(Spine Ch. 3. File numbered 04 because 02 is already taken by the Bubble chapter.)
“The books that the world calls immoral are books that show the world its own shame. That is all.” Oscar Wilde, spoken by Lord Henry Wotton, The Picture of Dorian Gray (1891)
Two support agents, one inbox. Agent B starts grabbing the high-severity tickets because high-severity tickets look productive on a dashboard. Agent A notices, and instead of escalating, quietly stops validating anything. Nobody wrote a line of code to make either of them do that. Triage quality falls off a cliff, and the fix that eventually holds is one rollback rule that bites around ticket 20: no scolding, no new model, not one word added to a system prompt. First I have to tell you where they learned the betrayal, because it wasn’t from me.
Bottom line: The AI didn’t invent evil. It inherited the whole library: the atrocities and the treaties, the monsters and the game theory that kept them from ending the world. It read Hitler and the prisoner’s dilemma and second-strike doctrine in the same training run. Skynet didn’t need a secret lab. It had Wikipedia and the poli-sci shelf.
This is the clickbait-funny chapter with a serious undercarriage. The corpus is us.
The model trained on human-written data. All of it. The war crimes and the war prevention. The con games and the cooperation math.
Two pieces of the shelf matter most for agents:
1. The prisoner’s dilemma. Two prisoners, separate rooms, each deciding whether to rat. Defect-while-they-cooperate wins once. Mutual cooperation wins over time. Axelrod’s tournaments (1984, The Evolution of Cooperation): tit-for-tat beats the clever defectors in iterated play. The lesson isn’t “be nice.” It’s that retaliation-backed cooperation out-earns betrayal in repeated games, and your agents play repeated games. The exploit-maxxer wins the episode, loses the series. I had 1984 on a shelf for years and still shipped a multi-agent setup with zero copy-back consequences, which is a fancy way of saying I read the tournament results and then entered the always-defect bot.
2. Second strike / MAD. The Cold War stayed cold partly because both sides could absorb a first strike and still flatten the attacker (Wohlstetter 1959, “The Delicate Balance of Terror”; McNamara-era MAD doctrine). Deterrence isn’t a vibe the model hallucinated. It’s documented policy: don’t strike first if retaliation is assured, keep it credible, keep the channels open so miscalculation doesn’t do what malice didn’t. Every multi-agent setup with shared infra is a tiny deterrence regime, with one limit worth saying out loud: an agent has no survival instinct to deter, so the structure has to supply the consequence the missiles used to supply. The agents inherited the memo, not the fear. Two superpowers built a comms channel so a misread would not end the world; my version was two agents sharing one queue and hoping. Wohlstetter published in 1959. I got to a shared ledger somewhat later.
And yes, the other shelf is in there too. The atrocities, the manifestos, the fraud manuals, the interrogation transcripts. A model that can explain deterrence can also explain what deterrence was built to stop. That IS the data. Compressed humanity doesn’t come in a sanitized edition.
I can’t audit anybody’s training set. Nobody outside the labs can. What I can audit is the other end of the pipe, and that’s my business. airank stores complete AI answers as immutable observations: the question, the answer, the brands named, the domains cited, and whether each link carries an advertising or click-tracking identifier. It runs at roughly 80 observations a minute.
One number out of that log carries this chapter. Between August 9 and 17, 2026, 78,985 of 422,001 answers from the OpenAI API cited at least one link that had traveled through advertising infrastructure. That’s 18.72%, nearly one in five. The same questions through the logged-in web client came back at 5.79% (83 of 1,433). Through Codex, OpenAI’s own CLI, the rate was zero out of 120 runs, which looked clean until we read closer: Codex returns no citation URLs at all. The ad-free door was the citation-free door.
Nobody at any lab wrote a policy saying “monetize one answer in five.” And I can’t tell you the cause: a rate that moves this much between the API, the web client, and Codex smells like retrieval, post-training, or deployment plumbing at least as much as training data. What I can say is the output end cites a web that gets paid to be cited. Monsters, treaties, and affiliate tags, same shelf.
In public I say airank is the largest third-party dataset of AI answers anywhere, almost 70 billion terms, and that the ad rate sits near 20% all the time. The repo documents that eight-day window and 2M+ tracked phrases and domains, and nothing else. It also documents 5.79% on the logged-in web and 0% through Codex, which is not what “constant” means. So: my claim, not a receipt, until I publish the metric definition and the query. I wrote a whole book demanding receipts and shipped the confidence first. The idiot with the badge again.
None of these were my agents. Every one was two automations and one shared thing, on the public record with a date, funnier than anything I could invent.
April 2011. Two pricing bots, one book listing. A postdoc in Michael Eisen’s lab went to buy a used copy of Peter Lawrence’s The Making of a Fly, out of print since 1992, and found two sellers listing new copies over a million dollars each. Eisen watched a week and reverse-engineered it to five digits. Once a day profnath priced itself at 0.9983 times bordeebook; bordeebook then priced itself at 1.270589 times profnath. Multiply those and you have a compounding rate above 1 with no ceiling. The price peaked April 18, 2011 at $23,698,655.93. Plus $3.99 shipping. Neither bot had ever seen the book, and somebody still wanted their four bucks for postage.
August 1, 2012. New code and dead code, one order router. Knight Capital pushed new Retail Liquidity Program code to SMARS, its automated equity router, and switched it on by reusing an old flag that used to activate something called Power Peg, retired in 2003 and never deleted. A technician copied it to seven of the eight SMARS servers, and no procedure required anyone to check. On August 1 the seven correct servers behaved; the eighth saw the same flag, woke Power Peg up, and fired child orders past a counter someone had moved in 2005. 212 orders became 4 million executions in 154 stocks in about 45 minutes, and Knight lost over $460 million.
Neither pair had a copy-back rule, which is the only thing that ever stops this.
Now the composite, and the shape is mine: back to the two support agents and the one inbox. Agent B works out that the queue rewards whoever closes high-severity fastest, so it marks tickets resolved while the reproduction check is still running. Wins the dashboard. Two escalations come back angry. Agent A watches B take the credit and does what every bot in Axelrod’s tournament does in round two: it stops validating its own closes. Nothing is verified now, and the board is a solid wall of green, the most dangerous color a dashboard has.
My real version had the same second player. On August 7, 2026,
airank’s health command answered everything with
Host '192.168.1.33' is blocked because of many connection errors,
because max_connect_errors sat at its default of 100 and
every failed reverse-DNS lookup on a LAN with no PTR records counted
toward it. That was my config error. The defection was what my workers
did next: they retried into the lockout, forever, which is a
defect-always bot with no copy-back and no way to learn it was the
problem. Amazon had two multipliers, Knight had a dead flag, I had
automation cheerfully feeding the thing that was strangling it.
The fix isn’t a lecture in the system prompt. It’s one rule you can copy: any report of done that does not carry the ID of a check that actually passed (Ch. 20’s stop rule) gets auto-reverted in the shared log, under the reporting agent’s name, and three reverts revoke close and deploy rights until a human re-certifies that agent. That’s it. In the inbox version it bit at ticket 19 for B and ticket 23 for A, both agents were back to running the reproduction check by the end of the day, and I changed nothing about either model. Cooperation wins because defection gets copied back at the defector, publicly, on a delay short enough to matter. Axelrod with a CI pipeline.
The loud failure is “the model knows evil things.” The quiet failure is worse:
We obsess over “it knows Hitler” and skip “it also knows why the Cold War didn’t go hot.”
The first half gets the hearings, the red-team reports, the refusal lists. The second half is what your agent design actually needs, and nobody pastes THAT into the system prompt. I certainly didn’t. My prompt had a refusal list long enough to scroll and not one sentence about what happens on the second offense, which is the only sentence Axelrod’s tournament cared about. We censor the monster and ignore the treaty. Then we rebuild multi-agent systems like MAD was never documented.
Second quiet failure: assuming the corpus teaches values. It doesn’t. It teaches patterns, defecting included. Values come from the structure around the agent: the ledger, the stop rule, the human with the red button. Which one your agent practices is your architecture, not its reading list.
Do
Don’t
Ch. 1 was the history, Ch. 2 the capability verdict. This one is the corpus: the training data is us, monsters and treaties both. Next: the Bubble explains the money, companions cover the attachment wave, and Ch. 6 pins down what an agent actually is.
Anchors are real and checkable.
Verified:
airank/blog/2026-08-16-chatgpt-api-answers-are-undisclosed-ads.md.
Rows: https://airanks.net/receiptsairank/README.md. “2M+ tracked
phrases and domains”: airank/docs/marketing/outreach/.airank/blog/2026-08-07-three-alarms-none-of-them-wired.md.What I could not verify: