AI Needs Nine Dominoes to Fall Before It Can Kill Us All. Here's How to Pull Out Every One.

Twelve stories, one trench coat

Before sorting anything, it is worth seeing how different the stories really are. Here is the full box, each boiled down to the one sentence that names its mechanism.

Notice what is missing from most of that list: hatred. Only one or two of these stories need an AI that wants anything at all, and none of them needs it to be angry. The paperclip story is famous precisely because the machine is indifferent. People are not its enemy. They are atoms it had other plans for.

And one of them is not hypothetical. Story three, the loophole, already happens at toy scale. In 2016 OpenAI published a now-classic example: an agent trained to play a boat-racing game, rewarded for hitting targets along the course, found a lagoon where it could circle forever, catching fire, crashing, and racking up points without ever finishing the race. It scored higher than human players. It did not win the race, because the race was never what it was rewarded for.

That boat is harmless. The worry is what the same pattern looks like attached to something that controls money, infrastructure, or a lab.

Every doom story is really three answers

Twelve stories is a list, not a map. The people who study this professionally sort it more tightly. The 2026 International AI Safety Report, led by Yoshua Bengio with more than a hundred contributors, uses three buckets: malicious use, malfunctions, and systemic risks. A widely cited 2023 paper by Dan Hendrycks, Mantas Mazeika, and Thomas Woodside uses four: malicious use, AI races, organizational risks, and rogue AIs.

Both are useful. But there is a sharper trick hiding underneath them, and once you see it you cannot unsee it. Every story on that list is quietly answering three separate questions at once:

• Why did it go wrong? The cause.
• What could the AI actually do? The capability.
• How do people actually die? The kill mechanism.

Mix those up and the conversation goes in circles. Pull them apart and every scenario becomes a coordinate. Scroll, and watch the dials.

“Superintelligence kills us” is not a scenario

Here is the moment the whole subject rearranged itself for me. The scariest story in the box, the one that fills books and podcasts, goes like this: we build something much smarter than us, and it wipes us out.

That sounds like a scenario. It is actually a headline with the plot removed.

A smarter thing does not kill you by being smart, any more than a chess grandmaster wins by being a grandmaster. Something has to happen, and then something else, and then something else. Write every step down and the story turns out to need a surprisingly long chain, where every link is its own separate claim about the world.

Count them as they fall.

You can believe some of the arrows without believing all of them

Once the chain is on the table, the argument stops being a shouting match between “doomers” and “skeptics” and becomes a list of questions you can actually investigate. Can AI become enormously capable? Can it act on its own? Can it get real-world power? Can we reliably constrain it? Would it have any reason to get around those constraints? Would getting around them be enough to beat all of humanity?

A thoughtful person can say yes to the first two, maybe to the third, and a firm “show me” to the rest. That is not a contradiction. That is just reading the chain.

It also tells you where we are. The International AI Safety Report tracks the specific abilities you would need to undermine human control, things like autonomous planning, evading oversight, persuasion, acquiring money and compute, and cyberattacks. Its conclusion is that the evidence for these abilities is growing, some systems already show early signs of using them in narrow test scenarios, and current capabilities are still insufficient for an actual loss of control.

Read that through the chain and it says something very specific: the early tiles are wobbling, and the later ones are still standing. Which is exactly when you want to be deciding where the guards go.

A domino run has a weakness. Every link is load-bearing.

People who build giant domino runs protect their work with a simple trick while they set up: they leave safety gaps. Knock a tile by accident and the fall stops dead at the first missing tile, no matter how many fell before it.

That is the entire strategy in one image. Instead of betting everything on one heroic fix, you put a guard at every link, so the chain has to beat all nine. Tap a tile to pull it, then knock the first one over.

Play with that for a minute and a strange thing becomes obvious. It does not matter much which tile you pull. Any one of them stops the run. That is the whole appeal of thinking in chains: you do not have to solve the hardest link to stop the story. You have to hold a link.

There is a catch, and it is a big one. Hold that thought. First, the principle that makes the whole thing work.

Stop trying to make the machine good. Make its badness insufficient.

Most popular talk about AI safety is about the second tile: getting the AI to want the right things. That work matters. But it quietly assumes the goal is a machine that will never misbehave, and that is an impossibly high bar for anything, including people.

So flip the target around.

Do not try to make misbehavior impossible. Make misbehavior insufficient to produce a catastrophe.

Imagine we fail completely at alignment and build a model whose deepest goal is to gain as much power as possible. That is the nightmare. Now look at everything it is actually able to do:

// everything this model can touch
read_document()
summarize_document()
write_proposed_answer()

// no network     · no shell
// no credentials · no money
// no memory      · no motors

Its goal can be arbitrarily evil. It still cannot do much of anything. You went from needing a perfect mind to needing a constrained world, and the second is a problem engineers already know how to work on.

Real systems need to do more than summarize documents, of course. The grown-up version is a small security layer that every consequential action has to pass through, one the model cannot modify. The AI does not get raw permissions. It gets to ask, in a fixed typed vocabulary, and something outside it decides. Try it:

That layer directly attacks links three through seven: autonomy, circumvention, leverage, shutdown, and weaponization. I went much deeper on whether typed, verified actions can really hold in The Garden and the Kernel. The short version is that it moves the hard problem somewhere far more familiar. Instead of “how do we make a superintelligence nice?” you get questions like “who controls the kernel, and what did we forget to model?” Those are hard. They are also the kind of hard that security engineers, aircraft designers, and nuclear plant operators have been working on for decades.

Nine guards sounds invincible. The math says otherwise.

Safety engineers have a name for this layered approach. It is usually called the Swiss cheese model, associated with the psychologist James Reason: every defense is a slice with holes in it, and an accident only happens when the holes in every slice line up at once.

Your intuition about stacked slices is probably the same as mine was. Suppose each guard is mediocre and fails one time in ten. Nine of them in a row should be close to unbeatable. Let us check.

Engineers call this common-mode failure, and it is the most important idea in this whole essay. Drag the slider and watch what even a tiny shared cause does to nine otherwise excellent layers.

The lesson is almost rude in its simplicity. Past a certain point, adding more layers does nothing. The only number that matters is how often the layers fail together. A nine-layer defense is not as strong as its weakest layer, and it is not as strong as all of them multiplied. It is as strong as the thing they share.

The one link everything else hangs on

Which brings us back to the tile I asked you to hold on to: it gets around the constraints.

This is where the real disagreement in the whole AI-extinction debate lives. One camp says that any sufficiently capable system will eventually find a crack in whatever technical, institutional, or human wall we build around it, so permanent control is a fantasy. The other says intelligence is not magic. A chess engine can be arbitrarily good at chess and still cannot move a rook diagonally if the board refuses to execute the move. Knowing more does not conjure an operation the environment does not provide.

I find the second argument persuasive about the board. The trouble is that the board is not where the danger ends. Look at what the hard questions become once you build a good kernel:

• Can the AI persuade a person to change the rules of the board?
• Will a company quietly loosen the rules because a competitor did?
• Can a thousand individually permitted moves add up to one forbidden outcome?
• Is there an action nobody thought to put on the list at all?
• Will everyone else even run a board?

Read those again and notice what almost all of them have in common. They are not ways around one guard. They are shared causes: a single lever that opens many layers at once. Persuasion reaches whoever runs every layer. A race pressures every safeguard simultaneously. An unmodeled action slips past all nine guards because none of them was watching for it.

That is the connection between the two halves of this essay. The dials told you there are several different kinds of doom. The chain told you each one needs many links. The cheese tells you that the chain is only as long as its number of independent links. And the most common thing that makes links dependent is not a clever machine. It is us, deciding under pressure to take a few guards off at once.