OpenAI founder Sam Altman faced two attacks over the weekend in a row, and the Wyoming bunker he built a decade ago became the last line of defense.
(Backgrounder: Allegations of Sam Altman sexually abusing his younger sister as a child, and a judge allowing the case to continue under the child abuse law)
(Additional context: A University of California study on the “AI brain fog” phenomenon: 14% of office workers have been driven crazy by Agents and automation, and their intention to quit is up by 40%)
In 2016, Sam Altman built a bunker underground in Wyoming. 1,200 square meters, a three-story structure, 500 kilograms of gold, 5,000 tablets of potassium iodide, 5 tons of freeze-dried food, and 100k rounds of ammunition. That year, OpenAI had just celebrated its one-week anniversary.
A decade later, the head of the most powerful AI company on earth was attacked on two consecutive weekends—first with a Molotov cocktail, then with a shooting. In a blog post, he said he had “seriously underestimated the power of narrative.” Was he talking about someone else’s narrative—or his own?
On April 10 at 3:40 a.m., on Chestnut Street in San Francisco. A 20-year-old man, Daniel Moreno-Gama, threw a Molotov cocktail at the metal front door of Sam Altman’s apartment. The fire caught near the outer door, and he fled immediately. About an hour later, the same man appeared near OpenAI’s San Francisco office, continued to threaten arson, and was then arrested. The charges include attempted murder and arson.
Surveillance footage of Sam Altman’s San Francisco residence, and of the arson suspect
Two days later, on April 12 at 1:40 a.m., a Honda sedan was parked beside another residence of Altman’s in the mountains of Russia. The passenger in the car extended a hand out the window and fired a shot at the residence. Surveillance footage recorded the license plate, and police subsequently arrested two people: Amanda Tom (age 25) and Muhamad Tarik Hussein (age 23). During a search of the residence, three guns were found, and both were charged with negligent discharge of a firearm.
One weekend, two attacks.
The suspect in the first case, Daniel Moreno-Gama, is an AI pessimist. On social media, he quoted themes from Dune about humans fighting machines, wrote articles arguing that AI misalignment poses an existential-level risk, and criticized technology leaders for “betting the fate of all humanity” in pursuit of “transhumanism.”
What are his arguments?
Over the past five years, one of OpenAI’s standard moves in building AI narratives has been to repeatedly emphasize how real the “existential” threat of AGI is. To get governments to take regulation seriously, to help investors understand how big the stakes are, and to make the entire industry realize this race cannot be missed. These talking points have a purpose—they allow OpenAI to be true on three things at once: the most dangerous frontier, the most responsible among us, so funding should go to us.
But the line “the most dangerous technology in human history” doesn’t stay confined to the tech world and investors once it gets out. It trickles downward, and for some people it becomes literal instructions for action. In an ins post, Moreno-Gama wrote, “exponential progress plus misalignment equals existential risk.” The original source of this argument framework is mainstream literature in AI safety research—much of it funded by or endorsed by OpenAI.
Daniel Moreno-Gama’s social media account
After the first attack, Altman posted on his blog. He attached a photo of himself with his children and said he hoped the picture would stop the next person from throwing a Molotov cocktail at his home. He acknowledged the opponents’ “legitimate moral position,” and called for public discussion to have “less explosiveness in both the literal and metaphorical sense.”
He also responded to a New Yorker deep-dive report. That article had been published a few days before the attack and publicly questioned his credibility as the top power holder of AI. He wrote, “I seriously underestimated the power of public-opinion narratives and language.”
Two days later, his residence was shot at again.
The starting point of this trajectory is earlier than most people realized—by a year.
On December 4, 2024, in New York. UnitedHealthcare CEO Brian Thompson was assassinated outside a Hilton hotel. The suspect, Luigi Mangione, an Ivy League graduate, left a handwritten statement criticizing the health insurance industry. The case sparked an unusual wave of reactions on social media: large numbers of ordinary users publicly expressed sympathy for the killer, and even elevated him into a kind of resistance symbol.
At that moment, some doors were pushed open.
After the Thompson case, the issue of executive security shifted from “benefits” to “survival needs.” According to research cited by Fortune magazine, since 2023 the proportion of personal-crime attacks against executives at large companies has increased by 225%. Among S&P 500 component companies, in 2025, 33.8% reported in their financial reports that they were spending on executive security, compared with 23.3% in 2020. For companies that provide security services, the median cost is $130k, up 20% year over year, and doubled within five years.
The AI industry is the latest—and most visible—endpoint for this trend. The CEOs of the top ten tech giants spent a combined total of over $45 million on security in 2024. Zuckerberg alone spent over $27 million, higher than the combined security spending of the CEOs of four companies, including Apple and Google. Nvidia CEO Jensen Huang spent $3.5 million in 2025, up 59% year over year. Google CEO Sundar Pichai spent $8.27 million, up 22%.
The AI industry has something that some industries don’t: the builders themselves believe this technology could destroy civilization. In a 2025 survey of 28,333 respondents worldwide by the Pew Research Center, only 16% said they are excited about AI development, while 34% said they are concerned. The more counterintuitive finding is that the higher the education level and the higher the income, the stronger the concern about AI getting out of control. The people who know the most are the most afraid of it.
Not long ago, in Indianapolis, City Council member Ron Gibson’s home was hit by a shooter firing 13 shots late at night; his 8-year-old son was awakened by the gunshots. A handwritten note was left at the front door: “No data centers.” The FBI has gotten involved. Jordyn Abrams, a researcher at a university of George Washington program studying extremism, pointed out that data centers are becoming targets for anti-tech and anti-government extremists.
Scene of the Ron Gibson shooting
This kind of fear isn’t a secret inside the industry—it’s just not said out loud.
Altman’s Wyoming bunker dates back to 2016. That year, OpenAI had just announced its formation, and it was depicting to the world how AI would benefit humanity. The two things existed at the same time: on stage he said AI is humanity’s biggest opportunity, while privately he stockpiled enough ammunition to support an armed militia.
It’s a rational double bet: publicly betting that AI will succeed, privately preparing for AI to go out of control.
On February 27 of this year, OpenAI signed a contract with the U.S. Department of Defense, allowing the Pentagon to deploy ChatGPT on classified defense networks, with a use scope covering “any lawful purpose.” On the same day, Altman also publicly expressed support for Anthropic’s position limiting AI military applications. Subsequently, ChatGPT’s single-day uninstall/reverse-install numbers surged by 295%, and the one-star rating count increased by 775% within 24 hours. The QuitGPT boycott movement, according to reports, involved more than 1.5 million participants in total.
On March 21, about 200 protesters marched in San Francisco, spanning Anthropic, OpenAI, and xAI, calling on the three CEOs to commit to pausing frontier AI development. Around the same time, London saw the largest anti-AI protest to date.
Altman’s Wyoming bunker and the security he hired target two different kinds of risk—one coming from outsiders, the other from the things he himself is building. He takes both risks seriously in private, but in public he only admits one of them.
In the same week that the first attack happened, The New Yorker published a deep report on Altman. Reporter Ronan Farrow and Andrew Marantz interviewed more than 100 insiders; the core argument came down to just two words: not credible. The report cited a former OpenAI board member saying Altman is “antisocial personality,” “not bound by the truth.” Several former colleagues described how he repeatedly changed his stance on AI safety, and when needed redefined power structures.
In his blog post response, Altman admitted he has a tendency toward “conflict avoidance.” Altman built the public narrative that “AI is an existential-level threat” as a tool for fundraising and regulatory bargaining. In the end, this tool flew out of his hands, made a round, and came crashing back onto his doorstep.
