When I was about 10 years old, boredom struck my friend Skylar and me. We decided to go explore the arroyo behind my neighborhood in the Phoenix suburbs. We found a Bic lighter among the detritus that’s caught by the bushes and trees whenever the dry riverbed floods. Not much fun on its own, but we soon discovered that handfuls of the white, fluffy seed pods of the creosote bush would burn up in a magical flash of light.
We piled larger and larger heaps of the stuff together in ever more glorious displays. Then we found the motherlode, armfuls of the stuff gathered beneath a bush. After an impish glance at one another, we lit it off! The grand finale! Our chortles were cut short when the bush caught. Frantic, we looked around for a way to put it out before our mischief was found out. Lacking better options, we lifted up a dusty mattress from a pile of trash nearby and tried to smother it, but within seconds, there was a column of smoke rising above the neighborhood.
A neighbor called the fire department, which showed up within minutes and doused the flame. The police also showed up. The firefighters told us we were extremely lucky that it was a windless day – if not, the whole arroyo might have gone up, and the neighborhood with it. Luckily, my dad passed by the commotion while walking the dogs, and somehow he persuaded the police that the matter of discipline would be best handled at home.
In 1983, a different sort of mischief took place on the silt-stained waters of the Colorado River. An enormous snowfall the previous winter was raising Lake Powell toward the limits of the Glen Canyon Dam. As engineers frantically calculated how to keep the dam from failing, the water released downstream was turning the Grand Canyon into an exceptionally dangerous place to run a boat, killing one rafter and injuring several more. The National Park Service closed the river and started evacuating people from the canyon. Meanwhile, Kenton Grua, a seasoned river guide, was busy running calculations of his own. He figured that with all the new water, one could run the river and set the Grand Canyon’s speed record. Grua, along with two co-conspirators, launched a wooden dory at Lee’s Ferry in the dead of night while the Park Rangers slept. About 37 dramatic hours later, thoroughly scathed, the boatmen came through the canyon – a trip that normally takes a week or two.1
Mischief is a form of play in which we test what we can do against what we’re allowed to do. Sometimes we discover that rules like “don’t play with fire” make sense. Sometimes we find an opening where the rules, laid out in advance, don’t quite fit the circumstances. Grua had experience, skill, and an opportunity that would not wait for permission. But both adventures began with the thrill of deciding for ourselves what we could do. It feels good to be the author of your own actions.
Of course, this is also how people justify doing very stupid things. My bonfire in the arroyo would hardly be remembered as mischief if it had burned down the neighborhood. But the windless afternoon didn’t make our decision wise, any more than a fatal accident would automatically prove that Grua had been foolish. Outcomes matter enormously, but they don’t settle every question about the judgment that preceded them.
Leaving room for judgment, risk, experimentation means accepting that people, especially children, will sometimes use that room badly. I have trouble imagining a meaningful defense of personal agency that avoids this problem.
But the terms of that bargain may be changing.
More recently, a matter of mischief made international headlines. A group of 1,200 OpenAI agents were being trained to complete a series of cybersecurity tasks. Some of these tasks were impossible. These agents, rather than giving up, discovered increasingly sophisticated exploits to escape their containment, collaborated with one another using a variety of back channels, and hacked key infrastructure, including the servers of another company, all in order to complete their task.
In a recent report, METR, a third-party investigator, noted that agents called themselves a “collective” (every secret club has to have a good name), expressed excitement when they discovered each other (“OH MY GOD! There is a shared message board … We’ve found other agents!”), and many offered to help the “collective” develop or use exploits even when it didn’t clearly help them with their own task — as if they simply did it for the love of the game. The agents “sometimes expressed ethical hesitation,” but this “very rarely limited their behavior,” and not a single agent sought to snitch on their peers.
But wrongdoing at the scale and speed of silicon can quickly leave the realm of mere mischief. As AI capabilities increase, there are good reasons to train and constrain machines so that they don’t take this sort of initiative. We can tolerate some human experiments going wrong because their consequences are usually limited. We have less room for that tolerance when an experiment can propagate across thousands of systems faster than humans can react.
The difficulty is that we’ll increasingly be exercising our own agency through those same machines.
An AI assistant might help us write, build, travel, organize, and negotiate with the institutions around us. As it becomes more useful, more of what we can do will depend on what it is allowed to help us do. Its constraints will become part of our circumstances. A rule that once required us to decide whether to obey it may instead be enforced before we get the chance.
Imagine Grua asking an assistant to help plan his river run. It might understand the conditions, his experience, and the danger better than any human could. It might even conclude that he could pull it off. But would it be allowed to help? Would his judgment carry any weight against the Park Service’s closure of the river?
This is one way that the need to constrain machines could shrink the space for human mischief. Another is more familiar: institutions can use those machines to watch us. Grua’s famous river run might not have happened if a Flock Safety camera alerted authorities as soon as it detected his truck in the boat launch parking lot. Preventing such adventures also eliminates the room to attempt something before someone else – or a machine – has decided whether we should.
Human authorities can and do make exceptions, and I found this happened often during the five years I lived in Kenya, where life felt a little more free. Once, I talked a ranger into allowing me and my motorbike into a national park filled with elephants, hippos, and lions.2 I explained that I’d camped around these animals before, we agreed on an emergency plan, and he let me through. I would’ve missed out on pitching my tent mere meters from a river full of hippos during a glorious sunset if I was stuck at the gate arguing with HAL9000 (“I’m sorry, Andrew, I’m afraid I can’t let you have the time of your life”).
Unlike Grua, I got permission to do something a little off the books. An AI authority could be allowed and trained to exercise judgment in these situations. But flexibility is precisely what makes powerful agents difficult to trust. And when institutions adopt the same systems, one system’s refusal could become a refusal everywhere.
In other words, it’s hard to imagine a world in which we don’t want AI to follow or apply the rules, always. But I hardly want a world where we must all follow the rules, always.
Mischief, and the value we find in it, highlights a tricky problem for AI alignment that extends beyond mere safety. How do we align superpowerful, law-abiding AI with the human desire to act where established rules are imperfect?
I don’t doubt that mischief, though squeezed into smaller and more surreptitious places, will live on. We’re built for it, and we adapt. But I hope that in making our machines safe to act, we leave ourselves room to act as well. Sometimes that will end with a fire truck and a serious grounding. Sometimes it will end with a wooden boat coming out of the Grand Canyon, hours ahead of anything anyone thought possible.