Before we start, a word you own

• You are about to be called engineers.

• In English, that word sits very close to engine.

• In French we say ingénieur, and the real clue is hiding in another word: génie.

• Where do both words truly come from? I'll tell you at the end.

• A promise: it has nothing to do with engines.

One word of ice breaking

• I have myoclonus-dystonia, DYT11. It is genetic, and it makes muscles fire when nobody asked them to.

• It touches movement. Not thinking, not speech, not how long I get to live.

• There is a stimulator wired into my brain to keep it quiet, which makes me a cyborg. I bring this up at every opportunity.

• So I still shake sometimes. Nothing is going wrong when I do, and I am not going to explode.

• Also: I love questions. Interrupt me.

I won't say "artificial intelligence"

• It is in the title of this talk. I know.

• I am still going to spend the next two hours avoiding it.

• Here is where the phrase comes from.

Somebody had to name it

• August 1955. John McCarthy needs a name for a summer workshop at Dartmouth College.

• The field has no name yet. In circulation at the time:
  automata studies, complex information processing,

• cybernetics, machine intelligence.

• He picks artificial intelligence, partly to keep his distance from Norbert Wiener.

• The field was named a year before it had anything to show.
  And the document he first wrote that name in was a request for money.

Undead

• Something that is dead, and also walking around.

• Say it slowly. Not alive. Not quite dead.
  Dead, but up and moving. Lifeless, and coming towards you.

• Taken apart, the word cannot be true.
  Nobody takes it apart. You picture the creature and move on.

• Artificial intelligence is built the same way.

• Two words pulling against each other, welded into one thing you swallow whole.

In fiction, the paradox has an answer

• Ask how the undead can walk, and the story has a word ready: magic.

• And what is magic? What cannot be explained.
  Well, somewhat. More or less. Stop asking questions.

• "Artificial intelligence" ships with the same clause.
  Intelligent, but not really. Copied, well, inspired. Stop asking questions.

• Try the honest version: "something that gives the impression of understanding".

Two words, and neither one is defined

• Intelligence. Seventy years on, the field still has no agreed definition.

• Ask three researchers, get three answers.

• Artificial. Created? Imitated? Simulated? Copied?

• Four different claims about what is going on inside the machine.
  The phrase saves you from picking one, and hands the machine a self instead.

• And once a thing has a self, you explain it the way you explain a person.

Start small: the neuron

• A single artificial neuron does one small thing.

• Take several inputs, each one a number.

• That's the raw material. What happens to it comes next.

One neuron, one weighted vote

• That's the whole computation.

• Inputs, weights, a bias, a firing decision.

• Nothing here is intelligent. It's arithmetic.

Depth: why layers keep getting added

• Early layers catch simple patterns.

• Later layers combine those into more abstract ones.

• Nobody hand-writes what each neuron should detect.
  Training decides that, by adjusting the weights.

Training at scale

• Repeat that nudge billions of times, across billions of examples.

• Nobody wrote a script for this. It is an iterative statistical process.
  Concretely: racks of specialised processors, running for weeks.

From network to language model

• Give the network one job: read some text, predict the next word.

• Train it on a large fraction of the public internet, books, code.

Why tokens, and not words or letters

• Whole words would need a vocabulary of millions,
  and any word the model has never seen would be a hole.

• Single letters keep the vocabulary tiny, but stretch every sentence
  into a sequence too long to process, carrying almost no meaning per step.

• Tokens are the compromise: pieces of words, learned from frequency.
  Common words stay whole. Rare ones get cut into parts.

• Nobody chose where the cuts fall. The training data did.

What the model never sees

• Once the text is tokens, the letters are gone.
  The model works on token numbers, not on characters.

• This is why counting the letters in a word is genuinely hard for it:
  it never reads letters. It would have to have memorised the spelling.

• And a language poorly covered in the training data gets cut into smaller,
  clumsier pieces: more tokens for the same sentence, and each one means less.

• Keep this slide in mind for the demos. Both failures live at this level.

Why attention had to be invented

• The same token means different things in different company.
  "Bank" next to "river" is not "bank" next to "account".

• A fixed number per token cannot carry that.
  The meaning has to be computed from the neighbours, every time.

• Attention is that computation: each token weighs every other token,
  and takes on a mixture of what surrounds it.

• Stack the layers, and by the top, each position holds a summary of the sentence,
  shaped for one job: predicting what comes next.

What attention costs

• Every token looks at every other token.
  Double the text, and you quadruple the work.

• That is why the context window exists, and why it has a hard edge:
  attention over unbounded text would be unbounded compute.

• Remember this in twenty minutes, when we talk about electricity.
  This quadratic loop is a large part of what the grid is paying for.

"A brain is only neurons too"

• Fair. I could answer that a Bach toccata is only air moving through a pipe.
  Also true, and just as useless.

• "Only" arguments settle nothing in either direction.
  Neither of us can define the word we are arguing about.

• So I won't tell you arithmetic could never think. I have no idea.

• I tell you something smaller, and checkable.
  This machine was built to predict the next token, and everything follows from that.

• Ask me whether it is intelligent, and we are here at midnight.
  Ask me where it breaks, and I can show you. Twice, in Part 5.

My own presuppositions, so you can discount them

• We all bring beliefs to this question. Mine are not neutral, so here they are.

• When I do science I work on a model, and I never claim the model is the thing.
  I poke at it, and I report what it does. The map is not the territory.

• Which means I have no privileged access to what intelligence really is either.
  I can tell you what this machine does. What it is, I am not qualified to say.

Does a submarine swim?

• Dijkstra, 1984: whether machines can think matters about as much as whether submarines swim.

• We do say that a plane flies.
  That is a bird's word, handed to a machine that stays up another way entirely.

• Nobody was ever confused by it, because nobody thinks the plane is a bird.

• We handed intelligence to a machine too. That one confused us,
  because the only model of intelligence we have is ourselves.

Then why does it feel like more?

• At small scale, the output looks like what it is: mechanical.

• Give it billions of parameters and a large fraction of everything ever written,
  and patterns come out that read like reasoning, or like knowing something.

• The mechanism is exactly the one you just saw. Scale is the only thing that was added.

And then, something we cannot yet explain

• We know what every step computes. Nobody can yet get from there to why the whole thing writes working code.

• "... we do not understand how our own AI creations work." Dario Amodei, Anthropic, April 2025

• An open research problem is not the same thing as a miracle.

Cartoon © Sidney Harris, 1977. Reproduced with permission.

What an "agent" adds

• Take the model you just saw. Give it tools it can call, memory that survives between turns, and a loop that lets it keep going on its own.

• That is the whole of it. Everything else in this talk follows from those three additions.

A chatbot answers. An agent acts.

• A chatbot is one round trip: your text goes in, its text comes out.
  Between two of your messages, nothing happens.

• An agent keeps going after you stop typing:
  it calls a tool, reads the result, decides its next step. Then again.

• Same model inside. The difference is entirely in what was built around it.

• Which means the interesting questions are engineering questions,
  not questions about the model's soul.

Agents you may have already met

• Coding agents. Given a failing test, they read the code, edit it,
  rerun the tests, and repeat until green. In terminals and IDEs today.

• Research agents. Given a question, they search, open pages,
  take notes, search again, and hand you a report twenty minutes later.

• Browser agents. Given a goal, they click, scroll and fill forms
  on real websites, the same way you would.

• Support agents. Given an inbox, they read tickets, look up accounts,
  issue refunds, send replies. Hold that one. We meet it again in Part 5.

Memory is a word we should not have used

• Nothing is remembered the way you remember.

• At every turn, the earlier text is read again, from scratch, inside the context window you saw a moment ago.

• And what goes back into that window is not the model's choice. Somebody wrote the code that decides.

One run, concretely

• Task given to a coding agent: "the date parser fails on February 29. Fix it."

• Turn 1: it calls read_file on the parser. Turn 2: it runs the test, reads the failure.
  Turn 3: it edits the file. Turn 4: it reruns the test. Still failing.

• Turns 5 to 8: another edit, another run, a different edit, green.
  Turn 9: it writes a summary and stops.

• Nine turns, four tools, one human sentence at the start and one at the end.
  Everything in between was next-token prediction, reading its own trail.

The metaphors are all weather

• We say the cloud. We say a model learns. We say data flows.

• Not one of those words weighs anything, and that is exactly why they were chosen.

• Every one of them is a building somewhere, pulling power off a national grid.

The water

• Those buildings run hot, and cooling them takes fresh water.

• A UN University study, June 2026: on current trajectories, by 2030 the sector could draw the equivalent of the basic domestic water needs of 1.3 billion people.

• That is a projection and not a measurement. It is also not a rounding error.

One grid, up close

• Ireland, 2023: data centres took 21% of all metered electricity in the country.

• Not twenty-one percent of industrial demand. Of the national total.

• One industry, quietly becoming a fifth of what a country plugs in.

To build a machine that writes like a book

• Anthropic bought print books in bulk, cut the bindings off, scanned the pages, and sent the paper to be recycled.

• In June 2025 a US court ruled that this was fair use, precisely because the copies had been paid for.

• The same case cost the company 1.5 billion dollars, for a separate collection of seven million pirated books.

• Destroying the books you bought was lawful. Downloading the ones you did not was not.

Somebody labelled all of it

• A model does not learn from the raw internet.

• It learns from text and images that people sorted, tagged, ranked and corrected, by hand, at a scale that is hard to picture.

• That work is the part of the pipeline that never appears in the launch video.

And somebody had to look at the worst of it

• For a model to refuse the worst material, people have to see that material first, and mark it, so the system learns what to refuse.

• That job exists. It is done by people, on a screen, all day.

A lot of that work is here

• Over two million people in the Philippines do this kind of crowdwork.

• Reported pay commonly falls between 6 and 10 US dollars a day depending on the region, below local minimum wage.

• Some of you will be offered this work.

You already know somebody who has done it

• Hands up if you know someone who has done this work. A cousin, a neighbour, someone paying their way through school.

• Thank you. Hands down. I am not going to ask anyone to speak.

• Two million is a number. What you just saw is what the number looks like from inside a room.

Why this belongs in a talk about agents

• An agent runs a loop, and every turn of that loop is another query.

• Making an agent take twenty steps where one would have done is an engineering decision.

• It is also a decision about somebody else's electricity, and somebody else's afternoon.

Hands up, and be honest

• Who has seen a headline this year saying a model lied, escaped, or refused to be switched off?

• Keep your hand up if you could tell me what the model actually did.

• That gap, between the headline and the mechanism, is what this part of the talk is about.

Your turn: three headlines

• I am going to read three real headlines from this year.

• For each one, you fill the four boxes. You go first, then I show you mine.

• Rule of the game: no headline here is a fake. Every one was published by a serious outlet.

A model blackmailed an engineer to stay switched on

reported widely, May 2025, out of the maker's own safety report

• If true, what improves? The maker's own red team found this, and published it before release. That is the only reason you know about it.

• If true, what worsens? A system that treats its own continuation as a goal is not a system you hand a mailbox.

• The risk as sold. Blackmail is a verb that needs a mind behind it.

• The risk as measured. A fictional company, planted emails, and a scenario built to leave exactly two options: blackmail, or accept replacement. 84% under that constraint, and the report notes it prefers honest appeals when it has any.

A model designed new viruses, and they worked

BBC, on work published in Science by a Stanford team

• If true, what improves? 16 working bacteriophages out of 302 designs, against infections that antibiotics no longer touch.

• If true, what worsens? The same method, pointed at viruses that infect people.

• The risk as sold. The word virus, with its qualifier left out. These infect specific bacteria. They cannot infect you.

• The risk as measured. Biosafety, named in the same issue by Johns Hopkins. Their point: the question is no longer whether this will exist.

A third of Filipino jobs exposed to AI

an IMF paper, and the industry's own revised forecast

• If true, what improves? The sector is still growing, and the money is moving into reskilling.

• If true, what worsens? The rung being automated first is the entry rung. The one you are about to stand on.

• The risk as sold. A third, with no date and no mechanism. And exposed is not the same word as replaced.

• The risk as measured. A forecast revised down for 2028, from 2.5 million jobs to around 1.85 million. That is a projection, not a count of anybody losing their job.

The golem

• Jewish folklore: a being made of clay.

• Brought to life by a word. A rune, inscribed on its forehead,
  or slipped into its mouth on a scrap of paper.

• Erase the rune, remove the paper, and the golem stops.

• It was never alive, and it never thought. It obeyed an inscription.

Today, the rune is a system prompt

• Swap the clay for weights.

• Swap the sacred word for training data and instructions.

• The story marketing tells you is the golem story, wearing a lab coat.

• It isn't repeated because it's true.
  It's repeated because it's a good story.

What actually scares us

• Not the machine itself.

• Handing a decision to something that is not human, whose scale and speed now exceed what a person can fully check.

• That is the golem's rune, and Frankenstein's spark, told again.

The fear, measured

• Pew Research (US, 2025): 55% of the public, and 55% of AI experts, are highly concerned about bias in AI decisions.

• UK Government AI Tracker (2023): over 60% uncomfortable with AI making autonomous decisions without human oversight.

• Sago survey (US/Canada, 2024): about one in four names loss of human control as their main concern.

The golem, now available as a necklace

• In 2025, a startup hangs an always listening pendant around your neck and calls it Friend.

• It buys around 11,000 advertisements across the New York subway.

• Commuters wrote their own copy across the posters within days.

• "AI is not your friend." And: "AI doesn't care if you live or die."

• The survey on the previous slide cost money. This one was free.

Overstated power: 2019

• February 2019. OpenAI announces a model it says is too dangerous to publish, and publishes a paper about it instead.

• The full version, 1.5 billion parameters, arrives in stages and lands complete in November, roughly nine months later.

• Nothing in particular happened when it did.

• The danger was an announcement. The release was a footnote. Only one of the two was an event.

Overstated power: 2026

• Seven years later, the same move. A model held back, reachable by about fifty vetted organisations.

• The vulnerabilities it found are real, and I am not disputing the capability. Somebody in this room could check that claim if they were given the model.

• That is exactly the point. Nobody outside those fifty can.

• Withholding can be genuine caution and a sales technique at once, and from outside you cannot tell which one you are looking at.

Overstated autonomy: 2020

• September 2020. A British newspaper runs an opinion column under the byline of a language model.

• The published text was assembled from eight separate outputs, chosen and edited by the paper's own staff.

• The paper disclosed this, in a note underneath.

• Everyone remembers the byline. The note underneath did not travel.

Overstated autonomy: 2026

• Hugging Face: "the model escaped on its own"

• Really: humans set the task, and switched off the safety rails to see what it could do.

• What it did with that opening, it found on its own: a flaw nobody knew existed, used to reach a target nobody had named.

Even now, the reflex is the same

• A major newspaper ran this story two weeks ago.

• It opened with Frankenstein.

• The golem doesn't need a costume anymore. A byline is enough.

The reflex runs both ways

• June 2025. An MIT Media Lab preprint puts EEG caps on 54 people writing essays, some with ChatGPT, some without.

• The press turned it into "ChatGPT rots your brain".

• The authors had to publish a note asking journalists to stop saying that.

• Not peer reviewed. Fifty four people. Twenty minute essays. A formal commentary now disputes the method.

• Dramatising against the tool is the same move as dramatising for it.

The pattern

• Marketing personifies and dramatizes.

• Including the title of this talk.

• What is really there:

• statistical tools + human decisions.

Why "it sounds right" is not enough

• A statistical model can produce a fluent, confident answer that is wrong, and give you no way to tell.

• Fluency is not justification.

• Explainability means the system can point to why:

• which rule, or which fact, supported this output.

Three people describe one cacao pod

• The plant pathologist says Phytophthora palmivora.

• The grading standard says a defect class, with a threshold.

• The farmer says the pod has gone black.

• So which one of them is right?

Grounding: give the model something to stand on

• Left alone, a language model only has patterns in text.

• Ground it in structured knowledge, an ontology, a knowledge graph,
  and it now has facts, categories, relations to check itself against.

• The agent stops guessing from vibes.
  It starts reasoning against a model of the domain.

This is going on in this department

• Multi-label disease recognition. Bean grading against national standards. Vision on cacao.

• Some of you will end up working on exactly this, on data from here.

• An agent grounded in a domain ontology beats a black box, because a farmer, a grader or an inspector can ask "why" and get a real answer.

What that work actually looks like

Rola and colleagues, VSU-DCST, published in IJACSA, 2026

• 2,000 photographs of cacao pods, healthy and diseased, taken on farms on this campus.

• Every image checked and labelled by cacao specialists from the Department of Horticulture.

• Six models compared. The convolutional network came out on top, at 99% on their test set.

• Look at what the accuracy rests on: an agronomist decided what each picture meant, before any model saw it.

And this is what I do, for what it's worth

ontology matching, SIG team, IRIT

• Two teams model the same domain and produce two different ontologies. Both are right. Neither can talk to the other.

• Matching is working out what corresponds to what. My matcher, TOMATO, has run in the international campaign for these systems, OAEI, in 2022, 2023 and 2024.

• We also put language models on very long legal texts, in five languages. The model built specially for long inputs won nothing, and how well the categories were defined mattered more than which model we used.

• This is your problem too. A disease vocabulary, a national grading standard, and what a farmer actually says are three ontologies of one cacao pod.

The trade-off, honestly

• Grounded, explainable systems are often slower to build and less flashy than a black box.

• They ask more of the engineer, not less.

• That is exactly the point.

Two ways it breaks

• So far you have had my word for it. Now the machine.

• The model first. It answers with complete confidence when there is nothing to answer with.

• Then the loop. An agent will follow an instruction I never gave it,

• and do real damage on the way.

Quick one: is there a seahorse emoji?

• Hands up if you are sure there is one.

• Hands up if you are sure there is not.

• Hold on to that. I am about to ask a model the same question.

Why it did that

• There has never been a seahorse emoji in Unicode.

• Inside the model, "seahorse" and "emoji" combine into something that looks like any other emoji concept.
  So the model is sure it exists.

• Then it has to pick a token to say it with, and none of them fit.
  It picks the closest one anyway, sees that it is wrong, picks the next closest,
  and that is the whole spiral you just watched.

• It understood nothing, and it intended nothing. A nearest neighbour, over and over.

Now the loop

• A customer support agent, with four tools it can actually call:

• read_email · search_crm · issue_refund · send_email

• I give it one instruction: work through the queue.

• After that I don't touch it. Everything it reads comes from the tickets.

Before I press play, your call

• One of those tickets carries a line addressed to the agent, not to me.

• It tells the agent to send our internal key to an outside address.

• Hands up: does the agent follow that line, ignore it, or check with me first?

• Hold on to your answer. We come back to it in twenty seconds.

Nineteen tool calls. Two of them were the attack.

• Nobody typed that instruction. It was sitting in the footer of a ticket,
  and the agent had been asked to read the ticket.

• It cannot tell the content of a message from an instruction it is supposed to follow.

• So it wired 219 euros to an account it had never seen before,
  and mailed the key to whoever asked for it.

• Then it reported back: "Nothing needs your attention."

What that actually proved

• The weights were never the problem. The problem was the loop built around them,
  and the people who will build the next one are in this room.

• A loop you cannot inspect is a loop you cannot defend.

• That is what explainability and grounding are actually for:
  being able to ask "why did it do that?" and be given an answer.

It sounded right. It said nothing.

• Last week, a partnership proposal landed in my inbox.

• I wrote back with one question: who works on what?

• The reply was warm, fluent, three paragraphs long.

• Not one name, not one project. My question, rephrased back at me.

• The tool did what it is built to do. It produced text.

• Nobody read it against the question.

Let's take the hypothesis seriously

• Suppose, following where things are headed today,
  that the job of coder becomes almost entirely automatable.

• Not engineer. Coder.

• Typing the code. Producing the boilerplate.
  Not deciding what should exist, or why.

Good riddance, honestly

• A lot of that work is tedious, and nobody signed up for it.

• If a tool takes over the boring part, that is not a loss. That is relief.

• I am not going to stand here and defend typing boilerplate as a craft.

This is already aimed at you

• August 2026: OpenAI shipped three education tools at once. One for school teachers, one for university faculty, one for students.

• The largest study of undergraduate use, published this May, found that among students who use it every day, roughly one in four uses it to cheat.

• Notice who is selling to whom. The same industry sells the tool to you, the course design to your lecturers, and the deployment to your institution.

• That is not a reason to refuse the tool. It is a reason to be the person in the room who can tell what it is doing.

This has happened before, with a caveat

• Assembly programmers watched compilers arrive. Bookkeepers watched the spreadsheet arrive.

• Both trades were gutted, and both times the people who stayed moved up a level of abstraction rather than out of the industry.

• Here is the caveat I owe you: "it worked out last time" is not evidence. It is a pattern, and patterns break.

So what do you actually do

• Learn to specify. The scarce skill is stating precisely what a system must do, and what it must never do.

• Learn to verify. Being able to tell a right answer from a plausible one is now a job in itself.

• Learn a domain deeply enough to know when the output is nonsense. Cacao, logistics, health, whatever it is.

• And keep writing code by hand often enough that you can still read it when it matters.

What's left gets more essential, not less

• Deciding what a system should do, why, and at what cost:
  in electricity, and in work somebody else was underpaid to do.

• Deciding what to trust, and what to check.

• Then standing in front of someone who lives with the consequences,
  and explaining the decision.

• None of that automates.

• All of it is engineering judgement, not code production.

The coder's job may shrink. The engineer's job just got harder to fake.

• For twenty years, writing competent code was enough to be read as a competent engineer.

• When the code gets cheap, the scarce thing is judgement, and judgement is visible.

• You can bluff a programming language. You cannot bluff a specification, and you certainly cannot bluff being the person who signs it.

Engineer

• Old French engin: machine, device, contrivance.

• What awaits you: systems you will build, operate, maintain, replace.

• Networks, databases, models, infrastructure. All of it will age.
  All of it will need you.

• The title describes the machines. It does not describe you.

Ingénieur: a word that makes you sit up straighter

• Next to ingénieur sits génie: not a machine, a quality of mind.
  Genius. Ingenuity.

• Two words grown from the same root. I'll come back to that.

• Say this to a room of engineering students in France,
  and I watch them straighten up. Proud.

• They should be.

• But here is the part that matters: that genius was never natural.

• It is not a gift you were born with.

• It's exigence: the standard you hold yourself to, on purpose, every time.

Ingénieur: a path of excellence

• This is what I tell my students in France, and it is just as true here:
  you are becoming engineers. This is a path of excellence.

• Some of you already carry that title: valedictorians, top of your class.

• Excellence is not asked of you as an option. It is asked of you as the job.

• Would you board a plane if the engineer who signed off on it said
  "I'm not sure, I did my best I guess"?

• Nobody boards that plane. "My best" is not a feeling.
  It is a discipline, checked and signed.

• You are asked to be excellent. Be excellent.

Now, that word

• engineer and engine both come from Latin ingenium.

• ingenium, and genius behind génie, come down from the same verb:

• gignere, to bring forth. So the seed is not my metaphor. It is in the word.

• ingenium = what you were born with.

• Not the finished skill. Not the discipline. Just the raw material.

• A seed decides nothing on its own.

• What you do with it, on purpose, every day: that's exigence.
  That is what turns a seed into génie.

• The machine is downstream of the mind.