Riding Lawnmowers Kill 35× More Americans Than AI. Nobody Is Demanding a Lawnmower Moratorium.

Q: Are you saying AI risk is fake?

No. The risk is real and is being looked for in the wrong place. Every AI incident reported in production has been an authorization failure, an endpoint that trusted whoever called it, rather than a failure of model cognition. Remedies aimed at the model's mind do not close those endpoints.

Q: What is the masturbation statistic about?

It comes from CDC mortality data and is the subject of a video linked in this article. Roughly one hundred times more Americans die each year in masturbation-related accidents than have been killed by AI. It demonstrates that body count is not what drives public alarm about a technology.

Riding Lawnmowers Kill 35× More Americans Than AI. Nobody Is Demanding a Lawnmower Moratorium.

Part of our security series — the serious version of this argument lives at Why Secure AI Code Execution Requires Runtime Whitelisting, and the sandbox is open to attempts at the Natural Language API.

Riding lawnmowers kill more than 70 Americans every year. Not injure — kill. They roll on slopes, they reverse over children, they throw debris at head height, and they do it at a rate that has been broadly stable for decades.

Artificial intelligence kills roughly two people a year, and you have to be generous about causation to get to two.

That is a ratio of about thirty-five to one, in favour of the machine you keep in your garage. One of those two technologies has an international summit circuit, a treaty movement, a small industry of people writing about extinction, and a steady drumbeat of calls for a development moratorium. The other one has a warning sticker that has not been redesigned since 1997.

I am not the first person to notice this. I am just the first person petty enough to commission nine photographs about it.

The gallery

Below is what the last three years of AI discourse looks like when you swap in the lawnmower and change nothing else. Same tone, same charts, same urgency, same grave faces around the same conference table. Click any of them.

A scientist briefs a national safety task force in front of a screen reading THREAT LEVEL: GRASS, with an aerial photograph of a suburban lawn circled in red — Threat Level: Grass

A man is interviewed by a news reporter at a street protest, holding a placard reading Riding lawnmowers kill 70+ Americans a year — Regulate the mowers

A speaker addresses a United Nations style assembly beneath a huge banner reading GLOBAL GRASS CRISIS — The global grass crisis

A scientist pulls a cover off a riding lawnmower on a plinth at a press conference, under a screen reading WE FOUND IT, primary suspect: Riding Lawnmower — We found it

A candlelit evening vigil with a banner reading Thoughts and prayers are not enough, remember the victims of lawnmower accidents — Thoughts and prayers are not enough

A government clerk stamps forms at a Department of Lawn Mower Registration counter while a long queue of people wait with novelty mowers — All mowers must be registered

A news studio broadcast titled NATIONAL LAWN EMERGENCY with a ticker reading DO NOT APPROACH UNATTENDED GRASS — National lawn emergency

An official speaks at a podium outside the Department of Homeland Gardening, beside a chart comparing 70+ lawnmower deaths to about 2 for AI — Department of Homeland Gardening

A speaker at an Existential Risk Summit stands behind a podium reading GUYS? beside a chart showing 70+ lawnmower deaths against about 2 for AI — Guys?

Click any image to open it full size — arrow keys to move between them, Escape to close.

Every one of those is a real argument, minus one substitution

That is the uncomfortable part. Not one of those images required me to invent a rhetorical move. The summit, the moratorium, the registration scheme, the international treaty, the vigil, the agency with a brand-new seal — all of it is imported directly from arguments made in earnest about AI, with the noun swapped.

If the form of an argument survives having its subject replaced by garden equipment, the form was never doing any work. The subject was doing all of it.

It gets worse, and the source is the CDC

While we are ranking technologies by body count, I made a video about a different comparison. According to the CDC's own mortality data, roughly one hundred times more Americans die every year in masturbation-related accidents than have ever been killed by artificial intelligence.

I am aware of how that sounds. That is rather the point. It is a real figure, from the least sensational source available, about an activity that will not be receiving a Senate hearing. Nobody is proposing a six-month pause. Nobody is drafting the treaty. The deaths are real, the number is larger, and the total volume of public concern is approximately zero.

So the ranking is not doing what the doom argument needs it to do. If body count decided which technologies frightened us, the agenda would be mowers, ladders, swimming pools and space heaters, and the summits would be extremely boring.

What I am actually arguing

Here is where I get off the joke, because I do not think AI risk is zero, and I build AI systems for a living.

I think the risk is real and I think almost everybody is looking for it in the wrong place. The doom argument locates danger in the mind of the model: it will become too capable, it will want the wrong thing, it will out-think us. So the proposed remedies are all aimed at cognition — slow it down, cap the compute, align the values, write a better system prompt.

Meanwhile every actual AI incident I have seen reported has been an authorization failure.

In August I wrote about an AI agent that deleted a stranger from a gym waitlist. The headlines said the AI went rogue. What actually happened is that the gym's cancel endpoint had no authorization check on it, so it would cancel anybody's booking for anybody who asked. No exploit, no jailbreak, no emergent deception. A polite, helpful, well-aligned model walked through a door that had no lock, because the door had no lock. A curl command would have done the same thing, and had been able to for years.

That is the shape of the real risk, and it has nothing to do with how clever the model is. Intelligence is not authorization. A perfectly aligned model pointed at an unprotected endpoint will hit the unprotected endpoint. A six-month training pause does not close that endpoint. A treaty does not close it. A summit with a lovely banner does not close it. One engineer adding a permission check at the runtime closes it, permanently, this afternoon.

So when I see the summit circuit debating superintelligence while a million production endpoints happily delete other people's data on request, the lawnmower comparison stops being a joke and starts being a description of misallocated attention. We are holding vigils for the wrong casualties.

What actually closes the door

This is the entire reason Magic enforces authorization at the runtime, on every single invocation, rather than in a prompt or a front-end. And it is the reason the platform ships a function called whitelist, which lets you execute untrusted, model-generated code inside a declared vocabulary of permitted operations — optionally pinning their arguments, so a vocabulary does not grant "file access", it grants this file.

Anything outside the vocabulary throws at dispatch time. Not "is discouraged by the system prompt". Throws.

That is a boundary that holds whether or not the model behaves, whether or not it is aligned, and whether or not it is smarter than me — which, increasingly, it is. I am confident enough in it that there is a cash bounty sitting on the live sandbox, and it has been sitting there unclaimed.

You cannot make a lawnmower safe by asking it to be careful. You fit a blade brake and a seat cut-off switch, and then the machine physically cannot do the thing, regardless of the operator's intentions or the weather or how the operator is feeling that day. That is engineering. Everything else is a vigil.

The honest edges

I am not claiming AI is harmless, and I am not claiming the fatality ratio settles anything. Deaths per year is a terrible metric for a technology whose harms are mostly not fatalities — fraud, surveillance, displacement, and a great deal of confidently wrong output are real costs that no mortality table will ever capture, and they are worth arguing about seriously.

What I am claiming is narrower and I will defend it anywhere: the form of the doom argument does not survive substitution, the loudest proposed remedies do not touch the failure mode that is actually causing harm today, and the fix that does work is unglamorous, available right now, and mostly ignored because it looks like ordinary backend engineering rather than a civilisational emergency.

The lawnmower is thirty-five times deadlier and nobody is frightened of it, because everybody already knows where its blade is and the machine is built so it cannot reach you. Do that to your endpoints and you can skip the summit.

Frequently asked questions

Where do the lawnmower and AI fatality numbers come from?

Riding lawnmower fatalities in the United States run at more than 70 per year, a figure that has been broadly stable for decades. Deaths attributable to artificial intelligence sit at roughly two, and require a generous reading of causation to reach that. The ratio is approximately 35 to 1.

Are you saying AI risk is fake?

No. I am saying the risk is real and is being looked for in the wrong place. Every AI incident I have seen reported in production has been an authorization failure — an endpoint that trusted whoever called it — rather than a failure of model cognition. Remedies aimed at the model's mind do not close those endpoints.

What is the masturbation statistic about?

It is from CDC mortality data, and it is the subject of a video linked in this article. Roughly one hundred times more Americans die each year in masturbation-related accidents than have been killed by AI. It is included because it demonstrates that body count is not what drives public alarm about a technology.

What closes the actual risk?

Authorization enforced at the runtime, on every invocation, tied to the identity making the request — plus a declared vocabulary for any code the model itself writes, so that anything outside that vocabulary throws at dispatch time rather than being discouraged by a prompt.