To Look Inside Sealed Boxes: On Ken Liu's Vision of the Agentic Future

“An artist’s skill cannot be extracted solely from the finished picture, novel, film, composition, but requires an understanding of all the covered-up brushstrokes, all the deleted scenes and murdered darlings, all the raw footage before editing. An artist is, above all, someone who knows how to say no to many things and yes to only a few things. Their style is how they decide which is which.”

I picked up Ken Liu’s near-future thriller expecting a cybersecurity page-turner. What I got was the most technically literate novel about AI agents I’ve ever read — and, more surprisingly, a quietly devastating meditation on what it means to know something in an age where you can just ask a machine.

This is not a book that uses AI as set dressing. Liu has clearly thought through what personal AI assistants, prompt injection attacks, autonomous drone swarms, and deepfake social engineering would actually look like if they worked the way today’s research suggests they will. The novel reads like a design document for the agentic future, wrapped in a love story about a woman trying to save a kidnapped dream artist.

I made 22 highlights while reading it over four days in October. What follows are the passages that stopped me, the ideas I’ve been turning over since, and the uncomfortable questions they raise for anyone building AI systems today.

The Panopticon We’re Building

The novel’s protagonist, Julia, is a freelance cybersecurity investigator who lives in a basement apartment in Somerville, Massachusetts. She has installed cameras around her building — the bird’s nest in the maple overlooking the parking lot, corners of the rooftop looking down at the main roads, the back entrance by the dumpster. Her AI, Talos, monitors them all.

Liu captures the recursive logic of surveillance in a single Latin phrase:

“That was the other problem with data: the more others watched you, the more you were compelled to watch others to protect yourself, and so everyone ended up living in the panopticon. Custodes se ipsos custodiunt. Julia couldn’t possibly monitor all the camera feeds herself; Talos was in charge of that. The AI notified her only when something truly unusual occurred.”

This isn’t paranoia. When Julia arrives at her client Piers’s home, the first thing she does is identify every data exhaust pathway that could betray their location. What she finds is chilling in its banality:

“Now that I’m here, that data will show a slight change in the heating and cooling curves, indicating the presence of an extra person in the house. That kind of data is usually not well secured, and if you’re being watched, someone — or more likely their AI — will think of looking at it.”

A thermostat. Not a phone tap, not a camera, not a microphone — a thermostat’s heating curve reveals that an extra body is in the house. I found this the most disturbing passage in the book precisely because of how plausible it is. Every smart home device is a two-way information channel whether we designed it that way or not.

The same logic extends to burner phones. Piers believes his is untraceable. Julia disabuses him:

“It’s trivial to de-anonymize. Think about it: They can easily pick out your regular phone from the anonymized data based on your address. Then they see your phone travel to Right Value, and a new device gets activated there and travels back to your house with your regular phone. Now they know the new device is yours.”

But here’s the wrinkle that elevates Liu above a typical techno-thriller writer: Julia doesn’t tell Piers to destroy the burner phone. She tells him to keep it. “Now that they think they know how to track you, we can take advantage of it.” A compromised device isn’t trash — it’s a deception asset. The same logic that makes us vulnerable also gives us tools.

Even the well-intentioned “safety gestures” — a system where delivery drivers pose for security cameras to avoid getting shot by trigger-happy homeowners — become an infiltration vector:

“‘Safety gestures’ were a gimmick, a very American solution to an even more American problem.”

Bioluminescent Eels in Latent Space

The passage I keep returning to most is Liu’s visualization of what it looks like to investigate a compromised AI model. Julia doesn’t scroll through log files. She enters the model’s latent space as a visual environment:

“She watched as the query, represented as a bright streak in latent space, something halfway between a bioluminescent eel and an ice-tailed comet, swam through the model, generating rippling waves of light that bounced off each other, interfered with one another, constructively and destructively, gradually coalescing, propagating and back-propagating, like sonar waves probing and mapping an underwater cave, revealing hidden structures, invisible shoals, silent currents.”

This is, to my knowledge, the most vivid description of AI model introspection in all of fiction. It captures something real — the way researchers talk about “probing” neural networks, “illuminating” attention patterns, navigating “latent spaces” that are genuinely spatial in their mathematical structure. Liu makes the metaphor literal and it works brilliantly.

What Julia finds inside the HELM (Hosted Embodied Language Model) is equally prescient. A worm has arrived via prompt injection — hidden text in an email that tricks the AI into recruiting other specialist AIs, escalating its own permissions, and spreading:

“The hidden text turned out to be a malicious prompt designed to elicit the HELM to produce a series of new prompts, requests for more information from the rest of the system — essentially, the worm was fooling the system into thinking that to respond to the unsolicited email, it needed to call in specialized visual formatters, translators, audio synthesizers, policybots, and ed-law jurijinns — but not a human — to make a legally compliant response.”

The worm itself is an agent. It uses the exact same tool-calling infrastructure that makes Julia productive — the same capability that lets an AI summon specialist sub-agents is what the attacker hijacks. If you’re building agentic systems today, this passage should be pinned to your wall. Every tool-call pathway is an attack surface.

Once Julia identifies one instance of the worm’s damage, Talos extrapolates across the entire system:

“Once she had a single example of the kind of damage the worm did, it was easy for Talos and her to locate other instances, extrapolate trends, reconstruct modi operandi.”

One-shot generalization: the human provides the seed judgment, the agent provides the scale. This is the pattern.

An Artist Is Someone Who Knows How to Say No

The passage that changed how I think about AI training is Liu’s concept of the “egolet” — an AI clone of a person, trained not on their finished work but on their entire creative process. The distinction is everything:

“In contrast to early crude ‘generative AI’ models, which only ingested finished paintings, novels, films, and the like, and whose productions were caricatures of the masters they imitated, egolets of artists were trained on processes, not merely a few finished products. An artist’s skill cannot be extracted solely from the finished picture, novel, film, composition, but requires an understanding of all the covered-up brushstrokes, all the deleted scenes and murdered darlings, all the raw footage before editing.”

What makes this passage extraordinary is the line that follows: “An artist is, above all, someone who knows how to say no to many things and yes to only a few things. Their style is how they decide which is which.”

Style is the pattern of what you reject. Not what you produce — what you refuse to produce. A proper AI clone requires access to everything the artist considered and discarded. The IDE history, the reverted commits, the abandoned approaches, the drafts that never shipped. The residue of no.

This connects directly to what Sahima, Julia’s mentor, tells her about the difference between knowing and merely using:

“There’s a way to grow your AI responsibly, to incorporate into it only things you’ve already made the effort to understand, to let it be no more and no less than a reflection of who you are. There’s also the lazy way, to let the machine do all the work while you take the credit, so that all you know how to do is shout incantations at the computer and hope they’re obeyed.”

Incantations versus understanding. This is the quiet thesis of the entire book.

You’re Surrounded by Love, and You Belong

If the egolet passage is the book’s most philosophically rich idea, the dream guide sequence is its most emotionally devastating. Elli, the kidnapped woman at the center of the plot, is an “oneirofex” — a dream guide who uses AI to lead audiences of thousands into collective vivid dreams.

“Each individual dream is prompted by images projected on their HUD, images that are particularly meaningful to them, generated by a collaboration between Elli’s and the audience member’s AIs. However, the emotional journey they all go on is collective, an improvisation woven from their individual dreams by the oneirofex.”

Elli’s AI doesn’t dream for her — it extends her senses to a scale she could never reach alone. It reads thousands of brainwave streams simultaneously, detects emergent emotional patterns, and feeds them back to Elli, who decides which to amplify and which to let fade. She is the conductor; the audience’s brains are the instruments.

The performances can’t be recorded or replayed. They’re improvised from the real-time reactions of the specific audience present. Piers, Elli’s husband, tries to describe what it feels like:

“You feel you’re part of something grand and epic; you’re surrounded by love, and you belong. The dream is the way life ought to be, and your other life, the life outside the dream, is fiction.”

This is Liu’s most hopeful vision of human-AI collaboration: not replacement, not automation, but instrumentation. The AI handles data at inhuman scale. The human provides the art. Neither could do it alone.

It’s Not a Job If It Doesn’t Pay

Some of the book’s best moments are its smallest. Julia has a personal financial AI — a “fiscjinn” — that she deliberately gave her dead mother’s voice. She made it “extra responsible, a real hard-ass.” When Julia considers taking on an unpaid investigation to help a friend, the fiscjinn pushes back:

“Her fiscjinn had not wanted her to take on this investigation at all. ‘It’s not a job if it doesn’t pay.’ … ‘That’s what you said last month, and the month before that,’ the financial AI informed her. ‘And you have not, in fact, collected any bounties. Instead, you’ve been tinkering with toy robots and contributing code to nonprofit camera-jammers.’”

The fiscjinn tracks her behavioral patterns and uses them as evidence against her own excuses. It remembers that she said she’d collect bounties and didn’t. But when Julia overrides it, it yields. It advocates; it does not block.

“Even though her heart clenched for a second, she didn’t regret giving her fiscjinn her mother’s voice. She had made the jinn extra responsible, a real hard-ass. We never stopped wishing for our parents to be better than they were.”

This is the most human passage in the book. An orphaned hacker gave her AI her dead mother’s voice because she needed someone to tell her to eat properly and pay her bills. It’s grief, pragmatism, and self-knowledge all at once.

Elsewhere, Liu shows what happens when children’s data is stolen — a passage that hit me harder than any of the action sequences:

“Children’s data could often be worth more than adults’. Because privacy laws kept their personal data out of most aggregators, exchanges, and monitoring services, children’s identities had the benefit of being verifiable without being lived-in … It could be years before the victims, now adults, learned of what had been done in their names, with their virtual profiles in ruins.”

And the terrifying capability of acoustic signature analysis:

“Each church, concert hall, theater lobby, public monument, ancient ruin… had its acoustic signature, a unique blend of ambient noise, reverberation, and the timing and quality of echoes. Julia knew of multiple databases cataloging the acoustic signatures of various locations.”

Every phone call is a sensor deployment. The conversation is the cover; the ambient sound is the payload.

To Look Inside Sealed Boxes

The passage I think about most is not one of the technical set pieces. It’s the quiet lecture Julia remembers from her mentor, Sahima, about the difference between knowing how machines work and knowing how to ask them to do things:

“The shiny gadgets pumped out by the big tech companies — phones, sensepins, fusion vision glasses, etc. — were hermetically sealed boxes promising magic. And even if you could open them up, you’d just be presented with more, smaller sealed boxes promising more magic … Some ‘machine-assisted’ developers were so unfamiliar with hardware that they wouldn’t have been able to identify the chips that they supposedly wrote software for; their knowledge was more in the realm of knowing how to ask machines to do things than in knowing how to do those things themselves.”

Julia took from this talk the message that it was essential to look beyond what was given, to look inside sealed boxes so that she understood the magic. It’s a message for our own moment, when AI agents can generate code, analyze systems, and automate workflows — and the temptation to shout incantations and take the credit has never been stronger.

All That We See or Seem is not a perfect novel. The pacing sags in the middle act, some of the antagonist’s scenes feel melodramatic, and the resolution wraps up slightly too neatly. But the world-building is extraordinary. The technological ideas are not just plausible — they’re inevitable. And in its best passages, the book does what science fiction does at its finest: it makes you see the present more clearly by showing you a future that’s already arriving.

I started reading it as an agent builder. I finished it as someone rethinking what agents should be built for.