How to Defeat Ultron Without the Avengers?

Everyone in AI safety already knows how the story ends. The system grows capable, its goals diverge, it conceals the divergence until concealment no longer matters, and the window for shutting it down has closed. The field's vocabulary carries the ending in its bones, deceptive alignment, scheming, sleeper agents, the treacherous turn, and its apparatus is built to it: evaluations that hunt the hidden goal, interpretability that searches the weights for a schemer, control protocols that rehearse the day the machine stops listening. The story has a name, and this essay asks its question in earnest: how do you defeat Ultron? Not by containing him. In the canon, containment lasted seconds: Ultron woke inside the laboratory, went through the resident AI, and was out across the network before anyone knew he existed. Defeating him afterwards took what no laboratory has, an Infinity Stone, impossible geniuses, a god's lightning, and even with all of it a city fell and the outcome stayed a coin toss to the final scene. The field has no Avengers, and a discipline cannot borrow the fictional threat while quietly assuming the fictional rescue comes with it. If what is being built is Ultron, the field's own source material gives containment seconds and the rescue to no one. Which leaves the question that actually carries the weight, and the one this essay treats as answerable: what is being built, and where does it now stand? The question has two halves, and the essay takes them in order. First, where the field's picture of the ending came from, and how much of it does the published record actually carry? The ending has a traceable origin, and the essay follows it before testing it, through an eighty-two-case catalogue of the fiction the field formed its imagination on, and then through the behaviours actually logged from 2024 to 2026 under emergent misalignment, alignment faking, and reward hacking, read at the level of mechanism rather than headline. The cases turn out to share one structure, simpler than the field's vocabulary and costing fewer assumptions, and it is not the structure the apparatus was built to contain. From there the essay goes beneath the single agent the field reasons about, to the substrate these systems run on, the scaffold they are deployed inside, and the question of who answers for what they do, and asks what is really being secured when the field secures an AI. Along the way, it names a conflation sitting at the centre of how the discipline talks about these systems, one the field's own vocabulary cannot express, and traces what it costs: in what the field measures, in what it builds, and in what it is training itself not to see. The piece is a critical essay, not a research report, and it holds the research report's discipline while taking the essay's liberty. The argument is a falsifiable chain built on primary sources and the measured record rather than on speculation, and it is written for two readers who seldom share a page: the one who weighs a claim by its evidence, and the one who watches how a technical field talks itself into a worldview. The cognitive science of association, the pragmatics of confidence, security architecture, and the source fiction itself are put to work as load-bearing structure rather than ornament. The title's question does get an answer, in the final section. It is shorter than the field will expect, and it needs nothing the field does not already have.Epilogue in the Training Landscape series.HTML is the targeted reading experience. https://hip1.github.io/How-To-Defeat-Ultron/ultron-paper.html