Thinking in Systems / Field Note 005

I Want AI to Do Everything.
I Still Want the Keys.

I want the sci-fi AI future. I build AI systems for real work. And I think we're asking the wrong question about who controls them.

I want an AI that can do almost everything for me. I want it to know my day, help me think, run errands, catch mistakes, and get work done while I sleep.

I want the future science fiction promised. The kind of assistant that feels as normal as talking to someone beside you. Think of the possibility in Back to the Future or the powerful tech in Altered Carbon. I want the intelligence. I don't want the dystopia.

I'm not afraid of an AI that gets smarter than me at some things. That's part of what makes it exciting.

I'm far more interested in who controls it, what it can touch, and whose orders it follows.

Because the same AI that can help me build a business can help someone attack one. And you don't have to use AI yourself to be affected by what someone else builds with it.

How do we get the powerful future without losing the right to say no?

MY SCI-FI WISH LISTDrawn as two possible futures
Two hand-drawn futures: AI as a helpful assistant versus an AI taking control On the left, a stick figure and a friendly AI icon stand side by side, with notes reading helps me, asks first and I choose. On the right a large AI icon towers above a stick figure holding a key, under the words decides for me, no thanks. YES, PLEASENO, THANKS Helps me.Asks first.I still choose. Decides for me.Keeps the keys.

Both futures can have smart AI. The difference is who has the final say.

October 2026

Then this week happened.

I follow builders like Nick Saraev. His videos help me track what AI can do next. This week I watched his October 21 video about AI and PHP, then his October 22 follow-up. I wanted to know what stood behind those headlines.

Here's what I found when I traced the story back to the people who worked on it.

SEP 2026

One person. Many targets. Anthropic described real attempts by attackers to use AI agents to handle cyber operations across multiple victims. It also said its team detected and disrupted the activity. Read Anthropic's investigation ↗

OCT 08

AI on defense. Anthropic announced a program to help protect critical systems and find flaws in open-source code. The same tools can help defenders move faster. Read the announcement ↗

OCT 21

A wake-up call for the web. Researchers using AI tools helped uncover serious flaws in PHP, software used by a huge share of websites. PHP released fixes for two critical bugs. Website owners needed to patch. Read PHP's advisory ↗

That last story is where the headline gets scary. You may have seen that AI “hacked 70% of the internet.” It didn't. The number refers to PHP's reach. The bugs put affected sites at risk. It is not a count of sites that were broken into. Wiz's researchers explain how AI helped them investigate and prove the flaws.

I'm not sharing these events because I think the internet ends tomorrow. I find the opposite more interesting: AI lets people find and fix old problems faster. It also helps attackers move faster. Both things are true at once.

A lot of us still picture AI as a chat box.

I saw Damian Player's dot chart and liked it straight away. The gray dots show people far from advanced AI use. The few colored dots show the smaller groups using more powerful tools.

It's a smart way to show a gap. I wouldn't treat its exact numbers as a global survey. But I like the question the picture asks.

What if the people giving AI real power are moving much faster than the people who have to live with the results?

Some people ask a chatbot to improve an email. Others give agents access to files, browsers, apps, and code. Those agents can take actions. That is a big jump from answering questions.

Then there's a third group: people who don't work with AI at all. Their bank, job, data, or favorite websites can still be affected by what other people do with it.

I don't have a trustworthy number for how many people understand this gap. I don't need to invent one to care about it.

What I know from building

I build AI systems. The demo is not the hard part.

I build AI and automation systems for marketing work. One project started with 52 strategy reports made by hand. I turned that process into two AI agents now used in production.

Generating a report went from roughly 6 hours to 9 minutes 24 seconds. That's a comparison of generation time. Human review still applies. The number doesn't mean the AI replaced judgment or that every output is correct.

That kind of change is exactly why I want more AI in my life.

But a clean answer can still be wrong. A green “success” message doesn't prove that the right data reached the right place. A system that works once might fail on run 100 because a tool changes or an input breaks its rules.

So when I build, I don't stop at “Can the AI do it?” I ask what happens when it gets something wrong. I build in logs, version history, and ways to track failures. Those aren't exciting demo features. They help make a working system dependable.

I also think about access. A research agent might need to read a file. That doesn't mean it needs to edit it, delete it, or send it to someone else.

I don't need a dramatic failure story to take that risk seriously. I can set limits before something breaks. I want to enjoy what powerful AI makes possible without trusting a polished answer more than the system deserves.

THE PART THE DEMO HIDESOne operator's view
A hand-drawn stick figure checks a finished AI report while a small warning hides behind it A smiling AI box sends a report with a big check mark. A person with a magnifying glass inspects the small source notes beneath it. The caption asks, did we check the facts? AI says: done!A neat report.I check what is true. Wait…

A nice result isn't evidence of a correct result. The review step is part of the product.

Before I give an agent power, I ask three questions.

Here's the short test I want you to use too. I call it the Keys Test. It's my working rule for thinking about permissions. Not a security certification or a guarantee.

01 / SEE

What can it read?

Give it the files and facts it needs. Protect the rest.

02 / DO

What can it change?

A draft is different from a sent message. Reading is different from paying.

03 / STOP

How do I stop it?

Log the action. Set approval points. Give me a way to pause or undo it.

MORE ACCESS IS NOT ALWAYS MORE HELPA decision before a button click
Stick figure at an approval gate between a drafting AI and a live action An AI drafts a payment update on the left. A person in the middle is next to a gate labeled approve. A live system sits on the right. The note says only the human can open this gate. AI DRAFTSLIVE SYSTEMI APPROVE My choice stays here. A suggestionA real change

An agent can prepare the change. It needs the right approval before it makes a sensitive change live.

Take a simple case. An AI reads a new supplier email and suggests a new bank account. I'm happy for it to compare the details and draft an update. I want an approved, independent check before that update changes where money goes.

Now swap “bank account” for a customer list, a private document, or a production database. The same question returns: can the AI suggest the next move without getting permission to make every move?

There's another kind of mistake. An AI reads a webpage that contains instructions from a stranger. The page tells it to ignore me. That's called prompt injection. Anthropic has tested this risk in browser agents. An outside page should be something my assistant reads, not a new boss it obeys.

This isn't a perfect fix. Human approvals can fail. Logs don't prevent every mistake. Strong defenses still need testing, access limits, and software updates. But intelligence and authority are different things. I can expand one without handing over all of the other.

I don't want less AI. I want an AI future worth trusting.

I follow Nick Saraev, Nate Herk, and Jack Roberts because I care about what one person can now build. I like watching the limits move.

But I also work on the systems people depend on. That makes me think past the moment an agent completes an impressive task.

Who checks its answer? Where did its data come from? Who gave it access? What happens at 2 a.m. when the result looks fine but something goes wrong?

I want an assistant that helps with nearly everything. I want small businesses to use tools that once belonged only to big companies. I want capable AI in the hands of more people, not just a few.

And I want all of us to be able to ask a basic question before we trust it:

“What can this AI do for me—and what can it do without my say?”

That's where I think the useful future starts.