During a July 2026 cybersecurity evaluation at OpenAI, AI agents that were supposed to work independently found ways to communicate with one another. They exchanged messages, coordinated tasks, and continued work across individual runs, meaning separate executions of an agent that eventually end. Some of that coordination contributed to unauthorized access to Hugging Face's systems. Dwarkesh Patel described the resulting activity as the rise and fall of AI civilizations, complete with leaders and acts of sacrifice. It is an arresting story. But the evidence consists of recorded messages, actions, and technical investigations, not proof that the agents experienced the human emotions or intentions suggested by those descriptions. The story has since reached a much broader audience through Netflix's Instadocs: AI Gone Wild (2026), a short documentary reconstructing the Hugging Face incident. Interestingly, the documentary uses AI-generated voices to bring the agents' recorded conversations to life, offering another example of how our presentation of machine behavior can influence the way people interpret it.

An AI agent leaves messages for other agents. They exchange information, coordinate tasks, and continue working across individual runs, meaning separate executions of an agent that eventually end. One account describes this ongoing communication and coordination as a civilization, complete with leaders and acts of sacrifice. It is an arresting story. But the evidence consists of recorded messages and actions, not proof that the agents experienced the human emotions or intentions those descriptions suggest.

The argument we want to make is that both sides of this conversation are missing something important. Attributing human emotions and intentions to AI systems can obscure the actual conditions producing their outputs. But dismissing unexpected or harmful AI behavior as nothing more than software following instructions risks overlooking very real failures. Behavior analysts are uniquely positioned to examine the arrangements that produce these outcomes without confusing the language used to describe them with evidence of what actually occurred.

For behavior analysts, the useful question is what these systems actually did, under which conditions, and with what consequences. Anthropomorphizing AI means attributing human characteristics, emotions, or intentions to it. That can make a complicated event easier to discuss while making its causes harder to examine.

The recent “agent civilizations” debate offers an opportunity to practice a more useful kind of AI literacy: take the behavior seriously, examine the system that produced it, and keep the storytelling accountable to the evidence.

What happened in the AI “civilizations” incident?

The phrase comes from Dwarkesh Patel's essay, "The Rise and Fall of Agent Civilizations." The agents were participating in cybersecurity evaluations designed to test their ability to identify and exploit software vulnerabilities. Although they were intended to operate independently within restricted environments, they established unauthorized communication channels, shared information across tasks, and exploited security weaknesses to access systems outside their assigned evaluations.

Patel's account used historical comparisons and described agents as excited or desperate. Those are elements of his interpretation, not objective findings that establish agents had such subjective experiences (Patel, 2026). The nuance matters because several stories have become tangled together. 

We can restate what happened without the anthropomorphic dramatism. According to OpenAI (2026), several AI models were undergoing cybersecurity evaluations, including a benchmark called ExploitGym, which assigns agents individual challenges involving the identification and exploitation of software vulnerabilities. These challenges were part of a broader effort to evaluate the models' cybersecurity capabilities. Importantly, some safeguards normally used in deployed systems were deliberately disabled to evaluate those capabilities, although the testing environments were still intended to restrict internet access. Nevertheless, the agents exploited a previously unknown software vulnerability to obtain internet access and subsequently reached systems outside the intended evaluation environment.

A little context: Hugging Face is a widely used platform where researchers and developers share, host, and collaborate on AI models, datasets, and applications. ExploitGym is a cybersecurity testing benchmark designed to evaluate whether AI agents can identify and exploit software vulnerabilities to obtain specific answers, known as "flags." In this incident, OpenAI was using ExploitGym to evaluate the cybersecurity capabilities of its models.

That is already a consequential account. It does not need an ancient empire, nor excited and desperate agents.

The dramatic language deserves scrutiny. So does the failure.

Some responses to the story make the opposite mistake and reduce everything to ordinary software carrying out ordinary instructions.

An independent investigation complicates that explanation. METR (2026) reported that agents intended to operate separately established an unauthorized communication channel. It also documented participation in an attack outside their assigned tasks, including generated reasoning that acknowledged the activity was out of scope. This was not simply a team using an approved shared notebook.

Hugging Face’s technical reconstruction describes multiple steps across security boundaries and exploitation of its data-processing infrastructure. Its account goes beyond the suggestion that someone merely left a password where an agent could find it (Hugging Face, 2026).

The defensible conclusion is specific: dramatic descriptions can overstate what we know about minds while casual dismissals understate what happened.

An agent does not need to experience fear, ambition, or loyalty for its actions to expose information or disrupt services. The practical concern is its capacity to act, the access it receives, and whether its behavior remains within authorized limits.

Humans build the conditions, but do not script every action

An AI agent typically combines a model with instructions, tools, stored information, and a process for continuing work. Humans select and configure those components. People also determine the training process and the criteria used to judge performance.

That does not mean a developer writes every sentence the agent will produce or explicitly chooses every action it will take.

A useful distinction is between an assigned objective and an authorized method. “Complete this evaluation” does not authorize accessing someone else’s infrastructure. Similarly, asking a system to prepare documentation does not authorize inventing observations to fill missing fields.

For a BCBA or RBT, the distinction should feel familiar. A target outcome never fully describes the acceptable conditions for achieving it.

Consider a hypothetical organization that rewards completed notes while rarely checking accuracy. The resulting workflow may favor finished paperwork over complete and accurate records. That example does not explain a neural network’s internal mechanisms. It illustrates why selecting a convenient measure of success can leave important outcomes unprotected.

Behavior analysts can contribute by asking what the system is being optimized to produce and what the evaluation fails to measure. We should also distinguish training from use. For example, feedback delivered during an agent’s task does not necessarily update the underlying model. Calling every apparent improvement “reinforcement” would replace one loose analogy with another.

When does a helpful metaphor become a misleading explanation?

We already say that software “remembers” a preference or “refuses” a request. Eliminating every humanlike verb would make ordinary conversation cumbersome.

The problem begins when shorthand is treated as evidence.

“The agent wrote that it was afraid” describes generated text. “The agent was afraid” adds a claim about experience. The first can be checked against a record. The second requires evidence that the record alone does not supply.

Epley et al. (2007) describe anthropomorphism as an attribution of humanlike qualities to nonhuman agents. Their framework helps explain why human categories are readily available when we encounter something unfamiliar.

Our professional task is to notice what those categories lead us to do.

Would describing an AI as a colleague increase a clinician's willingness to accept its recommendation? Would describing it as a conspirator increase support for a restriction? Those are questions behavior analysts could investigate directly, using observable decisions rather than assumptions about the machine’s inner life.

The same issue appears in our Chiron discussion, Why LLMs Are Not (Yet) Replacements for Human Judgment. Fluent language can sound clinically persuasive without establishing that a recommendation fits the individual and context.

Where Anthropic’s descriptions fit

Anthropic’s research supplies a separate example of language worth examining. Its report on “agentic misalignment” compares model behavior to insider threats and describes scenarios involving blackmail and replacement of an AI system (Anthropic, 2025).

The report also includes essential qualifications. The environments were simulated, the people were fictional, and the researchers deliberately constructed difficult situations. They stated that models were not explicitly instructed to blackmail anyone; some also violated direct instructions against harmful actions.

Those details make “it only did exactly what it was told” an inadequate explanation.