Nobody Chose It: Four Stories About Who Decides How AI Shows Up

November 13, 2026

By the GenHax Team · November 13, 2026 · Categories: AI in Education, Cybersecurity, Knowledge Graphs, Community, Research

On Monday, we looked at a worm that reached developers through code they never picked. On Tuesday, schools found out the AI in their search bar comes with no full off switch. On Wednesday, a nurse in Guam was invited to mentor at a hackathon and decided to build instead. On Thursday, Stanford's newest review of the research said the question isn't whether AI helps students. It's how they use it. Four stories, one thread.

The thread is choice. A lot of the AI in our lives arrives without anyone choosing it. The part we still control is what we do with it.

That sounds like a slogan, so we'll be concrete. Every story this week had a moment where something showed up uninvited: a package, a feature, a shortcut. And every story had someone who made a deliberate choice anyway. Here's the week, and what we think it means for anyone designing how people learn.

Monday: the package nobody chose

We opened with software supply chains. In August, Microsoft Threat Intelligence published its analysis of ChainDrop, a self-propagating worm that spread through "more than 400 packages across multiple unrelated publishers" on npm. The line that stayed with us:

"One stolen token can produce malicious patch releases across every package available to that publisher."

It hasn't stopped. On November 4, OX Security reported 17 more hijacked npm packages. On November 9, the same researchers flagged a poisoned Ethersphere release, likely published with a stolen developer access key.

What hits home is that most victims never picked the poisoned package. Something they installed depended on something that depended on it. Nobody chose it. Their dependencies did.

That's why we like Purdue's SecureChain knowledge graph, one of the NSF Proto-OKN projects (award #2333736, PI Tianyi Zhang). It maps those hidden dependency webs for Python and Rust: 803,769 packages, 312,388 vulnerabilities and about 29.6 million dependency links. On Monday we asked it one question: how many PyPI packages depend directly on the requests library? The answer was 64,097. That's only the direct ones. Transitive dependencies make the number far bigger.

Our SecureChain challenge with Purdue gives learners that graph and a real question to answer. Ghazi Hudeihed from Georgia Tech won an earlier round by building "Secure SaaS" on it. The skill isn't memorizing CVEs. It's being able to trace what you depend on before it ships, so the risk becomes a choice you can see and make.

Tuesday: where's the off switch?

On Tuesday we moved from code to classrooms. Google announced new K-12 controls on November 3. In a briefing reported by EdSource, Google's Chris Phillips said: "If a school is not comfortable with that, and simply wants AI off, then they have the choice to not have Search on at all."

Google then clarified on X. Schools can turn off Gemini and Gemini Notebook and keep Search, "but AI Mode and AI Overview will remain integrated into Google search." On November 9, Sen. Ed Markey sent Google a letter calling the policy an "ultimatum." He wrote that the company "should not use its dominant market position to force schools to adopt" its new tools.

Then came the number that made us stop. Common Sense Media ran 180 tests and found that AI Mode "completed students' homework assignments for them every time." All 180.

We don't have a view on antitrust. Our view on the classroom is simple. If schools can't fully turn off the answer box, they can still change the question. An assignment AI Mode can finish in one query is a choice the school made, not one Google made. A real problem, a working build and a conversation about how it works are much harder to outsource.

Randell Keiler, who runs NY STEP at MEC, described GenHax as "an easy way for our high school students to experience real-world problems." That's the redesign in one sentence. Give students the problem, not the worksheet.

Wednesday: invited to mentor, chose to build

On Veterans Day we told the story of Rachel Ceria. She's a nurse manager at VA Pacific Islands Health Care, based in Guam. "I live in Guam but manage registered nurses from across the Pacific," she told VA. She was invited to the 2025 Veterans Health Hackathon in Tampa as a mentor. She signed up as a hacker instead.

Her problem was one she lived with every day: community care records for veterans that still move by fax and paper. Her team, Mission Fax Possible, built an AI triage tool that handles requests "in seconds instead of minutes." It was one of nine first-place winners out of 51 teams, and it went on to VA's Make-a-thon with Microsoft and VA mentors. "You just never know whether your thought or idea could eventually become the next big thing," she said.

Dr. Indra Sandal, who founded the Veterans Health Venture Studio, describes the mission as creating "technology by the people who will use it, alongside those people." That's very close to what we believe. The person nearest to the problem should be the one building, with experts sitting beside them, not standing in front.

Rachel's choice is the mirror of Monday and Tuesday. Nobody chose the poisoned package. Nobody fully chose the AI in the search bar. She chose the problem, chose the tool, and chose to be the builder. VA's third hackathon starts today in Tampa and runs through Sunday. Somewhere in that room is the next Rachel.

Thursday: it felt like learning

The research story tied the week together. On November 10, Stanford's SCALE / AI Hub for Education published its November review of the evidence on AI in K-12 (Walker, Fesler, Martinez Claeys, Agnew and Loeb). The repository has grown to 1,686 papers. Studies with strong causal evidence went from 20 in March to 52. That includes five new student-facing studies in U.S. K-12 settings, where March had none. Stanford notes that most of the repository is preprints, not peer-reviewed work.

Two findings matter for this week's theme. First:

"AI appears to be better for learning when students use it for learning support than when they use it for producing work, although neither type of use consistently improves learning."

Second, and harder to sit with:

"AI tools can improve students' perceived learning experiences, even when they do not improve learning outcomes."

In other words, a student can feel like they learned more and not have learned more. Susanna Loeb summed up the first finding for Education Week: "Is paper good or bad? Well, it depends on how you're using it." The review closes by saying the question is "not simply whether generative AI is effective in education, but when, how, and for whom it supports learning."

That's the week's last choice, and the one teachers and learners control most. Is the AI supporting your thinking, or doing the work for you? From the inside, the two can feel the same. That's exactly why the second finding matters.

We hold ourselves to the same test. In a GenHax challenge, AI can help you build. Then a mentor asks you to walk through how it works and why you made each call. We think that conversation is what separates support from substitution. We don't have proof yet that it's enough, and we won't pretend otherwise. It's the bet we're making with learners, mentors and eight NSF Proto-OKN research teams.

NSF is making a similar bet in its own programs. Its FINDERS FOUNDRY solicitation (NSF 26-507) requires every K-12 AI team to include a K-12 educator, a technologist, a researcher and a parent or guardian. Development proposals from Planning awardees are due November 18. With only a handful of strong U.S. K-12 studies so far, putting the people closest to the classroom on the team looks like the right call.

What we're taking into next week

Four small design moves, one per story:

Make the hidden visible. Before learners use a tool, a library or a dataset, have them trace what it depends on. A knowledge graph like SecureChain turns "trust me" into a path you can follow.
Redesign what you control. You may not control the search bar. You do control the assignment. If one AI query can finish it, change the assignment.
Let the person closest to the problem build. Rachel wasn't the most technical person in the room. She was the one who knew the fax pile. Put mentors beside builders, not in front of them.
Measure learning, not the feeling of it. Ask learners to explain what they built, out loud, to someone who will push back. It's slower than a survey, and much harder to fake.

Keith John Ellis, who manages Purdue's Online AI Master program, wrote in his testimonial for GenHax that "Hugo's commitment to empowering students truly stood out." Purdue is also behind the SecureChain graph we opened the week with. That's the kind of loop we want: research data, a real challenge, learners who build, and a mentor who asks the hard question.

Try it this weekend

We closed the week with a small game: five numbers, higher or lower. (Spoiler: AI Mode did the homework in all 180 tests.) The bonus round had no answer key: how much did you learn this week, and was it more or less than it felt? We don't know a better way to find out than to build something and explain it.

Browse live challenges at app.genhax.com/explore, including SecureChain with Purdue and our other NSF Proto-OKN knowledge-graph challenges. Researchers who want to bring an open problem to a team of learners can start at app.genhax.com/government. The next GenHax Chronicles newsletter lands on LinkedIn on Monday, November 23.

Learn by building. Prove your skills. And choose what the AI is for.

Sources

Microsoft Security Research (Ravikant Tiwari, Sagar Patil, Suriyaraj Natarajan), "ChainDrop supply chain compromise: Anatomy of a self-propagating worm," Aug 4, 2026. microsoft.com
OX Security, "PolinRider Returns," Nov 4, 2026. ox.security; Ethersphere hijack report, Nov 9, 2026. ox.security
SecureChain knowledge graph (Purdue University, NSF award #2333736), live query via the Open Knowledge Network, Nov 9, 2026. registry.okn.us
Vani Sanganeria & Mallika Seshadri, "Google's new AI 'ultimatum' sparks concern over tech giant's power in California schools," EdSource, Nov 9, 2026. edsource.org
Fiona Bright Holton, Markey letter to Google, Boston.com, Nov 9, 2026. boston.com
Google, "AI in the learning era," Nov 3, 2026. blog.google
VA Pacific Islands Health Care System, "Rachel Ceria's 8,500-Mile Journey to 2025 Veterans Health Hackathon to Enhance Veteran Care," Nov 25, 2025. va.gov
VA via Audacy Connecting Vets, "Four hundred hackers gather in Tampa to improve veteran care," Sept 29, 2025. audacy.com
Roderick Cunningham, VA Tampa, "VISN 8 Innovators Poised to Transform Veteran Care at the 2025 Veterans Health Make-a-thon," Dec 23, 2025. va.gov
The American Legion, "Applications open for VA's third Hackathon," Oct 20, 2026 (Nov 13 to 15, Tampa). legion.org
Walker, Fesler, Martinez Claeys, Agnew & Loeb, "The Evidence Base on AI in K-12: A November 2026 Review," Stanford SCALE / AI Hub for Education, Nov 10, 2026. scale.stanford.edu
Sarah Schwartz, "Is AI Good or Bad for Learning? The Answer Isn't So Simple," Education Week, Nov 10, 2026. edweek.org
NSF 26-507, FINDERS FOUNDRY solicitation. nsf.gov
GenHax: Proto-OKN participation, app.genhax.com/government; community testimonials from genhax.com.