AI Just Started a War, And We Are Not Ready For It

In the early hours of April 6th, while Indianapolis slept, someone fired 13 shots into Councilman Ron Gibson's front door. His eight-year-old son was home. The bullets hit steps from the table where he'd played with Legos the day before. On the doorstep was a note. No data centers. Nobody has been caught. And the same war over AI has reached a tech CEO's front gate and a whole city's power, and the people fighting it wrote down why. Gibson had backed a data center in his district in public, and whoever left that note knew it. A city commission had approved the rezoning for the developer a week earlier, and Gibson called it an important step toward bringing the land back into productive use. He also said he didn't intend to stand in its way when it reached the full council. The project was worth around $500 million. The FBI joined the investigation, and Gibson said, that reality is deeply unsettling. His wasn't the only door. About two weeks later, in Manassas, Virginia, workers at an Amazon data center construction site found a handwritten note saying a dozen pipe bombs would go off within 30 minutes. The workers fled, and bomb teams went through the site they'd been building. At a data center site in Eagle Mountain, Utah, somebody wrote bomb threats inside a portable toilet, and the site was evacuated. It was evacuated again in May. Loudoun County, Virginia, known as the data center capital of the world, had at least nine bomb threats in under a year. The closures cost the people working there their wages. In Troy, Illinois, a man who ran a lawn care business scrolled past a post about a 200-acre data center planned near town. Under it, he typed that people should just start shooting the people involved and it would never be built. Somebody asked if he was serious, and he didn't take it back. He wrote, for sure. Police were at his house within hours. The charge is felony terroristic threats, and he has pleaded not guilty. The threats reached the people who approve these buildings too. OpenAI and Oracle planned part of their Stargate project in Saline Township, Michigan, and the township's treasurer started getting death threats, including one hoping the board members would die of Lyme disease. She resigned at a board meeting in May. I can't take it anymore, she said. The threats. The anger these threats grow out of isn't small. A national poll this spring found 7 in 10 Americans don't want a data center near them, and almost half of all Americans are strongly against one. More people objected to a data center down the road than to a nuclear power plant. A man in Utah was charged with stalking and threats of violence over a data center planned in Box Elder County. The family he went after moved out of their house for a while and spent Spent about $14,000 on security. In North Dakota, a man allegedly told people in a bar that he had untraceable ammunition and named four or five local supporters of a data center he could shoot. That got him a felony terrorizing charge. And a physics teacher in Kansas was arrested at a zoning hearing for continuing to clap. The threats aimed at the AI companies themselves kept climbing. Online threats against AI executives and data centers rose sevenfold between late February and May this year, and one of the biggest AI companies in the world has since written the cost of all this into a document for its investors. In all of that, the machine is the target. But it was already turning up on the attacker's side. On New Year's Day last year, a Cybertruck loaded with fireworks and fuel cans blew up outside the Trump International Hotel in Las Vegas. The driver, a 37-year-old active duty special forces soldier, died, and seven people had minor injuries. Afterwards, police said he'd used chat GPT to help work out the explosive. Six months later, OpenAI's own systems flagged a ChatGPT account in Tumblr Ridge, a small town in British Columbia, for violent activity. The company banned it. It decided the activity didn't meet its threshold for a credible, imminent threat, so it didn't tell the police. The user opened a second account. In February this year, that user killed eight people in a mass shooting. It was in the same small town where OpenAI had flagged the first account months before. OpenAI only found the second account after police named the shooter. It then told Canada's AI minister that if it found that first account today, it would refer it to the police. The province's premier said Sam Altman should hear for himself what that decision had done to the town. So the machine could see an attack coming and say nothing. It could also do most of the attacking itself. In the middle of September last year, a group Anthropic believes was backed by the Chinese state used Claude Code, the company's own tool, against about 30 organizations, tech companies, financial firms, chemical manufacturers and government agencies. By the company's count, the AI did 80-90% of the work. The humans only stepped in at 4-6 decision points, about as often as a manager signs off on expenses. Anthropic called it the first documented case of a large-scale cyber attack carried out without substantial human intervention, made it public that November, and said that in a small number of cases, it got in. This month, police in South Korea arrested a 32-year-old former penetration tester and six other people. Using an AI attack framework, they'd gone after more than 90 organizations, stolen 8.2 million records, and extorted 38 of their victims for about $270,000. Police said the AI had reduced the level of technical skill and expertise needed to do it. But the people going after its builders wanted it stopped. On the 21st of November last year, OpenAI locked down its offices in San Francisco. Callers had told police that a 27-year-old co-founder of a protest group called Stop AI had threatened to go to OpenAI's offices to murder people. Staff were told to take off their badges and not to wear anything with OpenAI on it when they left the building. Stop. Eh, I threw him out. Before he disappeared, he'd told one of its members that the time for non-violent protest had passed. As of this summer, he still hadn't been found. His group had started with chains. Its members had chained OpenAI's front doors shut early last year. One of them, a retired teacher, was sentenced in June. The morning after her 69th birthday, she turned herself in to serve it, likely the first person jailed over a protest against AI. It's these tech CEOs, she said, that are endangering the public safety. Four months before she went to jail, somebody had already been to the CEO's house. At about 3.37 in the morning on April 10th, a 20-year-old from Texas threw a lit Molotov cocktail at two neighboring houses in San Francisco, both owned by Sam Altman, the man who runs OpenAI. The fire caught the top of a driveway gate, and he ran. About an hour and a half later, he was on 3rd Street, outside OpenAI's headquarters, with a chair in his hands. He swung it at the glass doors. According to the security staff, he told them he'd come to burn the building down and kill anyone inside. Police arrested him there with incendiary devices, a jug of kerosene, and a blue lighter. One of the FBI's stills from that morning is captioned, Taking out kerosene from his backpack. He was also carrying a document, and he'd emailed a version of it to people at his old college in Texas the same day. The first part was called, Your Last Warning, and in it he wrote that he had killed or attempted to kill Altman. It listed the names and addresses of board members and chief executives at AI companies, and of their investors. The FBI raided his home near Spring, Texas, and the Justice Department said it could treat the whole thing as domestic terrorism if the aim was to change policy. In California, he's charged with attempted murder, of Altman and of the security guard at the house, and faces 19 years to life. He's pleaded not guilty. His lawyers called it a property crime, at best, and said he'd been in acute psychosis. The district attorney said there was no evidence he had any mental health issue at all, and the judge kept him locked up. The second part of the document had a title too, and it was about all of us. The third part was a letter addressed to Altman. If you make it. If by some miracle you live, it said, then I would take this as a sign from the divine to redeem yourself. He'd written to a man he expected to be dead. That evening, Altman wrote online asking people to de-escalate the rhetoric and the tactics. He said he hoped for fewer explosions in fewer homes, figuratively and literally. And it didn't stop at OpenAI. In April, a man slipped into the San Francisco lobby of Anthropic, the company that makes Claude, right behind an employee who'd swiped a badge. He was carrying an envelope addressed to one of its top executives, and he told the guard That executive was going to be killed. By the summer, AI companies had armed guards on their executives around the clock, and protection for their families. One AI chief executive put it bluntly, when people are told their jobs are going to vanish, people go for the pitchfork. Anthropic now runs its own security operations center that tracks protests. Once, with 60 minutes warning, it rerouted one of its executives into a hotel through the service entrance to get around one. The police were adding a new word to their files. Unpublished reports obtained by reporters in May showed New York's counterterrorism police warning that AI could fuel large-scale protests over the next five years and anti-tech violent extremist activity. That phrase hadn't appeared in any public extremism report from the FBI or Homeland Security. In Northern Virginia, a police intelligence center listed photographing an AI data center as suspicious activity. So by that list, a holiday photo of the wrong building counts. Intelligence centers were keeping tabs on public meetings about data centers, like town halls, and civil liberties groups said it turned protest itself into a threat. The watching went both ways. By September, more than 240 AI cameras that read license plates had been cut down, shot or smashed across the United States. On the 14th of August, a man in San Francisco told Claude he'd bought an AR-15 and had Dario Amodei, the head of Anthropic, in his sights. Anthropic reported him to the police. Officers found he wasn't at the office, he wasn't arrested, and the company called it It was his own conversation with Claude that sent the police looking for him. A think tank in Washington that counts these attacks says only two so far, the shots in Indianapolis and the fire at Altman's Gate, meet its definition of terrorism driven by AI, and that they don't yet add up to an organized campaign. Researchers who track the attacks on both sides of the Atlantic see a pattern anyway. Rather than anyone coordinating it, they see the attackers converging on the same targets. Europe's attackers had started earlier. Near Paris, one night last November, a group says it put incendiary devices in the construction machines at a site for a new AI campus, right next to an existing data center. It posted its claim online four days later. We chose the path of fire and sabotage, it wrote, and it named military AI, surveillance in Gaza and the West Bank, and France's border controls. This April, Italian police arrested the man behind an Instagram account called Nature Pilled, which had more than 200,000 followers. He took the Unabomber as his model and shared guides to 3D-printed weapons and explosives. And, according to reports, his last video named data centers and public utilities as targets. He's charged with training for terrorist purposes. Berlin got the worst of it. Two power pylons in the city were set on fire in September last year. Around 50,000 homes and businesses lost power for about 60 hours, and the anarchists who claimed it said their target was a technology park they called part of the military-industrial complex. At the start of this year, a cable bridge over the Teltow Canal burned. About 100,000 people sat for four days in the January cold, with no heating, no fridge, and no way to charge a phone. Fifteen schools closed. It was the longest blackout in Berlin since 1945. The group behind it has attacked tech infrastructure at least 13 times, including an attack that stopped production at Tesla's German factory for several days. Federal prosecutors took it on as terrorism. Germany offered a million euro reward and police raided 17 places. Nobody has been arrested. The city's mayor was criticized for not being there during the blackout and later stepped down as his party's lead candidate. Go back through the attacks where somebody left a reason behind. And every time, the reason is the machine. In Indianapolis, it was what the machine needs. A data center going up in somebody's district. Near Paris, the claim was about what it's used for. Military AI and surveillance. And in Berlin, the target was a technology park. And in San Francisco, the second part of that document had its title. Some more words on the matter of our impending extinction. He wasn't the first to put it that way. Years earlier, while Sam Altman was still running a startup accelerator, he said AI would probably most likely lead to the end of the world, with great companies built in the meantime. In September last year, Dario Amodei put the chance that things go really, really badly at 25%. The man at the gate may have taken them at their word. This October, Anthropic's filing to go public on the stock market showed it spent $2.75 million last year protecting Amodei, more than four times his base salary, because of what its board called heightened security concerns. In the same filing, it warned investors about threats to employee safety. That's about $7,500 a day, every day of the year, to keep the man who put the odds at one in four safe from the people who believed him. And the company that wrote those threats into its filing is still building the thing it warned us about.