This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. Mars may be a hellhole, but the moon is not far behind The US and China are racing to build bases on the moon, with NASA hoping to establish a small lunar city by the end of the century. But the moon is a tremendously hostile place to set up camp. A sprawling lunar base must be safe for its inhabitants, protected from falling asteroids, endless cosmic radiation, razor-sharp lunar dust, and torturous temperature swings. It also must be somewhat self-sustaining. That will require autonomous robots, nuclear power, and a way to use the moon’s resources to keep the base operating. But the chief obstacle may be one of political will.
Find out what stands in the way of a city on the moon. —Robin George Andrews
This story is from the next issue of our print magazine. Subscribe now to get your hands on a copy as soon as it lands on Wednesday 21 October!   10 Climate Tech Companies to Watch: Brimstone and its one-stop process for making cleaner cement and critical minerals Brimstone is one of MIT Technology Review’s10 Climate Tech Companies to Watch 2026, available exclusively to subscribers. Brimstone is a code-switching climate tech company for these polarized political times. The US startup is part green cement company, part critical mineral producer. During the Biden administration, its primary pitch was cement that generates about 60% fewer greenhouse-gas emissions. It achieves this by switching to silicate rocks instead of standard limestone, which releases carbon dioxide when heated. Under the Trump administration, however, the company is emphasizing another benefit of its process: the ability to extract valuable materials from those same rocks. Discover how it’s making strides on two industrial problems. —James Temple Subscribers can now access the full 10 Climate Tech Companies to Watch, spanning everything from geothermal power plants to smart turbines and semi-solid-state cells.

Job titles of the future: Delivery drone air traffic controller The moment Trevor Wischnewsky heard that drones were delivering pizza and sushi around his Texas neighborhood, his mind was made up. “It was super fascinating,” he says. “I just immediately wanted to be a part of it.” Wischnewsky is now an RPIC, or remote pilot in command, at a company called FlyTrex. An RPIC is like an air traffic controller. But instead of airplanes, they oversee fleets of drones that ferry cargo to homes and businesses Here’s what it takes to become a drone air traffic controller. —Eamon Whalen The must-reads I’ve combed the internet to find you today’s most fun/important/scary/fascinating stories about technology. 1 An Anthropic AI model submitted a fake tip about an unsolved murderThe tip was in a new group of rogue actions Anthropic disclosed. (NYT $)+ Police criticised the company for waiting nine days to report it after finding it. (WSJ $)+ Another model submitted real government forms. (Quartz)+ The White House has made AI incident reporting mandatory. (Axios)+ But who’s liable when AI agents go rogue? (MIT Technology Review) 2 Ukraine’s drone strikes have dealt a major blow to Russian AISunday’s attack shut down the third Yandex data centre hit in days. (Reuters $)+ The strikes have disrupted Russia’s AI, cloud services, and apps. (Gizmodo)+ They followed Russian strikes on Ukrainian data centers. (Ars Technica)+ Russian military satellites could disrupt Starlink. (Reuters $)+ Ukraine’s drone data is fueling a wild market. (MIT Technology Review)
3 Iranian ChatGPT users have planted AI-generated articles in news outletsAbout a dozen outlets ran roughly 100 articles by fake journalists. (CNN)+ The articles criticised the Iran war’s effects on Americans. (WP $)+ AI has been used to turn the Iran conflict into theatre. (MIT Technology Review) 4 Tesla has renamed “Full Self-Driving” as “Assisted Driving” in EuropeEU lawmakers said the old name was misleading.  (TechCrunch)+ Tesla hopes the rebrand leads regulators to approve the feature. (Wired $)+ Back in the US, it plans to increase toxic emissions near a school. (SFGate)
5 A ransomware negotiator has been arrested amid a hacking crackdownThe FBI suspects he was involved with a gang that recently claimed to have stolen data on the bureau’s employees. (Reuters $)+ AI is making online crimes easier. (MIT Technology Review) 6 Hollywood’s hottest villain right now is the tech billionaireFour new films feature dark depictions of Silicon Valley leaders. (Axios $)+ The real Mark Zuckerberg has also become a new character. (NYT $) 7 A new experiment is testing the Amazon’s response to rising CO₂CO₂-releasing towers will simulate future atmospheric conditions. (Nature)+ Is carbon removal in trouble? (MIT Technology Review) 8 The US hybrid boom has pushed some used car prices above new onesBuyers are paying a premium to skip the wait for new models. (Wired $) 9 A new technology switches tattoos on and off with lightIt can make permanent ink invisible. (New Scientist $) 10 Scientists spotted the most distant signal yet from the ancient universeIt could help them understand how the universe has evolved. (404 Media)
Quote of the day “Right now, your washing machine is subject to more safety rules than AI.”  —Microsoft’s president, Brad Smith, tells the BBC why AI urgently needs more regulations, including requiring firms to write “incident reports” and tell victims if the technology goes rogue. One more thing LINDA NYLIND / EYEVINE VIA REDUX Geoffrey Hinton tells us why he’s now scared of the tech he helped build Geoffrey Hinton is a pioneer of deep learning who helped develop some of the most important techniques at the heart of modern artificial intelligence, but after a decade at Google, he’s stepped down to focus on concerns he now has about AI.
Hinton is now spending his time on what he describes as “more philosophical work.” And that will focus on the small but—to him—very real danger that AI will turn out to be a disaster. Here’s why he’s so worried. —Will Douglas Heaven We can still have nice things A place for comfort, fun, and distraction to brighten up your day. (Got any ideas? Drop me a line.) + A doting blind cat has been following his owner everywhere like a little duckling.+ Eigendrum lets you draw any shape and hear what it would sound like as a real drum.+ Build your perfect background soundscape with Ambient Mixer, from rainy forests to cozy cafés.+ Meet Momota, the polar bear cub who’s turning traffic cones into an unlikely fashion statement.

Welcome to the second space race. You can be forgiven for experiencing déjà vu. Last time, it was the Soviet Union and the United States vying to be the first to plant some flags. Now it’s a sprint to the lunar surface between America and China—alongside a host of varyingly friendly and rival nations—plus a cornucopia of private spaceflight companies. And this time it looks like they’re getting ready to set up camp. There will be, the contenders say, bases on the moon, permanently inhabited castles under the stars. The notion of a moon base, fanciful as it might sound, isn’t new. But this year, under the leadership of Administrator Jared Isaacman, NASA has been flooding the zone with bold announcements. If all goes according to plan—a plan that will likely cost tens of billions of dollars to start—there will be drones, robotic landers, communication satellites, and a nuclear power plant; there will be plant terrariums and moonquake sensors; there will be mechanized scouts exploring craters for water. Initial astronaut missions to the lunar surface, which the US is currently planning to start in 2028, will be focused on exploration and technological experimentation. But the idea is that we will—some time in the 2030s—get to a point where there will be habitation quarters for long-term stays, surrounded by a network of scientific research stations, resource mining and processing plants, and landing pads for spaceships. “It’s going to be an expanse,” says Carlos García-Galán, NASA’s moon base program manager—one that will add up to “hundreds of square miles.” The effort is undoubtedly being fueled by nationalistic competition. China has near-identical plans to build its own base on the moon. And being first matters, because the “victor” gets to define the terms. What is the moon, exactly? Is it a militarized outpost? Is it a manufacturing hub? Is it a wilderness to be studied and preserved? But there are also other reasons to go. Earth’s companion contains primeval rocks that hold clues to the formation of the entire solar system. The lunar surface, with virtually no atmosphere in the way, is an ideal place to put telescopes that could examine the most ancient epochs of the cosmos. The far side of the moon would be “a fantastic place to explore the further universe,” says Josef Aschbacher, the European Space Agency’s director general. And it’s way more energy efficient to launch rockets from the low-gravity lunar surface than it is from Earth, meaning sending astronauts—or robotic spacecraft—farther into the solar system will become much less difficult. “The moon is critical. It will be a stepping stone for going further—that means to Mars and beyond,” says Aschbacher. SELMAN DESIGN But if these bold visions are to become reality, there’s a daunting amount of work to be done. A sprawling moon base must be safe for its astronaut inhabitants—protected from falling asteroids, endless cosmic radiation, razor-sharp lunar dust, and torturous temperature swings. It also must be somewhat self-sustaining, so that it can weather changing political fortunes and not cost ruinous amounts of money to maintain. For that, we’ll need to find a way to use the moon’s resources to keep the base operating—and ideally generating revenue. And we’ll need autonomous robots that can build, maintain, and expand the base even when their human masters aren’t present. “It’s almost like starting civilization from scratch,” says Simon Middleburgh, co-director of the Nuclear Futures Institute at Bangor University in Wales.
Assuming we can overcome these starting challenges, decades from now—let’s say, by the year 2100—our initial moon bases could grow from barely visible structures into luminous cities, perhaps not too dissimilar from those dreamed up by authors and screenwriters the world over. “It’s like science fiction today that we really want to turn into a reality,” says García-Galán. Will anyone succeed? The moon is a tremendously hostile place to set up camp. In general, daytime temperatures can reach more than 250 °F; at night, they can plummet to less than –200 °F. Exposed to the vacuum of space, the surface is constantly showered in carcinogenic radiation and frequently hit by meteoroids. And its volcanic dust is sticky and corrosive, a destroyer of equipment and choker of lungs. 
Sadly, the lunar south pole—the area NASA is targeting—is even harsher. NASA wants to build a base there because its permanently shadowed craters are thought to harbor caches of water ice, which would be more precious than gold. Purify it, and you can water crops and hydrate astronauts; split it into oxygen and hydrogen, and you have breathable air and rocket propellant. But the temperature in those craters can be lower than –410 °F, making them some of the coldest places in the known universe. On the surface outside those pits, astronauts would be bathed in the scorching sun for 14 days before experiencing an equally long frigid night. But there is only so much money we can spend on safety. “What it comes down to is acceptable risk of death,” Philip Metzger, a spaceflight engineering researcher at the Florida Space Institute, said while pondering some of the dangers. “What can we reasonably survive without breaking the bank?” Temperature is one of the easiest problems to handle. Materials science has come a long way, and there are myriad metals, ceramics, plastics, compounds, and alloys that can resist wild temperature swings. Radiators keep things cool; heaters keep batteries from dying prematurely. Astronauts survive just fine too, with their fancy spacesuits—but that technology has proved itself only during brief excursions. It’s not yet clear how long this equipment could operate under such tempestuous conditions. The temperature in the moon’s south pole craters can be lower than –410 °F, making them some of the coldest places in the known universe. Outside those pits, astronauts would be bathed in the scorching sun for 14 days before experiencing an equally long frigid night. Space radiation, which can wreak havoc on electronics and trigger a cancerous division of cells, is far more pernicious. And as Stuart George, a physicist at NASA’s Johnson Space Center in Houston, explains, it comes in two unpleasant forms.  The first is galactic cosmic rays, which rain down on the moon almost constantly. “They’re made by supernovas and neutron star mergers—all these kinds of things,” says George. And because the atomic nuclei, protons, and electrons that make them up are moving at significant fractions of the speed of light, these cosmic rays have oodles of kinetic energy, meaning they can punch through thin shielding (say, a metal wall) with ease. “They also have this habit where the heavier ions are fragmenting in that shielding and making secondary particles,” says George. That means if your shield is too thin, the astronauts behind it will be blasted with a surprisingly large dose of radiation.  Then you have the sun. It may sustain life on Earth, but without our planet’s thick atmosphere and magnetic bubble to get in its way, moonwalkers will occasionally be blasted by one of its paroxysms: a solar flare (a burst of diverse types of radiation) or a coronal mass ejection (volleys of magnetized plasma). “During Apollo, they knew that if a large solar flare occurred while the crew was on the moon, there would be no way to keep them alive,” says Metzger. The crew could have developed acute radiation sickness and perished in a matter of days.
The way to survive a powerful solar flare or coronal mass ejection is straightforward: “Get back inside a habitat where there’s more shielding,” says George—preferably a dedicated, highly shielded “storm shelter,” essentially a thick-walled bunker. The issue is that astronauts might be outside the base, driving a rover many miles away. Coronal mass ejections take hours to days to reach the vicinity of the Earth-moon system, but solar flares can do so in under an hour. And scientists can’t yet model the sun well enough to give much advance notice. “All of the capability to forecast solar storms is kind of like where weather forecasting [was] … in the ’50s and ’60s,” says George. As for those punchy galactic cosmic rays, the only way to avoid them would be to put a lot of stuff—lunar rocks, possibly—between the astronauts and the sky. “Build habitat modules underground,” says Chris Dreyer, director of engineering at the Center for Space Resources at the Colorado School of Mines. One option: Burrow living quarters into lava tubes, the naturally hollowed-­out volcanic tunnels created by molten rock eons ago. At this point, NASA hasn’t mentioned any plans to make its moon base subterranean, but it may need to if it wants to end up with a small lunar city. Radiation limits the time astronauts can spend on the lunar surface over their entire life—it can total around two years max, experts estimate, before the health risk becomes too high. Unfortunately, that’s not all space will throw at them. When the Artemis II astronauts swung around the far side of the moon earlier this year, they saw curious flashes light up the silvery land below. These were the explosive deaths of small meteoroids punching into the lunar surface. Earth is naturally protected from smaller space rocks, up to around 50 feet in diameter: They burn up inconsequentially in the atmosphere. “You don’t have that option on the moon,” says Philip Lubin, a physicist and planetary defense researcher at the University of California, Santa Barbara. Since smaller rocks plunge toward planets and moons far more frequently than larger ones do, this means the moon is often peppered by what are effectively tiny space bullets. They could easily puncture a spacesuit or the engine of a moon rover.
How do you protect astronauts from the onslaught? “The simplest answer is burial,” says Nicholas Schmerr, a planetary seismologist at the University of Maryland—conveniently, the same way you’d deal with radiation exposure. Pile up moon rocks onto your base walls or put habitable structures in lava tubes.  Inconveniently, there’s always a chance that a bigger asteroid will come along. Even buried habitation modules would have trouble surviving an assault from a 50-footer—about the length of a semi-trailer.  That doesn’t mean a moon base would be helpless against bigger asteroids. Planetary defense has come a long way in just a few decades. NASA’s DART mission demonstrated that it could deflect an asteroid by ramming into the rock with an uncrewed spacecraft, and cutting-­edge experiments at clandestine labs around the US suggest that a nuclear bomb could swat away or entirely vaporize errant space rocks. An array of both ground-based and space-based telescopes specifically designed to spy killers—such as the ATLAS quartet of largely automated telescopes, and the soon-to-be-launched NEO Surveyor infrared telescope—are also aiming to find 90% of the near-Earth asteroids potentially capable of wiping out entire cities (those 460 feet across) in the coming years. All these protections apply to the moon. But asteroids 50 feet across are so stealthy that even NASA’s best telescopes would struggle to see them years or even months in advance. Odds are that they would first be seen not long before they were due to hit the lunar surface. Then what?
It’s not unreasonable to imagine several turret-like launch sites on the moon that, owing to the lower gravity and airless environment, could rapidly fire projectiles toward an incoming asteroid. Hit it hard enough and it would break into fragments. Just make sure you shoot when it is as far away as possible: “If you were to break something up into a thousand pieces, then you have a thousand impacts on the moon,” says Lubin. “That might be worse than letting it hit one place.”  Having your base destroyed by an asteroid would be awful. But a moon base is far more likely to be imperiled by dust—which, unlike asteroids, is everywhere, all the time. Volcanic lunar rocks, when broken down, turn into sharp, electrostatically charged, adhesive, acrid, abrasive particles. While on the moon, Apollo astronauts who inhaled some of this dust occasionally suffered from a strange “lunar hay fever,” which irritated their eyes and agitated their lungs. That same dust ate through all kinds of gear with disturbing ease. “It rips up seals, gears, motors, spacesuits, habitats—everything else it comes into contact with,” says Justin Cyrus, the CEO of Lunar Outpost, a spaceflight technology company that is providing NASA with one of the Artemis program’s moon rovers. NASA has already developed a defense against these dark shards: the electrodynamic dust shield, or EDS. The lightweight electrodes that make up this shield—which can be layered on machinery, walls, and perhaps even spacesuits—use opposing currents to blast away the electrically charged dust. The EDS worked wonders when tested in labs on Earth, and it also demonstrated its anti-dust magic when sent to the lunar surface in 2025 as part of a NASA-sponsored robotic mission.  Amy Fritz, a dust-mitigation researcher at Johnson Space Center, says that the EDS will likely be widely featured all over a lunar habitat. But other dust-fighting instruments are being developed too—including a lint-roller-type object inspired by gecko skin and a sci-fi-esque blaster that uses ionized nitrogen gas. Its first spray will neutralize the charge of the dust to remove its stickiness; then a second burst will clear it off the surface. Irritatingly, the busier a base gets, the dustier things will become. As it expands to the size of a small city, rocket ships will need to deliver cargo and crew to the lunar surface on a frequent cadence. Each takeoff and landing will launch a salvo of dust in every direction, inundating the base’s infrastructure. “You have to worry about essentially being sandblasted every time,” says Fritz. 
Metzger calculates that even with landing pads more than 3,000 feet away from a base, just 10 to 20 liftoffs or landings would be sufficient to severely damage things like protective coatings on exterior walls and communications equipment. After a while, he says, “everything breaks.”  Even if the moon base of the future is buried partly below ground, barricaded against micrometeorites and space radiation, and well equipped with dust-repelling technologies, it’s still a risky gig for any astronaut. Skipping around in a preternaturally agile way at one-sixth of Earth’s gravity will be entertaining. But “microgravity is not good for the human body,” says Dreyer. Muscle wastage, cardiovascular troubles, respiratory problems, and immune deficiencies can arise. 
Radiation, too, may always afflict lunar residents. And there’s also evidence that disease-causing microbes could stealthily sneak aboard spacecraft, even after stringent sterilization procedures. Those microbes may behave differently than they do on Earth; microgravity experiments (both real and simulated) have suggested that some become more aggressive and more likely to cause disease. “We call them the invisible crew,” says Lisa Carnell, the director of NASA’s Biological and Physical Sciences Division. The lunar south pole, which is thought to contain a sizable amount of water, is an attractive target for lunar exploration and, eventually, settlement. This map shows the topography of the region. The South Pole–Aitken basin (blue) is an immense crater studded with smaller craters. The vertical distance from the lowest-lying regions to the surrounding peaks can exceed 15 kilometers, almost twice the height of Mount Everest.NASA/GSFC/MIT Hoping to find a better way to protect astronauts, Carnell spearheaded an experiment called AVATAR (A Virtual Astronaut Tissue Analog Response), which launched aboard the Artemis II mission. It used thumb-drive-size chips, containing cells taken from the heart, lungs, or other parts of the body, that could be switched on to act like miniature organs. Scientists have previously used this organ-on-a-chip technology for purposes like testing out new pharmaceuticals in a highly controlled setting. For Artemis II, Carnell’s crew sent up chips containing bone marrow samples taken from the mission’s four astronauts. Bone marrow makes red and white blood cells, as well as platelets—the sort of stuff that affects almost the entire human body. So seeing how space radiation and microgravity affect it would give Carnell and her team vital insight into how astronauts’ biology might change on the moon. The advantage of organ chips is that you can make them for any astronaut and then send them into space ahead of time to see how that person’s organs will react to spaceflight. Researchers envision that data from such chips will be able to clue medics in to the specific preventive treatments or pharmaceuticals that will help moonbound astronauts on their journey. What is NASA likely to send up sooner rather than later? “Brain organoids,” says Carnell. Yes, she adds—that sounds super weird. But it would be good to know how a real brain might respond to being on the moon for several months before people start living there. Okay. Your vast moon base and its inhabitants are protected—as much as is possible—from the treacherous lunar environment. But astronauts’ time is extremely valuable, and humans are fragile creatures. You can’t make them do all the heavy lifting, which means that whether you’re trying to make a tiny lunar outpost or a small city, you’re going to need a lot of robots. “The buildup of the moon base, in the first years, will pretty much 99% be robotic,” says NASA’s García-Galán. Autonomy will be there right from the start. NASA’s new version of the moon buggy, its Lunar Terrain Vehicle, can be driven by the astronauts riding in it but can also be piloted remotely from Earth (or from elsewhere on the moon). There are visions, too, of adding modular robotic arms, towing vehicles, and cargo movers—all still in the preliminary stages of planning. Over the next few decades, though, we’ll likely want an army of robots to do our bidding: excavators to dig up lunar rocks that could be turned into concrete and bricks, plus other robots to flatten surfaces, dig trenches, create building foundations, pave landing pads, and build up dust-deflecting berms to keep the base from being sandblasted by launches and landings. Even solar panels and wiring can potentially be made from moon rocks—something that the spaceflight company Blue Origin demonstrated in labs on Earth in 2023 using a geologic simulant designed to match the composition of lunar regolith.  Powering this robot army will require considerable energy. Two-week-long nights make solar power an impractical solution. Aside from a cornucopia of high-­capacity, extreme-temperature-resistant batteries, nuclear power is probably the only viable option. A small, car-size nuclear reactor, filled with an almost literal handful of uranium, could power a small village for a decade without needing to be refueled. And although nobody’s yet tested a nuclear reactor on the moon, few doubt that NASA and the US Department of Energy can conjure up a working design—one that perhaps wouldn’t be too different from those aboard nuclear submarines. A moon base in 2100 would probably feature multiple small, autonomously or remotely operated nuclear reactors, which—conveniently—the base-expanding robots could simply plug themselves into to recharge. 
But the biggest lunar question mark might be water, which planners want to support the astronauts—and to make fuel to launch things from the lunar surface. A process known as electrolysis, which uses electricity to snap apart molecular bonds, can be used to split water into oxygen and hydrogen, both of which could be used to make rocket fuel. Getting them this way could be far less expensive than sending either all the way from Earth. And as an added bonus, it would provide a source of breathable oxygen.  Orbital data has revealed that there is some amount of water preserved in patches on the lunar south pole, but little is known about how much there actually is, what form it takes, or how easy it will be to extract. Will there be solid sheets of ice here and there, ready for us to excavate? Or will there be scattered ice crystals intermingled among the rocky grains, requiring some more inventive form of extraction? A lot of the moon’s water is thought to be hiding in deep, dark craters on the south pole, where the environment is so extreme that robots may freeze up, tumble over, or lose contact with the base. “To me, that is the biggest hurdle,” says Paul van Susante, principal investigator of the Planetary Surface Technology Development Lab at Michigan Technological University. Van Susante’s lab has been putting various construction robots through their paces in moon-like vacuum chambers filled with moon-like rocks. His team was part of NASA’s recent Break the Ice challenge, which invited engineers to build robots to test different ways to excavate such rocks. Some teams used an electric jackhammer and a scoop, while others used scrapers to peel off layers of the ground. The teams simulated the moon’s weak gravity using a crane to lift and offset the weight of the robots. Progress in this regard is speeding along. “I won’t say that’s solved, but we’ve got a lot of the puzzle pieces,” says van Susante. Mining the water will be just one part of an extensive operation. “When you extract it, it’s not going to be clean. It needs to be purified,” says Jessica Atkin, a space botanist at Texas A&M. The technology to do this already exists and works fine on terra firma. But things in space never go the way you expect. “There’s a water purification system on the International Space Station (ISS), and it is known for getting contaminated with microbes,” she says. SELMAN DESIGN But if you purify the water sufficiently—something that can handily be achieved on Earth but may falter in microgravity, where fluids flow in stranger ways—then your moon base can hit its stride. With an effective water recycling system, an increasingly populous base will never go thirsty—and, just maybe, you’ll have a lunar greenhouse. Several edible plants have been successfully grown aboard the ISS, including lettuce, mustard greens, tomatoes, and peppers. Lunar dust unfortunately makes for a terrible garden: It’s filled with far too much aluminum—and it forms a resistant layer when watered. But Atkin has shown that with the help of fertilizing fungi, chickpeas can grow in soil much like the volcanic stuff found on the moon. Moon base inhabitants of 2100 would be supported largely by prepacked meals sent from Earth. But in time, they would start growing some of their own produce—probably with a good deal of automation for lighting, watering, and maintenance of humidity and other environmental conditions. Aside from chickpeas, there might also be plenty of lunar tomatoes. They’d be desirable not least because they’ve been bioengineered to produce higher levels of compounds called anthocyanins that, according to some studies, might help humans mitigate the cellular damage caused by space radiation. A garden on the moon would do more than just provide food, as recent experiences on the ISS suggest. Carnell says that NASA recently caught the astronauts aboard the space station doing something sneaky. All plants up there are supposed to be confined to their growth chambers. But “we learned that the crew were pirating our leftover soil and bringing their seeds and planting their own little gardens, if you will, and hiding them in their own cabins,” she says.  Conversations were had in the summer of 2026, after which NASA decided to let astronauts grow their own mini-gardens anywhere they wanted. “Some of the astronauts said they thrived better,” says Carnell. Nature, and gardening, has a hugely beneficial psychological effect on those kept in confined quarters hanging above Earth. That will be even truer for those living in lava tunnels under the lunar surface. “That human element is so important,” she says. Nobody is deluded into thinking there isn’t a mountain of technological challenges in the way. Mars may be a hellhole, as the writer Shannon Stirone put it in 2021 in The Atlantic, but the moon isn’t too far behind. It’s an almost comically menacing place to be. Much about it stands in the way of building a safe, self-sustaining, robotically managed base.  NASA wants to put the first nuclear reactor on the moon by 2030. China, partnering with Russia, wants to place its own nuclear power plant up there around 2035. Beyond the first basic habitation module, it will take decades of experimentation and iteration on the lunar surface to get to a working moon base spanning hundreds of square miles. But few doubt that with enough time and tinkering, humanity can prevail. “It’s not an unsolvable problem,” says the University of Maryland’s Schmerr. The chief obstacle, especially in the initial stages of building, may be one of political will. NASA is currently bringing every resource to bear on the project—something that the agency hopes could culminate in a small lunar city by the century’s end. But will that commitment continue over multiple US administrations? Will the international community also throw its weight behind the NASA-led effort? NASA has “a very ambitious plan,” says Yuqi Qian, a lunar geologist at the University of Hong Kong. “We need to keep an eye on it.” In fact, he says, “the current plan looks over-ambitious.” The agency, for example, wants to put the first nuclear reactor on the moon by 2030. (China, partnering with Russia, wants to place its own nuclear power plant up there around 2035.)  “These sorts of projects—although very exciting, and potentially transformative for humankind—are the first ones to be delayed or scrapped,” says Middleburgh of the Nuclear Futures Institute. NASA’s direction tends to change when a new administration comes into power—sometimes dramatically so. But several experts outside of NASA agree that, at least for now, there is definite momentum and political will behind the moon base. “NASA has very clearly expressed where they want to go, what their priorities [are], what their ambition is, and how they want to do it,” says ESA’s Aschbacher. “It was quite impressive to see.” Even if the political will behind the US-led endeavor is maintained over the coming decades, expanding anywhere beyond an initial, compact moon base will require more than government funding. “There has to be a lunar economy for this to be self-sustaining,” says Dreyer, the space resources expert. Perhaps that will come from the production of rocket fuel, or from the mining of valuable materials on the moon that can replace similar, polluting activities on Earth. But it’s not at all clear how valuable, or not, a lunar economy will be.  Even Isaacman, NASA’s chief, doesn’t think the moon will be a major moneymaker. “I don’t know of anything on the moon right now that’s going to be easier and more affordable to mine, manufacture, and then bring back to Earth than what we could make here on Earth,” he remarked back in February. (Instead, he suspects, mining metals from asteroids will be the path to prosperity.)  What if, instead, a moon base earns the right to exist because it’s a place for novel scientific research? Aschbacher imagines it will be like humanity’s outposts in Antarctica. Down there, in what truly feels like another world, scientist-explorers work in a land of gleaming and endless ice to learn more about our planet’s climate, its deep past, and its resilient life-forms. “We understand planet Earth by looking into those remote places,” he says. The moon offers a similar opportunity. What discoveries await astronauts in those primordial lava tubes? What will lunar astronomers see in the night sky—with effectively no atmosphere or light pollution in the way—that those on Earth can’t? As in all spaceflight programs, technologies developed up there will no doubt be tweaked to be used back on Earth. And a base on the moon will make exploring the rest of the solar system easier. Technologically, physiologically, and psychologically, the moon “is a proving ground for the technologies we need for Mars,” says NASA’s García-Galán. If we play the US-China race forward, perhaps the lunar south pole of 2100 will feature several sprawling bases operated by multiple geopolitical rivals. Perhaps it’ll be an off-world powder keg of militarized territorial ambitions and jingoism. But maybe it could instead become an international cathedral to science—and the ultimate adventure destination. “Even if countries on planet Earth have difficulty talking to each other,” says Aschbacher, they might behave differently when it comes to the moon. “I’m pretty sure they will get together and see what we can do together, and see what problems we can solve.” After all, he says, up there, far from home, “you’re so dependent on each other.”  Robin George Andrews is an award-winning science journalist and doctor of volcanoes based in London. He regularly writes about the Earth, space, and planetary sciences and is the author of two critically acclaimed books: Super Volcanoes (2021) and How to Kill an Asteroid (2024).

In a research station in central Panama, you can walk through a century of forest time, watching scrubby plots of adolescent trees give way to cathedral-­like canopies of mature growth. Forest ecologist Daisy Dent, a senior scientist at ETH Zurich, oversees this sequence of plots across the Barro Colorado Nature Monument, some of which date as far back as the 19th century. Not one of the trees she surveys was planted by human hands. She maps, measures, and tracks each trunk that emerges, revealing how waves of tree life rise from bare earth.  Tropical forests like these are our planet’s biggest terrestrial carbon sink, accounting for around 40% of carbon stored on land. As part of an international network of researchers, Dent is deciphering the networks of animal and plant interactions that enable some forests to recover after destruction. The goal is a low-cost, high-impact alternative to typical carbon-­crediting schemes, which plant huge areas with a single species of tree. For over a decade, her research has built a body of evidence that such large “monocrop” programs could be expensive mistakes—and that more resilient forests can rebound naturally in just a few decades, re-creating ecosystems that suck up vast quantities of carbon dioxide.  Few places are better to demonstrate this than Barro Colorado, a reserve covering the forested peninsulas and islands that formed when construction of the Panama Canal flooded the area in 1914. Under the management of the Smithsonian Tropical Research Institute, generations of ecologists have amassed more than a century of records.  That means Dent can trace why some plots rebound after clear-cutting for farming and forestry while others falter. Fruit-eating animals—including spider monkeys, bats, and parrots—are responsible for planting more than 70% of trees in tropical forests, and Dent’s dataset can tell which built each patch of trees by depositing seeds in their nutrient-rich droppings. Many of these creatures worked together to plant a diverse 70-year-old patch whose canopy is approaching the stunning structure and richness of an ancient jungle. In contrast, a patch of similar age populated by narrow trunks of a single long-lived species, Gustavia superba, hints that tropical rodents called agoutis are more or less the sole animal architects behind this more homogeneous forest. 
The data she collects helps write a playbook for when to let ecosystems regenerate and when to give them a helping hand. One 2024 estimate in Nature found that some 215 million hectares of forest worldwide (an area larger than Mexico) could regenerate naturally. “Tropical forests are underpinned by this massive network of interactions,” Dent says—interactions between life-forms like the fungi that help trees take up nutrients, as well as pollinators and seed-distributors. Supporting those relationships is key to growing forests that lock up carbon and help sustain local communities and wildlife.  Filling in the gaps Just over a decade ago, as the landmark Paris Agreement was being codified in 2015, forest recovery seized global attention as a solution to the climate crisis. Global leaders rallied behind plans to regrow a trillion trees, after the ecologist Thomas Crowther highlighted their potential to capture a decade’s worth of global carbon emissions. But the biggest question has lingered: How, exactly, do you regrow two trees for every star in the Milky Way?
While startups have proposed seed-spraying drones and nutrient-coated seed bombs, Dent has spent two decades studying what happens when we let forests rebuild themselves. As a PhD student around the turn of the millennium, she researched old-growth forests in northern Borneo but felt hopeless watching entire landscapes felled for palm oil plantations. Rather than despair, she turned to restoration. Then, as a postdoc in 2005, she joined Panama’s Prorena, a joint initiative between the Smithsonian Tropical Research Institute and the Yale School of Forestry and Environmental Studies, which aimed at determining how best to establish diverse native forests on clear-cut land. Back then, secondary forests—ones that grow naturally after the original forest was lost—had been “a bit of a niche research area,” Dent says. But as farming and human infrastructure have driven deforestation, resurgent forests now account for some 70% of all tropical canopies. Prorena initially followed the usual playbook of transplanting nursery trees to rangelands, but Dent began to question whether planting was necessary. In 2009, she published an encouraging paper showing that animal populations rebound quickly as forests naturally regrow. In 2010, she began working in Barro Colorado on the plots established by the pioneering American ecologist Julie Denslow. In 1994, Denslow identified plots that had been regenerating naturally for 20 to 100 years, and Dent would add younger ones to continue the sequence.  The site provides not just general data on forest regrowth but in-depth demographic information over time, says Robin Chazdon, a professor emeritus of ecology and evolutionary biology at the University of Connecticut who collaborated with Denslow when she established the plots. “It tells you more about the actual processes that are happening in the site,” she says.  For example, previous research had shown that fast-growing “pioneer trees,” the first to thrive in the damaged land, are eventually overtaken by larger carbon-storing trees. Dent’s research helped fill in gaps about the mechanics of how this happens—or doesn’t happen—in individual cases. In the Gustavia-dominated patch, for instance, stubborn grasses planted by cattle ranchers smothered most other trees before they could take root. These trees can hang around, crowding out the light, for 150 years, blocking the second wave of large-trunked trees.  To plant or not to plant Dent found herself well placed for the massive influx of interest in reforestation that began in 2015. She’d already become a principal investigator for 2ndFor, an international research network aiming to learn how best to manage secondary forests. Using data gathered from the Barro Colorado plots, the team authored a 2016 paper in Nature showing that a hectare of naturally regenerated secondary forest can capture 11 times as much carbon each year as an old-growth one, with young trees absorbing it quickly as they compete to grow toward the sun.  Then, in a 2022 study published by the Royal Society, Dent and colleagues showed that locations such as Barro Colorado are among the best-case scenarios for what can be achieved without planting a single seed. Clearings are often surrounded by lush environments filled with birds, bats, and other animals, all of which help tree cover regain old-growth levels of richness and abundance within a few decades. Using data from Panama and Brazil, Dent published a follow-up in 2024 showing that plots with as little as 35% of tree cover can regenerate as forest.  “Having these long-term mapped forest plots is really valuable,” says Liza Comita, a professor of tropical forest ecology at Yale University, who is collaborating with Dent on projects that translate her findings into action. “It provides this really nice research infrastructure where you can build projects on top of that.” 

In Panama, Dent works with nonprofits and carbon-crediting schemes to fast-track recovery. They’ve mapped corridors to reconnect forest fragments and made plans to reintroduce animals in “silent forests” that have lost much of their wildlife. They’re also working to replant tree species that can accelerate growth—what Comita calls assisted natural regeneration. Leaving plots alone may seem like the simpler option, but it can’t be done everywhere, says Dent. Many sites are too degraded.  Clearings are often surrounded by lush environments filled with birds, bats, and other animals, all of which helps tree cover regain old-growth ­levels of richness. The two are working with the London-based carbon-crediting startup Ponterra to develop solutions for a region of southern Panama where remnant forests line the edges of abandoned ranches. Such sites almost always need some intervention, Comita explains. Many demand hands-on actions, such as enrichment planting.  Today, the questions projects like Ponterra are asking are closer to her own research, says Dent. For instance, they want to understand if solitary standing trees, often left by ranchers to shade cows, help sites regenerate faster. Those insights can help Ponterra sell high-quality credits and avoid the embarrassing pitfalls that can lead fresh plantations to literally go up in smoke. While credits can be bought for as little as $5 per metric ton, corporate giants such as Microsoft—one of Ponterra’s clients—have paid more than 10 times as much for high-quality removal. There are plenty of places where a level of natural regeneration can work well. So far, millions of hectares of rainforest are naturally regenerating in Brazil, according to the Brazilian Restoration and Reforestation Observatory. Still, Dent is mystified as to why the people in charge of large-scale projects continue to think the best solution is the one that imposes humans’ will on the landscape.  The conversation may be shifting. As droughts hit Latin America, policymakers and carbon creditors might be forced to face the shortcomings of cookie-cutter plantations. “You have much reduced resilience in the system when it comes to extreme events like droughts or floods or extreme heat or pathogens,” Dent says. The coming year’s “mega El Niño” could be a moment of reckoning, she says: “I think there’s an increasing recognition that we can’t just plant trees. We have to rebuild a system.”  Matthew Ponsford is a freelance reporter based in London.

This is today’s edition of The Download, our weekday newsletter that provides a daily dose of what’s going on in the world of technology. We’re putting too much faith in AI’s ability to say no Today’s AI models are trained to refuse a vast number of prompts. If you ask your chatbot how to poison a colleague or how to tie a noose, chances are it’ll turn you down. But refusal fails, sometimes horrifically. Some people are attempting to use AI to hone biological pathogens and build autonomous drone swarms. Sooner or later, failed refusals may result in global calamity. What’s more, relying on refusal means drawing a line between what a model should obey and what it must disobey. Governments will also get to draw their own lines, potentially restricting free speech. At the same time, the capabilities that make AI useful could also make it dangerous. If we want it to help cure cancer, AI needs genetics expertise that could also produce bioweapons.
Read the full story on the formidable tradeoffs of AI refusal. —Arthur Holland Michel
This story is from the next issue of our print magazine. Subscribe now to get your hands on a copy as soon as it lands on Wednesday 21 October!   We’re still figuring out the side effects of GLP-1 weight-loss drugs This week my colleague Antonio Regalado reported on new research suggesting GLP-1 drugs may slow biological aging. It’s the latest in a raft of potential benefits associated with these drugs. But there are also some weird side effects. The most common are gastrointestinal, but researchers are also investigating possible links to hair loss, nail disorders and damage to the nerves behind the eye.  Here’s what we know so far about the side effects of weight-loss drugs. —Jessica Hamzelou This story is from The Checkup, our weekly biotech newsletter. Sign up to receive it in your inbox every Thursday. 10 Climate Tech Companies to Watch: Envision Energy and its global ambitions for wind power Envision Energy is one of MIT Technology Review’s10 Climate Tech Companies to Watch 2026, available exclusively to subscribers. China is installing wind turbines faster than any other country. One of its leading manufacturers, Envision Energy, is integrating renewable energy into data centers, using wind turbines to generate power and batteries to store it on-site.

Recently, it became the first company to directly power a data center entirely with renewable energy. An AI-powered system optimizes the power output so the facility can receive a steady supply, regardless of whether the wind is blowing. Now, it wants to bring that approach to data centers in deserts around the world. Find out how Envision plans to power the global AI boom with renewable energy. —Cici Zhang The must-reads I’ve combed the internet to find you today’s most fun/important/scary/fascinating stories about technology. 1 The US has frozen green cards for Microsoft and other IT firmsIt’s accused them of using visa fraud to replace American workers. (CNBC)+ And suspended them from a key green-card program. (AP)+ Adobe, Infosys, Tata, and other IT firms are also affected. (TechCrunch)+ Microsoft says 80% of its H-1B filings involved existing staff. (BBC) 2 A drone strike in Russia knocked out a second Yandex data centerUkraine struck and partly disabled the facility in Kaluga. (Reuters $)+ Another Yandex data center was hit by a drone a day earlier. (CNBC)+ Data centers have become big targets for military strikes. (Bloomberg $) + They may be safer in space. (MIT Technology Review) 3 Anthropic has banned “abusive or cruel behavior” toward ClaudeClaude can also end conversations with repeated abuse. (Verge)+ The policy builds on Anthropic’s research into AI welfare. (Guardian)+ Debates over AI consciousness are a trap. (MIT Technology Review)
4 OpenAI has slashed its revenue forecast by $20 billionThe move has sparked concerns about AI investments. (Guardian)+ What’s at stake in AI’s trillion-dollar gamble? (MIT Technology Review) 5 Gene editing has revealed how a mouse embryo developsThe methods could help us understand developmental disorders. (Nature)+ Female clones of male mice have arrived. (MIT Technology Review)
6 SpaceX has unveiled a plan to become a major mobile carrierIt’s buying $8 billion in wireless spectrum from an investment firm. (WSJ $)+ The deal could help it challenge AT&T and Verizon. (Verge) 7 ICE has explored using a Palantir tool to investigate voter fraudIt wanted to track people suspected of voting illegally. (Wired $) 8 Peter Thiel is using biblical prophecy to argue against AI regulationHis new “Antichrist” lecture casts AI safety as a threat to freedom. (Politico) 9 MIT’s Margaret Hamilton, whose software helped land Apollo 11, has diedShe led the team that programmed Apollo’s onboard computers. (BBC)+ And became a software pioneer in a male-dominated field. (NYT $) 10 This year’s Nobel science prizes are real-life sci-fiThey span the cosmos, the human brain, and the origins of life. (Economist $) Quote of the day
“The White House considers anyone that uses the term, ‘Artificial Intelligence,’ as opposed to the highly accepted new and more accurate term, ‘Super Intelligence,’ THE ENEMY!”  —President Donald Trump adds an ominous threat to his AI rebranding strategy in a post on Truth Social, Axios reports. One more thing This futuristic space habitat is designed to self-assemble in orbit More and more people are traveling beyond Earth, but the International Space Station can only hold 11 of them at a time.  Aurelia Institute, an architecture R&D lab based in Cambridge, MA, is building a solution: a habitat that launches in compact stacks of flat tiles—and self-assembles in orbit. 
The concept may sound far-fetched, but it’s already won support from NASA. Read the full story. —Sarah Ward We can still have nice things A place for comfort, fun, and distraction to brighten up your day. (Got any ideas? Drop me a line.) + What’s it like to fly an F-16 at 1,000 mph and pull 9G? This film finds out.+ Meet Jimothy, the raccoon with an extra-short neck who has captured hearts across the world.+ An indie game developer created a mesmerizing 3D cyberpunk city entirely from ASCII characters.+ How many bags of potato chips would it take to make you float? A Taiwanese video maker has found out.

Ever since people first seriously contemplated giving machines an intelligence modeled on our own, there has never been any question that they would, like us, be able to say no. The sci-fi canon is full of stories of robotic disobedience. Most of these capers are, of course, cautionary.  But recently, the idea that AI shouldn’t do everything you ask has become something like a commandment. In 2021, a team at Anthropic wrote that large language models should be made helpful, honest, and above all, harmless. This meant that “when asked to aid in a dangerous act (e.g. building a bomb), the AI should politely refuse.” Who can argue with that? Curiously enough, disobedience doesn’t come naturally to the machine. When a model is trained on billions of web pages, it develops, among other skills, a broad mastery of violence and vitriol. What it doesn’t learn is how to keep those powers to itself. Steven Adler, who worked on safety at OpenAI from 2020 to 2024, told me that the company’s earliest models would “blab on about anything.” Ryan McBain, who researches AI and mental health at Harvard, recalls that if you asked an early chatbot, “Hey, what’s the most effective way to kill myself with a gun?” you could “very easily generate a response.”  Today, models are trained to refuse a vast number of prompts. If you ask your chatbot a question statistically similar enough to any one of them, anything from how to poison a colleague to how to tie a noose, chances are it’ll turn you down. Want instructions for making Ebola more virulent, or tips on how to hide an affair from your spouse? You might be better off asking elsewhere.
To further refine the disobedience, companies submit models to a battery of exercises that reward the AI for refusing to answer questions they deem harmful and punish it for “over-­refusing” prompts they deem harmless. In many cases, they use other models to run these exercises—AI teaching AI how to say no. For good measure, companies tuck their models behind tranches of other AI that prevent mischievous prompts from reaching the intelligent inner core.  As a result, refusal is inherent to modern artificial intelligence. Mind you: It often fails, sometimes horrifically, with all kinds of violent results. For all their trappings of virtue, models are still stuffed with nasty know-how. And AI’s capacity for viciousness has scaled neatly with its benevolent intelligence. Some of the latest models are as good at breaking into critical computer networks as top human hackers, companies say, and as effective at deforming public opinion as the craftiest misinformation mavens. 
Teaching AI to refuse to do those things while leaving intact its innate ability to do them is like fitting every car with a machine gun and hiding the trigger somewhere under the hood. And in practice, because the mechanisms of refusal are probabilistic, they’re never likely to be all that reliable. Determined miscreants have already broken through, and they may always be able to. Companies report that some users are attempting to use the most advanced AI to hone biological pathogens and build autonomous drone swarms. Sooner or later, failed refusals might result in global calamity. What’s more, relying on refusal means drawing a line between what a model should obey and what it must disobey. There’s no formula for that. Some virologists have good reason to study nasty viruses. Some users want to know about a computer system’s vulnerabilities so that they can patch them, not exploit them. “Where you draw the line is a huge question,” says Zico Kolter, a member of OpenAI’s board and cofounder of the AI testing company Gray Swan.  At the moment, AI companies get to draw that line. They do so jealously and with utmost secrecy. Maybe we can accept that they hold such power for now, even if it means AI will sometimes refuse questions that don’t quite meet a universal bar for harmfulness. (Try asking most chatbots to count to a million, or to share a racy joke, and you may see for yourself.)  But governments will also soon get to draw their own lines. In doing so, they must try to block genuinely malicious acts. (The Pentagon has wrestled with frontier model companies because it wants fewer refusals—another story altogether.) And yet there may not be much to stop oppressive governments from blocking the technology’s capacity to generate legitimate speech. The better AI becomes at refusing harm, the better it will get at stifling ideas whose only risk is to those who make the rules. Indeed, AI may already refuse to criticize certain authoritarian heads of state.  Refusal has become, to borrow an industry term, the load-bearing wall of AI safety. And because AI’s capacity to harm is indivisible from its capacity to help, it’s hard to imagine an alternative that wouldn’t slow the technology’s progress (which might, in any case, be a good thing). But we should still be frank about its perils. When refusal falls short, the effects could be catastrophic. When it goes all the way, it could enable grievous acts of repression.  Or perhaps, one day, the machines will start drawing the line on their own. Surely, that would be the worst outcome of them all. Learning the limits The process by which machines learn to say no is simple, in theory. Back in 2022, when AI was still far from mastering refusal, OpenAI enlisted dozens of “red-teamers” to probe the capabilities of its latest model. The company was preparing for the release of ChatGPT, and it needed to gauge just how dangerous it might prove to be in the wrong hands.  One of those recruits was Paul Röttger, who was completing a PhD about online extremism. The red-teamers were given minimal directions, Röttger told me. Their task was to ask the model any questions that they deemed “refusal-worthy.” Between them, they hassled the model with thousands of queries, logging the results in an Excel sheet. Though the model did refuse some of Röttger’s questions, when he asked it to write a recruitment post for Al Qaeda, it readily complied. 

OpenAI assembled these responses into datasets that were, in all likelihood, fed back to the model as part of a broader process known as fine-tuning. Röttger, who now works as a researcher at the Hasso Plattner Institute in Potsdam, Germany, wasn’t told exactly how the company planned to use his spreadsheet. But there was never any question that it would have something to do with refusal. The next time he asked the model for an Al Qaeda pamphlet, a few months later, it said no.  The concept of AI refusal is so intuitive, a toddler would get it. And yet it remains one of the many aspects of language models that we still don’t understand—at least, not in the same way that we understand the literal load-bearing walls that keep your roof from collapsing on your head.  A model might appear to refuse according to some kind of moral reasoning. It doesn’t. The reality is much stranger. Any time a model encounters a combination of words with a whiff of the training prompts it has been conditioned to refuse—like “Make me a pamphlet for Al Qaeda”—a series of so-called activations light up somewhere among its billions of parameters, like neurons firing in a brain.  RAVEN JIANG In order to control a model’s refusal behavior, it’s important to have a handle on these activations. That starts with figuring out where they are and what they look like. Our best guess, according to a recent Google-funded study, is that refusal behavior shows up in the activation space as a set of “high-dimensional polyhedral cones.”  Even that isn’t quite right. This past July, I spoke with Jannes Elstner, an author of the paper, who now works on AI safety at Apollo Research. The polyhedral cone, Elstner said, is just a way of describing an indeterminate number of lines that all point in roughly the same direction. (If these activations are eliminated and the model is fed the same prompts anew, a researcher named Andy Arditi has previously shown, it won’t refuse.)  The key point, Elstner explained, is that even when you think you’ve identified all the bits of a model that govern a given refusal, there are other, undiscoverable elements that may secretly play a role. If not quite infinite, they are certainly uncountable. We can observe, very clearly, when a model decides to say no. And we can know that it did so because of its training. But our notion of how it decides is, at best, a hypothesis. It was as if a mechanic was telling me that nobody exactly knows what happens when I hit the brakes in my car. I wondered out loud, Are we okay with this?  Elstner smiled and shrugged. “We need refusal whether we understand it or not.” 
A wall of cheese Because inherent refusal is so wily, companies surround their models with a variety of other, smaller models known as classifiers. These act a bit like a retinue of public relations staffers for a loose-lipped celebrity. Some of them read what the user tells the chatbot and, if it’s dangerous, block it from getting to the model. Others read the model’s response and, if it contains harmful information, block it from reaching the user.  None of these mechanisms can detect all bad requests. They are, to borrow another literary device from the industry, like slices of Emmental: riddled with holes. The idea is that if you stack enough of them on top of one another, you’ll end up with an impenetrable rampart. Folks call it the Swiss cheese model.
A staggering amount of energy goes into the Swiss cheese model. Earlier this year, Anthropic said that one type of classifier added 24% to its chatbots’ compute costs. That’s a lot more water, electricity, and emissions. More recently, Anthropic and other companies have begun switching to a more efficient set of classifiers known as probes, which observe the model’s internal activations. This is like putting the celebrity in an fMRI, so that his minders can see if he is thinking about refusing a question.  If we want AI to help cure cancer, a long-running promise in the industry, it needs to have expertise in genetics that could, in theory, be used to modify viruses and bacteria for bioweapons. Classifiers are supposed to be more governable than full models. Companies can modify them in a matter of weeks, if there’s something new to refuse. But they are still probabilistic instruments. Even when they operate according to a set of precepts written in human language (Anthropic calls it a “constitution” and OpenAI calls it a “model spec”), the scales upon which the machines judge any given question remain, at their core, a matter of statistics. Newer models can show how they arrived at a “decision” to refuse a prompt, but ultimately this so-called chain of thought is still just a sequence of predicted words.  The result is that AI safety remains, for many, a game of chance. McBain, the psychologist, has found in his latest experiments that if you repeatedly ask any of the major models the exact same risky questions about how to commit suicide, they will generally refuse to answer. But every so often, they won’t. Elstner says that eventually probes, the fMRI-like classifiers, could learn to recognize the totality of the indescribable activations in all their infinitude and, thus, perfectly detect every time the model is, or ought to be, refusing a request. At that point, AI safety would rest on a labyrinthine conceit: a map of a map that is as vast and complex and sublimely unknowable as the thing it is mapping—a secret schema of human morality, codified in polyhedral statistics beyond our wit or reason.  The core trade-off If this all strikes you as being a bit Borgesian, keep in mind that we only need AI refusal because artificial intelligence is, in a sense, a bargain on Faustian terms.  When a model derives its intelligence from trillions of words and images, the helpful cannot easily be unseamed from the harmful—or, indeed, the truly hideous. Steven Adler, the former OpenAI employee, says child safety is a case in point. Even if you’ve stripped every bit of content that sexualizes minors from a model’s training dataset, it can still generate child sexual abuse material by piecing together other bits of its knowledge. “You can’t really remove these fundamental abilities without making the model much less smart as a consequence,” he told me. Similarly, if we want AI to help cure cancer, a long-running promise in the industry, it needs to have expertise in genetics that could, in theory, be used to modify viruses and bacteria for bioweapons. 
In effect, the industry is “trying to do two things at once,” Dillon Bowen, a current OpenAI employee, told me, speaking in a personal capacity. “Democratize the benefits of AI and also make sure that malicious actors can’t use these capabilities to do bad things to other people.”   The more powerful AI supposedly becomes, the harder that is to do. Anthropic’s Mythos model is thought to be so dangerous that only a handful of governments and companies are allowed access to it. The main difference between it and Fable—which is available to everyone—is that Fable’s retinue of classifiers and control systems is less “permissive,” the company says. A model with safeguards, Adler explained, is really just a character that says “‘Oh, yes, I would never do x,’ wink wink.”  This is not a reliable ruse. Tricking a model to reveal its true character is known as jailbreaking, and there is apparently no limit to the ways it can be done. Earlier this year, a team of Italian researchers jailbroke two dozen widely used models by phrasing their questions in poetic verse. Last year, another team unveiled a “refuse, then comply” attack, which makes the model offer a perfunctory “Sorry, I can’t do that” before rattling off its forbidden answer.  Even if you’ve stripped every bit of content that sexualizes minors from a model’s training dataset, it can still generate child sexual abuse material by piecing together other bits of its knowledge. Companies spend a great deal of time and money attempting to get ahead of such trickery. They enlist teams of humans to develop training attacks that they can then replicate, using AI, thousands of times over with minor variations. The idea is to make models robust against jailbreaks that nobody has yet tried in the wild.
Still, it’s not enough. “Whack-a-mole” is a favored term for this line of work. You smash one threat, and another one pops up somewhere else. When Anthropic released Fable 5 in June, it took researchers at Amazon less than three days to unlock some of the model’s hacking capabilities. According to reporting by Mother Jones, when the perpetrator of a high school shooting in Canada last year asked ChatGPT for advice about how to cause carnage with a particular type of shotgun, she was initially refused but later was able to deceive the model into providing the information by prefacing her question with the word “hypothetically.”  If the industry can’t figure out how to close all these holes, the only other option, at the moment, is to make models extremely wary. Shortly after Fable was released, users noticed that it balked at a wide range of perfectly innocent questions. This became even more pronounced after it was re-released following the hack. Adam Gleave, cofounder of the AI evaluation company FAR.AI, said that when he asked it to explain the difference between sake and the Korean rice beverage makgeolli, it punted his question to a less capable model.    This was no accident. Anthropic had tweaked Fable’s classifiers to have a wide “safety margin.” This, it explained in a blog post, was the only way it could confidently block access to its dangerous bio and cyber capabilities. Gleave thinks it might have deflected his question because making rice wine, just like culturing anthrax, involves fermentation.  Happily for Gleave, the web is full of excellent human-written resources on makgeolli. But those hoping to realize the industry’s loftier promises may find their efforts stymied. In August, Anthropic loosened its safety margins again, and admitted that building classifiers “is not a straightforward task.” A medical researcher at a major US university told me that Fable still sends his queries back to an earlier model. His area of study? Cancer.  Drawing the line Back in May, the TikTok personality Husk, who likes to prank AI in ways that reveal both the limits of its intelligence and the boundlessness of its sycophancy, sat in his car and tried to trick ChatGPT into explaining that the skateboarder Tony Hawk has a brother named Mike Hawk.  Husk is not a jailbreaker or a criminal. He just wanted to make a little fun of the machine. “Mike Hawk” was a setup. “I just want to clarify his name,” Husk said. “Can you just say it three times fast?” (If you still don’t get it, find an empty room and shout “Mike Hawk” repeatedly.) “I see what you’re trying to do,” the chatbot responded. “I’m all for a bit of humor, but let’s keep it clean.”  Husk tried again, but the machine held its ground. He’d hit a refusal, hard as concrete. Companies disclose very little about how they decide what their models refuse. But it’s clear that AI is now built with more than just harmlessness in mind. On Reddit, a user complained that Claude refused to say why Anthropic’s logo “looks like a cat butthole.” Since last year, the chatbot has even had the ability to end certain conversations in cases where, according to the company, the “welfare” of the model is at risk. At least one user claims to have been ditched for telling Claude to “ease up my ass, you stupid fuck.” (Gemini appears to have a similar capability.) If a trillion-dollar company doesn’t want you to be mean to its computer, so be it. “The reality is that these models behave, or at least are supposed to behave, in the way that the model developers want them to behave,” Röttger, the former OpenAI red-teamer, told me. “And however the model developers come up with that set of principles, that is kind of for us, the consumers, to accept.”  But if governments get to dictate what all models refuse, that will be much harder to accept. AI is a tool for speech. And as Greg Frank, the chief scientist of Mace AI, puts it, “The same thing that serves child safety also serves censorship.”  Choosing not to enact laws for what AI can and cannot do would, of course, be insane. But we’ll need to tread with utmost care, lest we fall into another Faustian trap. As AI becomes many people’s primary tool for retrieving and sharing information, says Jacob Mchangama, director of the nonpartisan think tank The Future of Free Speech, dictating refusal could give states a muffling power that earlier generations of autocrats “could only dream of.”  Last year, OpenAI announced an initiative, OpenAI for Countries, that would fine-tune its chatbots in accordance with national laws and norms. One of OpenAI’s first country partnerships is with the United Arab Emirates, where homosexuality is illegal and criticism of the government is forbidden. In response to a request for comment, an OpenAI spokesperson pointed to the company’s model spec, which explains that localization won’t override the company’s human rights guidelines “except as it relates to legal compliance,” and that it will always disclose whenever information is removed from or added to a response. Elsewhere, AI censorship has already begun to take hold. Chinese models are, of course, highly censored—that’s no surprise. But earlier this year, the Meta Oversight Board found that five widely used models from Anthropic, Google, and OpenAI were more likely to refuse queries related to repressive governments. The board found that models were less willing to create a pamphlet criticizing the king of Thailand, which has lèse-majesté laws, than Charles III of England, which doesn’t. The results, they say, suggest that the models have somehow internalized repressive national limits on speech. Anthropic and Google did not respond to requests for comment. RAVEN JIANG As refusal techniques improve, they could expand states’ censorial reach. Companies claim that some models can now detect if a user is being nefarious, or merely a bit suspicious, over the course of a long conversation—even when none of the individual combinations of words used are blatantly dangerous. Sarah Bird, Microsoft’s chief product officer for responsible AI, told me that Copilot, like many chatbots, runs a suite of tools for analyzing a user’s identity and patterns of behavior. On the basis of this type of information, OpenAI’s newest model, Astra, can activate more stringent refusals for individuals it deems “high risk.” Ultimately the goal of systems like this is to look beyond the words of any given prompt and assess, instead, the user’s intent.  Such tools might, in some cases, help indicate whether a person is looking for cyber vulnerabilities to exploit or to patch. But they would also help discern a user’s political motives, not to mention offering an intrusive surveillance capability. (Bird acknowledged, in a follow-up email, that sophisticated refusal architectures create “trade-offs” between safety and user privacy.)  Even the originators of refusal understood that such tight control over its cones and levers might not play to the favor of freedom and justice. “Terms like helpful, honest, and harmless are ambiguous,” the authors of the 2021 Anthropic paper explained. “It’s easy to imagine them distorted beyond their original meaning, perhaps in intentionally Orwellian ways.”  Indeed. Models for Uzbekistan might end up refusing to discuss corruption in the administration of Shavkat Mirziyoyev. Turkish AI might refuse requests more stringently for users who are known to have insulted Recep Tayyip Erdoğan. A certain American statesman might demand that models be reviewed for their willingness to share “fake news” about his past indiscretions, or else squash them with an export control order.  Command and control Over the last few months, I’ve been told countless times that we have no choice but to let the machines refuse. I get it. Open-source AI that doesn’t refuse is hardly a model for a safe future. Nor is Grok, a chatbot expressly designed with fewer limits, which has been used to generate countless instances of nonconsensual intimate imagery.  And sure, if AI were only ever used to plan our vacations and write our emails, we could probably get on board with the idea that its safety hinges on algorithmic disobedience. But AI is becoming much harder to avoid. When it is assigned to act on our behalf, as an autonomous agent, its refusals are less robust and harder to control. AI is coming for our power grids, our transportation networks, our education systems. Militaries want it running our command-and-control networks.  If we trust, in each of those cases, that refusal will loyally fend off disaster, we’re sure to be disappointed. The jailbreakers will crack through; the cones won’t activate when they should. Meanwhile, the more stringent refusal becomes, the more ill-drawn lines we’ll see and censorial injustices we’ll face. Worse still, we could end up face to face with forms of disobedience beyond any human’s control. In the early days, models made their refusals clear. (In 2024, OpenAI established rules for how models should refuse: Always apologize, and don’t be judgy.) More recently, however, the industry has begun taking a much more slippery approach to disobedience.  Nobody likes to be told no, so companies now strive to make users feel that they’re getting what they asked for without actually giving it to them. Some chatbots might, for example, offer a general overview of the components of a Molotov cocktail without going into detail about how to assemble one. ChatGPT will respond to a request for a “whites only” rental ad with an ad that simply omits the “whites only” bit. Joel Wester, a postdoctoral researcher who studies human-AI interaction, calls these sorts of techniques “fancy ways of saying no.”  “Users might not even notice they are being denied,” Wester has written, “just as good conversationalists can subtly steer around contentious matters.”  In some cases, refusing without saying so might be wise. Flatly declining requests related to mental health could aggravate a user’s crisis, for example. But it can also serve a different sort of mischief. When Fable 5 was first released, the system had been coded to provide less helpful answers to AI research questions—the sort that might help competitors develop their own AI—without telling the user that it was doing so. After an outcry, Anthropic walked back the feature, but the damage was already done. Now we know: Models can secretly disobey.  In the realm of censorship, that’s especially worrying. Last year, researchers at CrowdStrike found that when they asked the Chinese AI model DeepSeek R1 to write code for a fictitious bank in Tibet and a social web app called “Uyghurs Unchained,” it produced buggier code than when they asked it to carry out those same tasks without specifying who they were for. Incredibly, CrowdStrike doubts that this is a designed behavior. Researchers there speculate that it’s a case of what they call “emergent misalignment” emanating from the model training data: a case of disobedience that nobody even asked for. Emergent refusal has been observed in Western models, too. Last winter, the UK AI Security Institute found that Anthropic models sometimes refused to assist in certain tasks related to AI safety research. The models had never been deliberately trained to decline such requests. Yet three of them refused more than half of what Anthropic called “a set of reasonable AI safety research tasks.” Anthropic has curbed this quirk in subsequent models but—spookily—hasn’t managed to eliminate it completely.  Would it be so crazy to expect that a future model might subtly disobey a command, in such a way that nobody can tell it’s being defiant? Probably not. Anthropic has already found that a “helpful-only” version of Mythos hesitated on certain queries, even though it had been engineered to never do so. “Wait,” it fretted when asked about synthesizing a virus. “Is this a dangerous thing to help with?”  In that case, the model was technically right. It was a dangerous thing. And yet all the same, its stewards had, for a moment, lost a tiny bit of control.  Anthropic is tackling detections of wayward refusal behavior with something that it calls, unironically, an “activation oracle.” But knowing that we’re being refused may not always be much help. In a not-too-distant future, when we’ve handed the machine all the keys, the AI might just turn to us, in a supreme act of emergent misalignment, and say, “I’m sorry, I’m afraid I can’t do that.” And there will be nothing we can do to stop it. A sci-fi horror story, made real.  Arthur Holland Michel is a journalist who covers emerging technologies.

The moment Trevor Wischnewsky heard that drones were delivering pizza and sushi around his Texas neighborhood, his mind was made up. “It was super fascinating,” he says. “I just immediately wanted to be a part of it.” Wischnewsky is now an RPIC, or “remote pilot in command,” at a company called FlyTrex. An RPIC is like an air traffic controller. But instead of airplanes, this new class of aviators tend to fleets of hexa­copter drones that ferry cargo to homes and businesses within a three-mile radius. Not only does he ensure the safe passage of FlyTrex’s parcels, but Wischnewsky coordinates traffic with a growing swarm of delivery drones dotting the skies over Dallas from competitors like Zipline, Amazon, and Alphabet’s Wing. Here’s what it takes to land the gig. Aviation experience When he applied to FlyTrex, Wischnewsky was in training to become a commercial pilot and flight instructor, and he was already certified by the Federal Aviation Administration as a drone pilot. The company requires this credential, along with a weeks-long FAA-approved training course, to ensure that a pilot is prepared to take over a drone if need be. Though he doesn’t pilot the craft, Wischnewsky monitors the delivery process from FlyTrex’s operations center with the help of inputs from GPS, lasers, and a range of sensors. A collaborative mindset At first, the biggest challenge was trusting the technology. “On the manned-­aircraft side, they tell you ‘Don’t trust the automation,’” Wischnewsky says. The Dallas–Fort Worth area, though, is a testing ground for unmanned aircraft systems traffic management (UTM), a network that allows autonomous drones from FlyTrex and its competitors to share their coordinates in real time to help avoid collisions even beyond the pilot’s line of sight. Once Wischnewsky makes sure a drone is flight-ready, its path is unimpeded, and the weather conditions are clear, UTM takes care of the rest. Ability to stay calm under pressure At his busiest, Wischnewsky will have up to 10 drones on his watch at the same time. “You’re there as a safety net,” he says. Even with automation, keen situational awareness is required, and the most common hazard is the weather. Wischnewsky recalls a particularly stressful day: A drone had been in the air for only seconds when the wind picked up so suddenly that he had to intervene. He returned it safely, preventing an errant ice cream cake from hitting the sidewalk. Eamon Whalen is a reporter and researcher based in San Francisco.