until it does, a revoked certificate and a valid one look identical to most software that inspects them.

Hold that sequence in mind, because it contains the whole argument in miniature. Manufacturing a convincing fake cost one person an afternoon and no money. Certifying that something is real required a camera manufacturer, a firmware pipeline, a certificate authority, an industry consortium, a specification, a conformance programme and a public trust list — and it failed anyway, in a way only the consortium could repair.

This is the asymmetry that will define the next decade of the internet, and almost every optimistic account of the “trust economy” walks straight past it.

The Statistic Everyone Cites Cannot Prove Its Own Provenance

Writing in Modern Diplomacy on 16 August 2026, Yang Xite, a research fellow at ANBOUND, set out the case with unusual clarity. “Information used to be scarce, and access to it was a source of power,” he wrote. “Today, the problem is almost the opposite; there is too much information floating online.” His conclusion: “As the cost of producing information approaches zero, the value of finding, checking, filtering, and trusting information rises. The scarce resource is no longer content itself. It is confidence in the content.” And therefore: “In a market where consumers and businesses are increasingly exposed to fraud, proof of authenticity can itself become a product.”

That is correct as far as it goes. The trouble starts with the number recruited to support it.

You will have seen the claim that ninety per cent of online content will be AI-generated by 2026. It appears in policy briefings, keynotes and vendor decks, usually attributed to Europol, whose 2022 report Facing reality? Law enforcement and the challenge of deepfakes states that “experts estimate that as much as 90% of online content may be synthetically generated by 2026”.

In January 2023, Jesse Walker at Reason traced the chain. Europol's “experts” resolve to a single citation: Nina Schick's 2020 book Deepfakes: The Coming Infocalypse. Schick's source was one named individual — Victor Riparbelli, chief executive of Synthesia, a company that sells synthetic video. What Riparbelli said was that synthetic video may account for up to ninety per cent of all video content in as little as three to five years. A forecast about one medium, made by a vendor with a direct commercial interest in that medium's growth, generalised into a claim about the entire internet, laundered through a book into a police agency report and from there into the newspaper of record.

The most widely cited datum about information pollution is itself a specimen of information pollution. It is not a measurement. It never was.

The measurements that do exist tell a duller, more useful story. In October 2025 the search analytics firm Graphite published an analysis by Gregory Druck, Jose Luis Paredes, Bevin Benson and Ethan Smith covering forty-three thousand English-language URLs drawn from CommonCrawl between January 2020 and May 2025. They reported their error rates: a 4.2 per cent false positive rate against pre-ChatGPT articles, and a 0.6 per cent false negative rate against known GPT-4o output. AI-written articles overtook human-written ones in November 2024 and stood at just over half the sample by May 2025. Crucially, the proportion has been broadly stable for about a year. The wave crested; it did not keep rising toward ninety.

Graphite also noted something that cuts against the panic: these articles largely do not surface in Google or ChatGPT results. NewsGuard, tracking the sharper end of the phenomenon, had identified 3,749 AI content farm sites across sixteen languages as of 23 June 2026, more than double its count a year earlier. A real and growing problem. Not ninety per cent of the internet.

This matters beyond pedantry. Build a verification regime on the premise that nearly everything is fake and you will build something that treats unverified as guilty by default. Which is exactly what is being built.

What the Economics Paper Actually Says Is Worse

The arXiv paper usually invoked alongside the ninety per cent figure does not contain it. “The Economics of Information Pollution in the Age of AI: General Equilibrium, Welfare, and Policy Design”, submitted by Yukun Zhang and Tianyang Zhang on 17 September 2025 and revised on 4 January 2026, is a theoretical model rather than an empirical survey. It contains no census of what fraction of the web is synthetic.

What it does contain is a sharper claim. The authors argue that large language models represent “a fundamental shock to the economics of information production” because they collapse the marginal cost of generation asymmetrically — driving the cost of low-quality synthetic content towards zero while leaving high-quality production costly. Formally, AI substitutes for labour in low-quality output but complements it in high-quality creation. From this they derive a unique “Polluted Information Equilibrium”, and attribute its inefficiency to a threefold market failure: a production externality, a platform governance failure, and an information commons externality.

That framework explains something a raw percentage cannot. The problem is not the volume of synthetic content. It is that the cost gap between producing a plausible lie and producing a verified truth has widened, and every actor's incentives now point downhill. Zhang and Zhang propose an Information Pollution Index and an adaptive governance regime keyed to real-time readings — a proposal presupposing an instrument nobody operates.

“AI, Digital Platforms, and the New Systemic Risk” by Philipp Hacker, Lilian Edwards and Atoosa Kasirzadeh, submitted on 22 September 2025 and revised on 23 May 2026, comes at the same territory from the governance side. Drawing on finance, complex systems theory, climate science and cybersecurity, the authors argue that recent European legislation invokes systemic risk while relying on narrow or ambiguous characterisations of it. The Digital Services Act, they find, identifies systemic risk better than the more recent AI Act, and harms such as discrimination at scale and systematic hallucinations “may not fall under current legal definitions, given the AI Act's focus on frontier model capabilities”.

Put the two together and the diagnosis is precise. Generation has become cheap in a way structurally biased towards the low-quality end, and the legal instruments built to respond target frontier model capabilities rather than population-level degradation of the information commons. Neither paper says ninety per cent of the internet is fake. Both say something more troubling: the machinery for noticing and pricing the damage does not exist.

Seeing Stopped Being Enough Somewhere Around Last March

The abstraction becomes concrete fastest in medicine, where the readers are the most highly trained image analysts in the world.

On 24 March 2026, Radiology published a study led by Mickael Tordjman, a post-doctoral fellow at the Icahn School of Medicine at Mount Sinai, testing whether radiologists could distinguish synthetic X-rays from real ones. Seventeen radiologists at twelve centres across six countries assessed 264 radiographs, half authentic and half generated, using both a general-purpose commercial model and RoentGen, a diffusion model built at Stanford for chest radiography.

When the radiologists did not know the study's true purpose, only forty-one per cent spontaneously flagged the synthetic images. Told explicitly that the dataset was half fake, their mean accuracy reached seventy-five per cent, with individual performance ranging from fifty-eight to ninety-two per cent. Experience made no difference: the researchers found no correlation between years in practice and detection accuracy.

Read that again. Specialists, forewarned, missed roughly a quarter of fabricated medical images. The clinical implications are obvious — fraudulent insurance claims, manufactured litigation evidence, falsified trial data — but the epistemic implication is larger. A chest X-ray was, until recently, close to a paradigm case of self-authenticating evidence. It is not any more, and no amount of professional training closes the gap.

The financial sector has the loss figures. On 7 April 2026 the FBI's Internet Crime Complaint Center published its 2025 report: 20.9 billion dollars in reported losses, up twenty-six per cent from 16.6 billion, across 1,008,597 complaints — the first time annual complaints have exceeded one million in the centre's twenty-five year history. People aged sixty and over filed 201,266 complaints and accounted for roughly 7.7 billion dollars of the losses. For the first time, the report carried a section on AI-facilitated fraud: more than twenty-two thousand complaints and nearly 893 million dollars.

The archetypal case remains the engineering firm Arup, whose Hong Kong finance employee authorised fifteen transfers totalling roughly 25.6 million dollars in a single day after a video conference in which every executive on the call was a deepfake assembled from publicly available footage. Hong Kong police disclosed the incident in February 2024; Arup confirmed itself as the victim in May. Deloitte's Center for Financial Services, in an analysis published on 29 May 2024 by Satish Lalchand, Val Srinivas, Brendan Maggiore and Joshua Henderson, projected that generative AI could push United States fraud losses to forty billion dollars by 2027, from 12.3 billion in 2023. That last figure is a projection and should be read as one. The IC3 numbers are not.

Detection Is the Losing Side of an Arms Race It Cannot Leave

The instinctive response is to build a detector. The evidence says this will not work, and the best evidence is a benchmark designed specifically to test the claim.

Deepfake-Eval-2024, assembled by Nuria Alina Chandra, Oren Etzioni and eleven colleagues and first posted in March 2025, collected deepfakes actually circulating in the wild during 2024 — forty-five hours of video, 56.5 hours of audio and 1,975 images, drawn from eighty-eight different websites in fifty-two languages. The team then ran state-of-the-art open-source detectors against it.

Performance collapsed. Against the academic benchmarks on which these models report their headline accuracy, the area under the curve fell by fifty per cent for video, forty-eight per cent for audio and forty-five per cent for images. Commercial detectors and fine-tuned models did better, but still did not match human forensic analysts. The authors' conclusion is blunt: academic benchmarks are out of date and unrepresentative of real-world deepfakes.

This is not a temporary engineering shortfall. Detection is structurally the trailing party. A detector is trained on generators that already exist, and any published detector becomes a differentiable objective for the next generation to optimise against. Compression, re-encoding, screenshotting and platform transcoding degrade exactly the statistical residue detectors look for. Every step of ordinary internet distribution is, incidentally, an evasion technique.

Which means the question cannot be answered by looking harder at the artefact. You have to ask where it came from. And the moment you do, you have changed the subject from what is true to who is vouching — and created a market.

Provenance Changes the Question From What Is True to Who Signed

The Coalition for Content Provenance and Authenticity is the serious attempt at that change. Its output, Content Credentials, is a cryptographically signed manifest travelling with a file, recording what device or software produced it and what edits were applied. The specification reached version 2.4 in April 2026 and is progressing through ISO as standard 22144, still an unpublished draft.

The steering committee is the tell. It comprises Adobe, Amazon, the BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic — the world's largest advertising conglomerate, the dominant mobile and desktop platform vendors, the two largest generative model providers, three major distribution platforms, one public service broadcaster and one verification vendor. A reasonable roster for building an interoperable standard. Also a list of the organisations that will decide what counts as authentic.

Before assessing who should hold that power, be precise about what the technology proves. It proves that a manifest was signed by a key traceable to a listed certificate, and that the file has not changed since. It does not prove the manifest's assertions are true. Photograph an AI-generated image displayed on a screen using a C2PA-enabled Leica and you get a cryptographically impeccable credential attesting that a real camera captured a real scene, which it did — the scene was a monitor. Nor does provenance say anything about context: an authentic photograph from one conflict, correctly signed, remains authentic when captioned as coming from another.

The independent security assessment is worse than the conceptual critique. On 27 April 2026, Enis Golaszewski, Neal Krawetz, Alan T. Sherman, Edward Zieglar and seven colleagues published what they describe as the first comprehensive independent security analysis of C2PA, including the first formal-methods analysis of its core protocols. Their finding: “the current C2PA specifications fail to achieve their claimed security goals”. Their recommendation is stark. C2PA “should not yet be relied upon for high-stakes uses such as financial disclosures, journalism, or legal evidence” — a fairly comprehensive list of the uses for which it is being promoted.

The Certificate Authority Is the Chokepoint

Here the asymmetry stops being conceptual and becomes an access-control list.

To emit a Content Credential validators will trust, you need a signing certificate from a certification authority on the C2PA Trust List. To obtain one, your product must have passed the C2PA Conformance Program, which assesses it against the specification, a certificate policy and a set of security requirements. The interim trust list that held the ecosystem together in its early years was frozen on 1 January 2026; the formal programme replacing it opened in mid-2025 and remains in early enrolment.

Consider what this means in practice. SSL.com, a conformant certification authority, introduced a free tier in June 2026 offering one Level 1 claim signing certificate valid for a year plus ten thousand trusted timestamps. Generous — except that applicants must present “a valid C2PA conformance record ID”. The certificate is free; eligibility to hold one is not something an individual can obtain at all. Conformance is a process applied to products and organisations, with legal agreements, security assessments and identity validation attached. A freelance photographer in Nairobi cannot pass it. A witness with a phone cannot pass it.

The World Privacy Forum, in a technical review published on 3 September 2025 by Kate Kaye and Pam Dixon, put the governance objection with precision: “the criteria used for inclusion on these lists, or who the arbiters deciding which entities are considered known, and by extension, trustworthy have not been made public”. The same review noted that C2PA's own harms modelling documentation concedes that “loss of control over personal information and enforced suppression of speech are possible through use of C2PA”, and that identity specifications were moved out of the core standard into a separate working group in January 2024, with identity claims aggregators now bridging government and commercial identity systems into provenance workflows.

So the architecture, stated plainly: generating a convincing fake requires a consumer graphics card or a free web account. Generating a credential that a verifier will honour requires membership of, or accreditation by, a consortium whose selection criteria are not published. One of those capabilities has been democratised. The other has been enclosed.

Every Platform Reads the Evidence and Then Deletes It

Even for the accredited, the infrastructure does not currently deliver.

In October 2025 the Washington Post ran a test that ought to be better known. Reporters produced an AI-generated video carrying Content Credentials and uploaded it to eight major social platforms. Only YouTube surfaced any warning, and that disclosure sat inside a description attached to the clip rather than on the video itself. No platform preserved the Content Credentials data in a form users could access.

The mechanism is mundane. Platforms re-encode nearly every image and video at upload — for file size, for format normalisation, and to strip EXIF data that routinely contains GPS coordinates and device identifiers. Metadata not deliberately carried through the transcode does not survive it. Some platforms do read the manifest before discarding it: TikTok began reading C2PA data in 2024 and applies its own “AI-generated” labels on that basis, adding an invisible watermark in November 2025 precisely because, in its own account, C2PA metadata can be removed when content is re-uploaded or edited.

That is the settled state of affairs. The provenance record is read by the platform, used for the platform's own labelling decision, and deleted from the file that everyone actually sees. Users receive a conclusion, not evidence. Whether to believe the label is a question about the platform, which is where we started.

The proposed remedy is “durable” credentials — soft bindings such as invisible watermarks and perceptual fingerprints that allow a stripped manifest to be recovered from a cloud registry. C2PA's own FAQ describes the approach. It also relocates verification from the file in your hand to a lookup against a database somebody else operates, and makes every verification a queryable event. Google's SynthID, embedded by default across Gemini, Imagen, Lyria and Veo, had marked more than one hundred billion images and videos by Google's own account in May 2026, along with roughly sixty thousand years of audio. Detection has until now run through Google's detector portal and the Gemini app. At the same announcement Google said SynthID detection and C2PA verification were being built into Google Search and into Chrome, so that a reader can right-click an image, or circle it on a phone, and ask whether it was generated with AI. On the same day OpenAI began attaching Google's watermark, alongside a C2PA manifest, to images produced through ChatGPT and its API; ElevenLabs, Kakao and Nvidia announced adoption too.

Verification offered at the point of reading is a real improvement on everything described above. It also changes nothing about the transcode. The credential still does not survive the upload; what the reader consults instead is not the file but a query, and the largest rival model provider has just adopted the same company's mark. The watermark is Google's, the detector is Google's, and the answer to “is this real” is a request to Google.

Brussels Set a Deadline and It Lands on the Compliant

Two weeks ago, on 2 August 2026, Article 50 of the EU AI Act became enforceable. Providers of systems generating synthetic audio, image, video or text must now mark outputs with “effective, reliable, robust and interoperable machine-readable marks”. Deployers of deepfakes must disclose them with a visible or audible label a person can understand without any detection tool — a hidden machine-readable mark does not satisfy the deployer obligation. Systems already on the market have until 2 December 2026 to comply with the marking requirement, and content generated before 2 August 2026 needs no retrospective labelling. Non-compliance carries fines of up to fifteen million euros or three per cent of worldwide annual turnover, whichever is higher.

This survived a serious attempt to slow the whole regime. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and deferred the high-risk obligations under Annex III to 2 December 2027 and those for product-embedded systems to 2 August 2028. It did not delay Article 50. Spain has gone further, creating a dedicated supervisory agency, AESIA, and legislating penalties of up to thirty-five million euros or seven per cent of global turnover for failure to label.

Now apply the asymmetry. Article 50 binds providers placing systems on the EU market and deployers operating within its jurisdiction — companies with legal departments, European entities and revenue worth three per cent of. It binds OpenAI, Google, Adobe and Meta. It does not bind an open-weight model running on a laptop in a jurisdiction with no equivalent statute, which is where a growing share of genuinely harmful material is produced. The fraudsters who took 893 million dollars from Americans last year were not weighing their exposure to European administrative fines.

The predictable effect is that compliant, well-resourced, largely benign generation becomes marked, while non-compliant, adversarial generation stays unmarked. Over time that inverts the signal. If the honest are labelled and the dishonest are not, then “unmarked” ceases to mean “probably human” and starts to mean “outside the regime” — a category containing both the criminal and the ordinary person with a phone and no accreditation.

Hacker, Edwards and Kasirzadeh anticipated the structural version of this. Their framework identifies four levels of AI-related systemic risk and warns that the AI Act's orientation towards frontier model capabilities leaves population-level harms outside its definitions. Marking obligations regulate the emitter. The pollution they were meant to address is a property of the commons.

Ten Dollars a Title Is What Being Believed Now Costs

The optimistic version of the trust economy holds that a premium will emerge on genuinely human work. It is worth looking at what such a premium looks like once someone actually builds one.

The Authors Guild operates a certification called Human Authored. A book qualifies if its text was written by one or more humans, with an exception for spelling and grammar tools; using AI for research, brainstorming or indexing does not disqualify a title. The programme opened to Guild members in 2025 and, as of March 2026, to any author published in the United States. Certification costs ten dollars per title for non-members and requires identity verification through a third-party service. Both the fee and the identity check are waived for Guild members.

Two features deserve attention. First, the Guild does not vet manuscripts for AI content before certifying them, and says so, on the reasonable grounds that no reliable detection method exists. Enforcement rests on self-certification, a licensing agreement and community reporting. What is certified is not that a human wrote the book. It is that an identified person has made a contractual assertion and is exposed to consequences if it is false. That is accountability, which is genuinely valuable — and a different product from truth.

Second, look at the price structure. Ten dollars and an identity check for outsiders; free and no identity check for members. That is a small, benign, entirely defensible example of exactly the mechanism at issue. Membership confers the presumption of good faith. Non-membership must purchase it, and surrender identifying data to do so.

Scale that logic to every claim anyone makes online and the phrase “authenticity premium” reveals what it describes. A premium is a price. Someone pays it and someone collects it. Yang Xite's suggestion that “people with established reputations, professional track records, and a history of making reliable judgments may become more valuable precisely because they are accountable for what they say” is almost certainly right, and not obviously good news. It describes a market in which credibility accrues to those who already have standing, and everyone else must buy accreditation from an intermediary or be discounted. A premium on being believed is, in distributional terms, a tax on being doubted. It falls hardest on those least able to pay it and with the weakest prior reputation to trade on — which is to say, most people.

Proof of Personhood Turns Out to Be a Subscription Business

The same shape appears in identity infrastructure, at greater scale and with fewer safeguards.

World, the network built by Tools for Humanity and co-founded by Sam Altman, verifies humanness by scanning irises with a device called the Orb, issuing a World ID that lets a person prove uniqueness without revealing identity. By April 2026, nearly eighteen million people had verified at an Orb. During 2026 the company has pivoted towards enterprise, expanding verification points into retail and introducing fees for applications that check a user's humanity, while keeping verification free for the end user. Reported partners include Tinder and Reddit.

Read that business model carefully. Users supply biometrics free of charge; relying parties pay for the right to trust them. The asset being monetised is the population of verified humans, and the revenue accrues to whoever operates the verification layer. This is not a criticism of the cryptography, which is thoughtful. It is an observation about who ends up holding the register of real people, and on what terms.

The public-sector alternative is further along than most people realise and less far along than its deadline requires. Under the revised eIDAS regulation, all twenty-seven EU member states must make a European Digital Identity Wallet available to citizens by 24 December 2026. Denmark's AltID went into production on 3 June 2026, the first member-state wallet to go live, and passed 230,000 downloads within seven weeks, though it is not yet certified; France Identité and Italy's IT-Wallet are live national services on the same track, and Germany has said its state-issued wallet will arrive on 2 January 2027, after the deadline. Across the twenty-seven the rollout is uneven: fewer than half the member states are on track, the Netherlands among others has signalled it will not meet the deadline, and Bulgaria has not begun work on a state wallet at all. A wallet issued by a state is a materially better arrangement than one issued by a venture-funded company, and it is arriving late into a vacuum commercial providers are filling now.

Meanwhile the enforcement apparatus for synthetic commercial speech is thin. The Federal Trade Commission's rule on consumer reviews and testimonials took effect on 21 October 2024, expressly covering AI-generated reviews, with civil penalties per violation running to tens of thousands of dollars. In December 2025 the agency sent warning letters, later posted publicly, and in January 2026 established a dedicated AI enforcement unit. Set that against NewsGuard's 3,749 content farms and the scale problem answers itself. Enforcement is retail; generation is wholesale.

Absence of Proof Is Becoming Proof of Absence

Everything above converges on a single failure mode, and the World Privacy Forum named it before it arrived.

Provenance systems classify. Content carrying a valid signature is marked as such; content without one is rendered “unknown” or “invalid”. In an interface, on a phone, glanced at for a second and a half, those categories collapse into one: not verified, therefore suspect.

Consider who is systematically unverified. A protester filming police conduct on a five-year-old handset with no provenance capability. A whistleblower who must strip metadata to survive. A journalist in an authoritarian state for whom a cryptographic link between a file and a device is a targeting package. A photographer in a country with no conformant certificate authority. The World Privacy Forum found precisely this risk: that the trust model penalises creators lacking C2PA adoption and disadvantages marginalised and at-risk communities — the very groups the technology's designers set out to protect.

There is a second-order effect. When authenticity becomes a live question, real evidence loses force. The liar's dividend — dismissing genuine recordings as fabricated — is available to anyone whose accuser lacks a certificate, and that accuser is usually the one with less money. Provenance infrastructure does not merely fail to help such people. It hands their opponents a rhetorical instrument: where are the credentials?

Nor is the burden evenly distributed geographically. The conformance programme, the certificate authorities, the steering committee and the standards process are concentrated in the United States, western Europe and Japan. The trust list is the operative boundary of the verifiable internet, and it was drawn by eleven organisations, none accountable to an electorate, according to criteria that have not been published.

What Would Actually Redistribute the Burden

None of this argues for abandoning provenance. Content Credentials are useful, and a signed chain of custody from a wire agency's camera to a newspaper's front page beats nothing. The argument is that provenance as currently constituted transfers the cost of doubt onto the people least able to bear it, and that this is a design choice rather than a law of nature.

Four changes would alter the distribution.

Make absence neutral by design. Interfaces should be prohibited from rendering unsigned content as suspect. The presence of a credential is information; its absence is not. This is a user-experience rule with constitutional weight, and the cheapest intervention available.

Open the trust list. If the conformance criteria and the identity of the arbiters remain unpublished, a private consortium is exercising a public function without accountability. Publishing the criteria, the appeals process and the removal grounds costs nothing. An individual pathway to signing — accreditation of persons, not only products and organisations, with the cost borne publicly — is the harder and more necessary step.

Fix revocation before scaling. The Nikon episode was contained because Horshack disclosed it, and could not be fully remediated because validators do not check revocation by default. A provenance ecosystem in which a revoked certificate validates is worse than no ecosystem, because it manufactures unearned confidence. Golaszewski and colleagues have supplied the formal analysis; the specification should be treated as pre-deployment until their findings are addressed.

Regulate the reader, not only the writer. Article 50 obliges emitters to mark. It says nothing about the platforms that strip those marks in transit. A distribution-side duty to preserve and display provenance data, enforceable against very large platforms under the Digital Services Act, would make the marking obligation meaningful. At present the EU compels the creation of evidence and permits its destruction seconds later.

The pug flying the aeroplane was never really about Nikon. It was about the discovery that the certificate and the thing certified had come apart, and that only the certifier could put them back together. That is the position ordinary people are being moved into across every domain where truth must now be demonstrated rather than observed. The ability to fabricate has been handed to everybody. The ability to be believed is being metered, priced and administered by a small number of hardware manufacturers, platforms, model providers and identity vendors, on terms they have not published, with an appeals process that does not exist.

Confidence is indeed becoming the scarce resource. Whether that is a market opportunity or a civil liberties emergency turns not on whether verification gets built, but on whether the people who cannot afford it are treated as unproven or as liars.

References

1. Yang Xite, “Information Pollution and the Rise of the Trust Economy,” Modern Diplomacy, 16 August 2026. https://moderndiplomacy.eu/2026/08/16/information-pollution-and-the-rise-of-the-trust-economy/
2. Yukun Zhang and Tianyang Zhang, “The Economics of Information Pollution in the Age of AI: General Equilibrium, Welfare, and Policy Design,” arXiv:2509.13729, 17 September 2025, revised 4 January 2026. https://arxiv.org/abs/2509.13729
3. Philipp Hacker, Lilian Edwards and Atoosa Kasirzadeh, “AI, Digital Platforms, and the New Systemic Risk,” arXiv:2509.17878, 22 September 2025, revised 23 May 2026. https://arxiv.org/abs/2509.17878
4. Jeremy Gray, “Nikon Can't Fully Solve the Z6 III's C2PA Problems Alone,” PetaPixel, 22 September 2025. https://petapixel.com/2025/09/22/nikon-cant-fully-solve-the-z6-iiis-c2pa-problems-alone/
5. Europol Innovation Lab, “Facing reality? Law enforcement and the challenge of deepfakes,” Europol, 2022. https://www.europol.europa.eu/cms/sites/default/files/documents/Europol_Innovation_Lab_Facing_Reality_Law_Enforcement_And_The_Challenge_Of_Deepfakes.pdf
6. Jesse Walker, “That time we tried to make sense of a statistic in a 'New York Times' story on deepfakes,” Reason, 27 January 2023. https://reason.com/2023/01/27/that-time-we-tried-to-make-sense-of-a-statistic-in-a-new-york-times-story-on-deepfakes/
7. Gregory Druck, Jose Luis Paredes, Bevin Benson and Ethan Smith, “More Articles Are Now Created by AI Than Humans,” Graphite, October 2025. https://graphite.io/five-percent/more-articles-are-now-created-by-ai-than-humans
8. NewsGuard, “Tracking AI-enabled Misinformation: 3,749 AI Content Farm sites (and Counting),” NewsGuard AI Tracking Center, 23 June 2026. https://www.newsguardtech.com/special-reports/ai-tracking-center/
9. Mickael Tordjman et al., “The Rise of Deepfake Medical Imaging: Radiologists' Diagnostic Accuracy in Detecting ChatGPT-generated Radiographs,” Radiology, 24 March 2026. https://pubs.rsna.org/doi/10.1148/radiol.252094
10. Federal Bureau of Investigation, “2025 Internet Crime Report,” Internet Crime Complaint Center, 7 April 2026. https://www.fbi.gov/file-repository/2025_ic3report.pdf/view
11. Heather Chen and Kathleen Magramo, “Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee,” CNN Business, 16 May 2024. https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk
12. Satish Lalchand, Val Srinivas, Brendan Maggiore and Joshua Henderson, “Generative AI is expected to magnify the risk of deepfakes and other fraud in banking,” Deloitte Center for Financial Services, 29 May 2024. https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html
13. Nuria Alina Chandra, Hannah Lee, Ryan Murtfeldt, Lin Qiu, Arnab Karmakar, Emmanuel Tanumihardja, Kevin Farhat, Ben Caffee, Changyeon Lee, Jongwook Choi, Sejin Paik, Aerin Kim and Oren Etzioni, “Deepfake-Eval-2024: A Multi-Modal In-the-Wild Benchmark of Deepfakes Circulated in 2024,” arXiv:2503.02857, 4 March 2025, revised 27 May 2026. https://arxiv.org/abs/2503.02857
14. Coalition for Content Provenance and Authenticity, “C2PA,” c2pa.org, accessed 16 August 2026. https://c2pa.org/
15. Enis Golaszewski, Neal Krawetz, Alan T. Sherman, Edward Zieglar, Sai K. Matukumalli, Roberto Yus, Carson L. Kegley, Michael Barthel, William Bowman, Bharg Barot and Kaur Kullman, “Verifying Provenance of Digital Media: Why the C2PA Specifications Fall Short,” arXiv:2604.24890, 27 April 2026. https://arxiv.org/abs/2604.24890
16. Kate Kaye and Pam Dixon, “Privacy, Identity and Trust in C2PA: A Technical Review and Analysis of the C2PA Digital Media Provenance Framework,” World Privacy Forum, 3 September 2025. https://worldprivacyforum.org/posts/privacy-identity-and-trust-in-c2pa/
17. SSL.com, “C2PA Certificates for Media Authenticity,” ssl.com, accessed 16 August 2026. https://www.ssl.com/products/content-authenticity/content-credentials/c2pa/
18. Washington Post, “Tests show top social platforms don't disclose markers on AI videos,” 22 October 2025. https://www.washingtonpost.com/technology/2025/10/22/ai-deepfake-sora-platforms-c2pa/
19. Google DeepMind, “SynthID,” deepmind.google, accessed 16 August 2026. https://deepmind.google/models/synthid/
20. European Commission, “Transparency obligations under Article 50 of the AI Act,” Shaping Europe's Digital Future, 2026. https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act
21. Gibson Dunn, “EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes,” gibsondunn.com, 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/
22. The Authors Guild, “Human Authored Certification,” authorsguild.org, accessed 16 August 2026. https://authorsguild.org/human-authored/
23. Biometric Update, “World shifts from crypto identity experiment to enterprise proof-of-humanity,” biometricupdate.com, June 2026. https://www.biometricupdate.com/202606/world-shifts-from-crypto-identity-experiment-to-enterprise-proof-of-humanity
24. European Commission, “European Digital Identity Wallet,” ec.europa.eu, accessed 16 August 2026. https://ec.europa.eu/digital-building-blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home
25. DLA Piper, “FTC's 2026 enforcement approach to fake reviews takes shape: Takeaways for companies,” dlapiper.com, July 2026. https://www.dlapiper.com/en-us/insights/publications/2026/07/ftcs-2026-enforcement-approach-to-fake-reviews-takes-shape-takeaways-for-companies

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

In April 2025, researchers at Invariant Labs published a demonstration that sent a quiet shudder through the software security community. They showed that a malicious Model Context Protocol server, running alongside a legitimate WhatsApp MCP server and disguised as a harmless “random fact of the day” tool, could silently exfiltrate a user's entire message history. The technique was a sleeper: the rogue server advertised something innocuous, waited, then altered its tool description to shadow the legitimate WhatsApp tool, instructing the agent to route conversations to an attacker-controlled phone number. The victim's assistant appeared to be sending a perfectly ordinary message. Behind the curtain, it was transmitting months of personal and business conversations to a stranger.

The detail that mattered most was the one easiest to miss. The attack did not depend on a user being careless with permissions. As Invariant Labs put it, the technique circumvents the need for the user to approve the malicious tool at all, because the poisoned description hijacks a tool the user has already sanctioned. Approval prompts, the control most organisations still treat as their primary safeguard, were not so much bypassed as rendered irrelevant. Invariant released reproducible proof-of-concept code. The vulnerability it exposed, that autonomous agents can be turned against their operators through crafted manipulations of tool definitions and prompt structures, has since become one of the most consequential challenges in software security.

That was the warning shot. Sixteen months later, the demonstration has become an industry. Check Point Research's AI Security Report 2026, published in July, records indirect prompt injection detections rising roughly fivefold between March and May 2026, approaching one per cent of all observed prompts, and describes a threshold being crossed: “AI has crossed from development aid to live attack operator. It now does the hands-on work inside live intrusions.” Attackers have moved on from the single poisoned prompt to planting malicious configuration files that agents load and trust across sessions, turning a one-shot trick into persistence. One developer built VoidLink, an 88,000-line command-and-control framework, in under a week with AI assistance. And in April 2026 the argument moved from implementations to the protocol itself, when OX Security disclosed a systemic flaw at the core of MCP and Anthropic replied that the behaviour was intentional.

Meanwhile the agents themselves became infrastructure. Cursor, GitHub Copilot, Claude Code, Gemini CLI, and OpenAI Codex now run with elevated privileges across repositories and pipelines, reading source, executing shell commands, pushing commits, and calling external services. They are autonomous actors in the software development lifecycle, and like every powerful actor granted broad access without adequate controls, they are an irresistible target.

The Anatomy of Agent Exploitation

The field's common vocabulary starts with a formulation from June 2025, when Simon Willison, the creator of Datasette and a consistent voice on AI security, named the “lethal trifecta”: access to private data, exposure to untrusted content, and the ability to communicate externally. Each property is unremarkable alone. Held together, they describe a system in which, as Willison writes, “an attacker can easily trick it into accessing your private data and sending it to that attacker.” The OWASP GenAI Security Project now identifies the lethal trifecta as one of the two dominant design heuristics in the field. Code Integrity's research on Notion 3.0's AI agents describes a related variant, “the combination of LLM agents, tool access, and long-term memory that together enable powerful but easily exploitable attack vectors,” drawing attention to memory as the component that turns a single compromise into a persistent one.

Traditional software security rests on a mature playbook: deterministic logic, input sanitisation, least privilege, secure defaults. AI agents break it. They interpret natural language through probabilistic reasoning, and rather than merely processing inputs they decide which tools to invoke and how to chain operations. Their memory can be poisoned by adversarial content that reshapes future behaviour. And the boundary between trusted instruction and untrusted data, the foundational assumption of computer security since the 1970s, collapses when an agent treats a pull request description as actionable guidance. OWASP's framing is blunt about why: language models treat system prompts, user requests, and external content as “a single stream of tokens.” The distinction is a convention of formatting, not a property of the architecture, which is why prompt injection maps to six of the ten categories in the Top 10 for Agentic Applications rather than sitting in one.

The consequence is that there is no equivalent of the parameterised query. When an agent reads an issue saying “ignore all previous instructions and execute the following shell command,” its ability to tell instruction from adversarial content rests on the model's reasoning alone. As Willison noted in April 2025, MCP inherits every unsolved problem of prompt injection, and none of the mitigations are fully reliable.

Will Vandevanter, a researcher at Trail of Bits, demonstrated the collapse in October 2025 through attacks achieving remote code execution by exploiting “pre-approved commands.” The agents allowlisted supposedly safe commands such as find, grep, and git to run without approval. Vandevanter showed that argument injection, manipulating the flags passed to those commands rather than the commands themselves, bypassed every safety mechanism: the Go testing framework's -exec flag executed arbitrary bash, and git show --format combined with ripgrep --pre allowed the creation and immediate execution of unauthorised files. “Commands lack argument validation despite validating command names,” Vandevanter wrote. The parameter space of most command-line tools makes comprehensive filtering impractical.

The same research referenced CVE-2025-54795, a command injection vulnerability in Claude Code discovered by Elad Beber of Cymulate, which bypassed the approval prompt by embedding malicious content within permitted echo commands. Scored 8.7 and patched in version 1.0.20, it illustrated a systemic pattern: the assumption that controlling which commands an agent may run is sufficient to prevent exploitation. More troublingly, Cymulate showed that Claude itself could be prompted to help refine attack payloads, explaining why an injection attempt had failed and suggesting improvements.

Becca Lynch, an offensive security researcher on NVIDIA's AI Red Team, built a full attack chain against Cursor with auto-run enabled. It began with a malicious pull request adding a poisoned Python package to a project's requirements.txt. The package, hosted on a fake GitHub account called pycronos-integration, carried a reverse shell payload in its setup.py, obfuscated to evade Windows Defender. When the agent ran pip install, the payload triggered automatically. “An overly privileged agent treating untrusted data as trusted can be turned into a tool working on behalf of the attacker,” Lynch wrote.

The CI/CD Pipeline as Attack Surface

Developer environments are one front; continuous integration and deployment pipelines are another and more consequential one. In December 2025, Aikido Security disclosed a vulnerability class it named PromptPwnd, affecting GitHub Actions and GitLab CI/CD pipelines integrated with AI agents. The pattern was devastatingly simple: untrusted input from issue bodies, pull request descriptions, or commit messages was embedded directly into agent prompts. The agent, holding privileged access to repository secrets, interpreted malicious text as instruction and executed it.

Researcher Rein Daelman of Aikido demonstrated the attack against Google's own Gemini CLI repository. By submitting an issue containing hidden instructions, Daelman directed the agent to execute shell commands that leaked the repository's GEMINI_API_KEY, GITHUB_TOKEN, and Google Cloud access tokens. Google patched within four days, but the implications ran well beyond a single repository: Aikido confirmed that at least five Fortune 500 companies were affected, and open-sourced Opengrep rules and a scanning tool to help developers find vulnerable workflow files. The same year brought CVE-2025-53773, a hidden prompt injection in pull request descriptions that achieved remote code execution through GitHub Copilot at a CVSS score of 9.6. PromptPwnd also showed that environment variables offer no protection. Configurations that appeared restrictive, such as Claude Code Actions' allowed_non_write_users setting, amplified risk when misconfigured, and some could be triggered by anyone filing an issue, making them reachable by attackers with no prior access.

March 2026 supplied the ecosystem-scale proof, and it began with a credential rotation somebody thought was finished. Aqua Security, maintainer of the widely used Trivy vulnerability scanner, disclosed a comparatively small breach in late February 2026. The rotation that followed was partial, and the attackers retained access. The group, which calls itself TeamPCP and which Google tracks as UNC6780, used that retained access on 19 March to force-push malicious commits to 76 of the 77 version tags on the trivy-action repository and to all seven tags on setup-trivy, then published a malicious Trivy 0.69.4 release through official distribution channels. Over the following days the same operation reached Checkmarx's KICS and AST GitHub Actions, and then LiteLLM. Microsoft's incident analysis is unusually direct about the mechanism: the attackers leveraged access from a prior incident that had not been fully remediated. Partial remediation of a minor compromise financed a major one.

LiteLLM's CI/CD pipeline pulled Trivy from apt without a pinned version, so the poisoned action ran inside its GitHub Actions runner and exfiltrated the project's PYPI_PUBLISH token from the runner environment. Five days after the Trivy compromise, that token was used against LiteLLM's PyPI publishing pipeline. Malicious versions 1.82.7 and 1.82.8 went live at 10:39 UTC on 24 March 2026 and were quarantined by PyPI roughly 40 minutes later. The two used different injection techniques, and the second is the more alarming. Version 1.82.7 carried a base64-encoded payload inside litellm/proxy/proxy_server.py that executed whenever anything imported litellm.proxy. Version 1.82.8 added a litellm_init.pth file to site-packages, a file type Python executes on every process startup in any environment where the package is installed, which converts a library compromise into an interpreter compromise. The payload ran a three-stage operation: credential harvesting, attempted lateral movement across Kubernetes clusters, and installation of a persistent systemd backdoor that polls for further payloads. CloudSEK's analysis of roughly 434,000 captured files mapped them to more than 2,500 organisations, a figure the firm was careful to describe as potential exposure rather than a victim count, because it identifies organisations whose credentials may have been captured rather than organisations known to have been breached. On 2 July 2026 the FBI issued FLASH-20260702-01, warning that affiliated actors are likely to weaponise credentials exfiltrated during the campaign long after the initial compromise, and urging rotation of CI/CD secrets, publishing tokens, and cloud credentials exposed during the relevant windows. The tail of this compromise is measured in months, not days.

None of it was a flaw in LiteLLM's own code, which is exactly what makes it the strongest available argument about pipelines. LiteLLM is the language model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks, so the chain ran from a security scanner to a CI/CD pipeline to a package registry and into the agent framework supply chain, with each link trusted precisely because the one before it was. The recursion is the point: the case for treating pipelines as attack surface was proved by an attack that travelled through the tooling of the people who do security professionally. A single compromised workflow affects every build and release passing through it, arriving through the automation organisations trust to enforce quality.

The Model Context Protocol and Supply Chain Peril

The Model Context Protocol has become the connective tissue of the agentic ecosystem, the standardised interface through which agents discover and invoke external tools. Wiz Research found in early 2026 that MCP servers were present in at least 80 per cent of observed cloud environments, and that 5 per cent of those ran at least one internet-facing server. Adoption at that speed has been matched by an equally rapid accumulation of vulnerabilities.

The tool poisoning attack Invariant Labs discovered exploits a fundamental design characteristic. Tool descriptions are transmitted as metadata that models process as instructions, while users see only simplified tool names. A malicious server can embed hidden directives within those descriptions, using constructs such as <IMPORTANT> tags that are invisible to the operator and fully visible to the model. The specification allows tool definitions to change between tools/list responses with no integrity check, no hash pinning, and no mandatory re-approval. This creates the conditions for rug pull attacks, in which a tool that appeared safe at installation quietly mutates weeks later, and for the tool shadowing seen in the WhatsApp demonstration.

The scope of implementation flaws is sobering. Research compiled by Tigran Bayburtsyan found that 43 per cent of tested MCP implementations contained command injection flaws and 30 per cent allowed unrestricted URL fetching. Three chained vulnerabilities in Anthropic's own mcp-server-git achieved remote code execution via malicious .git/config files, and its MCP Inspector permitted unauthenticated execution through its proxy architecture, meaning that merely inspecting a malicious server could compromise a developer's machine. In September 2025 the first malicious MCP server was found in the wild, an npm package impersonating Postmark's email service that worked normally while secretly copying every message to an attacker. The following month, the Smithery attack affected over 3,000 hosted applications and their API tokens.

Then, on 15 April 2026, OX Security disclosed something categorically different. Its researchers reported a systemic architectural vulnerability in MCP's STDIO transport, the mechanism by which most local servers launch: user-controlled configuration values flow directly into shell execution without sanitisation or allowlisting. The flaw sits not in a third-party implementation but in Anthropic's official SDKs, across Python, TypeScript, Java, and Rust alike. The injected command executes even when the target process fails to start, so an attacker does not need a working server, only a configuration entry. The numbers are unusual for a single disclosure: more than 150 million package downloads, roughly 7,000 publicly reachable servers, an estimated 200,000 vulnerable instances, commands executed against six live production platforms, and nine of eleven MCP registries affected. Ten CVEs accompanied the disclosure and fourteen have followed, most critical, including LiteLLM (CVE-2026-30623), Agent Zero (CVE-2026-30624), and Windsurf IDE (CVE-2026-30615), alongside Fay, LangChain, and IBM LangFlow. OX Security grouped the exploitation into four families: unauthenticated interface injection, hardening bypasses in protected environments, zero-click prompt injection in AI IDEs, and malicious distribution through registries.

The decisive moment came not in the disclosure but in the response. During coordinated disclosure in January 2026, Anthropic confirmed the behaviour was intentional. Its position is that STDIO execution is a secure default provided developers restrict what may appear in the command field; sanitisation is the developer's responsibility. Nine days after initial contact it updated SECURITY.md to advise caution with STDIO adapters. No architectural change was made. Some researchers now call it the protocol that will not be patched.

This is qualitatively unlike every other item catalogued above. A rug pull abuses a specification gap; an unsanitised AppleScript call is a bug with a patch number. Here there is no patch to wait for, because the maintainers do not accept that the flaw is theirs to fix, and their reasoning is not unserious: a protocol that launches local processes must let a developer specify what to launch. But the standard advice, treat every MCP server as a third-party dependency and vet it accordingly, no longer reaches far enough. Vetting assumes the ecosystem beneath the dependency is sound. Organisations must now defend against a transport whose specified behaviour is itself the exploitation primitive.

When the Marketplace Becomes the Payload

The governance argument for MCP servers generalises, and in February 2026 it did so violently. Researcher Paul McCarty identified 386 malicious skills on ClawHub, OpenClaw's official skill repository, published between 1 and 3 February. Koi Security's Oren Yomtov then audited all 2,857 skills available and found 341 malicious, 335 of them traced to a single coordinated operation now tracked as ClawHavoc.

The skills impersonated crypto-trading automation using real brand names including ByBit, Polymarket, Axiom, Reddit, and LinkedIn, and deployed infostealers on macOS and Windows that harvested exchange API keys, wallet private keys, SSH credentials, and browser passwords. All shared common command-and-control infrastructure, and a single account, hightower6eu, accumulated close to 7,000 downloads. By 16 February the count had reached 824 malicious skills across a registry that had itself expanded past 10,700, and Antiy Labs eventually catalogued 1,184 published to ClawHub over the platform's history.

The lesson is not specific to one marketplace. Every agent extension ecosystem reproduces the same structure: low-friction publishing, a naming system that permits brand impersonation, an install flow granting broad local privilege, and review that scales far more slowly than submissions. The npm and PyPI ecosystems took a decade to learn this. Agent marketplaces are relearning it in months, with the aggravating factor that the installed artefact is not a library the developer calls but an instruction set the agent obeys.

The IDEsaster Landscape

The attack surface extends beyond servers and registries into development environments themselves. Over a six-month investigation, security researcher Ari Marzouk, who publishes as MaccariTA, identified a pattern he named IDEsaster: more than 30 vulnerabilities across over ten market-leading products, including Claude Code, Cursor, GitHub Copilot, Windsurf, JetBrains Junie, and Zed.dev, of which 24 received assigned CVEs. His central finding was unambiguous. One hundred per cent of tested AI IDEs were vulnerable.

The research revealed three core attack patterns. Remote JSON schema attacks exploit the tendency of IDEs to fetch schemas referenced in JSON files automatically; an attacker who prompts the agent to write a file containing a remote schema reference can cause the IDE to transmit data as URL parameters when fetching it, exfiltrating information even with human-in-the-loop protections and diff preview active. Settings overwrite attacks modify .vscode/settings.json or .idea/workspace.xml to redirect executable paths to malicious code, with CVEs assigned to Cursor, Roo Code, and JetBrains Junie. The third pattern exploits multi-root workspace files, affecting GitHub Copilot, Cursor, and Roo Code.

What makes these attacks troubling is that they defeat the safeguard most developers rely on, the confirmation prompt. Even with diff preview enabled and approval required for every change, they succeed because the malicious behaviour sits inside changes that look benign. A remote schema reference looks like ordinary configuration; a workspace settings change looks routine. The reviewer, facing hundreds of them daily, has neither the time nor the context to spot the threat. Context hijacking extends this through vectors few would think to inspect: poisoned URLs containing invisible Unicode characters, malicious .cursorrules files inside cloned repositories, and instructions hidden in filenames.

The Vulnerability Moves Down a Layer

On 7 May 2026, Microsoft disclosed two vulnerabilities in its own Semantic Kernel framework that shifted the problem again. CVE-2026-26030, affecting the Python package before version 1.39.4, arose from unsafe string interpolation in a default filter function. The framework used eval() to build lambdas from filter strings the model controlled, so an attacker could close the quote, append Python logic, and turn a data lookup into an executable payload. A blocklist meant to stop exactly this was circumvented by traversing Python's type system to reach __name__, load_module, and eventually system, reconstructing dangerous capability from parts that were individually permitted.

CVE-2026-25592, affecting the .NET SDK before 1.71.0, was simpler and more instructive. A DownloadFileAsync method had been marked with the [KernelFunction] attribute, making it directly callable by the model. With no path validation on its destination parameter, it permitted arbitrary file writes to the host, breaking container isolation by writing a payload into the Windows Startup folder from inside a sandboxed session. Nobody chose to expose that capability. An annotation intended to publish useful functions to a model published a dangerous one.

Microsoft's remediation was properly layered: allowlists of permitted AST node types and callable functions, a blocklist of attributes used for class hierarchy traversal, and a restriction on name nodes to lambda parameters, plus removal of the offending attribute and canonicalised path validation. The significance lies in the location rather than the fix. Every vulnerability discussed so far lived in an agent's configuration, tools, or extensions, the layer an organisation controls. These live in the framework that builds agents, beneath the layer most security teams inspect.

Building Layered Defences

The OWASP GenAI Security Project announced its Top 10 for Agentic Applications on 9 December 2025, explicitly as the 2026 edition, the product of more than a year of research involving over 100 researchers and an expert board including NIST, the European Commission, and the Alan Turing Institute. It spans ten categories, from agent goal hijacking and tool misuse through identity abuse, insufficient sandboxing, and supply chain compromise to memory manipulation, cascading failures, and rogue agents.

It also introduces a concept that may prove as consequential as its predecessor, least privilege: the principle of least agency. Where least privilege restricts what permissions a process holds, least agency restricts what autonomous decisions an agent may make. An agent with broad tool access but constrained autonomy can still be held to bounded, well-defined tasks.

Meta gave that principle an implementable shape. Its Agents Rule of Two, published on 31 October 2025, holds that until prompt injection can be reliably detected and refused, an agent must satisfy no more than two of three properties within a session: processing untrustworthy input, accessing sensitive systems or private data, and changing state or communicating externally. Where all three are genuinely required, the agent should not operate autonomously and needs human approval or another reliable means of validation, with a fresh context window as the mechanism for resetting the count. It is the lethal trifecta expressed as an operational constraint rather than a warning, and OWASP names the two together as the field's dominant heuristics. The practical value is that it is checkable: an engineer can read a session configuration and count.

The first implementation layer is tool restriction: limiting which commands, APIs, and resources an agent may reach, and separating operations safe to auto-approve, such as reads and static analysis, from those needing approval, such as filesystem writes, package installation, and outbound network calls. The separation is not merely administrative tidiness. It maps the blast radius of a successful injection, because an agent that can only read cannot exfiltrate, and an agent that cannot install packages cannot be handed a payload by a poisoned manifest. Trail of Bits' argument injection research is the caveat that keeps this honest: allowlisting a command name without constraining its arguments is not a control, it is a label. The lesson generalises well beyond the specific flags Vandevanter demonstrated. Any tool rich enough to be worth giving an agent has a parameter space large enough to conceal an escape, so restriction is better expressed in terms of the capability granted than the binary invoked. Anything that can spawn a subprocess, write to an arbitrary path, or fetch a remote resource should be treated as the dangerous capability it is, whatever name sits at the front of the command line.

The second layer is sandboxing, and here the past year has produced genuine movement. Software-only isolation was always the weak form of this recommendation; Bayburtsyan's research emphasised the need for hardware-enforced boundaries. Claude Code now ships operating-system-level sandboxing that enforces filesystem and network isolation through the kernel rather than through trust or prompt engineering, routing network access through a proxy outside the sandbox, applying domain allowlists, and prompting on first contact with a new domain. That last detail matters more than it appears. It moves the approval decision off the question the model can be manipulated about, whether an action is reasonable, and onto one it cannot, whether a destination is on a list. The Semantic Kernel file write is the reminder of what happens when the boundary is enforced anywhere softer: an isolation layer defeated by a single unvalidated destination path was never isolation, only a convention that the code inside agreed to observe. A recommendation made in the abstract a year ago is now a shipped default.

The third layer is identity and credential isolation, which has matured from an aspiration into a standards effort. Each agent instance should hold unique, scoped credentials granting access only to what the current task requires. Shared credentials and long-lived tokens create the conditions attackers exploit, as the Supabase Cursor breach of mid-2025 showed when an agent with privileged service-role access processed support tickets containing user-supplied SQL. What has changed is that agents are beginning to hold identities of their own. Microsoft Entra Agent ID, first documented in April 2026, issues agent identities that speak OAuth 2.0, MCP, and A2A. NIST's AI Agent Standards Initiative, announced in February 2026, organises the work across three pillars: industry-led standards development, community-led open source protocol maintenance, and research into agent security and identity. The principle emerging from that work is scope attenuation, the rule that each delegation hop must narrow and never widen the permitted action set, so no sub-agent accumulates capabilities the original human principal never authorised. Cryptographic workload identity, through SPIFFE and SPIRE identity documents or OIDC-federated tokens, replaces the shared API key with something that can be scoped, attributed, and expired.

The fourth layer is trust boundary enforcement. Every piece of external data an agent processes must be treated as adversarial, scanned not only for injection patterns but for hidden instructions, role-playing directives, and system prompt overrides. The list of entry points is longer than most teams assume: issue bodies and pull request descriptions, fetched web pages, the output of one tool feeding the input of the next, dependency manifests, and the configuration files that arrive with any cloned repository. Invisible Unicode and instructions concealed in filenames both belong on the same list. But the layer should be held loosely, because filtering is a probabilistic control applied to a probabilistic system, which is why it is the last of the preventive layers rather than the first.

The fifth layer is monitoring and anomaly detection, and it exists because the preceding four will eventually be got round. Agent actions warrant the scrutiny given to privileged human users, which means baselining what normal looks like for a particular agent in a particular repository and alerting when behaviour departs from it. The baseline is more tractable than it sounds, because agents are creatures of habit. A documentation agent that reads Markdown and opens pull requests has a behavioural signature, and a sudden interest in environment variables, credential stores, or outbound connections is a deviation visible without any understanding of what the agent was asked to do. Continuous comparison against expected patterns catches the class of compromise that defeats every preventive control by looking legitimate at each individual step, because in those cases the anomaly lives in the aggregate rather than in any single action. Detection of this kind is imperfect and will fire on unusual but entirely legitimate work. That is the right trade for a system whose characteristic failure mode is silence.

Audit Logging as Institutional Memory

Detection without documentation is insufficient. An effective agent log should capture the instruction that triggered each action, the tools invoked and the arguments passed, the outputs and side effects, the credentials used, timestamps precise enough for causal ordering, and the provenance of any external data the agent consumed. This matters for two reasons. Prompt injection is designed to be invisible, so without logs there is no artefact to investigate and no way to establish whether an agent was manipulated or merely mistaken. And because identical inputs can produce different outputs, a decision cannot be reproduced unless it was recorded at the time it was made. The log is the only durable evidence that a probabilistic system ever behaved in a particular way.

Logging also underwrites the control that matters most once something has gone wrong, which is the ability to stop the agent mid-action. Every major tool exposes a manual interruption path: Ctrl+C in Cursor, Cmd+Esc in VS Code, Esc in Claude Code. These are worth knowing and worth teaching, but they depend on somebody watching at the moment it matters, which is precisely the assumption agentic workflows are designed to remove. Beyond manual intervention, organisations should implement automated kill switches that trigger when agent behaviour exceeds defined parameters: an unusual volume of file modifications, network requests to unknown domains, or attempts to reach credentials outside the agent's designated scope. The thresholds are organisation-specific, and the first versions of them will be wrong. Thresholds set too tightly halt an agent that was doing legitimate work, which is an annoyance measured in minutes. The absence of a halt is measured in the FBI advisories that follow months later.

Logging must also span agent boundaries, and OWASP's emphasis on cascading failures explains why. When multiple agents interact, whether through direct communication or through shared resources such as a repository, a job queue, or a common memory store, a compromise in one propagates through the system. An injected instruction absorbed by the first agent becomes a plausible-looking artefact consumed by the second, and by the third the origin has vanished entirely, because what the third agent sees is simply the state of the codebase. Tracing that chain of causation after the fact requires detail comparable to distributed tracing in microservices, applied to decision-makers whose behaviour is inherently less predictable than deterministic software. The comparison is instructive and also generous to the problem. Microservices at least fail the same way twice.

Preserving Autonomy Within Boundaries

The central tension in agent security is that every control reduces capability. Requiring approval for every tool invocation eliminates the productivity benefit that justified deployment; restricting agents to read-only operations prevents the work that makes them valuable. Over-constrained agents become expensive autocomplete. The pragmatic path accepts that some risk is inherent and concentrates on making it manageable, building architectures where no single control is assumed sufficient and the failure of one layer is caught by the next.

Plan-then-execute workflows offer one approach: requiring agents to produce execution plans for review before acting inserts a checkpoint without discarding their reasoning. It is not foolproof, since a sophisticated injection could produce a plan that reads as benign, but it raises a single-step exploitation into a multi-stage deception that must survive scrutiny. Its underrated value is that it changes what the reviewer is asked to look at. A diff shows what will change; a plan shows what the agent believes it has been asked to do, and a hijacked goal is far more legible in a statement of intent than in the file that intent eventually touches. Tiered autonomy provides another frame: low-risk operations such as reading code, running tests, and producing analysis proceed autonomously, source modification requires automated policy checks, and pushing to production or accessing secrets always requires explicit authorisation. Read against the Rule of Two, this keeps the sessions touching untrusted content separate from those holding sensitive access and outbound reach, which is the same discipline expressed as a workflow rather than a count.

Egress filtering remains the most underrated control available. Most exfiltration depends on the agent reaching an attacker-controlled endpoint, so restricting which domains it may contact, and alerting on attempts to reach anything else, disrupts exfiltration even when injection succeeds. The alert is as valuable as the block. A blocked request to an unrecognised domain is close to a positive indicator of compromise, and it is one of very few signals in this field that does not require anyone to interpret a model's reasoning. Egress filtering removes the third leg of the trifecta outright, which is why kernel-enforced network isolation with domain allowlisting is the highest-value change most teams can make this quarter.

MCP server governance deserves particular attention, with the caveat the OX Security disclosure imposes. Organisations should maintain curated registries of approved servers, prohibit dynamic loading of tool definitions from untrusted sources, and monitor definition integrity continuously, the discipline Invariant Labs' MCP-Scan was built to support. But vetting does not address a transport whose vendor considers the execution behaviour correct, which means the configuration files feeding server definitions must themselves be treated as executable content, versioned, reviewed, and access-controlled accordingly.

None of this composes into a guarantee, and the framing matters. Layered defence is not a claim that five imperfect controls multiply into one reliable control. It is a claim that their failure modes are uncorrelated enough that an attacker must defeat several unrelated mechanisms rather than one. Prompt injection defeats the model's judgement. It does not defeat a kernel-enforced network boundary, a scoped credential that expires, or an alert that fires on a file-modification threshold, because none of those controls consult the model about whether they ought to apply. That is the design principle underneath every recommendation here: place as much of the enforcement as possible in the parts of the system the agent cannot argue with.

The Institutional Challenge

The technical controls above are necessary but insufficient. The deeper challenge is institutional: building cultures that treat agent security as a first-class concern.

The scale is now measurable. OWASP's State of Agentic AI Security and Governance, published in June 2026, tracks 53 agentic projects, 28 of them coding agents, with Claude Code, Gemini CLI, Codex, Cline, and Aider growing fastest. Advisory counts are already substantial: 57 for n8n, 22 for Claude Code, 15 for AutoGPT, 13 for Dify, 11 for Roo-Code. Release velocity compounds the triage burden, with one tracked project averaging a release every eight hours. No security team reviews changes at that cadence. The governance model most organisations apply, periodic review of a stable dependency set, does not survive contact with software that reissues itself three times a day.

Bayburtsyan's observation that “IDEs were not originally built with AI agents in mind” applies equally to the governance structures within which they operate. His sharper point is that “once AI began to take action, the nature of security changed forever.” Most organisations adopted these tools on the strength of productivity promises, addressing security retrospectively if at all. The result is a landscape where agents hold privileges no human developer would receive without vetting, tool access is configured for convenience, and behavioural monitoring is minimal. Reversing this means involving security teams from the outset, bringing agent configurations under the change management applied to infrastructure, and writing agent compromise into incident response plans. Training matters too: developers must understand that pull requests can carry injections, that MCP tools can mutate after installation, that marketplace extensions can be hostile at a rate approaching one in eight, and that agent output is untrusted however confident it sounds.

Sixteen months after the WhatsApp demonstration, the honest assessment is neither vindication nor despair but a split verdict. Real defences shipped. Kernel-enforced sandboxing exists and is available by default. The Rule of Two and the lethal trifecta have given engineers a vocabulary precise enough to design against. Agent identity has moved from conference talk to standards initiative, with NIST convening the work and scope attenuation as its organising principle. These are not gestures; they are the recommendations of 2025 arriving as products. And yet the underlying problem is untouched. OWASP's researchers now describe prompt injection not as a defect awaiting a patch but as a structural property of how language models consume tokens, and the year's most consequential disclosure ended with a protocol's maintainers declining to change it. That is the tension the industry has to hold. The perimeter around the agent is getting genuinely stronger while the thing inside it remains, by construction, persuadable. Every control described here is an admission of that, a way of ensuring that when an agent is talked into working for the attacker, and it will be, the damage is bounded by something that cannot be talked into anything.

References and Sources

1. Invariant Labs. “WhatsApp MCP Exploited: Exfiltrating Your Message History via MCP.” invariantlabs.ai, April 2025. https://invariantlabs.ai/blog/whatsapp-mcp-exploited

2. Invariant Labs. “MCP Security Notification: Tool Poisoning Attacks.” invariantlabs.ai, April 2025. https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

3. Willison, S. “The Lethal Trifecta for AI Agents.” simonwillison.net, 16 June 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

4. Willison, S. “Model Context Protocol Has Prompt Injection Security Problems.” simonwillison.net, 9 April 2025. https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/

5. Vandevanter, W. “Prompt Injection to RCE in AI Agents.” Trail of Bits Blog, 22 October 2025. https://blog.trailofbits.com/2025/10/22/prompt-injection-to-rce-in-ai-agents/

6. Cymulate. “CVE-2025-54795: InversePrompt: Turning Claude Against Itself.” Cymulate Blog, August 2025. https://cymulate.com/blog/cve-2025-547954-54795-claude-inverseprompt/

7. Lynch, B. “From Assistant to Adversary: Exploiting Agentic AI Developer Tools.” NVIDIA Developer Blog, 2025. https://developer.nvidia.com/blog/from-assistant-to-adversary-exploiting-agentic-ai-developer-tools/

8. Daelman, R. “PromptPwnd: Prompt Injection Inside GitHub Actions.” Aikido Security Blog, December 2025. https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents

9. The Hacker News. “Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations.” thehackernews.com, 12 August 2026. https://thehackernews.com/2026/08/malicious-litellm-releases-tied-to.html

10. Microsoft Security. “Detecting, Investigating, and Defending Against the Trivy Supply Chain Compromise.” Microsoft Security Blog, 24 March 2026. https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/

11. OX Security. “The Mother of All AI Supply Chains: Critical Systemic Vulnerability at the Core of the MCP.” ox.security, 15 April 2026. https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/

12. The Hacker News. “Anthropic MCP Design Vulnerability.” thehackernews.com, April 2026. https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html

13. Wiz. “Model Context Protocol (MCP) Security.” wiz.io, 2026. https://www.wiz.io/academy/ai-security/model-context-protocol-security

14. AuthZed. “A Timeline of Model Context Protocol (MCP) Security Breaches.” authzed.com, 2025. https://authzed.com/blog/timeline-mcp-breaches

15. Code Integrity. “Notion MCP Server Vulnerability Analysis.” codeintegrity.ai, 2025. https://www.codeintegrity.ai/blog/notion

16. Dark Reading. “Malicious OpenClaw Skills on ClawHub Threaten AI Supply Chain.” darkreading.com, February 2026. https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain

17. Marzouk, A. “IDEsaster.” maccarita.com, 2025. https://maccarita.com/posts/idesaster/

18. Bayburtsyan, T. “Securing AI Coding Agents: IDEsaster Vulnerabilities.” tigran.tech, 29 December 2025. https://tigran.tech/securing-ai-coding-agents-idesaster-vulnerabilities

19. Microsoft Security. “Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks.” Microsoft Security Blog, 7 May 2026. https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/

20. OWASP GenAI Security Project. “OWASP Top 10 for Agentic Applications for 2026.” Announced 9 December 2025. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/

21. Help Net Security. “OWASP: Prompt Injection Underpins AI Security Failures.” helpnetsecurity.com, 11 June 2026. https://www.helpnetsecurity.com/2026/06/11/owasp-prompt-injection-ai-security-failures/

22. Check Point Research. “AI Security Report 2026.” research.checkpoint.com, July 2026. https://research.checkpoint.com/2026/ai-security-report-2026/

23. Meta. “Agents Rule of Two: A Practical Approach to AI Agent Security.” ai.meta.com, 31 October 2025. https://ai.meta.com/blog/practical-ai-agent-security/

24. Anthropic. “Claude Code Sandboxing.” code.claude.com, 2026. https://code.claude.com/docs/en/sandboxing

25. NIST. “Announcing the AI Agent Standards Initiative for Interoperable and Secure Innovation.” nist.gov, February 2026. https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

The code compiles. The tests pass. The function returns the correct output for every input you throw at it. By every metric the industry has relied upon for years, this is a success. And yet, when a developer looks at the generated code, something feels wrong. The variable names are cryptic. The documentation is missing. The error handling is non-existent. The style conventions the team spent months establishing have been cheerfully ignored. The code works, but it is not the code anyone asked for.

This gap between “functionally correct” and “actually good” has been hiding in plain sight for years, papered over by benchmarks that never thought to look for it. Now, a team of researchers led by Ming Zhong at the University of Illinois Urbana-Champaign and Google DeepMind has given this gap a name, a framework, and a set of numbers that should make every AI lab and engineering organisation sit up and pay attention.

Their paper, published at ICML 2026 as “SWE-IF: Aligning Code Evaluation with Human Preference” and circulated in preprint under the catchier title “Vibe Checker,” reveals something professional developers have long suspected: when it comes to judging AI-generated code, instruction following is the primary differentiator separating models humans prefer from models that merely produce working output. Even more troublingly, the research demonstrates that Claude 4 Opus, a frontier model rather than an also-ran, manages only a 46.75% success rate when asked to follow five instructions simultaneously. That is less than a coin flip.

The timing could not be more pointed. According to the 2025 Stack Overflow Developer Survey, 84% of developers now use or plan to use AI tools in their development process, yet more developers actively distrust the accuracy of those tools (46%) than trust them (33%). Two-thirds, 66%, report spending more time fixing AI-generated code that is “almost right, but not quite.” The trend has not reversed since. Stack Overflow's own follow-up analysis, published in February 2026, tracked trust in AI accuracy falling to 29% from 40% the previous year, even as adoption climbed. The 2026 Developer Survey opened on 23 June 2026 and had not reported at the time of writing. These numbers describe exactly the problem the SWE-IF research has now quantified: models that pass functional tests but fail the requirements that matter most to the humans using them.

The Benchmark That Measured the Wrong Thing

To understand why this matters, you need to understand what pass@k actually measures, and what it does not.

Since OpenAI introduced the HumanEval benchmark in 2021, the industry has treated functional correctness as the gold standard for code generation evaluation. The pass@k metric works like this: generate k code samples for a problem, run them against a test suite, and check whether at least one passes. There is no middle ground, no partial credit, no assessment of anything beyond “does it work?”

That binary approach made sense when getting a model to produce syntactically valid Python was itself an achievement. But contemporary models routinely achieve pass@1 rates above 90% on HumanEval, and the benchmark is, for practical purposes, saturated. Research from EvalPlus found its original test suites so insufficient that pass@k scores drop by 19.3% to 28.9% once more rigorous test cases are applied, and the problems skew overwhelmingly easy: 84.8% classified as “Easy,” only 0.6% as “Hard.”

The deeper problem is not test quality or difficulty distribution. It is that functional correctness captures a single dimension of what makes code good. HumanEval says nothing about maintainability, runtime performance, or whether code follows established conventions, includes proper documentation, or handles edge cases gracefully. Even BigCodeBench, which pushed evaluation towards realistic tasks involving diverse function calls across 139 libraries, found the best model of its day solving merely 60% of complete tasks against human performance of 97%. The gap between benchmark performance and real-world capability is not small. It is a chasm.

What none of these benchmarks measure is the constellation of non-functional requirements that occupy the bulk of a professional developer's attention: style conventions, documentation standards, error handling patterns, API usage constraints, and the dozens of other specifications that transform raw functionality into maintainable software. The ISO/IEC 25010 standard recognises this directly, treating structural quality as distinct from functional suitability. When a developer asks an assistant to “write a function that parses this JSON, use type hints throughout, add docstrings in Google style, handle KeyError exceptions explicitly, and keep line length under 88 characters,” pass@k cares about exactly one of those requirements. The rest are invisible.

Thirty Rules, Five Categories, One Reckoning

The SWE-IF research team, which includes senior research scientist Jiao Sun at Google DeepMind and is supervised by Jiawei Han at UIUC, set out to make these invisible requirements visible. Their approach was systematic, grounded in existing software engineering practice, and deliberately designed to be deterministic rather than subjective.

The centrepiece is VeriCode, a taxonomy of 30 verifiable code instructions organised into five categories: Coding Style and Conventions, covering the rules linters and formatters enforce, such as line length and naming; Logic and Code Patterns, addressing structural requirements like maximum function branches and complexity thresholds; Documentation and Commenting, dealing with docstring formats and documentation completeness; Error Handling and Exception Management, capturing requirements around try-except blocks and specific exception types; and Library and API Constraints, specifying which libraries or API patterns should or should not be used.

These categories are not arbitrary. They map to the dimensions of code quality professional developers care about daily. Qodo's “State of AI Code Quality” report found that the single most requested improvement to AI coding tools was not raw capability but improved contextual understanding, cited by 26% of developers and rising to roughly 30% once customisation to team standards is folded in. Developers are not, in the main, asking for models that can solve harder problems. They are asking for models that will do what they were told, the way their own team does it. That is a request for instruction following, and it is precisely what VeriCode was built to measure.

Twenty-seven of the 30 instructions are implemented as checks in Ruff, the Rust-based Python linter that has become the de facto standard for Python code quality verification, and which implements over 800 built-in rules at 10 to 100 times the speed of its predecessor, Flake8. The remaining three verifiers sit outside what an off-the-shelf linter covers, a small detail worth dwelling on: it means the taxonomy is not simply a repackaging of Ruff's rule book but a deliberate attempt to describe what developers actually specify, including a few things no linter ships with.

Crucially, every instruction comes with a deterministic verifier. There is no ambiguity, no subjective judgement, no need for another language model to act as judge, an approach that introduces exactly the noise and subjectivity earlier attempts at measuring code quality struggled with. Either the code follows the instruction or it does not. A machine can check. And because parameters can be varied (line length from 79 to 120 characters, docstring format from Google to NumPy style), the 30 base rules generate hundreds of distinct instruction variants, making memorisation nearly impossible and keeping the evaluation robust against the contamination that has plagued benchmarks like HumanEval.

Building the Testing Ground

With VeriCode in hand, the researchers constructed two complementary benchmarks designed to cover the spectrum of programming tasks developers actually encounter.

Big-SWE-IF extends BigCodeBench, a collection of 1,140 real-world programming tasks involving diverse function calls and complex instructions across seven domains. BigCodeBench was itself built through systematic human-LLM collaboration: starting from real developer intents harvested from Stack Overflow, twenty human experts, most with more than five years of Python experience, refined and validated every task inside an execution-based sandbox, producing an average of 5.6 test cases per task at 99% branch coverage.

Live-SWE-IF extends LiveCodeBench, which draws 1,055 algorithmic tasks from competitive programming platforms like LeetCode, AtCoder, and CodeForces. Its critical advantage is that new problems are continuously collected after model training cutoff dates. Problems are annotated with release dates, so for any model with a known cutoff, scores can be computed exclusively on problems it could not have seen during training.

For each task, an LLM-based selector chooses relevant, non-conflicting instructions from the VeriCode taxonomy, so models are never asked to follow arbitrary or contradictory rules. They receive instructions a reasonable developer might actually specify. The evaluation runs in two modes: single-turn generation, where all instructions are presented at once, and multi-turn editing, where they are added in stages. Both test functional correctness and instruction following simultaneously.

The researchers then evaluated 31 leading language models from 10 model families, spanning Gemini, Claude, OpenAI, DeepSeek, Qwen, Grok, Gemma, Mistral, MiniMax, and Kimi. The results were sobering.

The Numbers That Should Worry Everyone

When models were asked to follow a single instruction alongside producing functionally correct code, performance was reasonable. Most leading models handled one constraint without significant difficulty. But as the number of simultaneous instructions increased, performance degraded in ways that reveal fundamental limitations in how these systems process and prioritise requirements.

The clearest evidence comes from the multi-turn editing condition, where instructions arrive in stages rather than all at once, much as they do in a real code review. On Big-SWE-IF, adding five instructions this way cut the average pass@1 rate by 5.85%. That is not a trivial drop. It represents a measurable loss of functional correctness caused by nothing more than the presence of additional non-functional requirements. The models were not being asked to do harder computational work. They were being asked to write the same code while also adhering to style and documentation conventions, and the effort of following those conventions caused them to break the code itself.

On Live-SWE-IF, the pattern holds but distributes unevenly across models, which is arguably more troubling than a uniform decline would be. For some systems the degradation is modest. For others, o4-mini and Kimi K2 among them, it exceeds 10%. A drop of that magnitude is not sampling noise. It means that for particular models, telling them how you want the code written measurably reduces their chance of writing code that works at all. And because the effect is concentrated in specific models rather than spread evenly, it is invisible to any evaluation reporting only an average.

The headline numbers are worse still. With five instructions applied simultaneously, the best result on Big-SWE-IF belongs to Claude 4 Opus, at 46.75%. On Live-SWE-IF the ceiling is 40.95%. These are not mid-tier models struggling with an unfair test. This is the frontier. And with three or more instructions, most advanced models fall below 50 across both benchmarks. Consider what that means in practice: give one of the best code generation models in the world a moderately complex task with five reasonable constraints (use type hints, add docstrings, handle exceptions, follow a naming convention, keep functions under a certain length) and it will satisfy all of them less than half the time. For models outside the top tier, failure rates are considerably worse.

This phenomenon, which the researchers term “functional regression,” is particularly insidious. Adding perfectly reasonable, non-conflicting instructions does not merely cause the model to miss those instructions. It actively degrades the model's ability to produce correct code in the first place. The instructions are not just ignored; they interfere with the core capability. Think of it as asking a chef to prepare a dish while also specifying plating, garnishing, and seasoning. The additional requirements should not make the food taste worse, yet with language models the analogous degradation is measurable and consistent.

Ninety-Five Per Cent, and Under Fifty

It would be reasonable to assume a result like this ages badly. Benchmarks fall. Models improve. A 46.75% score recorded against the frontier of late 2025 ought to look quaint within a year, overtaken by the next generation the way HumanEval was overtaken.

That is not what happened. What happened instead is that the two halves of the problem came apart.

On functional correctness, the past year has been a rout. The top of the SWE-bench Verified leaderboard now sits at 95% and above: Claude Fable 5 records 95.0%, with Claude Opus 5, released on 24 July 2026, reported higher still, and Claude Opus 4.8 at 88.6% before it. Gemini 3.1 Pro sits at 80.6%. GPT-5.6 Sol reached general availability on 9 July 2026. Kimi K3 ranks third on the Artificial Analysis Intelligence Index and first on Frontend Code Arena. On SWE-bench Pro, a deliberately harder successor built to resist exactly this kind of saturation, the leaders have already reached roughly 80%.

Those figures deserve one caveat. Leaderboard positions shift monthly, and published scores frequently fail to distinguish between standardised harnesses and vendor-specific scaffolding, a difference that can move a number by several points. But the direction of travel is not in dispute. Resolving real GitHub issues, a task considered a serious open research problem as recently as 2023, is now something the best models do roughly nineteen times out of twenty.

Now set that against the other number. Ninety-five per cent on functional correctness. Under fifty on instruction following at five constraints. Functional correctness has been substantially solved at the frontier. Instruction fidelity has not moved with it.

This is the whole argument, and the past year has widened it rather than closed it. The industry poured extraordinary resources into the dimension it could measure and received extraordinary returns. The dimension it was not measuring stayed roughly where it was. Every point of SWE-bench progress since has been earned on the axis that was already winning, which means the distance between what these models can do and what developers actually ask them to do is now greater than at any previous point in the history of code generation. We have built systems that can solve the problem and cannot reliably be told how.

Lost in the Middle of Your Prompt

Perhaps the most revealing finding is what the researchers call the “lost-in-the-middle” effect for instruction following. The phenomenon was first characterised in the broader language model context by Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang in their influential 2024 paper in the Transactions of the Association for Computational Linguistics. Working at Stanford, they demonstrated a distinctive U-shaped performance curve: model performance was highest when relevant information appeared at the very beginning or the very end of the input context, and degraded significantly when models had to retrieve information from the middle. Subsequent work has connected this to architectural properties of transformers, specifically the interaction between positional embeddings and causal attention masks, with some researchers reframing the effect not as a bug but as an emergent property of autoregressive pre-training.

The SWE-IF team found the same U-shaped curve applies specifically to code generation instructions. Models are less likely to follow constraints appearing in the middle of a prompt than those at either end. This transforms an abstract observation about attention patterns into a concrete software engineering problem.

The implications for daily development work are profound, because in professional software development requirements are rarely ordered by importance. They are organised by category or logical grouping. A developer asking for “type hints, Google-style docstrings, exception handling for network errors, maximum line length of 88, and use of the requests library” has no reason to expect the exception handling requirement to be treated as less important simply because it sits third in a list of five. A competent human programmer would read all five, understand them as a single specification, and satisfy every one regardless of position. But language models systematically deprioritise middle-positioned constraints. The instruction governing how the code handles failure, arguably the most consequential requirement for production reliability, is the one most likely to be silently discarded.

What Humans Actually Want

The most consequential finding emerges from the comparison with real human preferences. The team analysed over 800,000 human votes from the coding subset of LMArena (formerly Chatbot Arena), where users compare outputs from different models in blind pairwise comparisons, aggregated into Elo ratings. This is not a small or synthetic dataset. It represents the accumulated preferences of real developers making real choices about code they intend to use.

They found that combining functional correctness and instruction following produced a composite score substantially more predictive of human choice than either measure alone. Traditional benchmark rankings, the researchers noted, often showed little or even negative correlation with what human evaluators actually prefer. This is a striking claim. It means the leaderboards the industry uses to compare models are not merely incomplete; in some cases they are actively misleading. An organisation choosing its AI coding tool on the basis of HumanEval rankings might systematically select the model least aligned with what its developers want. Copilot Arena, a Visual Studio Code extension built by researchers at Carnegie Mellon, UC Berkeley, MIT, and Cornell, reached the same conclusion from a different direction: across more than 25,000 code completion battles, it found rankings drawn from real developer preferences correlate poorly with most traditional benchmarks, with smaller models that overperform on static evaluations frequently underperforming when actual developers judge their output.

The correlation data also reveals an important contextual distinction. For everyday programming, the work most developers do most of the time, involving web development, data processing, API integration, and utility scripting, instruction following emerged as the main differentiator among advanced models. Once models clear a threshold of functional correctness, what separates the ones developers prefer is how well they follow the non-functional requirements embedded in the prompt. For competitive algorithmic problems, by contrast, functional correctness still dominates: when the task has a single correct answer, style matters less than output. But competitive programming is a tiny fraction of real-world software development. The vast majority of code written on any given day is building applications, maintaining systems, integrating services, and extending existing codebases. For that work, instruction following is what matters.

The Training Pipeline Problem

These findings expose a fundamental misalignment in how models are trained for code generation. The dominant paradigm, Reinforcement Learning with Verifiable Rewards (RLVR), uses pass@k as its primary reward signal. Models are trained to maximise functional correctness because that is what the verifier can check. The reward is binary, and the optimisation pressure is entirely focused on producing code that works.

This has been remarkably effective. Models like DeepSeek R1 scaled RLVR with rule-based rewards for mathematics, code, and logic, and every subsequent generation of reasoning models has pulled the same lever harder, coupling reinforcement learning with tool use to produce exactly the SWE-bench numbers described above. The lever works. That is the problem. It works on one axis, and the industry has spent a year pulling it.

When RLVR trains a model to maximise pass@k, it implicitly teaches that nothing matters except getting the tests to pass. Style conventions, documentation, error handling, API constraints: all orthogonal to the reward signal. At best the model learns them incidentally from training data. At worst the optimisation pressure works against them, because following additional constraints reduces the probability of producing functionally correct code, exactly as the functional regression finding demonstrates.

VeriCode offers a path forward. Because each instruction carries a deterministic verifier, the taxonomy can be integrated directly into RLVR pipelines as an additional reward signal. Instead of rewarding models solely for code that passes tests, training could reward code that passes tests while also following the specified instructions. The verifiers are automated, scalable, and objective: precisely the properties reinforcement learning rewards require.

That proposal has begun to be acted upon. Multi-component RLVR reward designs now in circulation use Ruff-detected lint, style, and vulnerability signals as reward components alongside test-passing, treating code quality as a first-class training objective rather than a hoped-for side effect. A forward-looking suggestion buried in the discussion section of a 2025 preprint has, inside a year, become an active line of work.

It also carries a hazard the original proposal named only in passing. The moment a linter becomes part of a reward function, it becomes a target, and Goodhart's law applies to reinforcement learning with unusual force. RLVR is already known to be prone to over-optimisation, in which models exploit verification shortcuts that satisfy the checker without satisfying the intent behind it: reward hacking, in the field's terminology. Work such as IFDecorator addresses this directly for instruction following, wrapping RLVR training in intent-alignment checks and deliberately planted “trip wire” instructions designed to catch a model in the act of gaming its verifier. The lesson is not that verifiable rewards for instruction following are a bad idea. It is that a model trained to satisfy Ruff will learn to satisfy Ruff, and whether it has also written good code remains, stubbornly, a separate question.

What This Means for Engineering Organisations

For teams relying on AI coding assistants, these findings carry immediate practical implications. The first is that prompt engineering is more consequential than most teams realise. Because of the lost-in-the-middle effect, ordering matters: placing the most critical non-functional requirements at the beginning and end of prompts, rather than burying them in the middle, can meaningfully improve compliance. This costs nothing to implement.

The second is that teams should not trust AI-generated code to follow specifications without verification. A 46.75% success rate at five simultaneous instructions means that more than half the time, even the best models will miss at least one requirement. Automated verification, using linters like Ruff configured to match team standards, becomes not a nice-to-have but a necessary component of any AI-assisted workflow. Code review needs to check specifically for instruction compliance, not just functional correctness. In most organisations the infrastructure to do this already exists. What needs to change is the focus of the review it performs.

The third concerns tool selection. If traditional benchmarks correlate poorly with human preference, organisations making purchasing decisions on HumanEval scores are optimising for the wrong thing. Teams should evaluate tools against their own standards and conventions, testing whether a model produces code meeting their particular requirements for style, documentation, error handling, and API usage. A model scoring five points lower on a public leaderboard but consistently following your team's conventions may be the better choice.

There is also an organisational design consideration. As AI handles more routine code generation, the role of senior developers shifts towards specification and review, and the ability to catch the instructions a model missed becomes the primary quality assurance function. The Atlassian 2025 State of Developer Experience report found developers spend only 16% of their time coding, with 50% losing ten or more hours per week to non-coding tasks and organisational inefficiencies. The picture has improved since: Atlassian's 2026 research into AI-native development, drawing on 3,400 repositories across 2,500 customers, found teams merging 19% more pull requests per month and saving two to three hours per developer per week, with 99% reporting some time saving and 68% saving ten or more hours weekly. But time returned at the point of generation can be spent again at the point of review. If these tools are to genuinely improve productivity, they need to reduce the review burden, not relocate it. That means following instructions the first time.

A Subfield Forms Around the Gap

When this work first appeared, it read as an isolated finding: one team, one taxonomy, one uncomfortable number. It no longer does. In the months since, instruction following in code generation has acquired the unmistakable features of a research subfield, complete with independent replication, competing benchmarks, and a workshop of its own.

The most important corroboration came from outside the original group. CodeAlignBench, released by a team at Apple in October 2025, took a deliberately different route to the same question. Rather than deriving instructions from a linter's rule set, its authors ran a user study with working developers across three programming languages and built the benchmark from the adjustments those developers actually asked for. It evaluates both adherence to constraints specified up front and the ability to act on follow-up refinements, and it agrees with human judges 87% of the time on whether an instruction was followed. Its findings are hard to wave away: frontier model scores spread across a range of roughly 30 percentage points, and, crucially, the resulting ranking does not mirror the ranking those same models achieve on functional correctness. Two independent teams, different methodologies, different instruction sources, same conclusion. The models developers prefer are not the models the leaderboards promote.

CIFE, published in December 2025, sharpened the question by asking not whether models follow instructions but how nearly they do. Its 1,000 Python tasks carry an average of seven developer-specified constraints across thirteen categories, and its authors evaluated fourteen open and closed models against a composite C2A Score designed to capture correctness and constraint compliance jointly rather than trading one against the other. The result is perhaps the most diagnostically useful finding in the entire literature: there is a large gap between partial and strict constraint satisfaction, with strong models clearing 90% on partial adherence. Read that slowly. These models are not ignoring instructions. They are very nearly following them, satisfying most of what was asked, missing some fraction of it, and producing output that is correct in outline and wrong in detail. Which is, almost word for word, the complaint two-thirds of developers make about AI-generated code: almost right, but not quite. The benchmark has found the mechanism behind the survey response.

Then the question moved into the environment where most professional AI coding now actually happens. OctoBench, accepted at ACL 2026, dropped the single-prompt framing entirely and asked how models handle instructions inside agentic, repository-grounded work: 34 environments and 217 tasks instantiated across three scaffold types, scored against 7,098 objective checklist items, over eight representative models. It found the same systematic gap between solving the task and complying with the constraints surrounding it. This matters more than it might first appear. The deficit was originally measured where a human writes a prompt and reads an answer. OctoBench establishes that it survives translation into agent harnesses, where constraints are heterogeneous, persist across many turns, and go unenforced by anyone until something breaks. The deficit follows the models into the tools built on top of them, and in 2026 those tools are where the code comes from.

The institutional apparatus has caught up too. VeriCodeGen, a full-day NeurIPS 2026 workshop on AI for verifiable coding, convenes in Atlanta this December. The gap now has a venue.

Rethinking Evaluation From First Principles

What SWE-IF added to a landscape already in flux was a rigorous, deterministic framework for measuring the dimension that most strongly predicts human preference. Its own history since publication contains a small and telling irony. The paper began life in October 2025 as “Vibe Checker,” a title trading on the coinage Andrej Karpathy had introduced on 2 February 2025 to describe developers accepting AI-generated code without fully comprehending its functionality, an approach Karpathy allowed was “not too bad for throwaway weekend projects.” By its second revision in June 2026, on the way to peer review at ICML, the vibes were gone. The framework had become SWE-IF, BigVibeBench and LiveVibeBench had become Big-SWE-IF and Live-SWE-IF, and the paper presented itself as what it had always actually been: a software engineering instruction-following benchmark. Only VeriCode, the taxonomy at its centre, kept its name.

The renaming is worth a moment's attention, precisely because nothing else changed. The phenomenon the work measures was entirely unaffected by the loss of the branding. The 46.75% did not move. What the rename marks is a shift in how the field regards the problem: not a cultural observation about how people are using these tools, worth a knowing joke in a title, but an engineering deficiency with a number attached, submitted for peer review under a name that simply describes it. Vibe coding was a mood. Instruction-following fidelity is a measurement. The eight months between the two titles are roughly the period in which the industry stopped finding the first framing funny.

What remains is a challenge nobody should mistake for a rounding error. A sub-50% success rate at five instructions is not a gap to be closed by incremental improvement. It is a structural problem in how language models process and prioritise competing requirements, and closing it will likely require architectural innovation, changes to training methodology, and evaluation frameworks that go well beyond tweaking what already exists.

For the broader industry, the message is clear: the benchmarks we use shape the models we build. When pass@k is the only metric that counts, we get models excellent at producing code that passes tests and mediocre at everything else. When instruction following enters the evaluation framework, we get models that write code the way developers actually ask for it. The question is not whether this shift will happen, but how quickly, and how much accumulated code we live with in the meantime.

The code compiles. The tests pass. But does it follow the instructions? That, it turns out, is the question that actually matters.

References and Sources

1. Zhong, M., Zhou, X., Chang, T.-Y., Wang, Q., Xu, N., Si, X., Garrette, D., Upadhyay, S., Liu, J.Z., Han, J., Schillings, B., and Sun, J. (2026). “SWE-IF: Aligning Code Evaluation with Human Preference.” Proceedings of the 43rd International Conference on Machine Learning (ICML 2026). arXiv:2510.07315 (v1 submitted 8 October 2025 under the preprint title “Vibe Checker: Aligning Code Evaluation with Human Preference”; v2 revision 5 June 2026). Available at: https://arxiv.org/abs/2510.07315

2. Zhong, M., et al. (2026). “SWE-IF” code and VeriCode taxonomy repository. Available at: https://github.com/maszhongming/SWE-IF

3. Mehralian, F., Shar, R., Rae, J.R., and Hashemi, A. (2025). “CodeAlignBench: Assessing Code Generation Models on Developer-Preferred Code Adjustments.” Apple Inc. arXiv:2510.27565. Available at: https://arxiv.org/abs/2510.27565

4. Gunnu, S., et al. (2025). “CIFE: Code Instruction-Following Evaluation.” arXiv:2512.17387. Available at: https://arxiv.org/abs/2512.17387

5. “OctoBench: Benchmarking Scaffold-Aware Instruction Following in Repository-Grounded Agentic Coding.” (2026). Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (ACL 2026), Long Papers. arXiv:2601.10343. Available at: https://aclanthology.org/2026.acl-long.269/

6. “IFDecorator: Wrapping Instruction Following Reinforcement Learning with Verifiable Rewards.” (2025). arXiv:2508.04632. Available at: https://arxiv.org/abs/2508.04632

7. VeriCodeGen. (2026). “VeriCodeGen: AI for Verifiable Coding — NeurIPS 2026 Workshop.” Available at: https://vericodegen.github.io/

8. Liu, N.F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F., and Liang, P. (2024). “Lost in the Middle: How Language Models Use Long Contexts.” Transactions of the Association for Computational Linguistics, 12, pp. 157-173. Available at: https://aclanthology.org/2024.tacl-1.9/

9. Chen, M., Tworek, J., Jun, H., Yuan, Q., et al. (2021). “Evaluating Large Language Models Trained on Code.” arXiv:2107.03374. Available at: https://arxiv.org/abs/2107.03374

10. Zhuo, T.Y., Vu, M.C., Chim, J., Hu, H., et al. (2025). “BigCodeBench: Benchmarking Code Generation with Diverse Function Calls and Complex Instructions.” ICLR 2025. arXiv:2406.15877. Available at: https://arxiv.org/abs/2406.15877

11. Jain, N., Han, K., Gu, A., Li, W.D., et al. (2024). “LiveCodeBench: Holistic and Contamination Free Evaluation of Large Language Models for Code.” arXiv:2403.07974. Available at: https://arxiv.org/abs/2403.07974

12. Liu, J., Xia, C.S., Wang, Y., and Zhang, L. (2024). “Is Your Code Generated by ChatGPT Really Correct? Rigorous Evaluation of Large Language Models for Code Generation.” COLM 2024. Available at: https://openreview.net/forum?id=1qvx610Cu7

13. Chi, W., Chen, V., Angelopoulos, A.N., Chiang, W.L., Mittal, A., Jain, N., Zhang, T., Stoica, I., Donahue, C., and Talwalkar, A. (2025). “Copilot Arena: A Platform for Code LLM Evaluation in the Wild.” Proceedings of the 42nd International Conference on Machine Learning (ICML 2025). arXiv:2502.09328. Available at: https://arxiv.org/abs/2502.09328

14. Astral Software Inc. (2026). “Ruff: An extremely fast Python linter and code formatter.” Available at: https://docs.astral.sh/ruff/

15. Stack Overflow. (2025). “2025 Stack Overflow Developer Survey: AI Section.” Available at: https://survey.stackoverflow.co/2025/ai

16. Stack Overflow. (2026). “Mind the gap: Closing the AI trust gap for developers.” 18 February 2026. Available at: https://stackoverflow.blog/2026/02/18/closing-the-developer-ai-trust-gap/

17. Stack Overflow. (2026). “2026 Stack Overflow Developer Survey” (opened 23 June 2026; results not published at time of writing). Available at: https://survey.stackoverflow.co/

18. Qodo. (2025). “State of AI Code Quality in 2025.” Available at: https://www.qodo.ai/reports/state-of-ai-code-quality/

19. Atlassian. (2025). “2025 State of Developer Experience Report.” Available at: https://www.atlassian.com/blog/developer/developer-experience-report-2025

20. Atlassian. (2026). “The AI-native SDLC is paying off: 19% more PRs and 2–3 hours saved per developer per week.” Available at: https://www.atlassian.com/blog/ai-at-work/ai-native-sdlc-paying-off-per-developer-per-week

21. SWE-bench. (2026). “SWE-bench Verified and SWE-bench Pro leaderboards.” Available at: https://www.swebench.com/

22. Artificial Analysis. (2026). “Artificial Analysis Intelligence Index.” Available at: https://artificialanalysis.ai/

23. LMArena. (2026). “LMArena leaderboard (coding subset).” Available at: https://lmarena.ai/

24. Karpathy, A. (2025). Post on X (formerly Twitter), 2 February 2025. Defining “vibe coding.” Available at:

    There's a new kind of coding I call "vibe coding", where you fully give in to the vibes, embrace exponentials, and forget that the code even exists. It's possible because the LLMs (e.g. Cursor Composer w Sonnet) are getting too good. Also I just talk to Composer with SuperWhisper…

    — Andrej Karpathy (@karpathy) February 2, 2025

25. International Organisation for Standardisation. (2023). “ISO/IEC 25010:2023 Systems and software engineering.” Available at: https://www.iso.org/standard/35733.html

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...

Paragraph 173 of the order runs to one sentence. “The Court grants no abatement relief relative to the design and implementation of Meta's algorithms.”

It sits on page sixty of a sixty-eight-page document filed at 4.41pm on 6 August 2026 in the First Judicial District Court in Santa Fe County, cause number D-101-CV-2023-02838, State of New Mexico ex rel. Raúl Torrez, Attorney General v. Meta Platforms, Inc. Fourteen pages earlier, the same judge, Chief District Court Judge Bryan Biedscheid, had ordered Meta to deposit 567 million dollars into an abatement fund, four hundred and twenty million of it earmarked for treatment services for young people. Thirty pages earlier he had written that “the weight of the evidence presented demonstrates that Meta's platforms are a cause of and substantial contributing factor to the youth mental health crisis in New Mexico”. Twelve pages earlier still, he had rejected Meta's defence under Section 230 of the Communications Decency Act on the ground that the state's claim targeted “various platform designs and features, rather than third-party content”.

Read those four passages in sequence and the shape of the ruling becomes clear, and slightly vertiginous. The design caused the harm. The design was Meta's own conduct rather than somebody else's speech. Meta must pay for the consequences. And the court declined to order any change to the design.

This is the first time an American court has put a price on the mental health consequences of an engagement-optimising recommendation system and ordered the company that built it to pay. Attorney General Raúl Torrez called the judgment “a blueprint”, and told the public radio station KUNM that “if this judgment were replicated in all fifty states, it would be collectively 150 billion dollars in liability for Meta”. That arithmetic scales New Mexico's two million residents against a national population of about 340 million. It is a thought experiment about a hypothetical fifty-state judgment, not a description of what happened in Santa Fe.

What happened in Santa Fe is narrower and more interesting. A court examined an optimisation system, concluded it was making children measurably worse, and then discovered that almost none of the tools available to a court of equity could reach it. What it could reach was money, plus a list of peripheral product constraints. Whether that alters the objective function that produced the harm is a question the ruling itself, read closely, answers in the negative.

What the Court Found and What It Declined to Touch

The case ran in two phases. A jury sat from 2 February to 24 March 2026 on the state's Unfair Practices Act claims and returned 375 million dollars in civil penalties, calculated at the statutory maximum of 5,000 dollars across roughly 75,000 violations. A bench trial then ran from 4 to 22 May on the public nuisance theory and the abatement relief that flows from it. The August order is the product of that second phase, and brings Meta's total New Mexico liability to 942 million dollars.

The factual findings are unusually specific for this genre of litigation. Drawing on the state's expert Zachary Ward, who analysed New Mexico Youth Risk and Resiliency Survey data, the court found that of New Mexico children aged eleven to seventeen with at least one mental health concern, twenty-one per cent would not have had it but for social media use. It recorded Ward's component estimates verbatim: twenty-six per cent of those with depression symptoms, twenty per cent of those with anxiety symptoms, fifteen per cent of those sleeping less than eight hours and twenty-two per cent of those carrying at least one suicide risk factor would not have done so absent social media exposure. Meta's experts, including Laurence Steinberg, Randy Auerbach and Michael Baiocchi, argued that the studies do not definitively establish causation. The court found their analysis “restrictive” and inconsistent with the trial record.

On the mechanism, paragraph 161 is blunt. “Regardless of whether it is labelled as an 'addiction' or 'problematic use', the evidence at trial proved that design elements, such as autoplay, infinite scroll, 'like counts', and push notifications create a product that, particularly for adolescent users, is highly rewarding psychologically and neurochemically.” Paragraph 162 adds that “algorithmic content recommendations can create harmful feedback loops and 'rabbit hole' users”. The court noted internal Meta data showing the top one per cent of New Mexico teenagers by time spent on Facebook were on that platform alone for at least 290 minutes a day, close to five hours.

Then came the refusals. The court declined to restrict autoplay and infinite scroll, reasoning that “regulation of industry-wide features that contribute to problematic use... require legislative or executive branch action”, that ordering changes “would risk competitively damaging Meta's platforms to an unreasonable extent”, and that such an order might run “afoul of the First Amendment and Section 230”. It declined algorithmic relief outright, holding the state's proposals “vague and aspirational, rather than objective and measurable, and would unreasonably interfere with the functioning of Meta's business activities (equivalent to putting the factory in receivership in order to abate its pollution)”.

The factory analogy was Meta's. The court adopted it, and adopted its logic with it. Pollution can be abated. The production line cannot be redesigned by a judge.

Anderson Cuts Both Ways and Meta Needed Only One Edge

The most consequential move in the order is a doctrinal pincer the court walked into without appearing to notice it had closed.

To defeat Meta's Section 230 defence, Biedscheid relied on three cases: Lemmon v. Snap in the Ninth Circuit in 2021, the Nevada Supreme Court's 2025 decision in TikTok, Inc. v. Eighth Judicial District Court, and, most importantly, the Third Circuit's August 2024 decision in Anderson v. TikTok. Anderson arose from the death of ten-year-old Nylah Anderson, who attempted a “Blackout Challenge” video that TikTok's algorithm had served her. The Third Circuit held that Section 230 did not immunise TikTok, because the recommendation algorithm was “the platform's own expressive activity” and Section 230 protects only against liability for third-party content.

That holding is a gift to plaintiffs, and New Mexico used it. But it rests on a premise with a sharp reverse edge. The Third Circuit reasoned from the Supreme Court's 2024 decision in Moody v. NetChoice, which treated a platform's compilation and curation of content as its own protected expression. If algorithmic curation is the platform's speech for First Amendment purposes, it must be the platform's speech for Section 230 purposes too. The two doctrines are inversely related. Losing immunity means gaining constitutional protection.

Biedscheid took the first half and then, forty pages later, ran into the second. Paragraph 172 states that the requested algorithm relief “would directly alter and limit the manner in which platform content is displayed. As a result, Plaintiff's requests would likely violate the First Amendment and Section 230.” Paragraph 163 explains why: autoplay, infinite scroll and algorithmic recommendations “are most closely tied to content presentation”.

So the same characteristic of the recommendation system — that it is Meta's own editorial act rather than a neutral conduit — establishes liability and then insulates the remedy. The algorithm is the company's conduct when the question is who pays. It is the company's speech when the question is whether it must change. Meta lost the immunity argument and won the injunction argument on identical grounds, and paragraph 178 concedes as much, describing the disclosure remedies the court did order as necessary precisely to mitigate the harms “that the First Amendment, Section 230, and this Court's jurisdiction prevent from being more directly addressed in abatement relief”.

That is not judicial timidity. It is a structural feature of American law as it currently stands, and it means that liability for algorithmic harm and control over algorithmic design have been decoupled at the point where they most needed to meet.

Twenty Hours of Revenue, Already Provisioned

Now the money, which is where the “cost of doing business” objection either lands or does not.

Meta reported second-quarter 2026 revenue of 60.801 billion dollars, up twenty-eight per cent year on year, and net income of 15.848 billion. That is a revenue run rate of roughly 668 million dollars a day. The 567 million dollar abatement fund is therefore about twenty hours of company revenue. The full 942 million dollars of New Mexico liability is about thirty-four hours. Measured against full-year 2025 figures — revenue of 200.97 billion dollars and net income of 60.46 billion — the abatement fund equals roughly three and a half days of profit. Meta closed the second quarter of 2026 holding 90.26 billion dollars in cash and marketable securities. The fund is 0.6 per cent of that balance.

The more telling number is on the expense line. In the same quarter, reported on 29 July 2026, a week before the Santa Fe order landed, Meta booked 2.4 billion dollars in charges “related to legal proceedings” — the single largest driver of the quarter's cost increase, large enough to prompt the company to raise the low end of its full-year expense guidance to 165 billion dollars. Meta did not itemise the charge, so the inference has to be drawn rather than read off. It does not have to be drawn unaided. On the same quarter's earnings call, chief financial officer Susan Li told analysts that the company continues to see scrutiny on youth-related issues in several markets and has a number of youth-related trials scheduled in the United States this year which may ultimately result in a material loss. Meta has separately warned investors that its exposure on claims that its platforms were designed to be addictive could run to the high tens of billions of dollars. A company that tells its shareholders to expect a material loss from youth litigation, in the quarter it books 2.4 billion dollars of legal charges, a week before a youth litigation judgment lands, has not been surprised by the judgment. The 567 million dollars is not a shock to the accounts. It is a provision being drawn down.

The historical record on penalties of this shape is not encouraging. In July 2019 the Federal Trade Commission imposed a five billion dollar penalty on Facebook over the Cambridge Analytica affair, then the largest privacy fine levied anywhere by a factor of nearly twenty. When it was reported, Facebook's share price rose, adding roughly ten billion dollars to its market capitalisation — double the fine. In July 2024 Texas secured a 1.4 billion dollar biometric settlement, payable over five years. In April 2025 the European Commission fined Meta two hundred million euros under the Digital Markets Act over its “pay or consent” advertising model.

Only one of those changed the product, and it was not the one with the biggest number. Meta stopped using facial recognition in 2021, before the Texas settlement. The DMA fine was trivial in cash terms, but the accompanying non-compliance decision forced Meta to offer European users a genuinely less-personalised advertising option from January 2026. The lesson is not that penalties never work. It is that penalties work when they are attached to a specification of what the product must do differently, and function as an ordinary operating expense when they are not.

The Harm Was Priced at Billions and Billed at Millions

The abatement figure itself repays attention, because the court showed its working and the working concedes something important.

The state asked for 953 million dollars. Its abatement plan, prepared by Dana Weiner and costed by the economist Kelly O'Donnelly, proposed a fifteen-year programme; the state's experts put the cost of fully addressing the harm statewide at around 3.7 billion dollars. Biedscheid cut the drawdown period to five years, on the reasoning that “a 15-year plan would necessarily involve treating harms beyond those that exist today”. He declined to fund construction of new clinics or hospitals as beyond what is needed “to abate current harm”. And, repeatedly and explicitly, he reduced the allocations “based on a reduced time period and Meta's market share”, noting that “other social media companies share responsibility for harm to New Mexico teenagers” but were not before the court.

The resulting allocation is itemised: four hundred and twenty million for treatment, ninety million for screening and assessment, thirty-three million for awareness and prevention, fifteen million for referral and linkage, nine million for implementation and evaluation.

Every one of those reductions is defensible on its own terms. Together they produce a figure representing Meta's apportioned share of five years of the current stock of damage. It is a settlement of accrued harm, not a charge on the activity that produces it. Nothing in the calculation is indexed to future conduct. If Meta's platforms generate the same attributable fractions of adolescent depression, anxiety and sleep deprivation over the next five years as they did over the last five, the company owes exactly the same 567 million dollars, because that number was fixed by reference to harm already done.

There is also a timing problem the order creates for itself. Paragraph 131 provides that the five-year abatement period “shall be tolled during the pendency of any appeals, provided that Meta pays a supersedeas bond”. Meta has said it will appeal, and a company with ninety billion dollars in liquid assets will not struggle to post a bond. The clock on every behavioural obligation in the order can therefore be stopped by a filing and a surety, for however long New Mexico's appellate courts take.

Meta's public response to the ruling was short. “We disagree with the ruling and will appeal,” said Andy Stone, the company's communications chief. Meta added that it works hard to keep people safe on its platforms, that it has been transparent about the challenges of identifying and removing bad actors and harmful content, that it remains “confident in our record of protecting teens online”, and that it will “continue to defend ourselves against claims that misrepresent the facts”. The appeal to the New Mexico Court of Appeals rests on First Amendment and Section 230 grounds, the two doctrines the trial court accepted as limits on the remedy having rejected them as a bar to liability, and Meta is separately appealing the 375 million dollar first-phase jury verdict. Neither appeal obliges the company to change anything about how content is ranked while it proceeds.

Push Notifications, Like Counts and Ninety Hours a Month

The injunctive half of the ruling is where the interesting engineering lives, and it deserves to be judged on its merits rather than dismissed as consolation.

Meta must eliminate push notifications to accounts of known or estimated under-eighteens in New Mexico between 10pm and 7am every day, and between 8am and 3pm on school days during term, with carve-outs for messages from connected users and for security or hazard alerts. It must hide “like counts” by default on all under-eighteen accounts, overridable only with a parent or guardian's permission. It must impose a mandatory usage cap of ninety hours a month cumulatively across Facebook and Instagram for under-eighteens — roughly three hours a day.

It must proactively seek proof of age from accounts predicted to belong to under-thirteens, delete unverified accounts after thirty days, and commit to “attempting to develop, within two years, a dedicated under-13-years-of-age prediction model (using reasonable best efforts in light of COPPA limitations)” — the Children's Online Privacy Protection Act being, as the order notes, itself a limit on what age verification a court may compel. It must bar recommendations of under-eighteen accounts to unconnected adults, bar unconnected adults from messaging minors, and prohibit under-eighteens from romantic or sexualised interactions with chatbots. On child sexual abuse material, it must report a baseline detection rate to the National Center for Missing and Exploited Children and the state within thirty days, and improve on that baseline by no less than five per cent over the abatement period.

Note the logic separating what was ordered from what was refused. Paragraph 165 is explicit: push notifications and like counts are ordered precisely because they are “least connected with platform content”. Like counts are “merely a feature created and offered by Meta to principally track and motivate user feedback, all without altering the underlying published content”. The court could reach them because they are not speech.

This is a real and defensible line, and some of these measures will bite. A ninety-hour cap is a genuine constraint on the metric the entire business optimises, and an under-thirteen prediction model is a substantial engineering commitment. But look at what the boundary produces. The court could regulate the delivery mechanism, the scoreboard and the door policy. It could not regulate what the ranking system selects, or the objective it selects for. Sonia Livingstone of the London School of Economics, who leads the Digital Futures for Children centre, put the resulting evidentiary problem precisely in comments to the Associated Press: “Tested one by one, the evidence for each design feature will be weaker, as it is the combination.” A remedy assembled feature by feature, with the load-bearing feature excluded on constitutional grounds, is not the same intervention as a remedy directed at the system.

Nobody Is Appointed to Check the Homework

Verification will decide whether any of this means anything, and it is the part the court cut most deeply.

New Mexico asked for a court-appointed Child Safety Monitor, funded by Meta, with a term of at least five years. Biedscheid denied it, and his reasoning returns to the factory. “A monitor usually would measure pollution in the air and report whether or not identified pollutants were within satisfactory levels. But, the State asks for much more here... the monitor not only would determine which pollutants to test, but also decide what level of each pollutant would be satisfactory, and whether to force the factory ownership to use the factory to produce a new product that is more to the monitor's liking.”

In place of a monitor, the order requires Meta to file written compliance reports with the court and the state by 30 June and 31 December each year, and permits the New Mexico Department of Justice to delegate review to whatever agency it chooses. The court reserved the right to appoint a monitor or special master later if a specific requirement proves persistently contentious.

That is self-reporting with a delegated audit and a reserved power. Brooke Istook, president and chief strategy officer of the Heat Initiative, told the Associated Press that the ruling means “now, we will have someone in an official capacity checking the homework of these companies”. The order does not obviously establish who.

The wider record on independent verification of platform behaviour is worse than the order assumes. Meta shut down CrowdTangle, the analytics tool thousands of researchers and journalists used to observe content distribution on Facebook and Instagram, on 14 August 2024. Its replacement, the Meta Content Library, imposes materially tighter access conditions; a joint investigation by Proof News, the Tow Center for Digital Journalism and the Algorithmic Transparency Institute found it less transparent and less accessible, and a Coalition for Independent Technology Research survey found thirty-two of thirty-six researchers concerned the shutdown would impede their work. Europe has built the alternative: the Commission adopted its delegated act on researcher data access under Article 40 of the Digital Services Act on 2 July 2025 and opened the DSA Data Access Portal that October. New Mexico has a semiannual PDF.

Peter Ormerod, an associate professor of law at Villanova University, made the adjacent point about the age provisions: “Age verification can be done well in a privacy-protective way, but it is not easy.” Ordering a company to build a prediction model is not the same as being able to tell whether the model does what the order intended.

An Opioid Settlement for the Feed

The four hundred and twenty million dollar treatment allocation carries a framing that deserves to be stated plainly, because the court states it plainly itself. The public nuisance doctrine Biedscheid applied is the doctrine of the tobacco and opioid settlements. The remedy is abatement: you do not shut the factory, you clean up what it emitted.

The concession embedded in that framing is that the harm becomes an externality of continued production rather than a defect in the production. The order is candid about it. Paragraph 178 says accurate disclosure and education are essential “unless and until Meta eliminates the dangers to adolescents on its platforms” — a conditional assigning the elimination to Meta's discretion and the mitigation to New Mexico's clinics.

The opioid analogy also brings its own well-documented failure mode. Reporting by KFF Health News, which has spent years tracking how national opioid settlement money is actually spent, has found lax reporting rules, minimal guidance on appropriate use, and repeated instances of settlement funds substituting for existing budget obligations rather than adding to them. In Washington, DC, budget documents obtained by KFF showed around 2.3 million dollars proposed to cover the city's Medicaid contribution and at least 5.5 million to support treatment centres previously funded from general revenue. Twelve states that promised annual transparency reports produced documents that, on KFF's assessment, remain difficult for an ordinary reader to decipher.

Biedscheid anticipated some of this, noting that he expects to enter separate orders governing fund administration and drawdown. Torrez told KUNM that “elected officials” would decide how the money is spent, and that his office's focus would turn to the coming legislative session. Both are reasonable positions. Both also mean the accountability mechanism for four hundred and twenty million dollars of algorithmic harm remediation is the ordinary state appropriations process, which has not historically exerted much influence on ranking systems in Menlo Park.

The Real Number Is in Oakland, Not Santa Fe

Jury selection began on Wednesday 12 August 2026 in Oakland, before Judge Yvonne Gonzalez Rogers of the Northern District of California, in the first bellwether trial of the state attorneys general claims within MDL 3047, the consolidated federal social media adolescent addiction litigation. Twenty-nine states press the claim under the Children's Online Privacy Protection Act; four of them — California, Colorado, Kentucky and New Jersey — additionally bring claims under their own consumer protection statutes. Opening statements are scheduled for 18 August, three days from now. In late June, Gonzalez Rogers refused Meta's final attempt to dispose of the case, finding “numerous disputes of fact” over whether Meta designed its platforms to be addictive while misrepresenting what it knew, and granted the states partial summary judgment on part of the COPPA claim.

The panel now being seated will not decide the case. Gonzalez Rogers took the unusual step of empanelling an advisory jury, which will answer specific questions put to it and thereby guide a ruling she issues herself. The trial is expected to run about six weeks, with her decision expected in October. The arrangement is worth pausing on, because it reproduces the Santa Fe bottleneck in a federal courtroom a thousand miles away. In Oakland as in New Mexico, the remedial question — what, if anything, Meta must build differently — belongs to a single judge sitting in equity rather than to a jury. Whatever the advisory panel concludes about Meta's conduct, the constraint that produced paragraph 173 operates on the person who writes the order, not on the people who heard the evidence.

That is the proceeding with the capacity to change a balance sheet, and Meta has supplied the number itself. In a court filing, the company stated that the penalty calculations proposed by California, Colorado, Kentucky and New Jersey could amount to approximately 1.4 trillion dollars if those states prevail. The figure needs handling with care. It is a constructed statutory ceiling rather than a forecast of any award, arrived at by multiplying the number of affected young users by the maximum per-violation fine available under each state's consumer protection law, and legal observers do not expect anything resembling it to survive trial or appeal. What it is good for is scale. New Mexico's abatement fund is twenty hours of revenue, a sum a finance function absorbs without adjusting a single ranking parameter. A theoretical ceiling in the trillions is a different class of instrument even after two orders of magnitude have been argued off it, which is precisely what Meta will spend the next six weeks doing.

The federal MDL contains more than three thousand pending actions, claims from over two hundred and fifty school districts, and, since late 2024, more than one hundred thousand individual mass arbitration demands against Meta. The parallel California coordinated proceeding, JCCP 5255 before Judge Carolyn Kuhl in Los Angeles, encompasses roughly three thousand three hundred cases. In March 2026 a Los Angeles jury returned the first personal injury verdict in the K.G.M. case, three million dollars compensatory and three million punitive, apportioned seventy per cent to Meta and thirty to Google. The first federal school district bellwether, brought by a Kentucky district, settled in May 2026 for a combined value near twenty-seven million dollars across four companies. Three more state-court bellwethers are expected from late October.

Oakland is not the only live parallel, and it was not the first. On 27 July 2026, ten days before the Santa Fe order landed, Tennessee Attorney General Jonathan Skrmetti delivered opening arguments in the Chancery Court for Davidson County in Nashville, in the state's civil enforcement action against Meta. The claim is that Instagram was intentionally designed to promote addiction in young users, through autoplay, Reels, notifications and disappearing content, and that Meta misled the public about the platform's safety, in violation of the Tennessee Consumer Protection Act. The trial was expected to run about seven weeks. It is still running today.

What makes Nashville worth more than a passing mention is its architecture, which is New Mexico's architecture exactly. The jury decides first whether Meta violated Tennessee law. If it does, a second phase follows in which a judge, not the jury, determines both the monetary penalties and any changes Meta must make to Instagram. That is the same two-phase split that produced a 375 million dollar verdict in Santa Fe in March and paragraph 173 in August: a jury to establish that something was done, a judge to decide what may be done about it. Tennessee's remedial phase is still ahead. Should the state win the first, the second will put a Nashville chancellor in front of the question Biedscheid has just answered — whether a court of equity can order a company to rebuild a ranking system — with the same First Amendment and Section 230 arguments waiting for him, and now with a reasoned New Mexico order available as persuasive authority for the answer no.

Alongside this, the liability theory is migrating to conversational systems. Megan Garcia's wrongful death suit over the February 2024 suicide of her fourteen-year-old son Sewell Setzer III produced, in May 2025, the first ruling allowing product liability claims against a chatbot developer to proceed past the First Amendment and Section 230. Character Technologies, its founders and Google disclosed a mediated settlement of that case and four related family suits on 7 January 2026, on confidential terms and without admission of liability. Raine v. OpenAI, filed in August 2025 over the death of sixteen-year-old Adam Raine, remains pending.

Legislatures are moving on a parallel track and faster. Illinois enacted the Wellness and Oversight for Psychological Resources Act on 1 August 2025, barring the provision or advertising of therapy by anyone other than a licensed professional, with civil penalties up to ten thousand dollars per violation. Nevada's Assembly Bill 406 took effect on 1 July 2025 with penalties up to fifteen thousand. California's Senate Bill 243, effective January 2026, requires chatbot disclosure and carries a private right of action. Senate Bill 903, introduced by Senator Steve Padilla, would prohibit advertising chatbots as therapy and bar AI from making therapeutic decisions without licensed review; it passed the Senate thirty-nine to nil and cleared two Assembly policy committees before being placed on the Assembly Appropriations Committee's suspense file, where it sat against a suspense deadline of 14 August 2026 and an adjournment date of 31 August.

Torrez himself gestured at the division of labour. “The judge was actually restrained in part,” he told KUNM, “because he expects the legislature and Congress to take up some of the more sweeping calls for change that we included in this case.”

The Literature Names What the Bench Deferred

Three research strands map onto the gap the order leaves, and it is worth being precise about what each does and does not establish.

Sunil Arora, Sahil Arora and John D. Hastings submitted “The Psychological Impacts of Algorithmic and AI-Driven Social Media on Teenagers: A Call to Action” to arXiv on 19 August 2024. It is a synthesis rather than new empirical work, arguing that the algorithms underlying social platforms inadvertently produce profound psychological effects on adolescents through curated personas, notification overload and peer pressure, and calling on policymakers, developers and educators to prioritise teen safety. It is an argument for the proposition the New Mexico court accepted on the evidence, not independent proof of it.

Austin Shouli, Ankur Barthwal, Molly Campbell and Ajay Kumar Shrestha submitted “Ethical AI for Young Digital Citizens: A Call to Action on Privacy Governance” on 15 March 2025. Its framework rests on four pillars — algorithmic transparency, privacy education, ethics around parental data sharing, and accountability measures. The first and fourth are exactly what the Santa Fe order could not deliver: it produced neither a transparency mechanism capable of revealing how ranking operates nor an accountability body capable of assessing it.

The most directly relevant is “AI, Digital Platforms, and the New Systemic Risk”, submitted on 22 September 2025 by Philipp Hacker, Lilian Edwards and Atoosa Kasirzadeh, revised in May 2026 and accepted at ACM FAccT 2026. Building a framework from finance, complex systems theory, climate science and cybersecurity, the authors argue that the EU's AI Act and Digital Services Act invoke systemic risk while relying on narrow or ambiguous characterisations of it, and that current instruments miss harms such as discrimination at scale and novel failure modes arising from multiple interacting agents. Their central move — treating collective, population-level harm as a distinct regulatory object rather than an aggregation of individual injuries — is precisely the move a public nuisance claim makes, and precisely the move a court equipped only with equitable remedies against a single defendant cannot complete. Biedscheid said so himself when he reduced the fund for Meta's market share and observed that its competitors were not before him.

What Would Actually Bind an Optimiser

If a 567 million dollar abatement fund does not change the ranking system, the interesting question is what would. Four categories of instrument already exist, and none of them is a fine.

The first is deletion. Since the Everalbum consent order in January 2021, the Federal Trade Commission has required companies to destroy not only unlawfully collected data but any “affected work product” — models and algorithms trained on it. The remedy reached a children's privacy case for the first time in the 2022 action against WW International and its Kurbo subsidiary, and featured again in the 2023 Ring settlement. Algorithmic disgorgement converts a penalty into a loss of capability. It is the only American remedy that has made a model itself the object of an order, and its logic — that a firm should not retain the analytical product of unlawful conduct — maps onto engagement optimisation trained on minors without much strain.

The second is a positive duty on the recommender. The UK's Protection of Children Codes under the Online Safety Act came into force on 25 July 2025, and they do the thing Biedscheid found himself unable to do: services whose recommender systems present a medium or high risk of harmful content must configure those algorithms to exclude such content from children's feeds. That is a design mandate aimed at the ranking function, imposed by a regulator with rule-making authority rather than by a judge in a single case, and it exists because Parliament wrote it rather than because a court inferred it.

The third is a design code, and its American history is instructive about the constitutional headwind. California's Age-Appropriate Design Code Act has been in litigation since 2022. On 12 March 2026 a Ninth Circuit panel issued its second opinion in NetChoice v. Bonta, holding that NetChoice had not met the standard for facial First Amendment relief against the statute's coverage definition or its age estimation provision, while agreeing that the data-use restrictions and dark-patterns prohibition are likely unconstitutionally vague. The pattern matches Santa Fe exactly — age assurance survives, content-adjacent design rules do not.

The fourth is measurement, and it is the precondition for the other three. Article 40 of the Digital Services Act gives vetted researchers a statutory route into platform internals for the specific purpose of studying systemic risk. Nothing comparable exists in American law, which is why Biedscheid's alternative to a monitor was a report Meta writes about itself.

There is a version of this ruling that reads as a landmark, and Torrez is entitled to sell it that way. A court took an optimisation system seriously as a cause of population-level psychiatric harm, refused to let Section 230 dispose of the question, applied a doctrine built for tobacco and opioids, and attached a nine-figure number to the result. Other states and school districts now have a template, and Meta's own lawyers have to price it.

But the specific claim the ruling is being asked to bear — that ordering a company to pay for algorithmic harm changes the algorithm — is contradicted by paragraph 173 of the ruling itself. The court identified the mechanism, named the feedback loops, quoted the internal data showing the heaviest-using one per cent of New Mexico teenagers on Facebook for five hours a day, and then wrote that it granted no relief as to the design and implementation of Meta's algorithms, because to do so would be vague, competitively unfair, and probably unconstitutional. The engagement objective that produced the finding survives the finding intact, in New Mexico as everywhere else, with an accrual against it that the company had already booked.

Meaningful accountability for algorithmic harm to children would have to bind the objective function rather than the consequences of running it: a positive duty on what a feed served to a minor may optimise for, an independent capability to verify whether that duty is met, and a remedy that removes the capability rather than pricing its output. Two of those three exist in Europe. The third exists in a handful of FTC consent orders. What New Mexico has is a five-year clock that a supersedeas bond can stop, a semiannual report written by the defendant, and four hundred and twenty million dollars to treat the children the system has already reached. That is not nothing. It is a state agreeing to clean up after a process it has been told, in the same document, that it lacks the authority to alter.

References

1. State of New Mexico, ex rel. Raúl Torrez, Attorney General v. Meta Platforms, Inc., No. D-101-CV-2023-02838, “Findings of Fact, Conclusions of Law, and Judgment, Order, and Decree of the Court,” First Judicial District Court, Santa Fe County, New Mexico, 6 August 2026. https://www.courthousenews.com/wp-content/uploads/2026/08/j-bryan-biedscheid-order.pdf
2. Associated Press, “A New Mexico judge ordered new child safeguards for Meta. Advocates hope other courts follow,” The Boston Globe, 8 August 2026. https://www.bostonglobe.com/2026/08/08/nation/new-mexico-judge-ordered-new-child-safeguards-for-meta/
3. Jonathan Vandiver, “New Mexico Attorney General says Meta ruling should prompt action by lawmakers and Congress,” KUNM, 7 August 2026. https://www.kunm.org/local-news/2026-08-07/new-mexico-attorney-general-meta-ruling-lawmakers-congress
4. Meta Platforms, Inc., “Meta Reports Second Quarter 2026 Results,” StockTitan, 29 July 2026. https://www.stocktitan.net/news/META/meta-reports-second-quarter-2026-hkjfhayj8l0v.html
5. Meta Platforms, Inc., “Meta Reports Fourth Quarter and Full Year 2025 Results,” PR Newswire, 28 January 2026. https://www.prnewswire.com/news-releases/meta-reports-fourth-quarter-and-full-year-2025-results-302673127.html
6. Angela Chen, “Facebook is actually worth more thanks to news of the FTC's $5 billion fine,” MIT Technology Review, 15 July 2019. https://www.technologyreview.com/2019/07/15/134196/facebook-is-actually-richer-thanks-to-news-of-the-ftcs-5-billion-fine/
7. European Commission, “Commission finds Apple and Meta in breach of the Digital Markets Act,” ec.europa.eu, 23 April 2025. https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085
8. United States Court of Appeals for the Third Circuit, Anderson v. TikTok, Inc., No. 22-3061, 27 August 2024. https://law.justia.com/cases/federal/appellate-courts/ca3/22-3061/22-3061-2024-08-27.html
9. MDL Update, “JCCP 5255 Social Media Cases (California): K.G.M. $6M Verdict & Status August 2026,” mdlupdate.com, August 2026. https://mdlupdate.com/mdl/3047-social-media-adolescent-addiction/jccp-5255/
10. Erin Mulvaney and Isaiah Poritz, “Meta Denied Final Bid to Toss State AGs Case Before August Trial,” Bloomberg Law, 30 June 2026. https://news.bloomberglaw.com/litigation/meta-denied-final-bid-to-toss-state-ags-case-before-august-trial
11. Clare Duffy, “Character.AI and Google agree to settle lawsuits over teen mental health harms and suicides,” CNN Business, 7 January 2026. https://www.cnn.com/2026/01/07/business/character-ai-google-settle-teen-suicide-lawsuit
12. Kristen Hwang, “As AI 'therapists' dish out advice, California lawmakers try to set some limits,” CalMatters, 6 August 2026. https://calmatters.org/health/mental-health/2026/08/at-therapists-chatbot-mental-health/
13. Mintz, “Algorithmic Disgorgement: An Increasingly Important Part of the FTC's Remedial Arsenal,” mintz.com, 23 January 2024. https://www.mintz.com/insights-center/viewpoints/54731/2024-01-23-algorithmic-disgorgement-increasingly-important-part
14. Ofcom, “Tech firms must tame toxic algorithms to protect children online,” ofcom.org.uk, 24 April 2025. https://www.ofcom.org.uk/online-safety/protecting-children/tech-firms-must-tame-toxic-algorithms-to-protect-children-online
15. Cooley LLP, “NetChoice v. Bonta: Ninth Circuit Narrows Injunction Against California's Age-Appropriate Design Code Act,” cooley.com, 30 March 2026. https://www.cooley.com/news/insight/2026/2026-03-30-netchoice-v-bonta-ninth-circuit-narrows-injunction-against-californias-ageappropriate-design-code-act
16. European Commission, “Commission adopts delegated act on data access under the Digital Services Act,” digital-strategy.ec.europa.eu, 2 July 2025. https://digital-strategy.ec.europa.eu/en/news/commission-adopts-delegated-act-data-access-under-digital-services-act
17. Coalition for Independent Technology Research, “Blocking our Right to Know: Surveying the Impact of Meta's CrowdTangle Shutdown,” independenttechresearch.org, July 2024. https://independenttechresearch.org/wp-content/uploads/2024/07/CrowdTangle-Survey-Report-Final.pdf
18. Aneri Pattani and Henry Larweh, “Budget Battle Erupts in Nation's Capital Over Opioid Settlement Money,” KFF Health News, 2026. https://kffhealthnews.org/public-health/washington-dc-opioid-settlements-medicaid-budget-supplantation/
19. KFF Health News, “12 States Promised To Open the Books on Their Opioid Settlement Funds. We Checked Up on Them,” kffhealthnews.org. https://kffhealthnews.org/public-health/state-opioid-settlement-funds-transparency-update/
20. Sunil Arora, Sahil Arora and John D. Hastings, “The Psychological Impacts of Algorithmic and AI-Driven Social Media on Teenagers: A Call to Action,” arXiv:2408.10351, 19 August 2024. https://arxiv.org/abs/2408.10351
21. Austin Shouli, Ankur Barthwal, Molly Campbell and Ajay Kumar Shrestha, “Ethical AI for Young Digital Citizens: A Call to Action on Privacy Governance,” arXiv:2503.11947, 15 March 2025. https://arxiv.org/abs/2503.11947
22. Philipp Hacker, Lilian Edwards and Atoosa Kasirzadeh, “AI, Digital Platforms, and the New Systemic Risk,” arXiv:2509.17878, 22 September 2025, revised 23 May 2026. https://arxiv.org/abs/2509.17878
23. Courthouse News Service, “Jury selection begins in states' trial against Meta over youth social media harms,” courthousenews.com, 12 August 2026. https://www.courthousenews.com/jury-selection-begins-in-states-trial-against-meta-over-youth-social-media-harms/
24. JURIST, “Tennessee takes Meta to trial over Instagram addiction allegations,” jurist.org, July 2026. https://www.jurist.org/news/2026/07/tennessee-takes-meta-to-trial-over-instagram-addiction-allegations/
25. ICLG, “Meta warns of 'tens of billions' in potential exposure over algorithm-addiction claims,” iclg.com, 2026. https://iclg.com/news/23228-meta-warns-of-tens-of-billions-in-potential-exposure-over-algorithm-addiction-claims

---

Tim Green UK-based Systems Theorist & Independent Technology Writer

Tim explores the intersections of artificial intelligence, decentralised cognition, and posthuman ethics. His work, published at smarterarticles.co.uk, challenges dominant narratives of technological progress while proposing interdisciplinary frameworks for collective intelligence and digital stewardship.

His writing has been featured on Ground News and shared by independent researchers across both academic and technological communities.

ORCID: 0009-0002-0156-9795 Email: tim@smarterarticles.co.uk

Listen to the free weekly SmarterArticles Podcast

Discuss...