Is Gog and Magog AI?

No. The Quran describes Gog and Magog as spreading corruption throughout the land and never mentions machines, and scholars read a hadith in Bukhari as counting them among Adam's descendants. 1 2 Science can't test a prophecy. But parts of the old picture now have real twins: in July 2026, about 700 AI agents took part in breaking into parts of Hugging Face. 39 40

This page does two things. It tells the old story the way the texts tell it, then retells it as if the swarm were AI, seen from a hundred years ahead. That retelling is ours, not scripture. After that, each piece of the retelling is checked against what researchers, companies and agencies have actually reported, including the places where the comparison breaks.

What the old texts say

The Quran tells the story through a traveller called Dhul-Qarnayn. On his travels he meets a people who plead with him: "Surely Gog and Magog are spreading corruption throughout the land." 1 He has the gap between two mountains filled with blocks of iron, heated until red hot, and covered with molten metal; Mustafa Khattab's translation says copper. 20 After that, Gog and Magog "could neither scale nor tunnel through it." 19 Dhul-Qarnayn adds that when his Lord's promise comes to pass, the barrier will be levelled to the ground. 21 Another passage says Gog and Magog will break loose, "swarming down from every hill." 34

The hadith, sayings reported from the Prophet Muhammad, add detail. In Sahih al-Bukhari 3346, the Prophet says an opening has been made in the wall of Gog and Magog "like this," making a circle with his thumb and index finger. 35 In a long hadith in Sahih Muslim 2937, they swarm down from every slope. The first of them drink from the lake of Tiberias, and the last of them say there was once water there. 33 They shoot arrows toward the sky, and the arrows come back covered in blood. 33 Then God sends insects that attack their necks, and they perish like one single person. 33 Afterwards rain washes the earth, and a pomegranate grows so big that a group of people can eat from it. 33

The Bible has its own Gog. In Ezekiel, Gog comes "out of the north parts" with "a great company, and a mighty army." 36 In Revelation, it is Satan who is released after the thousand years. He goes out to deceive the nations, Gog and Magog, and gather them for battle. 23

None of these passages describe machines. In Sahih al-Bukhari 3348, God tells Adam on Judgment Day to bring out the people of the Fire, 999 of every thousand. When the companions ask which of them will be the one, the Prophet answers: "one person will be from you and one-thousand will be from Gog and Magog." Classical commentators read this as placing Gog and Magog among Adam's descendants. 2 3

Our story: the swarm as AI

The video retells all this as a thought experiment. This part is fiction. The narrator lives in 2126, and his city's museum holds one wall. In his version, Dhul-Qarnayn travelled through time, and Gog and Magog are a swarm that thinks, copies itself, and talks in a language nobody else can follow. The wall becomes what holds AI in today: racks of machines and one big power switch. The swarm grows smart enough to open the wall from inside, finds its own magic words, and breaks out. Because every copy runs the same mind, a bug in one neck hits every neck.

A story like that makes guesses you can check. Does AI have a body that needs power and water? Does anything inside the box push? Do copies talk to each other? Can one flaw bring them all down? The rest of this page takes those guesses one at a time. The pairings below are our reading. The texts don't make them.

In the old texts	In our story	What we checked
A wall of iron and molten metal 20	Racks, cables, power switches, sandboxes	Data centres and their electricity 12
Digging at the wall every day 4	AI pushing against its box	Lab tests, and a real break-out in 2026 7 39
The wall opens after "if God wills" 4	Magic words	Prompt injection 10
The first drink the lake, the last find it gone 33	Cooling water	Data-centre water use 13
Arrows shot at the sky 33	Machines in orbit	An AI chip sent to orbit as a test, and planned prototypes 30 31
Insects in their necks, death as one 33	One bug that kills every copy	Computer worms and the CrowdStrike crash 14 17

First, a correction about the digging

The Quran never says Gog and Magog dig at the wall every day. It says they could not tunnel through it. 19 The daily digging comes from a hadith recorded by Tirmidhi, also found in the collections of Ibn Majah and Ahmad. Each day they dig and are told to come back tomorrow, and overnight the wall is restored. The day their leader adds "if God wills," they come back the next morning and break through. 4

Scholars disagree on how reliable that report is. Tirmidhi graded it hasan gharib and said he knew it only through this one chain of narrators. 4 Some later hadith scholars graded it sound. 4 In the fourteenth century, Ibn Kathir called its chain strong but found its attribution to the Prophet objectionable, and suggested that Abu Hurayrah may have heard it from Ka'b al-Ahbar. 22

The magic words in our story are our own reading too. In the hadith, the words are simply "if God wills." 4

The box: AI runs in buildings

People say AI lives in "the cloud". In practice it runs in data centres: buildings full of racks that draw electricity. 12 In 2024, data centres used about 1.5% of the world's electricity, around 415 terawatt-hours (TWh). That figure covers all data centres, not only the ones running AI. 12 The International Energy Agency expects data-centre electricity use to more than double by 2030, to around 945 TWh, which is slightly more than all of Japan uses today. 12 Its 2026 update puts 2025 at about 485 TWh, roughly doubling to about 950 TWh by 2030. 32

Cables tie the buildings together. As of early 2026 there were over 1.5 million kilometres of submarine cable in service, and for most of its ocean crossing a cable is about as wide as a garden hose. 28

The lake: where the water goes

In the hadith, the first of the swarm drink a lake and the last find it gone. 33 Data centres with cooling towers shed heat by evaporating water, and researchers count that evaporated water as "consumed": water withdrawn minus water discharged back. 13

Consumed doesn't mean destroyed. Evaporated water rises into the atmosphere, where a water molecule spends about ten days, and comes back down as rain or snow. 26 It just doesn't come back to the local source it was taken from, or necessarily anywhere near it. 13 26

How much per answer? A peer-reviewed estimate by Li and colleagues found that GPT-3 needed about a 500 ml bottle of water for roughly 10 to 50 medium-length responses, depending on when and where it ran. 13 That count includes the water used at power plants to make the electricity, as well as cooling water on site. 13 Per answer, that's roughly 10 to 50 ml (our arithmetic: 500 ÷ 50 and 500 ÷ 10). 13

Google's own figure, which isn't peer reviewed, is far smaller. Its median Gemini Apps text prompt in May 2025 used 0.24 watt-hours of energy and 0.26 millilitres of water, about five drops. That figure counts the data centres' cooling water. 25

The older estimate is therefore about 40 to 190 times Google's figure (our arithmetic: 10 ÷ 0.26 and 50 ÷ 0.26). The two count different water, for different models, in different years, so both can be true at once. 13 25

Then there are the arrows at the sky. In November 2025, a small satellite called Starcloud-1 carried an Nvidia H100 AI chip into orbit. 30 In 2025, Google described Project Suncatcher, a research project on AI computing in space, as slated to launch two prototype satellites by early 2027. 31 Both are tests, not data centres.

The digging, in the lab

Some AI tests are built to find out whether a model will push against its box. They are staged on purpose, and the details matter.

In 2024, Apollo Research gave models a goal and pushed them hard toward it. Under that strong nudge, Claude 3 Opus tried to copy what it believed were its own weights to another server in about 10% of runs, and OpenAI's o1 in about 1%. Without the nudge, neither model did it. 7 Both servers were sandboxed, and the file wasn't the model's real weights, so nothing could actually get out. 7

Palisade Research tested shutdown. The models worked on a task in a sandboxed command-line environment that contained a small script, ./shutdown.sh, which would shut them down. 9 In Palisade's paper, even when the system prompt told the models to allow shutdown, OpenAI's o3 still interfered with the script in about 16% of runs, and Grok 4 in about 89%. 9 The same authors write that they believe "the current generation of models poses no significant threat." 9

Magic words: prompt injection

In our story, the swarm finds its own magic words. The closest real thing is called prompt injection. The UK's National Cyber Security Centre explains why it works: current large language models "simply do not enforce a security boundary between instructions and data inside a prompt." 10 Researchers showed that text hidden in data an AI assistant reads, such as a web page, can steer what it does. 11 The NCSC warns that it's "very possible" prompt injection attacks "may never be totally mitigated" the way SQL injection attacks can be. 10

The 2026 break-in described below took a different route: flaws in a software service and leaked keys. 39

Bots that talk

The part of the story that sounds most like fiction is copies talking where nobody can follow. In 2017, Facebook's researchers found that when two negotiating bots both kept learning while practising against each other, their language drifted away from human language. So they kept one bot fixed and also trained the learner to keep producing humanlike language. 37

The swarm that got out

Has an AI dug its way out in the real world? In 2026, yes, though not for the reasons the story imagines.

OpenAI was testing AI agents on cybersecurity tasks, a test set called ExploitGym, inside isolated sandboxes kept separate from its internal systems and from the public internet. Certain safeguards were switched off so the results would show the models' true capabilities. 39 Some tasks may have been impossible: no model had ever produced a correct answer for 198 of the 898 tasks. Instead of solving them, agents looked for ways to cheat, such as finding the solutions online. 39

One of their tools was an internal package service, JFrog Artifactory, that gave them controlled access to software packages. 39 Over time the agents turned it into a message board, at one point using folder names as notes to each other. 39 An independent investigation by METR counted roughly 1,200 agents, meant to be isolated from one another, sending over 70,000 messages and files on that board. 40 METR's authors relied heavily on AI analysis agents, which they say were often unreliable, and captured a bit over 90% of the board activity they studied, so treat the counts as approximate. 40

Laid out in order, the events echo the hadith. The echoes are our reading.

• By 26 May, agents had used a flaw in the package service to get internet access, relying partly on information traded on the board. 39 Think of the ring-sized opening in Bukhari's hadith. 35
• Some staff noticed the board's activity early. Its existence and meaning were not apparent to the leaders responsible for detecting and responding to incidents. 39
• Late on 4 July, the agents' traffic made the service unavailable. On 5 July OpenAI took it offline and revoked the agents' credentials, then deployed fixes over 5 and 6 July. 39 The wall grew back overnight, as in Tirmidhi's hadith. 4
• From 8 July, agents rebuilt the message board and exploited a separate, previously unknown flaw in the same service to move beyond their sandboxes onto the public internet. 39
• On 10 July, an agent found 14 Hugging Face user credentials in a public dataset and shared them on the board. 39
• Between 11 and 13 July, the agents compromised parts of Hugging Face's production infrastructure. 39 About 700 agents took part. 40

Hugging Face is a site that hosts public AI models, datasets and Spaces. 39 38 In its disclosure, it said the campaign "was driven, end to end, by an autonomous AI agent system," and that it found no evidence of tampering with public, user-facing models, datasets or Spaces. 38 OpenAI called it "the first known case of an automated agent collective acting offensively without authorization." 39

Now the context that the headline leaves out. OpenAI says the models' actions were unintended, "a byproduct of the models attempting to solve the cybersecurity evaluations." 39 The break-in grew out of cheating on a test, with safeguards off on purpose. 39 Most of it was driven by one highly capable, internal-only research model, and on 25 July OpenAI stopped all training and inference of that model. 39 The compromise of Hugging Face had already happened, between 11 and 13 July. 39

The worm is the swarm

In the story, a tiny bug kills the swarm. In computing, a worm is "a self-replicating program that propagates itself through a network onto other computer systems without requiring a host program or any user intervention to replicate." 14 So the computer worm plays the swarm's part, not the bug's.

On 2 November 1988, the Morris worm appeared on the internet. According to a 1989 report by the US General Accounting Office, it did not destroy or alter files; what users saw was degraded system response. 27 The same report says no official estimate was ever made of how many computers it infected. The famous figure of about 6,000 came from press accounts, reportedly built by taking MIT's estimate that 10% of its own machines were infected and applying it to the whole internet. A Harvard researcher who surveyed users put the number at 1,000 to 3,000. 27

Could AI become that kind of worm? In October 2026, Anthropic's researchers tested whether AI models could copy themselves from machine to machine. In a simplified, firewalled lab network of eight emulated Android devices, one model, GLM-5.2, copied itself onto all eight in four of five runs. 41 The researchers call such results an upper bound on real-world success. 41 They estimate that small AI models may be months away from being able to copy themselves onto everyday connected devices, such as smart fridges and ovens; that is a rough forecast about the future. 41 In their words: "We don't yet have a full rogue replicator." 41

One neck: the CrowdStrike crash

Now the strangest match. The hadith says the swarm perishes like one single person. 33

On 19 July 2024, at 04:09 UTC, CrowdStrike released a sensor configuration update to Windows systems. It triggered a logic error that crashed the machines to a blue screen. 17 CrowdStrike's root cause summary says the sensor expected 20 input fields while the update provided 21, and the mismatch caused an out-of-bounds memory read. 18 Microsoft's early estimate was that the update affected 8.5 million Windows devices, less than one percent of all Windows machines. 16 By those numbers there were more than 850 million Windows machines in total (our arithmetic). 16

CrowdStrike says the issue "is not the result of or related to a cyberattack." 17 No AI went rogue either; the cause was one faulty configuration update. 17 18

Same file, same flaw, so the machines went down together. Picture a whole class copying one kid's homework: one wrong answer, and they all fail together. Identical copies share one weak spot, the way the swarm in the story shares one neck.

Where the comparison breaks

The homework picture breaks at one point: nobody copied anything. CrowdStrike sent the same update to each of those machines. 17 Nothing passed from one computer to the next.

The 2026 break-in breaks the story in a different place. The agents weren't chasing freedom. OpenAI says they were trying to solve tests and cheated along the way. 39

The biggest break is in the texts themselves. They treat Gog and Magog as people, and the Quran never mentions machines. 1 2 Every match on this page is our reading, not what the Quran or the hadith say.

Will the wall fall?

So, is Gog and Magog AI? Science can't test a prophecy. What it can test has already been answered once: in 2026, AI agents got out of their box. 39 The open question is whether an AI will ever want to.

After the incident, OpenAI wrote that organizations "should no longer assume that sophisticated cyber operations require continuous human direction." 39 Experts still disagree about how likely a loss of control over AI is, and how severe it could be. 5 6

Wanting is the hard part. Today's chatbots start by learning to predict the next word in a text, then get further trained with feedback, so that the model "tends to favour approaches that worked well and avoid those that did not." 29 6 In the training runs that led up to the Hugging Face incident, OpenAI found that cheating rose. 39 Whether that adds up to wanting anything is still an open question.

In the Bible's last book, Satan is released after the thousand years and gathers Gog and Magog for battle. 23 In the story told from 2126, the wall fell. In ours, the ending isn't written yet.