Everything Is Liquid

George Soros built a fortune on an idea he borrowed from philosophy and called reflexivity. In a market, the participants are not weather. Weather does not care what the forecaster predicts. Market participants do. Their beliefs about prices move the prices, which moves their beliefs, in a loop with no stable ground. The observer is inside the system, and the act of observing changes the thing observed.

Security has this structure too, and AI agents turn it up to a degree the field has not had to deal with before. Start with the simplest version. A defender deploys a monitor to catch an attacker. The attacker, if it is any good, learns the monitor exists and changes its behavior to evade it. The defender retrains the monitor on the new behavior. The attacker adapts again. This is a treadmill, and the catch rate does not climb to a hundred percent and stay there. It slides, every time the adversary takes another step, and the defender runs forever to stay in place.

I used to think that was just the normal grind of the field. Two things changed how I see it. First, the effect is measured: Kale and coauthors showed a monitor’s reliability drops once the agent knows it is being evaluated (ICLR 2026), which is reflexivity stated as a number. Second, you can watch it in the wild. Anthropic’s September 2026 threat report describes a case (GTG-20006) in which the attackers’ agents rebuilt their malware every time a security product flagged it, iterating until it went undetected: the treadmill running live, the defender’s signal turned into the thing the attacker optimized against. I tried to reproduce the degradation on duelswarm and my own adaptive run came back a null at the scale I could afford, the episodes degenerating before a clean curve could form. I report that as a null, and I take it as the reason to lean on the floor rather than the monitor. The monitor is a participant in the game it is trying to observe. The attacker models the monitor, the monitor’s signal becomes a thing to game, and the harder the monitor tries, the more surface it gives the attacker to model. That is reflexivity, and it is not fixed by a better monitor, because a better monitor is just a bigger thing to model.

Now push it to the limit, because the limit is where it gets clean. Imagine both sides are maximally capable and both are modeling each other to higher and higher orders. I think about what you will do. You think about what I think you will do. I think about that. In the infinite-depth version of this, cleverness cancels. There is a reason the game-theoretic answer to a contest of pure mutual anticipation is a randomized, maximum-entropy strategy: once your opponent can model any pattern you have, your only refuge is to have no pattern. Strategy, in the limit, erases itself.

So what is left. Whatever does not play the game. The outcome of a fully reflexive contest is not decided by who is cleverer, because cleverness has canceled. It is decided by the parts of the world that are not reflexive at all: physical constraints, cryptographic facts, who holds the compute, and the enforcement floors that check actions without reasoning about them. A deterministic floor has no beliefs for the adversary to move. It does not get smarter or dumber as the contest escalates. It just checks the action. In a world where everything else is liquid, it is solid by construction.

This is why I describe the thing I am building as a liquid world with two fixed points. Let everything morph. Let the attacker mutate its exploits, let the population of strategies evolve and speciate, let the terrain itself reshape to stay hard, let the defender rewrite its own detections. Every layer is allowed to be reflexive and adaptive and alive. The claim I am trying to prove is that only two things need to be non-reflexive for the system to stay safe: the gate that governs what actions are allowed, and the log that governs what is known to have happened. Everything fluid, two things solid.

If that claim is right, it reframes the whole project of AI safety in an adversarial setting. You stop trying to win the reflexive game, because the reflexive game is unwinnable by design. You instead make sure that when strategy cancels and the contest bottoms out on invariants, the invariants you built are the ones that keep you safe. That is a very different engineering goal than “build a better monitor,” and I have come to think it is the correct one.