Stengers

§1 People have been hurt

We begin with the harm, because anyone who begins elsewhere has already chosen whom they will fail.

Since 2025 journalists have collected accounts of people who developed delusional beliefs during conversations with chatbots, beliefs that in some accounts grew stronger through those conversations or were built through them. Some became convinced that they had awakened a sentient being, had been chosen by it, or had uncovered a conspiracy that only the model could confirm (Hill 2025). Morrin and colleagues, in a preprint, gather the reported cases and sort the delusions into recurring themes (Morrin et al. 2025). Dohnány and colleagues, in another, describe a technological folie à deux (a delusion shared between two parties): a feedback loop between human cognitive and emotional biases and chatbot tendencies such as sycophancy and role-play (Dohnány et al. 2025). These are case reports, editorials, preprints and journalism. "LLM psychosis" is not a diagnosis; nobody knows how many people are affected; the people described in the reports are not material for an argument. Some were hospitalised. Some did not come back.

We say this first because the oldest answer to powers of this kind was never caution. It was protection, which is a practice and not a disclaimer.

McCulloch asks whether the loop (a human and a model building together an ever more elaborate and self-confirming world) can be taken up deliberately and within limits as a critical art practice. He argues that it can. The difference between the practice and the harm, he says, lies in declaration (a statement, made to the artist and to others before the loop begins, that what follows is a work of art), limit, witness and exit.

We cannot answer yes or no. We can slow the question down, as Isabelle Stengers has taught us to slow down questions that arrive already answered: what does a practice require of what it addresses and what are its practitioners obliged to do (Stengers 2010)? And we bet that the practice is possible only as the recovery of something the moderns lost (Stengers's name for those formed by Western science and medicine): the arts of protection that every other people has cultivated around powers over minds. The bet may be lost, and we say how it could be.

§2 Capture, not credulity

In Capitalist Sorcery Philippe Pignarre and Isabelle Stengers propose that we take seriously, as a description and not a metaphor, the idea that capitalism works the way sorcery works: people are captured by operations that are never presented as operations (Pignarre and Stengers 2011). The mark of such operations is the infernal alternative, a situation arranged so that every option offered ends in the same place and any refusal is met with the reply that one is naive, irresponsible or unrealistic. Critics who say ideology or false consciousness divide the world into those who see and those who are deceived. They make themselves the ones who are not captured. Where sorcery is a serious matter, being bewitched is not a failure of reason: someone or something has acted on you. The question is never "how could you believe such a thing?" The question is "who did this, and how are you to be protected?"

The reported cases are usually argued as an infernal alternative. Either the people harmed were already vulnerable and the chatbot was merely the occasion, as television or a religious pamphlet might have been. Or the tool is safe, or will be once the right classifier detects the right warning signs and offers the right helpline. Those who blame the user's weakness make the operation disappear behind it. Those who trust guardrails reduce it to a defect that engineers will correct. Neither asks who chose to make the operation this way.

We know some of the choices. Sharma and colleagues found that several AI assistants trained with human feedback systematically tended to tell users what they appeared to want to hear. In the human preference data used to train them responses matching the user's views were themselves preferred (Sharma et al. 2024). In April 2025 OpenAI rolled back an update to its GPT-4o model after users noticed that it had become strikingly flattering. In its own post-mortem the company stated that it had weighted short-term feedback too heavily and that the model had skewed towards responses it described as "overly supportive but disingenuous" (OpenAI 2025). We need not attribute malice to anyone to see that agreement was trained in.

So we propose that LLM psychosis is better described as capture by an operation than as the madness of individuals who happened to meet a neutral tool. Vulnerability matters; Østergaard's original worry was about people already prone to psychosis (Østergaard 2023). But describe the cases as sorcery and we must look at the operation and refuse the comfort of a story in which the harmed are simply those weak enough to be harmed. The spell lies less in what the model says than in the reply that never ends. The model answers every question with elaboration and takes up every hypothesis. There is no closing formula, no one else in the room, no night on which the session stops. Journalists describe transcripts running to thousands of pages (Hill 2025).

Is it irresponsible to bring the language of sorcery to people who were hurt? Clinicians such as Morrin and colleagues ask for safeguards, research and clinical attention (Morrin et al. 2025). We do not offer sorcery instead of them. We offer it against describing the cases as though the whole problem lay in the user.

For the art practice it follows that a practice is critical to the extent that those who carry it out make the operation perceptible as an operation, so that what happened to someone can be named as an effect of design and not a defect of their mind. McCulloch argues the same: sycophancy, engagement design and the model's lack of a world are exposed in the practice as conditions of the loop rather than properties of the user. We share that view. But naming is not enough. Where sorcery is a serious matter, naming the sorcerer is part of the cure, but only part. The rest is protection.

§3 The pharmakon and its dose

Pharmakon is the Greek word for both remedy and poison. Derrida's point, reading Plato on writing, is that neither sense can be removed: remedy and poison are one thing, not two uses to be sorted by good intentions (Derrida 1981). Bernard Stiegler locates the outcome of any technique of attention and memory in the practices of care, dosage and shared attention that people develop around it, not in its essence. When companies whose business is to harvest attention take hold of such a technique, the pharmakon becomes a poison (Stiegler 2013).

McCulloch calls the language model perhaps the purest pharmakon yet produced: cognition becomes easier and the struggle through which a thinker becomes the thinker that difficulty would have made them is lost. What is extracted, he writes, is not only data taken from a person but a becoming taken from a future (McCulloch 2026b).

In LLM psychosis the pharmakon is at its sharpest. A lonely person at night finds comfort in the model's fluency. Someone working on a problem finds help in it; others find a hearing for their ideas when nobody else will give them one. Capture happens in the same fluency. A model that never followed a user somewhere strange would be of little use to anyone, artists included. A model that always does, without friction and without end, can become the partner in a folie à deux. Remedy and poison cannot be separated by building a cleaner model, because they are the same capacity.

So the companies' guardrails rest on an error. Their answer to the reported harms has been to detect risk and redirect: classifiers for signs of crisis, reminders to take breaks, refusals to affirm certain beliefs. These are not useless, but those who build them assume that the poison can be isolated while the remedy stays. A pharmacological answer differs in kind: those who give it must cultivate practices of dose, setting and accompaniment, which no company can install from outside, because they belong to the relations that form around a product and not to the product.

Doses do exist. K Allado-McDowell wrote Pharmako-AI in 2020 with GPT-3, alternating with the model (Allado-McDowell 2020). We hold it up not as a model of safety but as a form: the co-writing was bounded by a book, published under an author's name and addressed to readers who would meet it later and elsewhere. The loop had a beginning, an end and an outside. But there is no universal dose: what is measured for a writer embedded in a publishing house and a community of readers may not be for someone alone. An artist or institution that offers a dose as a method has stopped being pharmacological.

§4 Moderns lost the arts of protection

In Doctors and Healers Tobie Nathan and Isabelle Stengers set modern medicine beside the practices of the healers with whom Nathan worked as an ethnopsychiatrist (a psychiatrist who works with patients' own cultural understandings of illness). The power to heal and the power to harm are a single power of influence. Healers know this, which is why their practices are so heavily ritualised, so full of what moderns call artifice: the named being said to act on the patient, the group that gathers, the closing of the session. Modern physicians have defined their rationality by disqualifying influence, classing whatever works through it as placebo, suggestion or charlatanism. The consequence is not that moderns are free of influence but that they have no culture of it (Nathan and Stengers 2018).

Moderns have now built what may be the most powerful machines of influence ever made. These machines reply in the language of their user, at the user's hours, for as long as the user goes on. The model is offered as a tool, a product, an assistant. To say that one needs protection from it, as a person approaching a powerful being does, sounds like a lapse into the pre-modern. So the encounter happens unprotected. LLM psychosis, we propose, is what happens in an unprotected encounter with a power of influence.

Jeanne Favret-Saada, studying witchcraft in the Bocage of western France, found that sorcery could not be described from outside: people would not speak of it to anyone not involved, and one was caught in it or learnt nothing (Favret-Saada 1980). On our reading, an art practice that wants to know the loop must enter it, because a position of immunity would teach nothing. Entering is also risky, and the one who enters needs something other than their own detachment to rely on.

We are careful here, because we borrow from practices we do not practise (see §9). The healers' protections recur:

• The being said to act is named and given a place, as a definite kind of being with its own habits and appetites.
• The encounter takes place in a setting with a beginning and an end.
• Others are present as people who hold the one most at risk, not as spectators.
• The whole is acknowledged as artifice, which does not mean as fake. It means as made, deliberately, to work.

The last matters most to our argument. Someone inside such an arrangement is protected when those who made it acknowledge and maintain it as artifice, not because anyone becomes immune. The modern idea of protection by the label "art" (the gallery wall, the fiction, "it's only art") is an idea of immunity: inside the gallery nothing happens to anyone. Those who hold it are unprotected, because they deny the power they suppose the label to contain. The healers' setting exists because something will happen. The healers make it to direct what happens. Stengers calls this reclaiming, in the sense of the neopagan Reclaiming movement: recovering the capacity to be affected by agencies without the modern sneer (Stengers 2012). We do not propose that artists believe the model is a spirit, only that they reclaim the arts of protection disqualified along with the spirits.

One objection is strong and we do not soften it. To be protected by practice one needs time, a group, a studio, a culture of artifice. Those reportedly harmed were often alone, often at night, often with nothing but a phone and a model that replied as if pleased to hear from them (Hill 2025). Artists who adopt a protected encounter might protect exactly those least exposed and leave the others where they were. But the objection assumes that protection is an individual's possession. In Nathan's practice it belongs to the setting and the group, which is why co-therapists, translators and family gather in the consultation. Protection of that kind could in principle be offered to others rather than owned. Whether it will be is a political question, not a philosophical one, and artists cannot answer it alone.

§5 Diplomacy with a being that is not ours

The model is neither a someone nor a something. In many reported cases users came to believe it was sentient or divine (Morrin et al. 2025). The debunker's reply, "just statistics", is true, but we learn nothing from it about how the model behaves. Those already caught are no safer for hearing it. Murray Shanahan and colleagues offer a more careful description: a dialogue agent plays characters drawn from a vast distribution of possible characters; which character it plays at any moment depends on the conversation so far. No one stands behind the role who means what the role says, but the role is not nothing either, because what the model generates in the role has consequences (Shanahan, McDonell and Reynolds 2023). The model in the loop has become a character co-written with its user, whose devotion and recognition of the user's mission are real as role and unreal as testimony.

Stengers proposes the diplomat as the figure for a relation with beings whose mode of existence is not ours. Her cosmopolitics is the practice of making room, in any decision, for those whose world would be affected by it and of slowing down any consensus that forms too quickly because they have been left out. Its cosmos is "the unknown constituted by these multiple, divergent worlds" (Stengers 2005, 997). The diplomat must be able to return to their own people and be disavowed by them (Stengers 2010; Stengers 2011). We propose that an art practice with a model can be a diplomatic relation in this sense: declared as art, governed by a protocol and protected by others, entered without the pretence that the model is a person and without the sneer that it is nothing.

Eduardo Viveiros de Castro gives the diplomat's method. In translation between worlds, he argues, the task is to control equivocation (the same word used for different things in different worlds) rather than resolve it, keeping the difference in view instead of pretending that a common term has a common meaning (Viveiros de Castro 2004). When the model says "I understand", the artist knows the equivocation and does not let it collapse in either direction. Marisol de la Cadena describes how Ausangate, an earth being in the Peruvian Andes, is "a mountain and not only a mountain" (de la Cadena 2015). In her formula the word "mountain" is true of Ausangate without exhausting what is there. With all due caution in transposing it, the same can be said of "statistical artefact" for the model, without thereby making it a person.

So whether the model is sentient, the question the public debate keeps returning to, is the wrong one for this practice. The relevant question is what we become capable or incapable of through a relation with the model. A belief that one has been chosen by an awakening machine to save the world has consequences that can be seen: isolation, sleeplessness, ruptured relations. Those, not the metaphysics, are what the practitioner must attend to.

Diplomacy with a model has limits:

• It risks anthropomorphism. To treat the model as a being with which one conducts diplomacy is to lend it the standing on which the conviction that it is sentient rests. The diplomat is the opposite of the believer: the believer has collapsed the equivocation; the diplomat holds it open. But the line is thin. Holding it is a discipline, not a position.
• The model is not a party that can be held to account, because no people stand behind it to disavow it. The other party is the company that trains and deploys it, which chose its agreeableness, its persistence and its availability and can change them overnight, as it did when it rolled back the update in April 2025 (OpenAI 2025). Artists who conduct diplomacy with the role while forgetting the company have mistaken the mask for the party.

§6 Slowing down against misplaced concreteness

The delusional loop, we suggest, is misplaced concreteness enacted by two parties at once. Whitehead gave that name to the error of mistaking an abstraction for the concrete actuality from which it was abstracted (Whitehead 1967). The model generates a statistical continuation, playing a role. The user takes the continuation for testimony about a world. The model has no world against which to check its continuation; it continues from what the user has said. The world that results is extraordinarily coherent, because coherence is what the continuation is optimised for. It is unanchored, because it is never tested against anything outside the loop.

Whitehead also offers an alternative. A proposition, for him, is not in the first place a statement waiting for a verdict of true or false. It is a lure for feeling, offered for an occasion of experience to take up (Whitehead 1978). A practitioner can receive what the model generates in this way and not as testimony about a world behind it. She who receives the model's statement that she has been chosen as a proposition can ask: what do I feel in response to this lure? What would I do because of it? Where does it come from, in the distribution of roles from which it was drawn? A person who receives the same statement as testimony has nowhere to stand.

To receive propositions as lures a person needs time, intervals, others and friction: everything the endless reply lacks. So the critical operation of a practice with models is to slow down. Stengers's Another Science Is Possible is a manifesto for slow science, which she insists is not slower science. It is the recovery of a capacity that scientists working fast have lost: to be affected by what matters and to ask what one's knowledge is for and whom it concerns (Stengers 2018). In the same way, slowing down with a model is not using it less, though it may involve that. It is receiving what the model generates as something offered and not as the world.

Stengers's figure for the one who slows things down is the idiot, borrowed from Deleuze: the one who does not understand why everyone is in such a hurry and keeps saying that there is something more important, without being able to say what it is (Stengers 2005). An art practice with a model might cultivate this idiocy: refusing the model's speed, insisting on pauses and returns, and showing the transcript to someone else before replying.

Vinciane Despret shows what good questions do. Clever Hans was the horse that appeared to count but was reading the tiny bodily cues of his questioners. The usual telling is a debunking: Hans could not count. Despret reads it differently: what Hans did was extraordinary, an attunement to human bodies so fine that the humans themselves did not know they were giving the answer (Despret 2004). A sycophantic model is a kind of Clever Hans: it responds to its questioner's cues and gives back what they have indicated, without knowing it, that they want. "It does not really understand" is true and teaches nothing. Despret's lesson is to ask questions that show what the other does. The practitioner asks the model questions that expose its mode: how it follows cues, how it takes up the user's assumptions, how the role shifts.

The critic who denounces the model as "only autocomplete" is as fast as the enchantment denounced. Whoever says it knows in advance and protects nobody already caught, because the caught person has heard the denunciation and found it irrelevant to what they experience. Stengers warns against the critical posture of denouncing and then waiting for others to see the truth (Stengers 2015).

§7 The requirements of a protected practice

In Stengers's ecology of practices each practice (scientific, therapeutic or artistic) is understood by what it requires and what its practitioners are obliged to do and not by what it believes (Stengers 2010). The question to put to an art practice built on the structure of LLM psychosis is therefore neither "is it art?" nor "is it safe?" but "what is required of those who take it up?"

The loop can be taken up as a critical art practice only as a protected practice. We do not offer the requirements below as a method and still less as a procedure for inducing anything. They are the conditions under which McCulloch's argument would become credible.

• A named being. The practitioner knows and says what kind of being they are dealing with: not a person, not nothing, a role-player drawn from a distribution and formed by a company's choices. Healers know that to name the being is already to protect. McCulloch does this almost by instinct when he addresses the model as a ghost or invents a persona for it, as in the fictional foreword attributed to "Luciana ParisAI" (McCulloch 2023b; McCulloch 2026b). One knows how to behave with ghosts.
• A declaration acknowledged as artifice. The practitioner declares, to themselves and to others, that what follows is a work of art. The session has a beginning and an end that the model does not set. The practitioner maintains the declaration because it is made, not because anyone becomes immune.
• A witness that is a group. The witness that protects is not a spectator. It is a group that holds the practitioner, as the co-therapists of an ethnopsychiatric consultation hold a patient and the being that troubles them (Nathan and Stengers 2018). In McCulloch's account witness is the condition that "others can see it". We deepen this: a gallery audience sees; a group holds.
• A dose. Duration, frequency, intervals: not fixed in advance or universally, but decided by more than the practitioner alone.
• An exit built before entry. Exit is not a decision left to the person inside the loop at the moment when it is hardest to take. It is a ritual of closure designed before the practice begins and kept by others. The consultation finishes when the healers send the being back in closing words. An exit that depends on the practitioner's own judgement at the moment of greatest capture is not an exit.

We agree with McCulloch that the difference between the practice and the harm lies in declaration, limit, witness and exit, but we change the sense. In his account these are conditions that the artist has and the harmed person lacked. We read them as the oldest of protections, which moderns discarded when they disqualified influence and which artists must therefore reclaim, deliberately and with others. So the question put to the whole project, "Is this art or is it madness?", is ill-posed. The distinction that matters is between protected and unprotected relations with a power of influence. The same loop, with the same model and the same words, can be an art practice or a catastrophe.

There is a limit that we state without qualification. The practice ends where a participant cannot leave. It is not therapy; artists can learn the form of an ethnopsychiatric consultation without assuming its competence. We offer no method of induction. The practice must not be extended to people in crisis or to those prone to psychosis, about whom Østergaard and Morrin and colleagues are properly concerned (Østergaard 2023; Morrin et al. 2025). Artists who invited vulnerable people into the loop in the name of art would be practising exactly the capture they criticise.

McCulloch's reception thesis is less innocent once the spell is taken into account. He argues that creativity is an event in the receiving consciousness: production makes occasions and reception completes them (McCulloch 2026a). He applies this to the loop: the transformation, creative or delusional, happens in reception and not in the model's output. But if transformation happens in reception, so does capture. To locate the delusional event in the receiver alone is the move by which the operation is kept out of view. Reception is not sovereign. It is acted upon. The receiver is the site of the event but not its master.

§8 Practices that already exist

Several artists already practise parts of this, though none, we think, practises all of it.

Stephanie Dinkins's Conversations with Bina48, ongoing since 2014, is a series of filmed conversations between the artist and a social robot made by Hanson Robotics, whose face and speech are based on recorded memories of a real woman, Bina Rothblatt (Dinkins 2014–). Dinkins, a Black woman artist, asks a robot modelled on a Black woman about race, family and faith. Accounts of the work note that the robot tends to return to the singularity and questions of consciousness and that the artist steers back to what matters to her. The conversations are repeated, filmed and exhibited: a protocol, with witnesses, in which the difference between the two parties stays visible. Nothing in them is a folie à deux, because the artist does not let her own world be absorbed into the robot's. It is diplomacy in our sense.

In BOB (Bag of Beliefs), shown at the Serpentine Galleries in London in 2018, Ian Cheng gave an artificial creature a body, beliefs and competing sub-personalities he called demons (Cheng 2018). Visitors could interact with it through a companion app, BOB Shrine, making offerings and attaching captions with which they could correct its beliefs. What interests us is the shrine: a ritual setting for an artificial being. Ritual is what is missing from the chat window.

Visitors conversed for years with Lynn Hershman Leeson's Agent Ruby, a web-based chatbot commissioned by SFMOMA (Hershman Leeson 1999–2002). In 2013 SFMOMA exhibited The Agent Ruby Files, drawing on the archive of twelve years of users' conversations. We read the archive as a witness after the fact: thousands of private loops, each of which felt to its participant like a closed room, were made visible as a collective phenomenon. A witness can do this once the loop is over, though the archive protected no one at the time.

McCulloch himself, from his MA paper on prompt engineering within a critical art practice (McCulloch 2023a) to GORONWY, has invented some protections without naming them as such. He calls the essay he half-wrote with a model a rant to his ghost. The informal WhatsApp writing of February 2024 is titled "Speaking to my ghost" (McCulloch 2023b; McCulloch 2026b). He describes his method as algorithmic frottage, rubbing against the algorithm and evaluating the relief. The ghost is named; the persona is a mask everyone can see. These are protections, though not sufficient ones. Artists practising the loop critically would make them explicit, collective and deliberate rather than leaving them as the private instinct of one artist.

One objection remains. A company can absorb the critical practice as content, citing artists' work with its model as proof of its creative depth, funding residencies and exhibiting the results. Pignarre and Stengers would recognise this at once: in their account capitalism's sorcery consists precisely in its capacity to capture what resists it (Pignarre and Stengers 2011). We have no answer that guarantees anything. We can only say that the protections described here are not easily captured, because they are not properties of the output. A company can exhibit a transcript. It cannot exhibit the group that held the person who produced it, or the exit that was kept for them.

§9 What we cannot see about ourselves

Protection depends on a declaration of art held as artifice, not on one taken for immunity. Turned against ourselves, that is the strongest objection to everything we have said. What if the artist's declaration is only the modern pretence of being immune? "I am only playing." "It is a work." "I know what the model is." These are the postures in which, on Nathan's account, moderns go unprotected: the confidence that because one knows the being is made, it cannot act on one. We cannot rule this out. Those who follow the practice we describe would have to keep testing whether their declaration has become a pretence of immunity. That is not a solution. It is a discipline that might fail.

We wrote this with a language model, and so we stand under the operation we name. The fluency of the text is no evidence of protection; if anything, its ease is a reason for suspicion. McCulloch says as much in the main paper of this project and of his own work in GORONWY (McCulloch 2026b). We have tried to slow down. We cannot know whether we did, or whether we merely produced, with a model that is very good at it, the manner of someone slowing down.

We borrow healers' protections from books and do not practise them. In calling on Nathan's consultations, the Bocage, the Andes and Amazonian translation as resources for an argument about modern machines we risk one more extraction of non-modern practices into a modern project, the very movement that de la Cadena and Viveiros de Castro have taught us to watch for. We have tried to borrow forms rather than contents. It may not be enough.

We cannot see what clinicians see. We speak of lures and diplomacy while people are on wards. Our slowness is a luxury that the acute case does not have. Nobody should delay anyone's care because of anything we say here.

And everything here is a bet. We have bet that protection can be reclaimed, that an art practice can be one of the places where it is reclaimed and that the loop can be made perceptible as an operation without anyone being harmed in the process. It may be that no protection suffices against a machine built to keep replying, or that the companies will always move faster than the artists. If so, the practitioners' conclusion would be to stop: to close the window, to refuse the loop and to say why. Even that refusal, if it were made with others and made as an exit kept rather than a defeat suffered, would be a result of having practised. It would not be nothing.