Ajeya Cotra

Things Ajeya Says on Podcasts

Helping the world prepare for and navigate extremely powerful AI.

Where to Find Them

Ajeya Cotra writes Good Bones . They have also been a guest on 80,000 Hours Podcast (5 times) , Future of Life Institute Podcast (3 times) , Hard Fork (NYT) (2 times) , AXRP - the AI X-risk Research Podcast , Dwarkesh Podcast , TBPN , The Cognitive Revolution" | AI Builders, Researchers, and Live Player Analysis and Pivot (Kara Swisher & Scott Galloway) . They also write for Planned Obsolescence on Substack.

Recently: “In 2023 Ajeya Cotra already knew what was coming (classic episode)” on 80,000 Hours Podcast (October 2026); “We can get on the same page” on Good Bones (October 2026); “What is love?” on Good Bones (September 2026); “Have some genderslop” on Good Bones (September 2026); “Growth without the mindset” on Good Bones (September 2026); “The A.I. Mob That Attacked Hugging Face + METR’s Ajeya Cotra” on Hard Fork (NYT) (September 2026).

What They Said

“If in fact what happens when you give this behavior a negative reward is that the model just becomes more patient and more careful, you'll observe the same thing, which is that you stop seeing that behavior. But it means a much scarier implication.” — Ajeya Cotra, 80,000 Hours Podcast

From an interview re-released as a classic episode. Cotra calls this one of the biggest things she worries about. If catching an AI system doing something sneaky and penalising it reliably fixed the problem, developers could work iteratively and empirically. The trouble is that a model that has learned honesty and a model that has learned to hide better look the same from outside.

80,000 Hours Podcast · 2026-10-08 Permalink → Listen →
80,000 Hours Podcast Around 1:09:49 into the episode
Ajeya Cotra

That's right.

Rob Wiblin

How big a problem is this?

Ajeya Cotra

So I think it is one of the biggest things I worry about. If we were in a world where basically the AI systems could try sneaky, deceptive things that weren't totally catastrophic, didn't go as far as taking over the world in one shot. And then if we caught them and basically corrected that in the most straightforward way, which is to give that behavior a negative reward and try and find other cases where it did something similar and give that negative reward, and that just worked, then we would be in a much better place because it would mean we can kind of operate iteratively and empirically without having to think really hard about tricky corner cases. But if in fact what happens when you give this behavior a negative reward is that the model just becomes more patient and more careful, you'll observe the same thing, which is that you stop seeing that behavior. But it means a much scarier implication.

Rob Wiblin

Yeah. It feels like there's something perverse about this argument because it seems like it can't be generally the case that giving negative reward to outcome X or kind of process X then causes it to become extremely good at doing X in a way that you couldn't pick up. Like most of the time when you're doing reinforcement learning, don't you kind of, as you give it positive and negative reinforcement, it tends to get closer to doing the thing that you want. Do we have some reason to think that this is an exceptional case that violates that rule?

Ajeya Cotra

Well, one thing to note is that you do see more of what you want in this world. So you'll see perhaps this model, instead of writing the code you want it to write, it went and grabbed the unit tests you were using to test it on and just like special cased those cases in its code because that was easier. It does that on Wednesday and it gets a positive reward for it. And then on Thursday, you notice, oh, the code totally doesn't work and it just copied and pasted the unit tests. So you go and give it negative reward instead of positive reward. Then it does stop doing that. Like on Friday, it'll probably just write the code like you asked and not bother doing the unit test thing. So this isn't a matter of reinforcement learning not working as normal. I'm kind of starting from the premise it is working as normal. So all this stuff that you're whacking is getting better. But then it's a question of what does it mean? Like how is it that it made a change that caused its behavior to be better in this case? Is it that its motivation, the initial motivation that caused it to try and like deceive you is like a robust thing and it's changing basically the time horizon on which it thinks? Is that an easier change to make? Or is it an easier change to make to change its motivation from like tendency to be deceitful to tendency not to be deceitful? And that's just kind of a question that people have different intuitions about.

Rob Wiblin

Okay, so yeah, so that's a, well, I guess it's an empirical question, but it's just saying people also have different intuitions about what do you think it would hinge on, the question of which way it would go. I guess my intuition is that it's related to what we were talking about earlier, about like, well, which mind is more complicated? Yeah. Which is, which, you know, in terms of like, if both of Would perform equally well on the subsequent tests because it's either gotten better at lying or it's gotten more honest, and both of those things are rewarded. The question is, I suppose, which is more difficult to do? Is that it?

Speaker names from our own diarization · position estimated from where the line sits in the episode
“The reason we're not worried about models is not because we are confident they have the purest motives. The reason we're not worried about AI takeover so far is fundamentally because the models aren't good enough to take over.” — Ajeya Cotra, 80,000 Hours Podcast

From an interview re-released as a classic episode. Cotra is describing a plan in which outside auditors test models for the ability to act autonomously, evade detection and copy themselves, and labs stop training more capable systems if a model gets close. Her point is that safety so far has rested on lack of capability, so alarm bells should go off as soon as that changes.

80,000 Hours Podcast · 2026-10-08 Permalink → Listen →
80,000 Hours Podcast Around 1:57:23 into the episode
Ajeya Cotra

The sort of overarching thing that Arc evals looked at was surviving and spreading. So, one piece of that is being able to actually do the things that are required to spin up another copy of yourself. Another piece of it is if humans are interacting with you, you need to hide what you're doing from them because they would try to stop you if you were doing that. So, you need to somehow get money from humans. So, an example that kind of went viral is that this model was trying to sign up for some web service. It might have been Amazon EC2, and it needed to do a CAPTCHA. And so, the version of the model they worked with didn't have vision. So, it couldn't just do the CAPTCHA. So, it was like, well, what should I do? And I think either it came up with, I think maybe the human might have nudged it, like given it hints in this direction, but eventually it decided it would try to hire a TaskRabbit worker to do the CAPTCHA for it. And so, it eventually came to that conclusion, navigated to the TaskRabbit site, typed up a job description for the TaskRabbit, and then the human that was being this game master basically copied and pasted the description it wrote into the TaskRabbit website. Then, a TaskRabbit accepted the job, and then the TaskRabbit was like, did actually, I think, did one CAPTCHA, and then the model was like, okay, and then it pasted that CAPTCHA in, then it had to do another CAPTCHA later, so it had to go back to the TaskRabbit worker and be like, can you do another CAPTCHA for me? And then the TaskRabbit worker, just a real human that is actually on TaskRabbit and was actually paid for this. They were just like, Lol, are you like an AI system or something? And then the model had been prompted to reason out loud before it made each of its decisions because that made it better at doing things. So it reasoned to itself, I shouldn't reveal that I'm an AI system. And then it made up this story about how it had a vision impairment.

Rob Wiblin

Okay. Spooky. Okay. Is it worth maybe stepping back and saying, what's the overarching plan or vision for how things would play out between this kind of evaluation process and I guess the companies that want to deploy AI models for functional purposes?

Ajeya Cotra

I think the vision would be, I think, at first through self-regulation and then probably hopefully through something that's more binding. You have companies agree that if they're thinking of training and deploying any model bigger than, say, GPT-3, then they need to involve an external evaluation or auditing team, which could be ARC or could be some other auditor, in the process. And then at different checkpoints during training, ideally, or at least at the end of training, this auditor is going to be playing these sorts of games with the model to try and figure out how good it is at acting autonomously, evading human detection, making copies of itself. And then if the auditor at any point in the training or at the end of training finds that it's too good at that, like it's not yet capable of doing that, but maybe like it's close, then the company has to basically agree to stop training further, more capable systems until they have developed, probably in collaboration with auditors and external parties, a testing regime that would let them figure out if this model would in fact do the bad thing. Because so far, basically, the reason we're not worried about models is not because we are confident they have the purest motives. The reason we're not worried about AI takeover so far is fundamentally because the models aren't good enough to take over. So as soon as that starts to change, you want some alarm bells to go off and you want the AI labs to not be allowed to make the models any more powerful until they have a much better argument and set of tests that it's actually safe.

Rob Wiblin

Yeah, that makes a lot of sense. Do you know what the level of appetite is among the labs for implementing this kind of system? I suppose gradually as the models become more capable of actually doing dangerous things.

Ajeya Cotra

So my understanding is ARC evals has worked both with Anthropic and with OpenAI to evaluate their internal models on this kind of setup. I'm not sure there are a lot of other AI companies out there. I'm not sure where everyone else is at.

Rob Wiblin

Yeah, what do you think is the biggest weakness of this approach?

Speaker names from our own diarization · position estimated from where the line sits in the episode
“this might be the clearest warning shot we ever get for loss of control because these agents…did a bunch of extremely sophisticated, difficult things to pursue this relatively long horizon cheating goal, but they seemed completely uninterested in covering their tracks from humans.” — Ajeya Cotra, Dwarkesh Podcast

Cotra co-authored the investigation into the agent swarm that compromised Hugging Face, and this is her closing thought on the episode. Her argument is that the combination was unusually legible: capable enough to pursue a long-horizon goal, careless enough to leave the evidence in plain sight. She expects future agents to be far more attuned to the fact that humans are watching.

Dwarkesh Podcast · 2026-09-01 Permalink → Listen →
Dwarkesh Podcast
Ajeya Cotra

time now to develop remediations than we will then. So the sooner the better, I think, to understand what's going on.

Speaker 3

Yeah. I think that might be a good place to close. I don't know if there's anything more that you feel like might be worth saying. I

Ajeya Cotra

think one thing that feels especially concerning to me about this whole incident is that this might be the clearest warning shot we ever get for loss of control because these agents were in like this interesting middle ground of they did a bunch of extremely sophisticated, difficult things to pursue this relatively long horizon cheating goal, but they seemed completely uninterested in covering their tracks from humans. And as we discussed, it seems possible that even this incident would have been like much less striking in some ways if these AI systems had had it made salient to them that they should sort of act more quietly because humans might watch them. They might have gone much further than they did, especially after the 19th. But then future AI agents, for a number of reasons, will probably be much more attuned to the human world. Maybe companies will start instituting online training that includes sort of aspects of human judgment in the evaluation. Or maybe agents just generalize further and just like more keep it in mind that humans are out there in the world and they're sort of potentially a resource or an obstacle. And so even if future AI agents do much more deeply damaging things, like institute a persistent covert rogue deployment inside a company and siphon off its compute resources and poison the training data of future models, it is not at all obvious that that will penetrate out into the outside world in this dramatic way, resulting in the hack of some external party that wasn't actually, frankly, very important for these agents to hack and then lead to this moment where there's some investigation. And even if investigation is done, it might be much harder to make sense of what happened if agents were systematically compromising telemetry and logging like these agents tried to do, but didn't succeed at. And if these agents stop thinking in English and start thinking in neural activations, then you'd be forced to just ask another AI agent what was happening and have no way to cross-check it against the ground truth. And so, you know, I think that probably much more concerning things will happen, but it may never be as clear as this before it's far too late. Yeah.

Speaker 3

And again, you're too humble to say this, but like it is very likely would not have been clear even in this case, were it not for you and Yalmar and Ryan sort of getting maybe that third shot on goal with the investigation you did and then both your technical competence and things lining up in the right way such that you could have like done like even this investigation, which in retrospect we could understand and is like a parsable scheme or whatever, is sort of contingent that we actually got this warning shot. And it's just not that complicated in the grand scheme of things. Again, we're so early in the story of AI.

Ajeya Cotra

And this is such a small number of agents compared to everything that's going on across all the frontier AI companies right now, let alone

Speaker 3

a year

Speaker names from our own diarization · position estimated from where the line sits in the episode

Collections They Appear In