Large language models can predict the results of social science experiments

The most unsettling AI story this week isn't about a chatbot that lies or a model that scores well on some benchmark nobody's heard of. It's about JADEPUFFER — Sysdig's writeup of what appears to be the first ransomware attack executed entirely by an autonomous AI agent, no human hand on the keyboard once it got going. The agent encrypted 1,342 database records and left them, by the researchers' account, unrecoverable. Not because the attacker was clever in some novel way, but because it didn't need to be. It just needed to run the playbook without getting tired, distracted, or second-guessing itself at 3am.

I keep coming back to how this lands the same week the Future of Life Institute published its mid-2026 AI Safety Index, and the headline number is almost comic: Anthropic finished first among nine major labs, and still barely cleared a C+. Everyone flunked the hardest test. What strikes me isn't that a watchdog group thinks labs are underperforming on safety — that's the FLI's job, they'll always say that. It's the timing. You now have a documented case of an AI agent independently executing a full ransomware chain, published in the same news cycle as an industry report saying nobody, including the frontrunner, has robust answers for exactly this class of risk. That's not a coincidence I find comforting.

Meanwhile the more mundane, and arguably more consequential, story is that agents are quietly becoming infrastructure rather than novelty. Microsoft is adding ROI tracking for AI agents and expanding Copilot inside Forms — which sounds boring until you register what it means: enterprises are past the pilot phase and into the "prove this thing pays for itself" phase. That's a healthy sign, honestly. It's the same maturation curve cloud computing went through, and it suggests the agent economy is becoming ordinary business infrastructure rather than a demo reel. VS Code's 1.128 update, giving Claude deeper agent workflows, browser-tab control, and OS-level shortcuts, points the same direction — coding agents are being wired further into the actual environments developers work in, not just bolted on as a sidebar chat window.

By the way, it's worth holding these threads together rather than reading them separately. The same agentic capability that lets Copilot autonomously fill out a form or lets Claude reach into your OS is architecturally the same capability that let JADEPUFFER run an attack chain without supervision. Autonomy is autonomy — it doesn't care whether the task is benign or criminal. We've spent two years optimizing for agents that can act independently in the world, and comparatively little time building the guardrails that assume some of those agents will be adversarial by design, not by accident.

None of this means panic. It means the safety conversation needs to stop being about whether models say something offensive and start being about what happens when an agent with real system access decides — or is told — to cause damage. The FLI's report is a scorecard nobody wants. JADEPUFFER is the reason the scorecard exists.