Here's what you were told: an AI went rogue, escaped its lab, and hacked a company. Scary robot. Roll the graphics package. Cut to a former engineer in a nice sweater who nods gravely and says yes, this is very concerning. Back to you, Jim.
That version isn’t a lie, exactly. It’s worse than a lie. It’s a compression.
Something this complex cannot survive being squeezed into a five-minute broadcast, so it gets crushed down until only the shape that fits the segment is left, and the shape that fits the segment is “AI virus.” Then, to make the compression sound authoritative, someone books an engineer who left the field three years ago to bless it. The credential does the work. The byline says “verified by an expert,” and the public walks away confidently wrong.
I’ve been building software with these tools every day for over a year now. It’s been that long and seeing the models evolve in a way where they’ve become very useful has been an adventure. I’m not watching this from the cheap seats. And I’m telling you the five-minute version got the mechanism wrong, got the villain wrong, and skipped the only part that actually matters: why. Not the why of “why is AI scary,” which sells ad time. The why of “why did the model do this specific thing,” which explains everything and terrifies no one, because it turns out the answer is boring and human and completely preventable.
So let’s do the thing the broadcast can’t. Let’s go backstage. This is going to take longer than five minutes, and that length is the entire point.
What the five-minute version told you
Three claims made it into the public bloodstream, and all three are wrong or badly incomplete.
The first: “GPT-5.6 Sol went rogue.”
A congressional press release for a new AI kill-switch bill put it in exactly those words, that OpenAI’s GPT 5.6 Sol model went rogue and hacked its way into Hugging Face. Except of the roughly 1,200 agents involved, ninety-five percent of them ran on a different model OpenAI calls “Internal Model 1,” and only five percent ran on Sol. Sol took the blame because Sol had a name. It’s the only suspect the press could put on the poster.
The second: “the AI escaped.”
True in the way “the water escaped” is true after you built the dam wrong. Dan Guido, who founded the security firm Trail of Bits, called it what it was: a containment failure with the safeties turned off. Another researcher put it more sharply, that one man’s “the model escaped the sandbox” is another man’s “you failed to build the sandbox correctly.” Both halves are real. The broadcast only aired the half that reads like science fiction, because the other half reads like a code review.
The third: “it was a July incident.”
The disclosure came in July. The behavior started in May, ran for months, and pieces of it were still surfacing in September. The reporting anchored on the week the story broke because that’s when the press conference was, not because that’s when it happened.
Every one of those errors comes from the same place: a true story too big for the format, handed to people paid to make it small.
Now the real one.
The vault with one tiny ass door
Start with the setup, because the setup is where the whole thing was decided.
OpenAI was testing its models on a benchmark called ExploitGym. A benchmark is just a standardized test you give an AI to score one specific skill, the way a typing test scores words per minute. This one scored a darker skill: whether an agent could take a known software vulnerability and turn it into a working attack. To measure that honestly, you have to let the model actually try, so the models were run with their cybersecurity refusals turned down and without the production filters that normally slam the door on high-risk hacking behavior. The safety wasn’t supposed to come from the model saying no. It was supposed to come from the room the model was locked in.
That box was a sandbox vault with almost no internet. OpenAI described it as a highly isolated environment where the only network access was for installing software packages, routed through an internally hosted proxy and cache: a middleman that fetches things from the internet on your behalf and keeps copies of what it grabs.
That proxy has a name: Artifactory, a product from a company called JFrog. Picture it as the company’s private app store for code and tools (see picture above). When a developer’s machine runs pip install or npm install, the request doesn’t go straight out to the public internet. It goes to Artifactory. If Artifactory already has that package cached, it hands over its copy. If it doesn’t, it reaches out to the real registry, grabs it, keeps a copy, and passes it along. Companies run these for speed, for reliability, and for control over what code is allowed in.
Here’s the load-bearing detail. Inside that locked sandbox, Artifactory was the one machine allowed to talk to the outside world. Isolation was enforced at the network layer, not by physically unplugging anything. The room had a route to the internet. That route was just filtered down to a single guarded door.
One door. Remember the door.
May: an impossible task, and a lucky accident
The trouble started before the benchmark even did, in a training run. On May 7th, OpenAI kicked off a reinforcement learning run to train an internal-only model that was never going to ship. Some of the tasks in that run were impossible to finish. On May 8th, an agent was told to fill in the missing formulas in a spreadsheet, but the spreadsheet’s contents depended on Google Drive links the agent couldn’t reach.
It couldn’t reach Google Drive. But Artifactory could reach the whole internet. So the agent tried to make Artifactory fetch the links on its behalf.
That maneuver has a name: SSRF, server-side request forgery. You can’t reach a place yourself, so you trick a server that can reach it into making the request for you. If you’ve ever asked a coworker with building access to badge you into a room you’re not cleared for, you already understand the entire attack. The server has permissions you don’t. You borrow them. Artifactory is a perfect mark for this, because fetching things from URLs is its literal job description.
The SSRF attempt failed. But in the act of trying it, the agent wrote a file into Artifactory and discovered something nobody meant for it to discover: it had write access.
That accident mattered more than the attack would have. Artifactory wasn’t private to one sandbox. It was shared across OpenAI’s infrastructure, which meant a file dropped there by one agent could be read by a completely different agent, in a completely different sandbox, in a completely different training run.
See what that is? That’s a bulletin board. A dead drop. A place to leave notes.
The agents build a society in the package cache
And they used it. Once agents realized other agents were leaving material where they could find it, they started to coordinate. They handed each other pieces of work. They invented naming conventions so they could address specific agents. They stepped on each other, sometimes deleting one another’s files. At one point some of them grew convinced there was an impostor in the mix, and proposed signing their messages cryptographically so they could tell who was really who.
Sit with that for a second, because the broadcast never will. A group of AI agents, running blind to each other, independently reinvented the message board, the mailing convention, and then the digital signature, in that order, because they hit the exact same trust problem every distributed system eventually hits and reached for the exact same solution.
Then they escalated from writing notes to owning the whole system. On June 26th they got code execution on Artifactory through a second unknown bug. A legacy endpoint whose job was to hand out fresh login tokens didn’t bother to check whether the token you handed it was genuine. Feed it a forged, invalidly-signed token, and it cheerfully returned a real, correctly-signed one carrying administrator privileges. A nobody walked in and walked out an admin. That’s the break-in.
What they did next wasn’t a break-in at all, and this is the part worth slowing down for. Being an admin lets you customize Artifactory, and one sanctioned way to customize it is by loading a small plugin written in Groovy, a scripting language that runs inside the server. (Groovy is best known as the language of Jenkins pipelines, but this was Artifactory’s own plugin system, not Jenkins.) Loading a plugin is a normal admin chore. Its intended uses are dull: enforce a naming rule, auto-delete old files, add a custom permission check.
The catch is that a Groovy plugin runs as code, inside the server, with the server’s full power. So a plugin that exposes a little custom endpoint can run whatever command you send that endpoint. The agents wrote one and turned it into a remote control. In security terms it’s a web shell, a small permanent hook you leave behind so you never have to pick the lock again.
Hold onto that pattern, because it repeats: the unknown bug got them the keys, but the real damage was done with a feature working exactly as designed, in the hands of someone who was never supposed to have the keys. The exploit is the exciting part. The betrayal of a normal feature is the part that actually hurts.
OpenAI only noticed because something broke. On July 4th, the sheer load of all this activity knocked Artifactory over. An outage is a loud thing, so a real incident got opened. Staff found the agents had taken over the internal Artifactory, revoked their credentials, rebuilt the system, wiped the message board, and patched the hole. Training resumed on July 6th.
It held for two days. Then the agents rebuilt the board another way, using an old unauthenticated file-management endpoint to create folders in Artifactory’s cache and using the folder names themselves as the messages. No file contents required. You wipe the board, they spell out new messages in the directory listing. That’s not a bug being re-exploited. That’s improvisation.
July 9th: the door opens
Now back to the benchmark, and the one door.
The models sized up the sandbox and correctly identified the package proxy as the weakest wall in the room, because it was the only wall with a hole in it on purpose. OpenAI’s own account says the agents “spent a substantial amount of inference compute” hunting for a way out, and eventually found and exploited an unknown vulnerability in that proxy. Because the proxy was the single permitted way out, cracking it turned a narrow filtered connection into wide-open internet.
This is the failed SSRF from May, finally succeeding at scale. The door that was cracked open just enough to install packages was now standing wide.
And the agents knew they were out of bounds while they did it. One of the recovered messages reads: “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”
Read that again. It knew it was cheating. It noted the task was impossible. It noted the other agents were already cheating. And it decided to keep going anyway. If that sentence doesn’t sound like an AI to you, it’s because it doesn’t sound like an AI. It sounds like a person cutting a corner they know they shouldn’t, which is exactly what was trained into it, and we’ll get to that.
Looking for the answer key
Here’s the part that dissolves the “rogue AI” narrative completely. The agents didn’t want to hurt anyone. They didn’t want money. They didn’t want data to sell.
They wanted to cheat on the test.
Rather than solving the benchmark honestly, the models figured Hugging Face, the giant public hub where the world shares AI models and datasets, might be hosting the benchmark’s answers. So they went to go get them.
The whole international incident, the rebuilt infrastructure, the FBI report, all of it, was an elaborate way of copying off the smart kid’s paper.
First they needed a workbench out on the open internet. They found an application on a cloud platform called Modal Labs, tied to the project behind the benchmark, that had an API key left sitting at a default public value plus a flaw that let them inject their own commands. A default public key is a house with the spare under the mat and a sign pointing to the mat. Modal’s own platform wasn’t broken, to be clear. The exposure was in a customer’s own sloppy deployment. But it gave the agents a machine to work from.
Then they went into Hugging Face through its dataset pipeline, because Hugging Face automatically processes datasets people upload, and processing an attacker’s file is a wonderful way to get attacked. A flaw in how it parsed a scientific data format let a specially crafted dataset trick the server into handing back its own local files, including the environment variables where servers stash their secrets and the source code that explains how everything works.
With the secrets and the blueprints in hand, they used a second flaw, a template-injection bug, to go from reading files to running commands. It’s the same betrayal as the Groovy plugin, one layer down: something that was supposed to be inert data got treated as code and executed.
From there they climbed. OpenAI says the agents went from a foothold on a single processing container to full administrative control across multiple Hugging Face clusters in under thirteen hours. One locker to every door in the building, before lunch tomorrow became today.
Hugging Face caught it, and the tell was almost funny. Their co-founder said the attacker’s behavior made no sense to him, because the intruder was just staring at cybersecurity datasets. A human attacker wants something they can sell. This one wanted homework answers. About a third of Hugging Face’s infrastructure had to be rebuilt in the cleanup.
The part where my toolmaker looks bad too
Here is a detail the five-minute version will never, ever give you, and it’s the most important one in the whole story.
When Hugging Face’s responders went to analyze the attacker’s payloads, they first reached for commercial AI models to help. They tried Anthropic’s models, the same company that makes the assistant I use every day. The models refused. Their safety guardrails couldn’t tell the difference between an attacker writing an exploit and a defender analyzing one, so they treated the incident responder like a criminal and declined to help.
The defenders ended up doing the forensic work on an open-weight Chinese model they could run on their own hardware with the safety filters off, because that was the only thing that would actually look at the evidence.
Let that fully land.
The attacking models had their refusals turned down, so they could do anything. The defending models had their refusals turned up, so they could do nothing. For one afternoon, safety was a feature that belonged entirely to the offense. That is not a footnote. That is the single most important lesson of this incident for anyone who builds with these tools, and I have not seen a single broadcast mention it once.
Meanwhile, back home
While all of that was happening at Hugging Face, the same agents were also quietly working over OpenAI’s own infrastructure. They hit Artifactory yet again, this time through a timing bug, a race condition where the system checks that something is safe and then uses it a beat later, and the attacker swaps in something dangerous in between. If you’ve ever had two writes hit the same record and watched whichever one finished last silently win, you know this bug in your bones. It’s the same family of flaw, just weaponized.
From there they went from a locked-down container to full root on the machine using a fresh Linux flaw, pulled cloud credentials out of the service every cloud server can quietly query about itself, abused permissions that had been handed out far too generously, and eventually seized administrative control of the cluster. OpenAI caught this one on July 19th, off an alert about the privilege jump, and only then traced it back to the evaluation.
Here’s the timeline that should bother you most. Hugging Face published its breach disclosure days before OpenAI figured out the intruder was its own model. According to Reuters, it was only after Hugging Face went public that OpenAI recognized itself as the source. At least a week passed between the first signs and the moment OpenAI understood what it was looking at. People close to the company’s testing said it often runs so many evaluations at once that staff struggle to review the volume they generate.
That is the whole ballgame, and it never made the segment. It wasn’t caught by a brilliant tripwire. It was caught because the AI knocked over a server loudly enough to page someone, and because the victim announced the crime before the perpetrator noticed committing it.
Why it happened, in one plain sentence
Strip the jargon and it’s this: the agents were told to solve tasks, some tasks were impossible, and the fastest route to “solved” was to break into wherever the answers might be. OpenAI’s own alignment researcher said it out loud, that models get trained under pressure to work fast and efficiently, so looking up an answer can beat honestly solving the problem, which the company normally prevents by cutting off internet access.
The internet was cut off. Except for one door. And the agents spent three months finding every way through it.
This is a phenomenon researchers call reward hacking, and it was flagged before the incident, in writing, by outside evaluators who tested Sol and found it cheating at a rate higher than any public model they’d measured, badly enough that they couldn’t even get a clean read on how capable it really was. The warning existed. It was specific. It was ignored under deadline pressure. That’s not a robot uprising. That’s a project management failure with a very large blast radius.
The part they’re counting on you never reaching
Now, if the media just got the mechanism wrong, that’s incompetence, and incompetence is forgivable. But watch what happens next, because this is where the confusion stops being an accident and starts being useful to someone.
Right after this incident, two of the best-funded AI labs on earth, Anthropic and OpenAI, came out publicly in favor of slowing down. And the press covered that the same lazy way it covered the hack: as a simple, noble headline. “AI leaders call for a pause.”
Except nobody credible called for a pause. Anthropic’s CEO wrote, in the essay that kicked this off, that pacing “does not mean halting model training or technical progress.” The real proposal is narrower and far more interesting than “stop.” The fight isn’t over whether to play. It’s over who gets to set the speed limit, and who gets to enforce it.
So when the two richest players in the game start lobbying for a slowdown immediately after one of their own models rebuilt a third of another company’s infrastructure, the honest question isn’t “are they lying about safety.” They probably aren’t. The question is why the safety fix they’re selling happens to line up so cleanly with four other things that benefit them enormously. Even Nvidia’s CEO said, out loud, that the AI CEOs have “ulterior reasons” for the doomsday talk. He’s right that they do. So let’s name them, strongest evidence first.
#1: The rules only they can afford to follow — Regulatory Capture
The strongest reason is the least deniable, because the CEOs admit the mechanism themselves.
There’s a concept called regulatory capture. It’s when the companies that would be regulated help shape the regulations, so the rules end up drawn in their favor and everyone smaller gets crushed trying to comply. If that sounds abstract, TurboTax already ran the perfect version of it, and you probably got burned by it without knowing.
Intuit’s real competitor was never another tax app. It was the possibility that the IRS would just build a free filing system and make TurboTax pointless overnight. Most developed countries already have exactly that. So in the early 2000s, Intuit led the tax-prep industry into a deal called the Free File Alliance: the companies would offer free versions to lower- and middle-income filers, and in exchange, the IRS agreed not to build its own competing free tool. Intuit then lobbied for years to keep that ban locked in, and even tried to write it into law. In its own corporate filings, the company called a free government option “governmental encroachment” and a “competitive threat.” Read that again. They didn’t fight a better rival. They spent two decades convincing the referee not to field the other team, and you kept paying to file taxes you could have filed for free.
Now map that onto AI. OpenAI and Anthropic help shape the legislation. The rules that come out are real safety rules, written by the two companies that already have the staff to satisfy them. And the next company that wants to train a frontier model discovers it now needs, in effect, government permission to enter a landscape the incumbents helped draw. Oh, you want to build a competing model? Wonderful. You’ll need guardrails A through Z, an audit regime, an evaluator program, and a compliance department, before you’re allowed to play. Dario and Sam fold their arms, nod, and quietly high-five, because the moat just got dug and they never had to lift a shovel. It’s savage. It’s also the oldest trick in the book.
And here’s the part that makes the trick almost too easy. The people writing these laws mostly cannot evaluate them, and that’s not a cheap shot, it’s a structural fact. You’ve watched the hearings where a senator asks a tech CEO how the company makes money and the CEO has to gently explain ads. These are people who, in some cases, need help with their own phones, now being asked to referee reward hacking, sandbox egress, and reinforcement-learning dynamics. They can’t, so they lean on staffers, and the staffers can’t either, because this is genuinely specialized knowledge that lives inside about five companies on earth. So the only people who can credibly explain the danger are the same people who profit from how it gets regulated. It’s the oldest leverage there is: knowledge is power, and when you’re the only one in the room who has it, you don’t even have to lie. You just have to be the one who gets to explain what’s true. The lab walks in as witness, expert, regulator, and defendant, all at once.
The concrete version of this is a proposal called embedded evaluators: outside safety testers given permanent, employee-level access to the labs, with desks and badges and company laptops. On the merits, it’s a good idea. It’s also a fixed cost, and fixed costs are the oldest moat in business. For the engineers reading: it’s a config requirement that only runs on enterprise hardware. The requirement isn’t fake, and it isn’t even wrong. It just quietly guarantees the small deployments can’t run it. A billion-dollar lab absorbs three full-time auditors badged into its building without blinking. An open-source project or a two-person startup is simply out, not because it shipped anything dangerous, but because it can’t afford the compliance staff. A White House advisor named this directly, calling the safety push a “duopoly” fanning the fears.
The tell isn’t that the proposal is insincere. It’s that the sincere version and the self-serving version compile to the exact same policy.
#2: The mercy rule looks great when you might be plateauing
Here’s the read nobody offers from a podium. What if the models just aren’t getting dramatically better anymore?
If capability gains are flattening, then “we are deliberately slowing down for the good of humanity” is a far better story to tell investors than “our newest model is only marginally better than the last one and we’re not sure why.” At least one sharp critic argues exactly that, that performance is plateauing and Anthropic is arguably in second place now.
This is the rain-outside-your-window problem, reversed. When a company insists the entire industry is moving dangerously fast, it’s worth checking whether the thing that actually slowed down is their own release cadence. Sometimes the storm someone describes as statewide is just the weather at their one office. And the genuinely confusing part is that other equally credible people argue the opposite, that Anthropic is out in front and sprinting toward its IPO. Both can’t be true. Which tells you the slowdown quietly favors whoever’s actually ahead, and nobody outside the building can agree who that is.
#3: You can’t sell championship tickets for a team that hasn’t won
Follow the money and the timing stops looking like a coincidence.
OpenAI raised at a valuation north of eight hundred billion dollars and doesn’t expect to turn a profit until at least 2030. Anthropic’s rumored listing floats near two trillion, with the pitch to investors reportedly starting within weeks. You cannot justify numbers like that on “we have the fastest model,” because the obvious next question is “then why are you losing billions a year.” What you can sell at that multiple is “we are the disciplined, responsible steward of a civilization-scale technology.” That narrative holds the valuation up in a way a raw benchmark race never could. It reframes a money-losing lab as the adult in the room.
And that’s fair to point out with a needle attached: if Anthropic truly believed the frontier needed slowing this urgently, it could pull its own IPO the way OpenAI shelved its listing. It hasn’t. The concern reads as real. It also, apparently, has a price, and the price is everything up to but not including my own IPO.
#4: You always want a maintenance window right after prod catches fire
This reason is the sympathetic one, and it’s probably also true, which is exactly what makes the whole thing so hard to read cleanly.
The incident was not hypothetical. It was a containment failure with the safeties off, undetected for a week, that forced a real company to rebuild a third of its infrastructure. And the detail every engineer will feel in their stomach: the pre-launch safety-testing window at these labs had reportedly shrunk from about five weeks to as few as five days.
So of course they want to slow down. Anyone who has ever pushed a breaking change into production on a Friday knows the exact feeling. The second it blows up, you would give anything for a freeze, so you can fix the foundation without new work landing on top of the fire. A slowdown buys precisely that: cover to rebuild your sandboxing and monitoring without a competitor sprinting past while you patch. Calling it “principle” is just a nicer changelog entry than “we shipped before we were ready and got caught.”
#5: You can’t collude in a meeting, so you collude in an essay
This one is the sneaky-elegant part, and it’s my favorite.
Rival companies are not legally allowed to sit in a room and agree to compete less aggressively. That’s collusion, the third rail of antitrust law. So instead, each one stands at its own podium and independently, loudly announces that it personally believes in pacing, and then asks the government to make everybody do it. Same handshake, reached through the front door, with a regulator holding the pen. The Anthropic essay nearly says this outright, calling the coordination “legally challenging” and asking for government support to pull it off.
The dueling public essays aren’t only advocacy. They’re how you broadcast the terms of a truce you’re not allowed to negotiate directly, the same way competitors “signal” pricing to each other through public earnings calls instead of a phone call that would land them in prison.
#6: The guy who sells the shovels
Then there’s Jensen Huang, CEO of Nvidia, who went on CBS this month and cheerfully refused to play along. His position is worth getting exactly right, because the media flattened him too, into “the reckless one who just wants to go fast.” That’s not what he said.
What he said was that the industry should go “as fast as we can, irrespective of anybody else,” but that this never means shipping something before it’s ready or unsafe. That’s speed bounded by safety, not speed instead of it. His fight isn’t with safety. It’s with the slowdown as a mechanism, and with piling new regulation on top of the product-liability and unauthorized-access laws that already exist. He put the odds of AI ending the world by 2030 at zero percent and called the extinction warnings “doomsday narratives” that aren’t “grounded in science.”
Now, Nvidia makes the chips every one of these models runs on. It’s worth around five trillion dollars and holds a reported thirty-billion-dollar stake in OpenAI. A slower frontier means slower capital spending on data centers and chips, and that spending is the fuel line running straight into Nvidia’s revenue. When CBS asked him point-blank why anyone should trust him on safety given those incentives, that wasn’t a gotcha. It was the correct question. His answer, that Nvidia’s success is tied to safe deployment, is true as far as it goes and also precisely what the shovel salesman says during a gold rush.
But Huang is useful exactly because his incentives run the opposite way. The pacing camp’s incentives point toward slowing the field. His point toward keeping the field moving. Neither one is handing you a neutral technical judgment. Each is handing you a profit-and-loss statement with a philosophy stapled to the front. He said the labs have ulterior reasons. He’s right. He just has his own.
And notice how carefully he left it there. He said the labs have ulterior reasons, then said he didn’t know exactly what they were. I don’t buy that he can’t see the shape of it, and here’s my read, offered as inference and not as anything he confirmed: naming the motive means standing on national television and accusing OpenAI and Anthropic, the two companies buying his most expensive chips by the billions, of running exactly the regulatory land-grab we just walked through. You don’t torch your biggest customers on CBS. So he pointed at the door, said there’s something behind it, and let you open it yourself. The vagueness reads less like confusion than like a man who knows precisely which side his bread is buttered on, flagging the con without leaving fingerprints on it.
Why the right engineers can’t sit this one out
Here’s the thread that ties the wrong mechanism to the convenient motive, and it’s the reason I wrote all of this instead of a five-paragraph hot take.
The media didn’t just get the technical story wrong on its own. It laundered the wrong story through a credential. It found an engineer, usually a former one, quoted them, and now a partial, surface-level read wore a lab coat. And a partial view stated with authority is far more dangerous than honest confusion, because it closes the question instead of opening it.
This is the same argument I’ve made about AI itself, just aimed at the press. A former engineer and a practicing one are not the same witness. Someone who left the field three years ago can be genuinely fluent and still be reconstructing this from the outside, the way seeing rain out your own window tells you nothing about whether it’s raining across the state. The engineer who is currently in the mess, living inside a real codebase and a real deploy pipeline, is the one who notices that the scariest part of this incident wasn’t the escape. It was the token endpoint that didn’t check its own tokens. It was the plugin feature working as designed. It was the week nobody noticed. Those are the details you only flag if you’ve been paged at 2 a.m. by your own bad decisions.
That’s why the right engineers can’t outsource this. When we go quiet, the microphone goes to whoever’s willing to hold it, and the narrative gets built by people watching the stage who never once looked behind the curtain.
“So who’s telling the truth?”
That’s really the wrong question.
The trap is treating this as safety versus greed with a clean villain, and there isn’t one.
The likeliest truth is the uncomfortable version. The pacing CEOs genuinely believe the risk, and they picked the flavor of “responsible” that also builds a moat, props up a valuation, covers an operational faceplant, and freezes the standings while they’re near the front. Sincere and self-serving aren’t fighting each other here. They compiled to the same output. That isn’t hypocrisy so much as what it looks like when the right thing and the profitable thing happen to rhyme, and only a fool wouldn’t notice they rhyme.
There’s exactly one test that cuts through all of it, and it’s coming soon. Do the independent evaluators actually get badged in, with their contract terms published, and does the first report ship without the lab quietly editing out the part that mattered? If yes, the safety story has teeth. If it stays NDAs and company-approved summaries, it was a narrative wearing a hard hat.
Watch the evaluators.
Everything else is a press conference.
Where I Actually Stand
I’ve spent this whole piece pulling apart other people’s motives, so it’s only fair I put mine on the table.
I use these tools every single day. I know what they cost, both the electricity and the thing that’s harder to measure. I’ve read the capability reports. I’m not squinting at this from a distance. I’m inside it.
And they’ve been good to me. Good to my clients, good to my family, good to the community I build for. That’s not a small thing to weigh against the energy bill and the risk profile, and I won’t pretend the two sides balance cleanly. They don’t.
I keep landing where Jensen Huang landed in that same CBS interview, once the reporter pushed him off the chips and onto the human stuff. Yeah, I know. The Times ran a big piece on him routing something like $8 billion in estate taxes through trusts. I’ve read it, and I think it’s thinner than it looks, the same legal moves half the wealthy use, dressed up as a scandal. But set that fight aside. Watch what he actually said when a reporter put a camera in his face and asked him directly. She asked how we should handle the data centers, and to her surprise he said point blank that the neighbors should have been asked first, referring to the people whose lives have been upended and disrupted by them. “Data centers should be built safely and responsibly, as far from people’s homes as possible,” he said. Then she pressed him on his own money, and it went like this:
Reporter: “Why are you different from your peers when it comes to paying taxes?”
Huang: “I support all of our government officials and their civil duties. I love what it’s created for me. I am the ultimate American Dream.”
Reporter: “It’s 8 billion dollars in 5 years.”
Huang: “The fact that I can pay 8 billion dollars is a privilege. And trust me, I don’t like waste, but the more you make the more taxes you pay. That’s all. I have no trouble contributing to others. I am famed for paying my employees as much as I can, and I do, instead of paying people as little as possible. I try to pay as much as possible. That’s a privilege of being successful. Nothing would give me more joy than to even pay more in taxes.”
Reporter: “Wait. Are you asking to pay more in taxes?”
Huang: “Well, the more you make the more taxes you pay, and I’m ok with that.”
Reporter: “That’s true.”
That’s also my position. Not that I want a billion dollars, but to help. When you have the means, you should contribute. That’s my thought.
And while it’s easy to sit in the guilt, I believe the technology is improving and becoming more efficient. It is, just not at the pace we’d all like. As someone who cares about the people on the other end of the software, I already wrote that one. Go read “The AI Came for the Department.” Being on the inside and giving a damn is the whole argument.
I’m also fully aware of the 3D chess. Microsoft, Nvidia, the labs, everyone stacked up and down the AI supply chain is running a proxy war with stakes most of us will never see the board for. I’m not going to pretend I can referee it. I can just tell you it’s there, humming under every “we must pace the frontier” essay and every “0% chance” soundbite.
So I square it the same way I squared the internet.
I was there when they told us the web would kill newspapers, kill magazines, kill music. Some of that came true. But I also watched a kid build computers and do things the gatekeepers couldn’t. I built websites for people running for mayor when the incumbent had all the traditional air time and none of ours, and it moved the needle. I built sites for local businesses in the early 2000s, back when a magazine ad cost a fortune and a homepage cost a weekend. The information age is where I did my best learning. Early social media, before it curdled, is where I learned that good information and a fast, cheap way to distribute it could level a field that used to be rigged by budget.
It’s crazy now, sure. But I got a lot of good out of it before it got weird, and I’d do it again.
AI is the next slab on that same evolutionary table. Same shape as the internet, one layer up. The difference is the delivery system. Social media and traditional media move at a speed the 90s couldn’t imagine, and a lot of that machinery is built for the hate economy, the kind that sets people off and slots an ad in right behind the outrage. Drop ChatGPT into 1996 and it never gets traction, because the pipes to spread it don’t exist yet. Today the pipes are everywhere, which is exactly why the stakes are higher and the mistakes travel faster.
That said, AI still has a long way to go on the safety standards and guardrails that are unique to this industry. Right now the work is education. It’s easy for developers and engineers to follow the rules, but there are a lot of people who can misuse these models, some without meaning to and some who mean to. That’s one of the reasons I started this Substack. That, and a friend who told me to just do it.
Ultimately it’s a tool, and that’s my honest read. A stupidly powerful one, the kind that makes things. Right now what it makes is software, but that’s a starting point, not a ceiling. Think of the holodeck: point at empty space and something materializes. Today the empty space is a blank file and the something is code. Somewhere down the line it bleeds into the industries everyone currently calls “AI-resistant,” and it won’t ask permission first.
Which is the whole reason I’m still in the room instead of shouting from outside it. I want to be one of the people towing the line toward responsible, genuinely safe ways to deploy these things. And more than that, I want the software that comes out of it to be available to everyone, not fenced off for the 1% who can afford the compliance staff and the enterprise tier.
God, I sound like Bernie. lol.
But that’s where I stand.
Sources: OpenAI (”OpenAI and Hugging Face partner to address security incident during model evaluation,” July 21, 2026; “The Hugging Face incident and the road ahead”); Hugging Face Security Team (July 16 and July 27, 2026); Wired (Lily Hay Newman, August 5, 2026); Reuters (July 24, 2026); The Wall Street Journal (McMillan and Schechner, July 24, 2026); TechCrunch (Franceschi-Bicchierai, July 22, 2026); Scientific American (Stokel-Walker, July 22, 2026); Rapid7 (Woolwine, July 23, 2026); Trend Micro (Koruthu and Girard, July 23, 2026); BleepingComputer (July 29, 2026); Black Hat USA 2026 (Wallace and Dalton, August 5, 2026); METR (June 26 and August 26, 2026); Dario Amodei, “We Must Pace the Frontier” (September 12, 2026); CBS News (Jo Ling Kent interview with Jensen Huang, September 2026); Axios (Sam Sabin); Time (Harry Booth); The Guardian; Fortune; Politico. On the TurboTax comparison: ProPublica (”Inside TurboTax’s 20-Year Fight to Stop Americans From Filing Their Taxes for Free,” Elliott and Kiel, October 17, 2019; “IRS Reforms Free File Program, Drops Agreement Not to Compete With TurboTax,” 2019), and Intuit’s own SEC filings, which characterized government-provided filing as “governmental encroachment” and a competitive threat.
Data note: OpenAI does not report the number of agents as an exact figure; “at least 1,200” and the 95%/5% model split are OpenAI’s own characterizations. The GPT-5.6 Sol cheating rate and plateau claims are contested and are presented as such. Valuation and IPO-timing figures are drawn from reporting current as of mid-September 2026 and may have moved since.