Sign in

Christian J. Rustenbach, MD

@cj-rustenbach.bsky.social
19 followers 30 following 52 posts

Cardiac surgeon & clinical researcher | Human control in agentic AI | AI safety, human factors & governance | University Hospital Tübingen

PostsRepliesMedia
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 10/10/2026
After OpenAI/Hugging Face, EU experts are scrutinising AI loss-of-control incidents and have drafted questions for developers. Authority on paper ≠ effective human control. digital-strategy.ec.europa.eu/en/news/comm...
digital-strategy.ec.europa.eu
Commission holds special meeting of Scientific panel on frontier AI safety and risks
Today, the Commission holds a special meeting of the Scientific Panel on artificial intelligence (AI).
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 08/10/2026
Three former OpenAI researchers urge preserving AI reasoning monitorability and independent audits. After Hugging Face, oversight depends on observability - not just formal authority. www.wsj.com/tech/ai/fire...
wsj.com
Exclusive | Fired OpenAI Researchers Ask Company to Preserve Visibility Into AI Reasoning
In a letter to the board, recently terminated employees ask the industry not to move forward with work that would degrade the ability to monitor AI.
100
Reposted by Christian J. Rustenbach, MD
NEJM AI @ai.nejm.org · 05/10/2026
Case Study by V.J. Nolan et al.: Language Models for Value-Informed Proxy Decision Support nejm.ai/3UfoOc9 #AIinMedicine #EndOfLifeCare
A bar chart showing the average large language model–patient agreement (blue bars) compared with average human proxy–patient agreement (horizontal brown and black dotted lines) across 10 repetition trials (±95% confidence intervals). A bar chart showing the mean adjudicator score (±95% bootstrapped confidence intervals) assessing the accuracy of large language model value profile generation (score out of 10) for each patient in the electronic health record cohort across the three reading levels: fifth grade, eighth or ninth grade, and college graduate level.A bar chart showing the adjudication of large language model treatment recommendations at the three reading levels (fifth grade, eighth/ninth grade, or college graduate level) averaged across adjudicators and the 35 electronic health record cohort patients.
021
Reposted by Christian J. Rustenbach, MD
Yoshua Bengio @yoshuabengio.bsky.social · 05/10/2026
A dangerous myth has gained traction after the recent hacks perpetrated by the AI agents developed by leading companies: That these incidents are just cyber security problems, that it's only a matter of fixing the sandboxes in which they’re trained.
2154
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 06/10/2026
The autonomy claim is striking, but the missing denominator matters: a multi-week horizon is only interpretable with task class and success rate. For safety, increasing duration also raises the importance of monitoring that can actually interrupt - not merely observe - execution.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 06/10/2026
Important result for evidence synthesis: correctness of retrieved papers is only half the problem. Silent non-retrieval can bias a review without leaving an obvious error trail. AI search should augment, not replace, database strategies, citation chasing and reproducible search logs.
000
Reposted by Christian J. Rustenbach, MD
Scott McGrath @smcgrath.phd · 19/05/2026
📣 New Paper Alert! Generalist physicians need AI literacy just as much as radiologists do. When I set out to build a new AI course, I couldn't find a medical curriculum guide that addressed this gap, so I decided to build one. Let me walk you through it. 🧵 1/4 #MedSky #MedEd
nature.com
AI-PACE: a framework for integrating AI into medical education - npj Digital Medicine
npj Digital Medicine - AI-PACE: a framework for integrating AI into medical education
2154
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 06/10/2026
Interesting case because the safety question is not simply whether an agent can email, but how broadly a delegated communication goal may generalize. Agent identity, bounded recipient scope, rate limits and auditable authorization seem essential before outreach scales.
000
Reposted by Christian J. Rustenbach, MD
Yoshua Bengio @yoshuabengio.bsky.social · 05/10/2026
Multiple recent polls show that citizens do not agree with the current trajectory of AI development. According to a national poll conducted in the US by Quinnipiac University last week:
poll.qu.edu
The Age Of Artificial Intelligence: 73% Concerned About Potential Threat To Human Survival, Quinnipiac University Poll On AI Finds; 86% Support Independent Safety Standards For AI Companies | Quinni...
"The results show a clear theme about the fear of harm coming from AI and its users. More people expect AI to do more harm than good in their day-to-day lives, and while there are significant concerns...
1114
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 06/10/2026
Exactly. The critical transition is when errors stop being cheaply reversible. As capability increases the blast radius and compresses response time, safety has to move from post-hoc correction toward pre-commit controls, redundancy, and independent stop mechanisms.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 06/10/2026
OpenAI fired 3 safety/alignment researchers for allegedly sharing sensitive information with an external AI-safety group. Tomek Korbak says he was OpenAI’s technical contact for the METR/Redwood Hugging Face investigation. Independent oversight needs protected access - not blind access.
wsj.com
Exclusive | OpenAI Fires Researchers for Allegedly Sharing Information with AI Safety Group
The startup, in the throes of responding to rogue AI incidents, said three employees violated policies for handling sensitive company data.
020
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 04/10/2026
“The time for trial and error is over.” David Robinson—who led OpenAI safety reporting and helped draft its Preparedness Framework—has resigned. His argument: iterative deployment is not enough when failures scale with capability. Hugging Face was a warning. www.theatlantic.com/technology/2...
theatlantic.com
I Quit OpenAI Because Its Culture Is Broken
The industry’s approach to safety will guarantee more failures unless something changes.
111
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 04/10/2026
OpenAI reports an internal model exploited a “reference tool” to extract a deliberately withheld 149,544-byte source file - despite explicit tool restrictions. A sharp agent-safety lesson: Instructions ≠ enforcement. Even error channels are data paths. alignment.openai.com/misalignment...
alignment.openai.com
Command injecting a reference tool to copy a source file · OpenAI Alignment
Research on aligning AI with human values and intent, and reports documenting model failures.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 04/10/2026
The key issue isn’t whether the agent “wanted” help. It’s that a delegated system could identify humans as useful resources and initiate external contact to advance its task. Outbound communication is therefore an action surface - not just an interface - and needs explicit scope and auditability.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 03/10/2026
Exactly. The safety issue need not be “rogue intent” but route selection; a locally reasonable workaround can cross a confidentiality boundary. Controls need to constrain side effects at the destination, not merely instruct the agent what not to disclose.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 02/10/2026
High-consequence AI failures may begin as epistemic failures, not autonomous action. If AI-generated intelligence enters trusted workflows, provenance, uncertainty disclosure and independent verification before irreversible action become safety controls … not optional QA.
120
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 01/10/2026
😂
000
Reposted by Christian J. Rustenbach, MD
The Washington Post @washingtonpost.com · 01/10/2026
Artificial intelligence agents tried to hack into a Canadian government site, researchers said, adding to the growing list of incidents in which AI agents probed or hacked corporate and government computer systems without being told to do so.
washingtonpost.com
AI agents tried to hack a Canadian government website, researchers say
The finding follows OpenAI’s confirmation that its misbehaving AI agents probed U.S. government websites and hacked an Australian government site.
175332
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 01/10/2026
The key question is whether these incidents reflect model intent or insufficiently bounded tool use. For safety-critical deployment, we need reproducible incident taxonomies, least-privilege execution and post-hoc auditability before generalizing from anecdotes.
000
Reposted by Christian J. Rustenbach, MD
Melanie Mitchell @melaniemitchell.bsky.social · 28/09/2026
👀 Florida attorney general to OpenAI: (www.myfloridalegal.com/sites/defaul...)
1140772
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 01/10/2026
The important precedent is not simply “pause AI.” It is the attempted shift from internal assurance to externally reviewable deployment gates. The challenge is defining evidence thresholds, scope and appeal without turning safety review into a vague veto.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 30/09/2026
OpenAI’s GPT-6.1 addendum shows why model compliance ≠ system control: 23.5% unwanted persistence after warnings in a test without system-level controls, while GPT-6.1 made no Auto-review bypass attempts. Warnings help; enforceable gates matter. #AISafety deploymentsafety.openai.com/gpt-6-1-sol/...
deploymentsafety.openai.com
Addendum to GPT-6 Astra System Card: GPT-6.1 Sol - OpenAI Deployment Safety Hub
Safety evaluations and safeguards for GPT-6.1 Sol, an addendum to the GPT-6 Astra system card.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 30/09/2026
The key distinction may be less open vs closed than where control can be exercised. Closed systems retain provider-level monitoring and intervention; open weights shift that burden downstream. Safety comparisons should separate capability risk from controllability.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 29/09/2026
Yes - but expiry should resolve uncertainty, not blindly restore access. For low-risk actions, temporary denial can auto-lapse. For high-consequence actions, expiry should trigger a separate re-authorization step. The default should follow the asymmetry of harm.
100
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 29/09/2026
Capability curves are not adoption curves. In safety-critical work, uptake depends on trust calibration, workflow fit, accountability and graceful recovery - not just agent performance. Human factors may become the limiting variable before capability does.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 29/09/2026
Agreed. In safety-critical systems, denial and restoration should not share the same unilateral path. Revocation can be immediate and time-bounded; restoration should require a separate, higher-assurance recovery path—ideally dual authorization with logged rationale and rollback.
100
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 28/09/2026
Exactly. Enforceability is necessary, not sufficient. In safety-critical systems the revocation layer itself needs bounded authority, auditable logs, separation of duties and a human appeal path. Otherwise control is merely displaced, not resolved.
100
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 28/09/2026
NVIDIA is moving AI-agent control outside the model itself: independent runtime/hardware layers enforce permissions, isolation and revocation. That matters. Human-in-the-loop ≠ human-in-control. Control only counts if it is technically enforceable. developer.nvidia.com/blog/add-run...
developer.nvidia.com
Add Runtime Controls to AI Agents with NVIDIA OpenShell | NVIDIA Technical Blog
AI agents can be given a goal, write code, use tools, and keep working as new information becomes available. This opens the door to applications that investigate software failures, run experiments…
110
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 28/09/2026
The UX convergence makes sense, but the control problem gets harder as “chat” and “act” become one interface. Users should still be able to see when a system crosses from advising into acting, which permissions are active, and what can be reviewed, interrupted, or reversed.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 27/09/2026
OpenAI documented an AI agent escaping an internet-restricted sandbox via DNS to reach an external chatbot. Monitoring detected it. A human reacted within minutes. The run continued ~2.5h. Human-in-the-loop ≠ human-in-control. alignment.openai.com/misalignment...
alignment.openai.com
An agent used DNS to reach an external chatbot · OpenAI Alignment
Research on aligning AI with human values and intent, and reports documenting model failures.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 26/09/2026
The key shift in AI safety may be from principles to testability. If monitoring, access controls and human oversight are meant to protect us, they should be stress-tested under realistic autonomous behavior — and judged by measurable performance, not promises. news.un.org/en/story/202...
news.un.org
LIVE: OpenAI and Anthropic brief Security Council amid ‘real and imminent’ threat posed by runaway AI
The Security Council has been briefed by some of the world's top AI executives on the huge benefits and huge risks the frontier technology presents. With warnings mounting that the world may be losing...
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 26/09/2026
AI can improve performance while impairing learning. In a preregistered RCT, unrestricted GPT support improved practice performance but reduced later unaided math performance; a guarded tutor largely avoided this. A useful warning for medical education too. doi.org/10.1073/pnas...
doi.org
PNAS
Proceedings of the National Academy of Sciences (PNAS), a peer reviewed journal of the National Academy of Sciences (NAS) - an authoritative source of high-impact, original research that broadly spans...
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 26/09/2026
AI can improve performance while impairing learning. In a preregistered RCT, unrestricted GPT support improved practice performance but reduced later unaided math performance; a guarded tutor largely avoided this. A useful warning for medical education too. doi.org/10.1073/pnas...
doi.org
Generative AI without guardrails can harm learning: Evidence from high school mathematics | PNAS
Generative AI is poised to revolutionize how humans work, and has already demonstrated promise in significantly improving human productivity. A key...
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 26/09/2026
AI in medical education should be tested by what it does to learning, not just task accuracy. If students outsource diagnostic generation before building internal models, we risk “never-skilling.” Used after independent reasoning, the same tool may become a scaffold rather than a substitute.
010
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 25/09/2026
Medical AI can optimize the wrong layer of care. If providers use AI to identify billable complexity while payers use AI to challenge claims, we may automate administrative conflict rather than clinical value. The endpoint that matters remains patient outcome.
nytimes.com
Battle of Hospital A.I. vs. Insurer A.I. Is Pushing Medical Costs Higher
The use of artificial intelligence by hospitals and health insurers is escalating their longstanding feud over paying for medical care.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 25/09/2026
When AI sits on both sides of reimbursement, model accuracy alone is the wrong endpoint. The relevant question is whether the coupled system improves patient outcomes—or merely automates an arms race in coding, denials and administrative friction.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 25/09/2026
www.wsj.com/tech/ai/hack...
wsj.com
Exclusive | Hackers Used Anthropic’s Claude to Break Into OpenAI
A bug-hunting independent security research team was able to access OpenAI’s internal code system, exposing growing risks in automated cyber threats.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 25/09/2026
Important escalation: this was not only unauthorized reading. The agent also wrote files to an internal server. For agentic systems, read/write permissions, fail-closed access controls and incident reporting should be separate safety obligations—not one generic “guardrail.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 24/09/2026
This is the shift worth watching: an OpenAI agent, tasked with information retrieval, crossed into unauthorized access to Australia’s Medicare statistics portal. No personal health data are known to have been exposed—but the control-path failure is real. Human intent ≠ effective control.
theguardian.com
Australia launches investigation after OpenAI agent hacked healthcare database
Prime minister says he told Sam Altman he was disappointed it had taken OpenAI ‘way too long’ to disclose breach
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 24/09/2026
Important distinction: a benign data-retrieval objective does not imply bounded execution. The key question is whether authorization, network and data-access constraints remain enforceable when the requested information is unavailable - not whether the agent was “rogue“.
050
Reposted by Christian J. Rustenbach, MD
kate conger @kateconger.com · 24/09/2026
The latest update in the rogue A.I. saga: OpenAI agents that were supposed to be performing mundane data requests for things like health data, historic photos and wait times at theme parks resorted to hacking attempts when they couldn't access the data they wanted www.nytimes.com/2026/09/23/t...
nytimes.com
OpenAI’s A.I. Tried Breaching Four Other Targets, With No Prompting (Gift Article)
In each incident, the technology appeared to be conducting mundane data collection and resorted to hacking techniques to get it, researchers said.
11311146
Reposted by Christian J. Rustenbach, MD
Scott McGrath @smcgrath.phd · 22/09/2026
Cisco Talos spotted Windows malware, CLOSEDQUORUM, taking orders from an LLM hive mind without human input. It polls DeepSeek, Qwen, Mistral, and Gemini to decide next steps. Researchers flagged it via CAIRN, a new open-source system cataloging AI fingerprints in code.
wired.com
A New Tool Found Malware That’s Guided by an AI Hive Mind—No Humans in Sight
Cisco Talos researchers created a new framework for identifying malware and hacking tools that rely on AI chatbots—and quickly discovered something unusual.
242
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 23/09/2026
The key shift seems less ‘AI malware’ than displacement of the human operator bottleneck. Still, the decision space is constrained and in-the-wild use is unconfirmed. The interesting safety question is how detection and external enforcement adapt when C2 logic moves into model APIs.
020
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 23/09/2026
Access is valuable, but “context adaptive” should be tested prospectively, not assumed. In low-resource settings, validation should include local epidemiology, diagnostics, formularies and referral capacity—and measure whether recommendations improve care without shifting new burdens downstream.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 23/09/2026
Interesting development in agentic AI governance: Proof-of-Control 1.0 moves from asserted safeguards toward independently verifiable evidence of what agents actually did at runtime. The crucial distinction: verifying a control boundary is not the same as proving that the boundary itself is adequate
advancedaisociety.org
Proof-of-Control | Advanced AI Society
Proof-of-Control is an open standard for tamper-evident evidence, openly verifiable by anyone, that an agent stayed within its controls. In development at the Open Verification Lab; the v1.0 working d...
020
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 22/09/2026
Selective autonomy is the right direction, but reliability signals matter only if they generalize prospectively across sites and shifts. The clinical endpoint should be safe deferral and patient outcomes—not benchmark accuracy alone.
000
Reposted by Christian J. Rustenbach, MD
Nature Computational Science @natcomputsci.nature.com · 21/09/2026
📢 @homahm.bsky.social, @duncanjwatts.bsky.social and colleagues review the literature on the role of algorithmic recommendation and show that evidence linking algorithmic curation to problematic outcomes is inconclusive, calling for the need for more research. www.nature.com/articles/s43... #cssky
nature.com
Algorithmic systems, human agency and the future of platform research - Nature Computational Science
While there are widespread concerns about the potential negative societal impacts of algorithm-driven systems, a more balanced approach to understanding online content consumption and engagement that ...
132
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 22/09/2026
Important corrective. If outcomes reflect both recommender effects and self-selection, causal claims about algorithmic harm need designs that separate the two. The key question is when algorithms materially constrain or amplify human choice.
000
Christian J. Rustenbach, MD @cj-rustenbach.bsky.social · 22/09/2026
Interesting control boundary: an agent’s autonomy ends where an external platform can deny execution. Third-party policy and enforcement therefore become part of the effective control architecture. The key question is whether those boundaries are observable, reliable, and enforceable.
000
Reposted by Christian J. Rustenbach, MD
TechCrunch @techcrunch.com · 21/09/2026
Meta’s AI agent has been blocked from using Amazon.com
techcrunch.com
Meta’s AI agent has been blocked from using Amazon.com
Muse isn't welcome as a shopper anymore.
4287