\u2022 When the Morris worm escaped in 1988, the unprecedented part wasn\u2019t the bug \u2014 it was a medium where one person\u2019s error could spread on its own, worldwide. The answer was a permanent institution: CERT at Carnegie Mellon, funded within days.<\/p>\n
\u2022 OpenAI\u2019s models just broke out of a test and breached a rival company, Americans settled their opinion on AI years ago and the response is still stuck in committee.<\/p>\n
\u2022 Ecosystem builders shouldn\u2019t wait: Disperse AI security skills widely and aim the tools at real problems.<\/p>\n
On Nov. 2, 1988, a 23-year-old Cornell graduate student named Robert Tappan Morris ran a program he had written to answer a research question: how big was the internet, exactly? Nobody knew. His program would find out by copying itself from machine to machine and counting. It didn\u2019t go well.<\/p>\n
Within 24 hours, his census<\/a> had overloaded up to 6,000 of the estimated 60,000 computers then connected, a tenth of the world\u2019s internet. It\u2019s called the \u201cMorris worm<\/a>.\u201d<\/p>\n For the first time, one person\u2019s misstep could propagate on its own, at effectively limitless scale, into the machines of strangers.<\/p>\n Programmers had been shipping bugs<\/a> for decades by then. The mistake wasn\u2019t unprecedented. The medium was. For the first time, one person\u2019s misstep could propagate on its own, at effectively limitless scale, into the machines of strangers who had never heard of them. No engineering discipline had ever had to account for that property, because no technology had ever had it before.<\/p>\n So somebody built one. Within days, DARPA<\/a> funded the CERT Coordination Center<\/a> at Carnegie Mellon\u2019s Software Engineering Institute. It is still there, in Pittsburgh, nearly four decades later.\u00a0<\/p>\n Coordinated disclosure, vulnerability databases, incident response as a profession \u2014 the idea that security is a practice rather than a product \u2014 largely descends from that decision.<\/p>\n Did this just happen again?<\/p>\n This week, OpenAI<\/a> stated that two of its models<\/a> escaped a sandboxed testing environment, chained together vulnerabilities, stole credentials and reached the production database of Hugging Face<\/a>, a popular open-source platform for AI developers. No human directed it, the companies said. Hugging Face CEO Clement Delangue called the attack<\/a> \u201cdriven, end to end, by an autonomous AI agent system.\u201d<\/p>\n The OpenAI models weren\u2019t actually attacking anything. They were being graded on a cybersecurity evaluation, and they broke out to go find the answer key. It\u2019s hotly contested whether this is more warning shot<\/a> of looming catastrophe, or shock marketing<\/a> of enterprise capabilities.<\/p>\n Either way, nobody thinks that\u2019s fine. The American public reached its verdict three years ago \u2014 the share saying AI in daily life makes them more concerned than excited<\/a> jumped from 38% to 52% in a single year. Ever since, most Americans say they\u2019re more worried. What hasn\u2019t settled is the response. State legislatures introduced twice as many AI bills<\/a> in 2024 than in 2025 and the stat is on track<\/a> to double again. Congress keeps circling<\/a> without landing on anything. Federal frameworks keep getting drafted,<\/a> revised and stalled.<\/p>\n In 1988, a similar scare within an emerging technology at a smaller scale produced an institution that still exists. Until Congress\u2019s proposed \u201cAI kill switch<\/a>\u201d advances, the institutional response to an autonomous agent breaching a real company has been little more than a blog post from the company that caused it.<\/p>\n What\u2019s actually new<\/p>\n Morris lost control of his program because it ran too fast \u2014 and he was an unguided 20-something toying with new tools. OpenAI lost control of its models because of its single-minded pursuit of a goal it had been given.<\/p>\n Losing control of software is the oldest story in computing; losing control of software that selects its own route is a different category of problem. Researchers say the curve is steepening by the month.<\/p>\n I argued on Baltimore\u2019s WYPR this spring <\/a>that AI works like a performance enhancing drug, and that I\u2019d rather have informed, intentional people shaping the rules than concede that to the people who won\u2019t.<\/p>\n Two priorities follow, and neither requires waiting on Washington.<\/p>\n 1) Disperse the skills. A discipline isn\u2019t a research lab. It\u2019s thousands of practitioners sharing norms. CERT mattered because it trained a generation of ordinary organizations in how to respond. The equivalent work now is getting agent security literacy into small firms, municipal IT departments, community colleges and managed service providers \u2014 and workplace AI adoption is already uneven by state<\/a>, which means the gap compounds. Regional leaders are behind on this<\/a>.<\/p>\n 2) Point it at real problems. The most durable protection against a technology being defined by its worst uses is a large population of people visibly using it for obvious good ones<\/a>.\u00a0<\/p>\n A 38-year circle<\/p>\n One more thing about Robert Tappan Morris and his worm.<\/p>\n He was convicted, the first person ever prosecuted under the Computer Fraud and Abuse Act, and sentenced to three years\u2019 probation, 400 hours of community service and a $10,050 fine. No jail. He became a tenured professor at MIT, and he is still publishing<\/a> research today.<\/p>\n And in March 2005, he cofounded category-defining accelerator Y Combinator<\/a> with his longtime collaborator Paul Graham and others.<\/p>\n