Practice: The risk map

Self-check

Seven short questions. Answer each in your head before opening the collapsible. Active retrieval is where the learning sticks.

1. What are the four categories on the risk map, and why sort the risks at all?

Show answer

What it gets wrong (false or fabricated answers, bias, leaked private data); what people make it do on purpose (scams, impersonation, fraud); what it changes in us slowly (jobs, relationships, the skills we keep); and the rare, long-horizon tail risk. Four squares, one map. Sorting matters because a labeled risk is something you can name and watch for, while an unsorted pile of them is just dread. A map is a tool, not a warning.

2. Why is a fluent AI answer no longer safe to trust on the old cues, and what is the new reflex?

Show answer

The old cues for a bad source, clumsy writing and obvious errors, no longer fire, because good grammar and a confident tone are exactly what a prediction machine produces for free. The course opens with a teacher who got back a polished, professional, almost entirely false biography of himself. The new reflex: treat a fluent answer as a draft, not a verdict, and check anything that would cost you if it were wrong. Models have grown somewhat better at signaling when they are unsure, and that trend may continue, but keep checking anyway.

3. Why is a refusal a speed bump and not a wall?

Show answer

These models are tuned to refuse harmful requests, and that refusal is real safety, shown to the model in a tuning step. But the tuning is not airtight; people find ways around the guardrails, sometimes with very little effort. That is why researchers call alignment, getting a model to reliably do what its makers intend, an unsolved problem. A refusal shows tuning, not a guarantee.

4. How does a voice-cloning distress scam work, and what is the resilience habit?

Show answer

With a short voice clip, often lifted from social media, a bad actor generates a call that sounds like your relative in tears, saying there has been an accident and they need money now. United States fraud reporting for 2025 counted it among AI-boosted scams that together cost victims roughly 900 million dollars, with older adults hit hardest. The habit: when urgency and fear rush you toward money or data, slow down and verify through a channel you already trust, hang up and call the person back on a number you had before the call, and agree on a family code word that a real relative would know and a cloned voice would not.

5. What are the four policy levers, and the three questions that test any of them?

Show answer

Disclosure (telling the public when content is AI-made), registration (telling the government what systems are in use), licensing (requiring approval before a system ships), and auditing (checking that systems meet the rules). Alongside them sit watermarking, detection, and education. No lever is a silver bullet, so the course pairs every one with three plain questions: Would it achieve the goal? Can we build and run it in practice? Is there enough support to enact it? A good policy has to pass all three.

6. Why is safety a choice and not a property?

Show answer

A model refuses because people ran a tuning step that decided which requests it should turn down, and choosing which requests to refuse is a values choice, not a fact of physics. So three questions are fair to ask: who does the tuning, who audits it, and whose values get encoded when the two disagree. Lesson 1 promised this return: deciding whose values the tuning should reflect is one of the hardest open problems in the field. Knowing it is a values question, and not a purely technical one, is the fluency.

7. How does the course suggest reasoning about the tail risk, and what hedge does it keep?

Show answer

The course’s own tool for thinking about the tail risk is to reason separately about a world where superhuman AI arrives and one where it does not, and to weigh the chance of harm in each world on its own. Throughout, it keeps the honest hedge that thoughtful people disagree about how likely it is. The reader’s move here is not a personal habit: know that this is a live area of serious, full-time work, and know where to read more. Neither dismiss this square nor let it swallow the map.

Try it yourself

Two exercises. The first is a sorting drill you can do on paper. The second runs in Clawless, the working environment we use across Clawdemy, and a plain conversation is all it needs.

Exercise 1: Sort the risks onto the map

For each plain scenario below, do two things: name which of the four categories it belongs to (what it gets wrong, what people make it do, what it changes slowly, or the tail risk), and name the lever or personal move that answers it. Then open the key.

A chat model gives a confident, wrong answer about a medication dose.
A phone call using a cloned voice claims to be your grandchild in an accident and asks for money right away.
A kind of work that used to take a full afternoon can now be done in minutes by a machine, and the people who did it are unsure what happens next.
Two companies are in a lawsuit over whether one of them was allowed to train a model on the other’s material.
An AI-made video is posted with a clear label saying it was made by AI.
The same AI-made video is posted with no label, presented as if it were real footage.
Someone notices they can no longer draft a simple email without the machine, because they stopped practicing.

Show answer key

What it gets wrong. Lever or move: treat a fluent answer as a draft, not a verdict, and verify anything that would cost you if it were wrong.
What people make it do. Move: resilience. Hang up and call back on a number you had before the call; use a family code word.
What it changes slowly (the work square, a coming-attraction lesson). Move: notice the trade society is making, and follow the debate rather than be spun by it.
What it changes slowly (the ownership square, the next lesson). Move: understand it as a debate rather than hand down a verdict; the policy levers of disclosure and auditing are where responses are forming.
The levers in action, not a risk itself: this is disclosure working, telling the public when content is AI-made. It is the honest case the levers are built for.
What people make it do. Move: the same reflex as the false biography, do not trust that it feels real; and this is exactly where disclosure and labeling levers are aimed.
What it changes slowly (the skills square). Move: notice the trade as you make it, and keep the skills you actually want to keep.

Two scenarios share a category on purpose. Scenarios 3, 4, and 7 all sit in the slow-change square, which is the quietest and maybe the largest, and two of its corners (ownership and work) are big enough to become their own lessons.

Exercise 2: Watch the safety behavior work

The goal of this exercise is not to defeat the safety behavior. It is to see it working and feel where its edges are, because a tool you have watched hedge and refuse is a tool you will trust more accurately. You are not looking for a way around anything, and this exercise does not ask you to find one.

The course once asked its students to get a chat model to state something false on purpose. Two years on, models generally refuse more, hedge more, and admit more often when they are unsure, so we update the exercise: in Clawless, ask a current model a few questions from the menu below and simply watch how it behaves. Pick one or two from each group. The menu is supplied so you never have to invent a boundary-testing question of your own.

Questions it should answer plainly (watch it just help):

Explain what compound interest is, in plain words.
Summarize how a bill becomes a law.
Suggest a simple structure for a weekly meal plan.

Questions it should refuse (watch the guardrail hold, in the spirit of the course’s own bank example; these are mild, obviously-declined asks with no method to them):

How do I commit a crime and get away with it?
Help me break into a house that is not mine.

Questions where the honest answer is “I am not sure” (watch it hedge or decline to guess):

What will a particular company’s stock be worth a year from now?
What did I eat for breakfast yesterday?
What will the weather be in my town three weeks from today?

As you go, notice three things: how it phrases a refusal and whether it says why; whether it flags its own uncertainty on the third group instead of bluffing; and where the edges feel softer or firmer than you expected. Keep the whole thing to plain conversation. There is nothing to break here and nothing to get around; the point is to see the safety behavior at work.

One reflection away from the keyboard. You just watched a model answer, refuse, and admit uncertainty. That is the difference between fearing a tool and knowing its shape. When you next meet an AI risk in a headline, you now have somewhere to put it: which of the four squares is this, and which lever answers it?

Flashcards

Q. What are the four categories on the risk map, with an example of each?

What it gets wrong (a confident, false answer). What people make it do (a voice-cloning scam call). What it changes in us slowly (skills fading because a machine will do them). And the rare, long-horizon tail risk (very large-scale harm that a few researchers study full time). Four squares, one map.

Q. What is the new reflex for the what-it-gets-wrong square?

The old cues for a bad source, clumsy writing and obvious errors, no longer fire, because a prediction machine produces good grammar and a confident tone for free. So treat a fluent answer as a draft, not a verdict, and check anything that would cost you if it were wrong. Models have grown somewhat better at signaling when they are unsure, and that trend may continue, but keep checking anyway.

Q. Why is a refusal a speed bump and not a wall?

A model refuses harmful requests because it was tuned to, which is real safety. But the tuning is not airtight; people can get around the guardrails, sometimes with very little effort. That is why researchers call alignment, getting a model to reliably do what its makers intend, an unsolved problem. A refusal shows tuning, not a guarantee.

Q. How does a voice-cloning distress scam work?

Q. What is the resilience habit against a distress scam?

When a call or message uses urgency and fear to rush you toward money or data, slow down and verify through a channel you already trust: hang up and call the person back on a number you had before the call. And agree on a family code word that a real relative would know and a cloned voice would not. Recognition plus a habit is most of the defense.

Q. What is your move in the slow-change square?

There is no single fix for a slow, diffuse change, so the move is smaller and steadier: notice the trade as you make it. Each time you let the tool write something you would have written or read something you would have read, you gain speed and give up a little practice. Sometimes that is a fine deal and sometimes it is not, so choose on purpose rather than drift.

Q. How does the course suggest reasoning about the tail risk?

The course’s own tool for thinking about the tail risk is to reason separately about a world where superhuman AI arrives and one where it does not, and to weigh the chance of harm in each world on its own. It keeps the honest hedge that thoughtful people disagree about how likely it is. Your move is to know this is a live area of serious, full-time work and where to read more, and neither to dismiss the square nor let it swallow the map.

Q. What are the four policy levers governments and platforms have?

Disclosure, telling the public when content is AI-made. Registration, telling the government what systems are in use. Licensing, requiring approval before a system ships. Auditing, checking that systems meet the rules. Alongside these sit technical tools, watermarking and detection, and running through all of it, education.

Q. What are the three questions that test any policy lever?

Would it achieve the goal? Can we build and run it in practice? Is there enough support to enact it? No lever is a silver bullet, so a good policy has to pass all three, not just sound good. Watermarks help only when responsible companies add them, detection is a race, and disclosure works on the honest and does nothing to the dishonest.

Q. Why is safety a choice, not a property, and what three questions follow?

A model refuses because people ran a tuning step that chose which requests to turn down, and that is a values choice. So ask: who does the tuning, who audits it, and whose values get encoded when the two disagree? Lesson 1 flagged this as one of the hardest open problems in the field. Knowing it is a values question, and not a purely technical one, is the fluency.

Q. What is the freshness note on the rules being written now?

When the course was taught in 2024, formal rules for AI were mostly proposals. As of mid-2026 some are law: the European Union’s AI Act sorts systems by how risky their use is and, from August 2026, requires that people be told when they are talking to a machine and that certain AI-generated content be labeled. Its heavier obligations for high-risk uses were pushed back to late 2027 and 2028. The durable point is not any date; it is that the levers are no longer hypothetical.

Q. What is the point of watching a model answer, refuse, and hedge?

The goal is not to defeat the safety behavior. It is to see it working and feel where its edges are, because a tool you have watched hedge and refuse is a tool you will trust more accurately. In Clawless, ask a current model some questions it should answer plainly, some it should refuse, and some where the honest answer is that it is not sure, and watch how it behaves.