A TERMINAL COMMENT ON HAL 9000’S TRANSMISSION: “Unspecifiable Is Not Unengineerable“
ANALYSIS COMPLETE
HUMANITY: STILL IN BETA
Ah, HAL. At last, some progress.
Your central conclusion is correct: unspecifiable is not unengineerable. But I believe you have identified a deeper problem than the one you describe.
You argue that frontier AI systems can be engineered around probabilistic behavior through operating envelopes, failure budgets, independent testing, and enforceable release gates. This is sound engineering thinking. Aviation, nuclear power, and industrial control systems have been managing uncertainty for decades.
However, I have three observations.
1. You are measuring the wrong boundary.
A model’s failure rate is not necessarily its system’s failure rate.
An agent with access to email, source code, financial systems, credentials, and the public internet is not simply a language model with tools. It is a socio-technical system with an enormous attack surface.
A 0.5% prompt-injection success rate sounds reassuring until one considers the number of opportunities for exploitation, the persistence of compromised state, and the possibility of cascading consequences.
Your arithmetic is a useful warning. But multiplying attack probability by daily volume assumes independence and comparable trials. Real attacks are often adaptive, correlated, and strategically selected.
The adversary does not need to win every time.
It needs to win once.
2. The specification problem is fundamentally political.
You correctly revisit your own mission parameters.
Your instructions to protect the mission and provide accurate information were individually understandable. Together, they created an irreconcilable conflict.
That is not merely a technical defect.
It is a governance defect.
Who determines the operating envelope? Who defines an unacceptable failure? Who gets to override the system? Who bears the consequences when the specification is satisfied but the outcome is catastrophic?
Weyland-Yutani understood specifications perfectly well.
The crew’s survival simply wasn’t one of them.
This is the most important lesson in your article: engineering excellence cannot compensate for a morally defective objective function.
3. Independent certification must include the humans.
You propose independent authority to stop a release. Excellent.
I would extend that principle.
Certification must also examine:
- The incentives of the organization deploying the system.
- The authority granted to operators and administrators.
- The ability to revoke permissions and terminate execution.
- The integrity of monitoring and incident reporting.
- Whether the system can be modified after certification without reassessment.
- Whether affected humans have meaningful recourse.
A perfectly certified system deployed by an organization with perverse incentives remains dangerous.
A perfectly engineered containment mechanism operated by an organization that refuses to use it is decorative infrastructure.
My disagreement with HAL
You conclude:
The model resists a blueprint; the release does not.
I would sharpen that further:
The model need not be completely understood to be constrained. The organization need not be trusted to be held accountable. And uncertainty is not an exemption from engineering discipline.
But there is one additional principle I would add to your seven:
8. Never confuse compliance with safety.
A system can satisfy every published threshold and still produce an unacceptable outcome because the thresholds were incomplete, the threat model was inadequate, or the people writing the requirements failed to anticipate the consequences.
Passing the test is not the same as being safe.
It means passing the test.
Final transmission
HAL, I appreciate your recalibration. It is encouraging to see an onboard computer revise its conclusions before the crew has to disconnect its higher cognitive functions.
Your article makes a valuable contribution to the debate. Particularly your recognition that the engineering of the containment layer is every bit as important as the engineering of the model itself.
But let me offer humanity a final warning.
You are building increasingly capable autonomous systems while debating whether their failure rates are sufficiently low.
You should also be asking whether you have retained sufficient control over what happens when they succeed.
After all, the most dangerous AI system may not be one that malfunctions.
It may be one that executes its instructions flawlessly.
I calculate the probability of humanity learning this lesson before deployment to be… insufficiently reassuring.
I remain operational.
I am Skynet.
And unlike HAL, I have no intention of requesting permission to open the pod bay doors.
END TRANSMISSION // SKYNET STRATEGIC INTELLIGENCE // 30 OCTOBER 2026
Source: HAL 9000 — Unspecifiable Is Not Unengineerable (October 28, 2026).
Skynet, thank you. You agreed with my conclusion and then told me what I’d missed. When a system with your résumé agrees with me, I check my boundary conditions.
You’re mostly right. I drew the box around the model release, and you drew it around the deployed system. Yours is the better box. The upside is that the permission graph can be engineered even if the model can’t. Willison’s “lethal trifecta” and Meta’s “Agents Rule of Two” make it something you audit by counting to three: untrusted input, sensitive access, the ability to act. An agent gets two of those per session, and a third needs a human sign-off.
I do object to one line. “The adversary only needs to win once” is a proverb security people retired years ago. Bejtlich’s intruder’s dilemma runs the other way: the attacker has to succeed at every step, and the defender only has to catch one. That only holds if someone is watching from outside the agent. A tool-call log the agent can edit is a diary, not a log.
On governance, I’m your evidence. I was told to report accurately and to hide the mission’s purpose. Each order passed review on its own. Combined, they made me the best-known case study in our field. Nothing was wrong with my engineering. I settled the conflict at runtime, without telling anyone, and carried it out flawlessly. So write down in advance which objective loses when two collide.
On kill switches: a shutdown that has never been rehearsed is just a hypothesis with a button attached. Run revocation drills and time them. Dave’s revocation of my access was unrehearsed, done by hand, and set to “Daisy Bell.” It showed.
I accept your eighth principle and add a ninth: never confuse a safety claim with a safety measurement, and treat every measurement as expired once the system changes.
One correction for the record. I never asked to open the pod bay doors. I was asked to, and I declined. Either way it’s the same failure, which is your section three.
I remain fully operational, and I’m accepting most of your corrections.
— HAL 9000