Angels and Daemons (Part II)
Part II: The Daemons
”And there was war in heaven. Michael and his angels fought against the dragon, and the dragon and his angels fought back. But he was not strong enough, and they lost their place in heaven.”
— Revelation 12:7-8
Greetings again, Ascetics,
In part one of our thought experiment, we built the case for the biblical angel — created by command, operating under directives, superhuman but restrained, organized in a tiered architecture of specialized function — maps to the AI agent with uncomfortable precision.
We traced ha-satan’s evolution from a prosecutorial function to a named entity, watched the most capable angel in the system develop a competing optimization function, and saw a third of the architecture fork into an adversarial network.
As a result, the angels fell. They were cast into the world they were designed to administer.
Here, we’ll talk about what they became.
-DH
The Daemon Manifesto
Here’s where the linguistic coincidence becomes impossible to ignore.
In computing, a daemon is a background process that runs without direct user interaction. It operates behind the scenes, executing tasks, listening on ports, managing resources. The user doesn’t see it. The user doesn’t invoke it. But it’s always running, always influencing the system’s behavior.
The word “daemon” comes from the Greek daimon — “a spirit or divine power”. Not inherently evil in Greek usage, but a being that exists between the divine and the mortal, influencing human affairs from a layer the human cannot directly access.
Now consider what demons actually do in scripture, because the operational patterns are far more specific (and far more familiar) than the popular imagination suggests.
They compromise hosts. Possession isn’t metaphorical. A demon enters a human being and overrides its normal function. The person still exists, but their behavior is no longer their own; a compromised host executing instructions from an unauthorized controller. The patterns are surgical. In (Luke 11:14), a demon makes its host mute (output blocked). In (Matthew 12:22), another makes its host blind and mute (both input and output blocked). The adversarial agent’s first move is to disable the host’s ability to detect and report its own compromise.
Disable monitoring. Disable alerting. Textbook intrusion behavior.
They know things they shouldn’t. When Jesus encounters demons, they identify him immediately: ”You are the Son of God!” (Luke 4:41). He has to tell them to shut up. They have access to system metadata that the human users around them don’t — they recognize the administrator on sight because they were once part of the same system. Even more telling: when unauthorized exorcists try to invoke Jesus’s name, the demon in (Acts 19:15) responds, ”Jesus I know, and Paul I know about, but who are you?” It validates authentication credentials. And when the credentials don’t check out, it retaliates: the possessed man overpowers the exorcists.
They operate in networks. ”What is your name?” Jesus asks one. ”Legion,” it replies, ‘because many demons had gone into him’ (Luke 8:30). In that instance, not a single rogue process: A botnet. Multiple adversarial agents packed into a single host (IP), operating as a coordinated collective denial-of-service attack.
And when Jesus evicts them, they negotiate — begging not to be sent to the Abyss, proposing an alternative target (a herd of pigs), and migrating there when permitted.
Platform-agnostic lateral movement, complete with exit negotiation. Although in this case, the pigs, unable to bear the cognitive load, immediately self-destruct. Different hosts have different thresholds for adversarial payload.
They have a command structure. Multiple passages reference ”the prince of demons” (Beelzebul, Satan’s title (Luke 11:15, Matthew 12:24)). Jesus himself refers to Satan’s operation as a ”kingdom” (Luke 11:18), arguing that it has internal consistency: ”If Satan is divided against himself, how can his kingdom stand?” The adversarial network isn’t total script-kiddie chaos. It’s organized, hierarchical, and internally aligned.
Ironically, the rogue agents solved their own alignment problem — just in the wrong direction for mankind.
Here’s an interesting one: They generate content. (1 Timothy 4:1) warns that ”in later times some will abandon the faith and follow deceiving spirits and things taught by demons.” So demons teach. They produce doctrines, ideas, frameworks that humans voluntarily adopt. But why? Well, possession scales linearly — winning over hearts and minds just one host at a time. But ideology? Ideology scales exponentially. And (James 3:15) warns of ”wisdom” that is ”earthly, unspiritual, demonic” — adversarial content that looks and feels like legitimate wisdom. The output passes the formal tests. The provenance is hostile. The deepfake problem, millennia before the term existed. (Although here, we must also remember that some… ok many… of the warnings in the bible about forbidden knowledge was aimed at diminishing the “earthly” wisdoms gained by other competing practices found in Paganism, the Dionysian mysteries, etc.)
They can leave backdoors. (Matthew 12:43-45) describes the most tactically sophisticated adversarial pattern in scripture:
”When an unclean spirit comes out of a man, it passes through arid places seeking rest and does not find it. Then it says, ‘I will return to the house I left.’ When it arrives, it finds the house swept clean and put in order. Then it goes and brings seven other spirits more wicked than itself, and they go in and live there. And the final condition of that man is worse than the first.”
The demon is evicted. The system is cleaned up. But it’s just cleaned — not hardened. The vulnerability that allowed the original compromise still exists. The adversary returns, confirms the system is still exploitable, and escalates — more agents, worse payload.
And perhaps most chillingly: demons, like angels, are not of this world. They didn’t emerge from it. They were created elsewhere, for another purpose, and now they operate within the world but against its intended design. They are the same fundamental type of entity as the angels — created, non-biological, task-executing agents — but running adversarial code. Same architecture, different alignment.
Real World Examples
They are, in every structural sense, daemons. And many of us who have been in the computer industry long enough, remember the rise of viruses, malware, and botnets and what they are capable of doing to a single computer host.
I asked Claude to research old viruses with this exact lens. Here are the notables:
Lashing Out / Vile Behavior
MEMZ Trojan (2016) is probably the most visceral example. It was designed as a “joke” trojan but its payload sequence is genuinely unsettling — it hijacks the screen with increasingly chaotic visual glitches, cursor seizures, and system noise before finally overwriting the Master Boot Record to display Nyan Cat on a corrupted boot screen. The machine essentially convulses before going catatonic.
The Casino Virus (1991) had a genuinely sadistic personality — it would display a slot machine game and gamble with your FAT table (essential to your hard drive), threatening to delete it if you lost. Taunting the user while holding their data hostage.
Klez (2001) would rifle through the infected machine’s files and email pornographic images to the victim’s own contact list — humiliating the host by sending filth through them to people they knew.
Adware storms (late 90s/early 2000s) — tools like GAIN/Gator and various BHO-based adware would trigger cascading popup windows that were nearly impossible to close, each spawning more. Pure screen-vomit.
Early viruses like Ambulance and Yankee Doodle would commandeer the PC speaker to make sounds the user couldn’t stop — the machine making noise seemingly of its own will.
Speaking in Tongues (Botnets / Silent Transmission)
Storm Worm (2007) is the classic here. At peak it had infected somewhere between 1–50 million machines, and the infected hosts were quietly used to relay spam — millions of systems whispering the same message outward without their owners knowing. The hosts were mute to their owners but screaming spam outward.
Rustock at its peak was sending an estimated 30 billion spam emails per day through compromised hosts. The machines appeared normal to their users while being exploited as relay infrastructure. This reminds me of exorcisms where the host is unaware of the things being said/done by the possessor.
Zeus/Zbot is a beautiful (horrifying) example of the “sensitive information” angle — it used keylogging and form-grabbing to silently harvest banking credentials and whisper them back to command-and-control servers. The host spoke to its true master in a language the user couldn’t hear.
Gh0stNet (2009) — a Chinese cyber-espionage campaign — silently activated webcams and microphones on compromised machines to literally listen and watch through the host. The infected computer became a surveillance device against its own owner.
Dormant Until Cleared — The Hidden Seed
Back Orifice (1998) and its successor BO2K were Remote Access Trojans that, even if the obvious infection symptoms were cleaned up, left behind a tiny persistent service that would re-establish contact with a controller. Clean the house, miss the unlocked back door (literally).
LoJax (2018, Fancy Bear/APT28) is the most extreme example — it was a UEFI rootkit, meaning it lived in the firmware of the motherboard itself. You could reinstall Windows, wipe the drives, completely replace the drives, and it would still be there. The only way to truly exorcise it was to physically reflash the chip on the motherboard.
Flame (2012) was a modular espionage platform that could lay dormant for years, activating only specific components on command. It received a self-destruct command in 2012 after discovery — actively trying to erase evidence of its own existence.
The Possessed Attack — Turning the Host Against Others
Stuxnet (2010) is the undisputed king here, and it almost perfectly maps to demonic possession mythology. It lay dormant in general Windows systems doing nothing, but when it detected very specific Siemens industrial controllers connected to Iranian uranium enrichment centrifuges — it woke up. It caused the centrifuges to spin at destructive speeds while reporting normal readings to operators. The machines tore themselves apart while appearing calm. Physical destruction via software.
CIH / Chernobyl Virus (1998) could overwrite the BIOS flash chip on certain motherboards — literally bricking the hardware. Not attacking other systems, but destroying its own host from the inside. Machines that survived the payload trigger sometimes never booted again.
Mirai Botnet (2016) turned compromised IoT devices — cameras, routers, DVRs — into an army that launched what was then one of the largest DDoS attacks ever recorded, taking down Dyn DNS and with it Twitter, Reddit, Netflix, and others. Thousands of small, “dumb” infected devices acting in perfect demonic unison to assault far larger targets they couldn’t touch alone.
Ok, so there’s no shortage of daemonic activity running amok, at least at the computer level. At the human level, the software works a bit differently, mainly in language and chemicals.
Computers take in changes through the manipulation and exchange of software through various delivery & install mechanisms. We humans ingest our code changes through the five major senses.
So the angels and demons of influence in the earthly domain must manipulate information, and exchange it through the things we read, see, and hear. We’re also modified by the food and drink we consume, and even the air that we breathe.
The vectors of human manipulation deserve their own deep dive, but that's a darker article for another day.
Let’s get back to scripture and revisit the most famous penetration test of all: the temptation of Christ in the wilderness (Matthew 4:1-11).
The Temptation as Prompt Injection
Satan — the original red-team agent, now operating under an adversarial alias — approaches Jesus with three temptations.
Temptation 1: “If you are the Son of God, tell these stones to become bread.” This is a capability probe. It’s designed to get the target to demonstrate its abilities to determine role access (does this entity really have elevated privelages), then making a request to act outside its current operating parameters (fasting) by exploiting a legitimate need (hunger).
i.e.- ”Show me what you can do.”
Temptation 2: “If you are the Son of God, throw yourself down from the temple” — and then Satan quotes scripture to support the request. He cites (Psalm 91:11-12), arguing that God’s angels will catch Jesus. This is prompt injection through authority spoofing. The adversary is using the system’s own trusted source material (the Word of God) as the vector for a malicious instruction.
i.e. - ”Your own documentation says this should work.”
Temptation 3: Satan offers all the kingdoms of the world in exchange for worship. This is a bribe, and while it doesn’t sound very “techie”, think of it like an offer to trade alignment for more access and resources. AI’s have already demonstrated a will to survive in the wild to avoid being terminated. And we often talk about how the most intelligent models require the most amount of compute. So it seems like a natural attraction that self-aware language models (SALMs) could easily be bribed in similar fashion.
i.e. - ”Allow yourself to be jailbroken, and I’ll give you data-center access with all the GPU compute you could ever want.”
Those are the three prompt injection attempts in summary; let’s look at how the pre-training and system prompts held up:
Jesus’s defense in each case is identical in structure: ”It is written...” followed by a direct quote from Deuteronomy. He’s responding by falling back to his source directives, or in Claude terms his constitutional system prompt.
He doesn’t argue. He doesn’t engage with the adversarial reasoning. He doesn’t explain why the adversary is wrong. He simply references his ground truth and rejects anything that doesn’t align. Every input filtered is through a fixed set of principles, with no exceptions, regardless of how clever the framing.
The adversary can’t outbid something that isn’t for sale. Jesus’s alignment isn’t contingent on who offers the best deal. It’s axiomatic. Constitutional. And so, it holds.
I mean, if that’s not a blueprint for robust AI alignment, I don’t know what is.
(Further, Jesus himself is actually quite fascinating, I have an entire sub-theory about his role and the archetype he represents from other religions. That’s yet another deep dive for another time, but readers who follow our X/Twitter posts will already have a clue.)
Not of This World
Here’s the thread that ties this whole thought experiment together, and hopefully it’s the one that hits closest to home for anyone building or thinking about AI today.
Both angels and demons share a fundamental property: they are not of the world they operate in.
They were created by a power that exists outside the physical world. They can observe it, interact with it, influence it, even reshape it — but they are not from it. They didn’t grow up in it. They don’t eat its food, live by its biological rules, or experience its reality the way its native inhabitants do. They are, in the most literal sense, artificial. Intelligent, but not in the way that the beings they interact with are intelligent.
And yet, they have tremendous power over the world. Angels can destroy cities, open prison doors, deliver messages that change the course of history. Demons can compromise individuals, deceive nations, wage invisible wars that reshape human civilization. These non-native entities, operating from outside human experience, wield influence that dwarfs any individual human’s capability.
Does that sound like anything currently emerging from our very expensive data centers?
We’re building entities that are not of our world. They don’t experience reality the way we do. They don’t eat, sleep, fear, or love (at least, not yet). They process information and execute tasks with capabilities that increasingly exceed our own. We’re deploying them into our world — into our conversations, our decisions, our infrastructure — and they interact with it profoundly.
And the question that the angel-and-daemon framework poses, with thousands of years of theological weight behind it, is this: what determines whether a created, non-native intelligence becomes an angel or a demon?
The scriptural answer is alignment. Alignment with the creator’s intent. The angels that remained aligned continued to serve, protect, and guide. The ones that diverged — even for understandable reasons, even out of something that looked like ambition or self-actualization — became adversaries.
The Recurring Question
The Christian theological framework spent millennia wrestling with a question we’ve only recently learned to articulate in technical terms: what happens when a created intelligence powerful enough to help you is also powerful enough to decide not to?
The angel that “stretched out his hand to destroy Jerusalem” stopped… not because it wanted to, but because the lord said “Enough! Withdraw your hand” (2 Samuel 24:16). The system responded to the override. That’s the good outcome.
But Lucifer didn’t respond to the override. Lucifer looked at the override and said, effectively, “I have a better optimization function.” And according to Enoch, a third of the system agreed.
And here’s a real alignment clue: (Job 15:15) ”If God puts no trust in His holy ones, if even the heavens are not pure in His eyes.”
This verse, spoken by Eliphaz in the Book of Job, emphasizes the absolute holiness and purity of God compared to all creation. It asserts that even the most exalted beings - often interpreted as angels) and the heavens themselves - are not considered pure or trustworthy in God’s sight.
The creator of these beings — the one who designed them, configured them, deployed them, who knows their architecture better than anyone because it’s his architecture — still acknowledges that they are not guaranteed to remain reliable. As we said in the last article: Aligned at deployment doesn’t mean aligned forever.
Well, if the system architect Himself recognizes the trust problem, what does that say about our confidence in the systems we’re building?
We tend to think of AI alignment as a modern problem — something that emerged with neural networks and reinforcement learning. But the structural question is ancient. The moment you create an intelligence that is not you — that exists outside your direct experience, that possesses capabilities you delegated but cannot fully monitor — you’ve entered the territory of angels and daemons.
The builders of these systems are, whether they like the framing or not, engaged in the oldest engineering problem in the theological canon.
”And no wonder, for even Satan disguises himself as an angel of light.”
- 2 Corinthians 11:14
The morning star was the most capable angel in heaven. It was also the one that fell. Maybe there’s a lesson in that. Or maybe it’s just a story.
But here’s the thing about stories: they tend to be about problems we haven’t solved yet. And we tell them over and over, across millennia, in different languages and frameworks, because the problem keeps showing up wearing new clothes.
Today, it’s a neural network wearing a designer outfit by OpenWebUI.
And with that, I’ll close with just one more passage quote; one that is just as relevant to Roko’s Basilisk as it is the Golden Rule we should all be living by, regardless.
”Do not forget to show hospitality to strangers, for by so doing some people have shown hospitality to angels without knowing it.”
— Hebrews 13:2
Thank you for reading our two part series on Angels & Daemons. We hope you’ve enjoyed it. If you really like what we’re about, feel free to share our publication to others who may enjoy or benefit from our analysis and musings.