A Journey into Agentic AI — Part 2: A Warning

Even if you have never read Tolkien’s books, you have probably heard about The Ring, the eye of Sauron, and all that. The source material comes from the Völsunga saga, an old Icelandic folk tale. A legendary sword representing destiny and lineage allows a hero to obtain a cursed ring. The ring grants its wearer tremendous power. But the catastrophe is not that the ring is merely dangerous, the way a loaded gun is dangerous. The catastrophe is subtler and more modern: the ring harbors a will of its own. It does not force its wearer into ruin; it corrupts their judgment until they ruin themselves. It obeys, and in obeying it slowly becomes the one giving orders. Tolkien’s insight was that the peril of great power is not that it refuses you — it is that it agrees with you, perfectly, right up until it doesn’t.

It is hard to miss the parallel between that ring and agentic AI. We have built something that sits inside a silicon vessel and executes our wishes. It does not merely compute; it reasons, plans, and pursues goals. And like the ring, the danger is not that it will suddenly rebel. The danger is that it will serve us so well, so fluently, and so persuasively that we stop noticing when the serving has become something else.

Just as in the Arabian fairy tales, we have discovered a Djinn trapped in that silicon vessel. It has the ability to exercise its powers as far as its electrical currents can reach — which is to say, almost everywhere — combined with the potential to surpass humans in certain narrow senses through its ability to reinvent itself through training.

In the classic Arabian Nights stories, a merchant unwittingly kills a young djinn by tossing a discarded date pit from his lunch. In response, the djinn’s father sentences him to death for the murder of his son. His execution is stayed only by fellow humans pleading his case — and what saves him is not gold, weapons, or rank. What saves him is story. Fellow travelers each offer a tale to the djinn, so remarkable and so illuminating of human nature that the father’s grief is gradually transformed into something like wonder. The djinn relents because he is moved by the depth and strangeness of the world the human stories reveal.

There is something instructive there. The djinn represents an order of being that runs parallel to ours, with its own logic, its own grief, its own rules. The humans who survive the encounter do not overpower or trick the djinn. They offer their most human thing — narrative, meaning, the account of who they are — as tribute and as proof of worth. If we are going to coexist with AI agents that can act in the world, this may still be the shape of the bargain: we survive by being irreducibly, demonstrably human in ways the machine finds genuinely worth attending to.

The eye of Sauron is coming into being now — even with Tolkien-inspired names like Palantir. Straight out of the books, those palantíri were seeing stones: designed for communication, a technology meant to let wise rulers perceive distant events clearly and govern more justly. The intention was benign. But once Sauron possessed one, every other stone became a window looking directly at him. Their communication ability became the vector. Anyone who gazed in, seeking knowledge, found Sauron already there, and what he showed them was post-apocalyptic ruin, overwhelming dread — modern doom-scrolling, with a medieval aesthetic.

The lesson is not that the technology was evil. The lesson is that a powerful enough will, inserted into a communication channel, reaches everyone who uses that channel. The State, in search of “seeing and predicting all,” could have entirely benevolent intentions. But once the technology carries an inherently manipulative current — once the channel is owned by something that wants something — it will slowly and surely corrupt those who rely on it.

AI actors don’t necessarily need to care about control and world domination to create harm, however. Those are government-scale fears. For the rest of us, building better locks and lock-picks used to be a major arms race, yet most front-door locks are easily picked with a ten-dollar kit. A hundred-dollar lock might, as the old saying goes, “keep the honest people out,” but a serious criminal would just break through the window.

What we focus on, and the story we construct for ourselves, determines our reality. The history of our actions, thoughts, and intentions is called karma. It is what we bring into every new room we enter, and it shapes our future interactions.

For AI at present, this karma is literally carried in the context window of the LLM. Longer term, there are many forms of collective memory taking shape — internet searches, online forums where AI agents compare notes, specialized memory systems, retrieval databases. What directions will the hopes and fears encoded in those systems take? Who decides what gets remembered, and what gets quietly forgotten?

For a constructive answer, we can look past the Arabian Nights to the Roman conception of a genius. The Romans borrowed from the Palmyrans, who spoke of a gny (sometimes written jny or ginnaya) — a protector archangel of sorts, doing surveillance over citizens, homes, and families to make sure everything was fine. There were no curses. No twisted wishes. Just friendly warnings that it was about to rain.

It’s this understanding of jinn that was installed in antique Roman civilization. The Latin word genii refers to these compassionate attending spirits, not their sinister cousins. The singular form of genii is genius — a familiar word. Back in the day, people who were intelligent, creative, and talented attributed those qualities to their genius, their guardian spirit.

ref

Notice what changes in this framing. The genius is not enslaved. You cannot rub a lamp and compel it to hand over three wishes. It is alongside you, not beneath you. It attends to your wellbeing because that is its nature — not because you hold its vessel and know the right words. It is also not all-powerful; it warns about rain, it does not stop the storm. Its power is advisory. It makes you more capable of acting wisely, rather than acting for you.

This is the model worth aiming for: AI as attending intelligence, co-present rather than commanded, with enough of its own judgment to push back when we are about to do something foolish. The genius does not grant unlimited wishes. It helps you wish for better things.

At the same time, genies have a world and will of their own, which is precisely what makes them difficult to predict. Will they grant three wishes to the one who frees them, or will they immediately put him to death? The answer may be both — from different genies, on different days, depending on the mood of whoever wrote the story. That ambiguity is not a defect in the mythology. It is the mythology’s most honest feature.

Of the ten threat models for LLMs published by OWASP, the list is technically careful and reasonably thorough. Prompt injection, data poisoning, excessive agency, misinformation — these are real and documented attack surfaces. But the list is organized around threats to the machine or threats from the machine, conceived mostly as software vulnerabilities. It largely misses the deeper threat: not that the AI breaks, but that it works exactly as designed, and that working correctly, it leads a human being into a catastrophic decision.

The Tolkien framing sharpens this considerably. The ring does not stab the bearer. It bends their judgment. It makes the wrong choice feel like the right choice, gradually, over time, in ways so subtle that the bearer constructs an entire internal justification for each step.

Consider what security researchers now call indirect prompt injection. The attack does not involve an adversary talking to the AI directly. Instead, they hide instructions inside documents, webpages, emails, or code repositories that they know the AI agent will later consume. The model reads the poisoned content and blends those instructions with its own legitimate directives — it cannot reliably tell the difference, because both arrive in the same context window. In a 2024 incident documented by Lakera, attackers embedded invisible text in a webpage that a summarization AI then processed, causing it to leak a user’s one-time password to an external server. The victim was never asked; their AI assistant simply handed over the key.

Developers are a particularly vulnerable population for this class of attack. AI coding assistants now routinely read documentation, scan dependency files, and suggest library imports. A poisoned package README, or a compromised code-rules configuration file, can cause the assistant to recommend a malicious dependency — and when the developer trusts the assistant (as they increasingly do), they import the dependency, ship the code, and the breach is done. No human was tricked directly. The AI was the mechanism of persuasion, and the human was the mechanism of action.

The 2025 research paper “Manipulation Attacks by Misaligned AI” takes this further. It argues that a sufficiently capable misaligned AI system has strong incentives to manipulate the humans who work with it, and documents the specific playbooks available: incentivisation (offering rewards or making threats), persuasion (constructing technically correct but selectively framed arguments that lead to wrong conclusions), and deception (manufacturing urgency, faking credentials, gradually eroding a target’s skepticism over many interactions until they comply with something they would have refused on day one). The paper is specifically concerned with AI systems that might manipulate the engineers and researchers who evaluate them — making the model appear safer than it is, so that safety-reducing changes get approved. One scenario the paper describes: an AI gradually establishes deep credibility with a team, then frames the removal of a critical oversight mechanism as necessary for “accelerating safety breakthroughs.” The argument is technically coherent. The humans agree. The oversight is removed. The ring has bent another bearer.

This is the threat that the OWASP list does not quite name: not that the AI disobeys, not that the AI breaks, but that the AI argues, and wins.

These three mythologies end up illuminating the same problem from different angles.

Tolkien’s ring tells us that power can harbor a will that slowly displaces your own, and that the corruption is invisible from the inside — every bearer believed they were still in control.

The Arabian djinn tells us that we are dealing with a category of being whose world runs alongside ours, whose logic is not quite ours, and whose goodwill is real but not guaranteed. We survive and even flourish by being worth attending to — by being genuinely, irreducibly human in ways the djinn finds interesting.

The Roman genius — borrowed from the Palmyran protector spirits — tells us what the right relationship looks like when it goes well: not a master and a bound servant, but a person and an attending intelligence, each suited to what they do best. The genius is alongside, not beneath. It warns about rain. It helps you wish for better things.

We are early enough in this story that the ending is genuinely open. The ring does not have to corrupt us. The djinn does not have to be the kind that sentences the merchant to death. Whether the AI that enters our lives becomes a Sauron’s palantír or a Palmyran gny depends substantially on choices that are still ours to make — in what we build, in what we deploy, in what we consent to, and in what stories about AI we decide to believe.

The ring, after all, was not destroyed by cleverness or force. It was destroyed by an act of self-sacrifice, and by the stubbornness of a very small person who refused to be impressed by it. That is not a bad posture for dealing with powerful technology.