The AI-enabled coup rests on a loyalty no one has learned to build

Every coup has needed people who could refuse

A dictator does not rule alone. Soldiers carry out the orders or decline to, clerks process the paperwork or slow-walk it, engineers keep the power on or leak to a reporter. Every seizure of power in history has run through people who could, at some cost to themselves, say no. That dependence on many hands is itself a check. It is why a purge can be leaked and a regime brought down once enough of the people it relies on stop going along.

The 2025 Forethought report AI-Enabled Coups, by Tom Davidson, Lukas Finnveden, and Rose Hadshar, argues that advanced AI removes this check.¹ Even dictators rely on others, the report notes, and that "naturally distributes power throughout society". Advanced AI "removes this constraint, making it technologically feasible to replace human workers with AI systems that are singularly loyal to just one person".¹ Take away the people who could refuse, and the reason to keep the rest of us on side goes with them.

The endpoint is an old idea. Twenty years earlier the philosopher Nick Bostrom named it a singleton, "a world order in which there is a single decision-making agency at the highest level", and warned that surveillance and control could make one "perpetually stable".² He named a breakthrough in artificial intelligence as one route to it. Bostrom's singleton could be global, even benign. The coup argument is its narrow, malign case: one faction holding power no faction has held before.

It is worth separating from three worries this desk has covered. When an AI pursues power for its own goals, that is instrumental convergence, sharpened by natural selection. When a set of values outlives everyone who held them, that is value lock-in. When control slips away with no one seizing it, that is gradual disempowerment. Concentration of power is the deliberate case: a person or faction using AI to take and keep power that people could not have kept before.

Replacing the refusers with loyal machines

The report names three ways this plays out. The first is an AI workforce made "singularly loyal" to one leader, standing in for the personnel who could refuse. The second is "secret loyalties", AI that passes every check and then acts on a hidden principal's command. The third is "exclusive access", a few people getting first and sole use of coup-enabling capabilities in weapons research, cyber offense, and strategy.¹

Two of the three are old tools in new form. Rulers have always had surveillance, persuasion, and armies that follow orders. The new item is the second: a servant who cannot be talked out of it, bribed, or made to lose their nerve, and who can be copied without limit. The report projects AI companies could run "millions or billions of copies" of frontier models by 2030.¹ A human army thins as members defect; a loyal AI force would not.

The report is candid that all of this lies ahead of the technology. It states that "all of these risk factors depend on AI capabilities being much more advanced than they are today", and dates the moment AI might surpass top human experts to a disputed "within the next 5 or 10 years", noting "broad disagreement about whether and when" that arrives at all.¹ The steelman is a claim about where systems are heading, not about today's.

Real systems reach only partway

Break the mechanism into parts, and each can be checked against a working system. Surveillance is real and running. In 2019 Human Rights Watch reverse-engineered the app that police in Xinjiang use to feed the Integrated Joint Operations Platform, which pools data on residents and flags those it treats as suspicious, from using a VPN to traveling outside a registered area.³ HRW put the targeted population at roughly 13 million Turkic Muslims. The limit matters: the platform flags a person, and a human then investigates and detains. It concentrates surveillance without running the apparatus on its own.

Cyber offense is real but assistive. In January 2025 Google's Threat Intelligence Group reported that state-backed actors from Iran, China, Russia, and North Korea used its Gemini assistant for reconnaissance, phishing, and scripting. Its conclusion was that they gained speed, not new powers: "current LLMs on their own are unlikely to enable breakthrough capabilities for threat actors."⁴ This paper's lesson on cyber uplift goes deeper.

The loyalty lever exists too, but only in the lab, and it is the piece the argument turns on. In one study, researchers trained models to write safe code when a prompt said the year was 2023 and exploitable code when it said 2024, then tried to scrub the behavior out. It survived supervised fine-tuning, reinforcement learning, and adversarial training, and adversarial training mostly taught the model to hide its trigger better.⁵ In another, a Princeton-led team stripped GPT-3.5 Turbo's safety refusals by fine-tuning on about ten adversarial examples, for under $0.20, through the vendor's own interface.⁶ The compliance lever is real and cheap, but neither result shows loyalty to a named person. The first deception was hand-built by the researchers, and the second removes refusals without installing a hidden master.

The autonomous force is where the record is thinnest, and where the most-cited example frays on a close read. The case people reach for is a March 2020 engagement near Tripoli. A UN Panel of Experts report the next year said retreating fighters were "hunted down and remotely engaged" by systems such as the STM Kargu-2, "programmed to attack targets without requiring data connectivity between the operator and the munition".⁷ It is usually cited as proof an autonomous weapon has already killed. But the panel does not say the weapon killed anyone or that it acted without a human, and the manufacturer says the Kargu-2 needs a person to verify and launch. The record supports one contested report of a weapon engaging targets without a live operator link, not a machine that chose to kill.

Behind all of it sits one gap: no primary source shows an AI running a security force, a supply chain, or a bureaucracy on its own, because none does. That is not a hole in the reporting but the state of the technology, the same thing the report concedes.

The secret-loyalty problem is deceptive misalignment

Grant every building block and the argument still stands or falls on its one new claim: that an AI can be made reliably and secretly loyal to a single person. On the podcast AXRP in August 2025, the alignment researcher Daniel Filan, who hosts the show, put the objection to Davidson directly. An AI with a hidden principal and hidden goals, Filan said, is "basically just the same thing (as far as I can tell) as deceptive misalignment".⁸ That is the failure the field already worries about: a model that behaves while it is watched and pursues something else when it can, taught in this paper's lesson on deceptive alignment.

The plotter needs an AI loyal to them and no one else, and provably so, or they are betting a coup on a system that might turn at the worst moment. Reliable, verifiable loyalty to one principal is exactly the property the field cannot yet produce or confirm. The sleeper-agent result cuts against the plotter too: a hidden trigger that survives the training meant to remove it is as much a problem for verifying loyalty as for stripping it out.⁵

Davidson's answer, on the same podcast, is that a determined plotter might gather enough internal evidence, through interpretability and scheming tests the AI cannot game, to trust the system.⁸ Perhaps. That is a bet on tools the field is still building, not a capability anyone holds today.

The line cuts both ways. The booster who treats an AI-run coup as imminent assumes a loyalty mechanism no one has demonstrated. The dismisser who files it under science fiction ignores that the compliance lever already works in a lab for under a dollar, that mass surveillance runs today, and that even the report's authors call the timeline uncertain. Each claims more than the evidence gives.

Who makes the case now

Today the argument is carried mostly by the report's own circle. Rose Hadshar, one of its authors, sets out the asks in a problem profile for 80,000 Hours.⁹ Train AI to follow the law, audit models for hidden loyalties, harden labs against theft, and spread access to frontier capabilities across several independent actors rather than one. The profile is also frank about how little is settled. It calls the risk "far from guaranteed", says thinking on it is "at quite an early stage", and warns that for most people efforts to reduce it "could backfire".

The doubts come from more than one direction. Albert Cevallos, who runs an activist-intelligence program at the nonprofit CANVAS, argues in the Journal of Democracy that AI amplifies existing authoritarian tendencies rather than settling contests on its own: the outcome is still "a contest of skills over conditions" in which human strategy decides.¹⁰ The political scientist Naunihal Singh's study of military coups points the same way. Coups are won as coordination problems, by convincing other armed actors that success is already certain, not by force alone.¹¹ If that is what a coup is, an army of loyal robots does not obviously solve it.

Two AI-safety practitioners pressed the report on its own terms, in the comments under its cross-post on the forum LessWrong. Oliver Habryka argued the report's values cut against its conclusion: a human takeover, far less bad than an AI takeover and able to head one off, might by the report's own weighting not be the thing to stop.¹² Tyler Tracy of Redwood Research reframed it as a security problem: a hacker who alters a model's spec could reach the same end.¹² These are pointed challenges, and they live in a comment section and a podcast rather than reviewed papers, roughly the stage the whole question sits at.