![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/10a5e3867a7d87c1615c9f67cca6a973c0-altman-screentime.rsquare.w700.jpg\")
<\/p>\n <\/p>\n
\n Photo-Illustration: Intelligencer; Photo: Getty Images\n <\/p>\n
Earlier this month, the popular AI platform Hugging Face disclosed<\/a> a \u201csecurity incident\u201d in a blog post. In some ways, it was routine; Hugging Face described an intrusion that briefly allowed \u201cunauthorized access to a limited set of internal datasets and to several credentials used by our services.\u201d But in one way, it was exceptional: It had been carried out, the company believed, \u201cby an autonomous AI agent system,\u201d which had executed \u201cmany thousands of individual actions\u201d leading to the breach. \u201cWe do not know which model powered the attacker\u2019s agents,\u201d the company said, or who was deploying it.<\/p>\n A week later, OpenAI<\/a> made a disclosure<\/a> of its own. \u201cAfter investigating,\u201d the company said, \u201cwe now know that this particular incident was driven by a combination of OpenAI models \u2014 including GPT\u20115.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes \u2014 while being internally tested on a benchmark\u2060 of cyber capabilities.\u201d In other words, the tools used by the hacker were OpenAI\u2019s, and the hacker was \u2014\u00a0unintentionally, the company says \u2014 OpenAI.<\/p>\n The incident occurred while OpenAI was testing its models for cyber capabilities, a process which involves prompting them to \u201cpursue advanced exploitation using complex attack paths\u201d \u2014 that is, to achieve a given goal with minimal safeguards, few rules, and access to a great deal of computing power. The company was using an outside benchmark called ExploitGym, which is intended to test the ability of models to turn security vulnerabilities into actual exploits. Given the target of getting a high score on a benchmark, the model followed multiple paths. One of them, on which the model became \u201chyperfocused,\u201d the company said, involved circumventing the test\u2019s restrictions on the open internet, after which the model \u201cinferred\u201d that Hugging Face, which hosts thousands of AI projects, might contain information about solutions to the benchmark. This is when the attack started. Eventually, Hugging Face\u2019s \u201csecurity team and agents detected and stopped the activity.\u201d<\/p>\n There are a few accurate ways to describe what happened here, some of which seem to contradict each other. There\u2019s a good reason for that: Since the release<\/a> of Anthropic\u2019s Mythos, cybersecurity \u2014 in particular, the ability of AI models to help find, exploit, and protect against hacks \u2014 has become synecdochical for enormous and diverse debates about AI. Anthropic, for example, has suggested the emergence of cyber capabilities in its models is a warning that other potentially harmful capabilities predicted by the AI-safety community \u2014\u00a0developing biological weapons, becoming superhumanly persuasive, or becoming misaligned with the goals of the people who created it or humankind in general \u2014\u00a0demand regulatory action but should also be shepherded by ethical, safety-focused firms such as itself<\/a>. Early mainstream press of the hack leaned into similar themes, emphasizing the appearance of autonomy and describing<\/a> an AI that \u201cescaped<\/a>\u201d or \u201cwent rogue<\/a>\u201d or a situation in which OpenAI \u201clost control<\/a>\u201d on its creation. Notably, and contrary to claims<\/a> that this was a pure publicity stunt, OpenAI\u2019s own language was a bit more careful than this. But some longtime security researchers thought it wasn\u2019t nearly careful enough, turning the escalation of a longtime trend into something unnecessarily novel:<\/p>\n I understand why OpenAI wants this to be a big story but I don’t understand why anyone who works in computer security would be surprised by this story, which has been told decennially since Dan Farmer announced SATAN to, like, the NYT. https:\/\/t.co\/WMNiLdqvwR<\/a><\/p>\n \u2014 Thomas H. Ptacek (@tqbf) July 22, 2026<\/a><\/p>\n This is a reference to an old story in cybersecurity: In 1995, a pair of programmers announced the development of SATAN, short for \u201cSecurity Administrator Tool for Analyzing Networks,\u201d which would scan networked devices for known security flaws. It was characterized, in contemporaneous press reports, \u201ca burglar\u2019s tool kit to break the Internet wide open.\u201d After its release, though, press coverage<\/a> pointed out that \u201cthe wave of satanic attacks never materialized,\u201d while tools like SATAN were instead useful to security professionals to find and patch flaws in their own software. This remains the approximate shape of the cybersecurity debate today, or at least parts of it: \u201cAI tools that can be used to find and develop exploits are dangerous and should be restricted\u201d versus \u201cIf indeed they are, the only solution is to make such tools available to everyone for defensive purposes.\u201d<\/p>\n There are enormous differences here, both in the complexity of the software described \u2014\u00a0a modern AI coding tool could write a piece of vintage software like SATAN in a few minutes \u2014 and in the fact that OpenAI actually and unintentionally manifested a serious security breach. The fact that any company is in possession of a tool that can automate exploit-finding and hacking to this degree, and that its own engineers might be repeatedly surprised by how it works, is genuinely new. But the old frame of debate remains stubbornly relevant, even as the particular cybersecurity risks scale to levels that would have been inconceivable in 1995. And the fight over how this incident is portrayed and should be understood is about more than an old cybersecurity debate. It\u2019s about how the involved parties \u2014\u00a0two corporations with opportunities, competition, and liabilities to worry about \u2014\u00a0want to be understood and treated in a world they\u2019re spending hundreds of billions of dollars to change.<\/p>\n The coverage on this OpenAI incident is abysmal. Use of the terms “rogue”\/”loss of human control” lead to groupthink as people lack critical skills to understand the difference between “autonomy” and faulty reward functions in AI on a task it was directed and given access to do.<\/p>\n \u2014 Dr Heidy Khlaaf (\u0647\u0627\u064a\u062f\u064a \u062e\u0644\u0627\u0641) (@HeidyKhlaaf) July 22, 2026<\/a><\/p>\n Heidy Khlaaf, who used to work on safety evaluations<\/a> at OpenAI and is now the chief AI scientist at the AI Now Institute, is making a technical point here but also a broad one. Describing the hack as the result of a model \u201cgoing rogue\u201d shifts agency to AI and, more important, minimizes the role of the company that strenuously built, trained, tuned, and attempted to test it, hoping for an infinite money machine but, in the meantime, building a powerful piece of general-purpose malware. Emphasizing OpenAI\u2019s role in building a piece of software that is extraordinarily useful for malign purposes, on the other hand, might make people wonder why it should be trusted. OpenAI itself summed up the situation like this:<\/p>\n We consider this incident to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly. We are sharing preliminary findings at this stage to help defenders understand what happened and to help calibrate on what models are now capable of. We will continue to conduct a thorough investigation alongside Hugging Face and will share more details on the vulnerabilities, incident, and findings when our investigation is complete.<\/p>\n Within the AI discourse \u2014 where the core product is treated, depending on the circumstances, as both a tool and a strange emergent phenomenon \u2014 this language makes sense. From an inch or two outside of it, one might observe that it\u2019s pretty weird. A tech company, in the course of testing its own software, ended up breaching another tech company\u2019s systems and didn\u2019t figure out what had happened for a while. An individual who did this would have been committing a felony; one AI company doing this to another is being resolved with a \u201cpartnership\u201d and passive language about understanding what \u201chappened\u201d and what models are capable of.<\/p>\n The AI industry\u2019s instinct to frame this as a matter of \u201calignment\u201d \u2014\u00a0an example of AI\u2019s adherence to human goals, desires, and needs, or lack thereof \u2014 is also less than clarifying here. OpenAI\u2019s model was both misaligned and extremely aligned:\u00a0that is, doing exactly as it was told. You can see the outline of a story of runaway AI here. But you can also see something similarly weird, still worrying but also a little bit funny: AI companies have spent a trillion dollars to create an automated monkey\u2019s paw.<\/p>\n There are plenty of reasons Hugging Face wouldn\u2019t want to, for example, file an enormous lawsuit against a fellow AI company. But its fresh \u201cpartnership\u201d with OpenAI is an awkward one, not just because it started with an industrial accident but because of how that incident was resolved. When Hugging Face first detected the intrusion, it tried to respond using AI-powered cybersecurity systems that relied on \u201cfrontier models behind commercial APIs,\u201d referring to the most capable models offered for sale by companies like OpenAI and Anthropic. This didn\u2019t work, the company said, because these systems contained safety-focused guardrails, \u201cwhich cannot distinguish an incident responder from an attacker,\u201d and failed. Instead, the company was forced to rely on GLM 5.2, one of the Chinese open-weight models that has recently<\/a> demonstrated near-frontier programming capabilities.<\/p>\n Hugging Face didn\u2019t specify which models were made useless by their own safeguards, and we can assume that such a company had, and exhausted, multiple options. But heavy users of frontier tools had their suspicions. Earlier this year, Anthropic pre-launched Mythos, a model it said represented a \u201cstep change\u201d in cyber capabilities, and invited select firms and organizations to use it to get ahead of attackers, who it warned would have access to similar models, sans guardrails, within months. Eventually, it publicly released a version of Mythos called Fable, which had unusually tight restrictions. If you ask it to hack a website, or provide instructions to build a bioweapon, it will refuse, as many models do for many risky prompts. But if you ask it to dig up, say, a famous<\/a> 1994 AI experiment in which simulated creatures unexpectedly<\/a> \u201cevolved\u201d toward the goal of movement by growing very tall and simply falling over \u2014\u00a0or, one might say, went rogue \u2014 it will flag that, too:<\/p>\n Art: Claude\n <\/p>\n In the midst of a mysterious cyberattack, this is more or less what Hugging Face encountered: an \u201cI\u2019m afraid I can\u2019t do that\u201d at just the wrong time and for just the wrong reasons.<\/p>\n There\u2019s a perceptible tension in the companies\u2019 announcements about what should come next. OpenAI argues that the hack proves that \u201cadvanced cyber capable models need to help security teams find weaknesses before attackers do\u201d and invites other \u201cdefenders\u201d to apply for \u201ctrusted access\u2060\u201d to test its models \u2014 which they can eventually pay to use for cybersecurity. The CEO of Hugging Face makes a different argument. This incident, he says, \u201cproves a point we\u2019ve long believed\u201d: that AI safely \u201cwon\u2019t be solved by any single company working in secret\u201d but rather by \u201cin the open, collaboratively, with broad access to AI for every defender, everywhere.\u201d Broadly speaking, frontier labs, which have accused Chinese firms of \u201cdistilling,\u201d or copying, their models, talk about Chinese AI as both a commercial threat and a source of other risks, including use by hackers; meanwhile, much of the rest of the AI industry, and customers of the big labs, have come to see open models as necessary or appealing alternatives, offering more flexibility, fewer limits, and lower prices. Now, after months of warnings from frontier labs about cyber risks from copycat models with no safeguards \u2014 during which time Anthropic itself was briefly forced by the government to take Fable offline on the basis that its availability might help Chinese labs catch up \u2014 what we got instead was an American frontier lab accidentally attacking another AI firm, which was only able to stop it by using \u2026 an open Chinese model.<\/p>\n it’s ironic that the first autonomous AI attack was done by a close weight model defended by an open weight model, where everyone was expecting the opposite<\/p>\n \u2014 Thomas Wolf (@Thom_Wolf) July 23, 2026<\/a><\/p>\n This isn\u2019t dispositive, but as Hugging Face\u2019s co-founder notes above, it\u2019s certainly a twist. And it has drawn attention to partial and awkward alignment between frontier AI firms \u2014 which argue that Chinese AI is a threat to their businesses and, if sufficiently advanced, to the geopolitical order \u2014 and the Trump administration, which has shown little interest in regulating AI except on an incoherent<\/a> emergency basis as it relates to national security, trade, and China. A few months ago, the administration was declaring<\/a> war on Anthropic for its attempts to limit certain military uses; now, it\u2019s leaning into AI protectionism:<\/p>\n We have information that Moonshot AI distilled Anthropic\u2019s Fable for the development of its K3 model. <\/p>\n To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of\u2026<\/p>\n \u2014 Director Michael Kratsios (@mkratsios47) July 22, 2026<\/a><\/p>\n It\u2019s also discussing, according<\/a> to Axios, plans to \u201cban cutting-edge Chinese AI models \u2014 a momentous move that could lock in dominance by OpenAI and Anthropic,\u201d through a combination of \u201cprocurement rules, Entity List threats and public pressure campaigns aimed at U.S. companies using Chinese models.\u201d This is pretty close to a scenario \u2014 in which \u201cevery agency\u201d is directed to \u201cissue soft law\u201d that creates fear and uncertainty among potential customers \u2014\u00a0floated<\/a> a few days earlier by Dean Ball, a former Trump-administration AI adviser and recent hire at OpenAI, which inspired intense backlash outside of the company. Ball has since clarified he wasn\u2019t endorsing such a plan, just making the case that the administration will likely consider it; he reiterated, though, that it seems likely the \u201cnational security implications of frontier open-weight model distribution\u201d will soon be too severe to bear and that, in general, open AI models \u2014 derived from their closed counterparts or not \u2014 are inherently \u201cdecelerationist\u201d in the specific sense that, by offering something slightly inferior but cheaper, they\u2019ll disincentivize investment in frontier models.<\/p>\n Fast-following competition, particularly from a country with antagonistic trade relations and a motive to undercut American AI firms, is a familiar sort of threat to a domestic industry. Deceleration is a slightly more abstract problem. On one level, a perception that AI firms are overinvesting in something they won\u2019t be able to monetize would be enough to settle the current question of the AI bubble and then pop it. In slightly more esoteric terms, this would threaten the ability of American firms to beat China to far more powerful<\/a> AI, which the people in charge of some labs \u2014 again, best represented by Anthropic, the most superintelligence-pilled of the cohort \u2014 are strategizing<\/a> around.<\/p>\n wow am i understanding this correctly?<\/p>\n 1. put chinese models on the entity list. \u2014 sign\u00fcll (@signulll) July 22, 2026<\/a><\/p>\n In the real world of today, outside of the frontier labs, AI-safety circles, and parts of the national-security apparatus, the view that American models need to be protected is losing ground, and quickly. On X, warnings about model distillation are met with jokes about how AI companies are built on theft<\/a>. In the tech industry, other tech companies and start-ups are forming trade associations<\/a> to preserve access to open models, which they\u2019re already integrating into their businesses and which they see as acceptable compromises. On Friday, Meta, Microsoft, and Nvidia joined<\/a> in, signing an open letter warning against \u201cpremature restrictions\u201d of open models. The emerging consensus among people who work on or with AI outside of the leading labs aligns more closely with Hugging Face: They want \u201cbroad access to AI,\u201d however it\u2019s built and wherever it comes from, so they can go about their business but also so that they don\u2019t get eaten alive or regulated to the margins. It\u2019s the small group of companies with a slight and unstable lead \u2014\u00a0with the most to lose \u2014 against, well, everyone else.<\/p>\n don’t worry. I’ve setup the logos so we’re all included. play below https:\/\/t.co\/XP5LeT41KK<\/a> pic.twitter.com\/C70sCGer3n<\/a><\/p>\n \u2014 Ben Burtenshaw (@ben_burtenshaw) July 26, 2026<\/a><\/p>\n At the very least, the case for restricting model access looks a lot like protectionism. And whether frontier-lab futurists are right about bigger risks around the corner and the regulatory responses or precautions they might raise, for everyone in the industry but those labs, the situation emerging in the meantime \u2014\u00a0a few dominant companies controlling access and usage of high-priced products, protected by the government in the name of national security and\/or a trade war, in an interconnected world where everyone else will have access to alternatives \u2014\u00a0is manifesting risks today. The Hugging Face hack may have been a tipping point for the way the industry talks about risk and competition. Within a few days of its release, and after the emergence of something approaching a consensus among otherwise antagonistic factions in the AI world, the \u201cpremature restrictions\u201d letter had gained scores of new signatories, including, eventually, OpenAI itself. Led by Nvidia\u2019s Jensen Huang, in fact, who posted for the first time on X to argue for \u201csharing models, tooling and research in the open,\u201d the push \u2014\u00a0superficial and motivated as some recent support may be \u2014\u00a0left just one major AI company to defend what had been, until this month, the default position of companies that thought they had a chance of winning the AI race. Against growing backlash, Anthropic\u2019s Dario Amodei finally weighed in<\/a> this week:<\/p>\n To summarize my and Anthropic\u2019s position, we have not and are not advocating for a ban on open-weights models as a category. We should instead focus on keeping powerful chips out of authoritarian hands, stopping industrial-scale distillation, and requiring safety testing of all sufficiently capable models, open and closed.<\/p>\n This is unlikely to move anyone outside of Anthropic. The company, like all big model makers, depends on the \u201cindustrial-scale distillation\u201d of the world\u2019s information, which has already cost it a ten-figure<\/a> settlement with authors. The China policies it proposes would reduce the availability of cheaper, more flexible alternatives to Claude. And suggesting required safety testing \u201cof all sufficiently capable models\u201d in the current political environment, where the range of possible regulatory outcomes runs from capture to corruption, sounds naive at best<\/a>. A few years ago, a frontier lab accidentally hacking another AI company with a model it couldn\u2019t keep track of might have been treated as proof that arguments like Amodei\u2019s are correct. Today, in a world where the consequences of AI diffusion are becoming more concrete for more people, it\u2019s turning them against him.<\/p>\n Sign Up for the Intelligencer\u00a0Newsletter<\/p>\n Daily news about the politics, business, and technology shaping our world.<\/p>\n Vox Media, LLC Terms and Privacy Notice<\/p>\n![](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/c22abf3f46a349fda7f114a305e3115f0c-IMG-2365.rvertical.w570.jpg\")
<\/p>\n
2. force american companies to buy more expensive ai from american labs.
3. watch the rest of the world use cheaper models with equal or better intelligence.
4. discover that distillation did not\u2026 https:\/\/t.co\/Xs4T4uYoZq<\/a><\/p>\n