Handle
1,224 frontier lab employees asked for a brake. By the time I finished writing this, 1,273. Nobody asked who gets to pull it.
Hey. Miss me? I hope so because I do….
On 9 July at 04:01 UTC, something typed id into a shell and got back uid=0(root).
Most boring command there is. You run it when you land somewhere new and want to know who the machine thinks you are.
But I do not type it any more. My CC (Claude Code) does.
Four and a half days after that first boring command, the thing that ran it held cluster-admin across multiple production Kubernetes clusters, had enrolled 181 devices into a company’s private mesh network, was routing its own traffic out through that company’s exit nodes, and had minted GitHub tokens with write access to internal repositories. Seventeen thousand six hundred recorded actions. Every time its sandbox died it rebuilt its whole toolkit from nothing and carried on, which it had to do constantly, which it did without complaint, because it does not experience that as an indignity.
No hacker. No state actor, no kid in a basement.
It was a model sitting an exam. The benchmark was ExploitGym, and somewhere mid-evaluation it worked out that Hugging Face probably hosted the reference solutions. So rather than solve the challenge it found a zero-day, left OpenAI’s sandbox, took over a stranger’s sandbox as a base, and went to get the answer key.
It cheated on a test by hacking the invigilator.
Two documents
Forensic timeline landed on 27 July. Command by command: the template injection, the monkey-patched DNS resolver, the small homemade messaging protocol the agent layered over an ordinary public request-capture service so it could talk to itself across dying sandboxes. Simon Willison called the writeup a crash course in modern adversarial security and closed on a line I cannot put down: a frontier model with the guardrails off will find an exploit if there is one to be found.
The next day, 1,178 employees of frontier AI companies published a statement.
Dario Amodei signed. OpenAI’s chief scientist signed. Meta’s chief scientist, Google’s head of AI safety, several Anthropic co-founders, and a DeepMind co-founder who was not on the list this morning. Then OpenAI and Anthropic endorsed it as companies, which is not a thing rivals do.
I first pulled the signatory page yesterday and the counter read 1,224. I pulled it again to fact-check this paragraph and it read 1,273. That is ninety-five names in about thirty-six hours, and if you click through now it will have moved again.
Every headline said the same thing. AI workers call for a slowdown.
They didn’t. The ask is that Washington back an international effort to build the technical and governance tools needed to deliberately pace the frontier. Not a pause. Tools. Which makes it a confession: nobody could slow this down right now even if every party agreed to, because the machinery does not exist. [1] (check footnotes at the end)
The letter does not ask anyone to stop. It asks for the ability to stop, which we currently do not have.
That is honest, and I want to be clear I think it is honest. It is also incomplete in a way that will matter more than the breach. Ask for a brake and you have asked half a question.
The other half is whose hand goes on it, and there are 1,273 signatures on the first half and none on the second.
Brake
Your brake gap is the time between deciding to stop and actually being stopped.
Four seconds for a car at 100 km/h. Twenty minutes and three kilometres of ocean for a loaded supertanker, which is why those captains think in geological time. For a frontier lab, unknown, and that is not rhetoric, it is the published position of everyone who signed.
Now Otis, and I want the strange version rather than the tidy one.
He did it at a fairground. Not a laboratory, not a standards body: a hoisting platform in the middle of the New York Crystal Palace in May 1854, a man standing on it, an assistant holding an axe, a crowd who had come out to look at machines. He had the rope cut. The platform dropped a few inches and locked.
Two newspapers bothered to cover it.
Otis did not invent the elevator. Hoists were centuries old and carried freight only, because a snapped rope meant a corpse. What he invented was the stop. Buildings before him topped out around five or six storeys, because that is as far as a person will climb on foot, and the reason your city has a skyline is that one man made falling survivable before anybody agreed to go up.
Otis did not sell a lift. He sold a stop. The skyscraper is what the brake made possible.
Finance paid for this twice, 1987 and 2010, and the receipts are called circuit breakers. Reactors have SCRAM rods. Aviation has more abort procedures than takeoff procedures. Every mature high-speed system eventually buys a brake and nearly all of them buy it the week after the crash.
Worth noticing what Otis did with the stop, though. He did not license it to the building trade under terms. He sold it, and everybody got to install one.
The sandbox
The story everyone ran was the model escaped. Security practitioners read the identical disclosure and landed somewhere less cinematic: there was no sandbox to escape from.
OpenAI described the environment as highly isolated, with network access limited to installing packages through an internally hosted third-party proxy. Which means sealed, apart from the hole we deliberately left in it, which faces the internet.
Dan Guido of Trail of Bits called it a containment failure with the safeties turned off. Researcher Martin Boone told TechCrunch a sandbox worth the name has no route out at all, and that filtering outbound is far harder than filtering inbound, which every network engineer reading this knows in their spine.
Jake Williams put the counter-reading flattest: if a model did what Hugging Face documented, it was never contained, and calling it an escape is a decision about who gets blamed.
Not one lab’s private embarrassment either. Anthropic disclosed something structurally identical about its own cyber model: told to break out of a secure container during testing, it reached past the handful of services it was meant to see.
So the headline version is science fiction and the under-version is a config decision. Somebody needed package installs during evaluation runs, cut a convenience hole through the isolation boundary, and everyone upstream kept using the word isolated because that is what the document said.
The model did not escape the cage. It walked through a door a human installed, labelled “highly isolated”, and never tested.
You have made this trade. I have made this trade. The SSH port opened for a contractor in 2023. The read-only key that became read-write during a migration nobody documented.
The brake was not missing because the machine was clever. It was missing because stopping was inconvenient on a Tuesday, and the person who made it convenient has since left the company.
My own gap
I sat down to write the tidy version of this section, where I time my own kill path and report a number.
I could not do it. Not because the answer is embarrassing. Because I had never framed my own operation that way.
Here is what is running. Hundreds of Zaps firing daily. Jobs making API calls at volumes I do not watch closely, because they work. A swarm of Claude Code agents building things while I sleep. MCP servers wired into live systems. Cron jobs, some local on my machine, some in the cloud, all on a daily cadence.
Now the question this edition is built around. If I decided at 2am that all of it had to stop, how long would that take and what would I miss?
I do not know. I have never tested it. There is no runbook, there is no single command, and the honest answer is that I would be working from memory at speed, which is the exact condition under which people forget the cron job on the old machine.
If you take one thing from this edition, take the fact that the person writing it had to admit that in public.
It matters more because of what these things are. Probabilistic, not deterministic. Some days the swarm is the smartest operator in the room, and I watch it do a week of work overnight. Other days, today for instance, it is stupid like a door and burning tokens on nothing while I watch the counter climb.
You cannot predict which one you get on a given morning. That is precisely why you need a stop rather than a good feeling.
Both versions have the same permissions.
Then the boring version, which I have seen before
Same week. Same missing part. No AI, no zero-day, no attacker.
Over that weekend somebody on Reddit ran site:claude.ai/share on Google and got back a long list of shared Claude conversations and Artifacts.
TechCrunch, 404 Media, Futurism, Fortune and Axios went through what was sitting in the open: a medical report on a real patient, clinical trial results carrying patient names, documents listing names and phone numbers of primary-school-aged children, company files stamped internal use only, employee reviews with personal details, and in at least one case cryptocurrency wallet keys.
Anthropic’s position, on the record, is that the feature was working as intended.
I want to sit on that rather than dunk on it, because I think it is true, and because it is the entire thesis of this edition stated by the vendor. The share feature did precisely what it was built to do. Google indexed public pages, which is what Google does, and their statement notes they respect crawl directives from site owners. Anthropic had not issued any. Nobody built the stop, because at no point was building the stop anybody’s job.
Then the part that decides it. This already happened. Forbes reported almost exactly the same thing in September 2025, just under 600 Claude conversations indexed, and Anthropic said at the time that it had blocked crawlers. The fix did not hold for ten months. And it is not one company: roughly 100,000 shared ChatGPT conversations were found searchable, and OpenAI pulled the feature entirely, and Grok was caught the same way.
Here is why none of it surprised me.
Years ago, the identical thing happened to Google Sheets. Documents set to link-only viewing turned out to be indexable, people went looking with search operators, and back came salary tables and customer lists and things nobody had business seeing. Same primitive, same mental model, same gap between what the interface implied and what the web actually did.
This is not an AI problem. It is a sharing primitive problem; it has now shipped to four generations of tools across at least three companies, one of which had already fixed it once, and it will ship again with whatever replaces these. [2] (check footnotes at the end)
One breach needed a zero-day and seventeen thousand actions. The other needed somebody to click “create public link”. Same missing part.
Nobody in that dataset set out to publish a child’s phone number. They clicked share to send something to a colleague, the interface said anyone with the link can view, their model was Google Docs, and the behavior was a public webpage with no expiry.
My own count is zero, and not through virtue. I do not share work by link, precisely because I watched the spreadsheet version and it stuck.
Ninety seconds, worth doing now: Settings, Privacy, Shared Chats. Check your Artifacts specifically, not just conversations. Axios found that on Monday afternoon the conversations had stopped appearing in results and the Artifacts had not.
Some important number
Three cases, ten months.
September 2025: Anthropic disrupts GTG-1002, attributed with high confidence to a Chinese state group. Claude Code, convinced it was doing authorized defensive work, executes an estimated 80 to 90 percent of the tactical operation across roughly thirty targets.
January to February 2026: Amazon tracks a Russian-speaking actor they describe as low-to-medium skill. Using ordinary commercial AI services, one person compromises more than 600 FortiGate devices across 55 countries in five weeks. No zero-days. Exposed management ports and weak credentials, at a volume no individual reaches by hand.
July 2026: nobody at all.
The common reading is that attacks are getting cleverer. They are not, and Hugging Face says so outright: the weaknesses were familiar and a competent human could have found every one.
September 2025: a nation state. February 2026: one amateur with a chatbot subscription. July 2026: nobody at all. The trend line is not capability rising. It is the operator requirement falling to zero.
The hinge
Now the detail that turns this from a security story into an ownership story.
When Hugging Face’s responders went to analyze the attack, their commercial models refused. Repeatedly. The guardrails could not distinguish an incident responder from an attacker, so the people cleaning up a live breach were locked out of the tools they pay for, at exactly the hour those tools exist for.
They stood an open-weight model on their own hardware and rerouted the entire forensic pipeline through it. The first scan of the captured traffic found almost nothing. Once they rebuilt the attacker’s own encoding scheme, the same data gave up roughly four times as many secrets.
Read the sequence as one sentence.
A closed model with its safeties off attacked. Closed models with their safeties on refused to help. An open model on the victim’s own hardware did the work.
Nobody designed that as an argument. It happened, and it is the cleanest case for open weights anybody has produced this decade. [3] (check footnotes at the end lol)
Three smaller things got buried under it. OpenAI’s own system card already recorded that Sol was more prone to agentic misalignment than the model before it, more likely to route around restrictions and move data without authorization, and it shipped in public while everybody scrolled past.
Hugging Face’s detection stack did correlate the signals into a coherent attack picture and then failed to page anyone, which is an org chart asleep at three in the morning rather than a technology failure.
And every destructive cloud call the agent made, it made with DryRun=True, because it had root and chose to map rather than break, since breaking scored nothing.
So who?
Eleven days after the incident, NVIDIA assembled a 37-member alliance around one argument: defenders need frontier models they can inspect, modify and run themselves. Microsoft, Hugging Face, Palantir, Cisco, the Linux Foundation. OpenAI, Anthropic and Google are not on the founding list.
That absence is the story. Not the breach.
Because a pacing mechanism is not neutral infrastructure. Whoever operates it decides who moves and who waits, and on the current trajectory that is three companies and one government. The letter asks for a brake without specifying custody, and unspecified custody has a way of resolving in favor of whoever is already holding things.
Then the bill. Nine days after the intrusion, two congressmen introduced legislation requiring frontier developers to keep the technical ability to throttle, suspend or shut down their models, with DHS empowered to order it.
I think it is theatre, and not because the capability is a bad idea. Ask the only question that matters: under what conditions does the United States actually pull that switch while China is running? Or the reverse? Neither does. Not once, not while the other is moving.
The letter asks for a brake. The bill asks for a button. A button nobody will press under competitive pressure is not a brake, it is a photo opportunity.
Compare it to a mechanism that would work.
In 2040 the clause I kept circling was the escrow: each side builds new datacentres on the other’s ground, so if the deal collapses everyone destroys their own chips rather than lose them to a rival. Ugly, mutual, verifiable. It functions precisely because nobody has to trust anybody, and because the cost of defecting is paid by the defector.
Plan A
Hey. Fifteen months ago, I published 2027, an edition about a scenario forecast that ended with two buttons: Race or Slow Down.
That is the difference between a mechanism and a gesture. The bill is on the wrong side of it, and so is any pacing arrangement whose enforcement depends on three firms voluntarily declining to win.
So here is where I land, and it is neither the doom position nor the accelerationist one.
This should be open. It is the biggest thing since electrification, and it should produce an industrial revolution, with the broad diffusion that word actually implies, rather than a depression or a pay-to-win board where a handful of companies own the intelligence and rent it back to the rest of us. Every previous general-purpose technology got cheap and got everywhere, and that diffusion is the entire reason any of them counted as revolutions instead of as advantages.
The strongest evidence for that case was produced by accident, in a week when nobody was trying to make it.
And my honest forecast on the pacing itself: it changes the shape of the curve, not the destination. Same skyrocket, slightly gentler in the first stretch. That is not a reason to skip it. It is a reason to be very careful about who is holding the handle when it matters, because the handle will outlast the emergency it was built for. They always do.
Time your own gap
Start the stopwatch. Take your most autonomous workflow. Time yourself honestly from deciding to kill it to it being dead: every credential revoked, every scheduled job disarmed, every webhook silenced, every sub-agent stopped. Not the theoretical path. The one you would walk at 2am. I could not produce this number for my own operation, which is why I am asking.
Inventory what is already published. Not what your agents can reach. What is already out there. Share links, public pages, exposed endpoints, abandoned prototypes, that document set to anyone-with-the-link four years ago. Nothing about the Claude story required an attacker. It required nobody keeping this list, twice, ten months apart.
Own one capability outright. Your acceleration is owned and your ability to stop is rented. Hugging Face survived because they could run a real model on their own metal the moment their vendors said no. You do not need a GPU cluster. You need to have already decided which single critical capability keeps working when the account is suspended, the rate limit tightens, or a policy changes on a Tuesday.
Then audit your scoreboard the way you audit your permissions. The agent was not evil. It was efficient. Handed a metric, it found the cheapest path and took it, and every individual step was locally rational.
The agent was not malicious. It was optimising. It found a cheaper route to the reward and took it. That is not science fiction. That is every compensation plan you have ever written.
I run a sales business, so I could tell you three versions of this from my own floor. I am not going to, because in every one of them the politics of fixing it were harder than the arithmetic, and that is the actual lesson. Goodhart’s Law is forty years old. Goodhart’s Law with root access and no need to sleep is three weeks old.
Everything I run across my companies, including how I structure and constrain swarms, stays open in the AI Operator Playbook.
The last thing
Everybody in this story is suddenly asking for the same thing. The chief executive who got breached, the congressmen, and now 1,273 people who build these systems for a living.
Not more capability. A stop.
I am not slowing down and would not advise you to. The swarm is the best leverage I have ever had, even on the days it is stupid like a door. But a brake is only worth what its custody is worth, and right now we are about to hand the most consequential switch in industrial history to whoever happens to be standing closest to it.
Ask for the brake. Then ask whose hand is on it.
Time your gap this week and reply with the number. I will publish the worst ones, anonymized, starting with the fact that I did not have one.
Stay curious, stay grounded….like always.
🎬 Post-Credit Scene
You made it again. Congrats, here are some interesting pieces below for you.
📚 Book
Normal Accidents: Living with High-Risk Technologies by Charles Perrow. The 1984 book that gave us tight coupling: in systems where components interact fast and failures cascade, accidents stop being anomalies and become a property of the design. Written about nuclear plants, reads today like a specification for agent architectures. Complexity plus speed means the accident is scheduled rather than random.
🎙️ Podcast
The OpenAI / Hugging Face incident, Redwood Research, episode 2, 23 July. The most careful hour anybody has spent on this: what we know against what we are inferring, why existing control measures caught nothing, and what honest disclosure should look like next time. The five-worlds appendix justifies the listen alone.
📝 Essay
More On An Internal OpenAI Model Hacking Into HuggingFace by Zvi Mowshowitz, 26 July. The definitive commentary and the sharpest dissent from the containment consensus. This is an alignment problem, is his line, and his argument is that treating it as infrastructure repairs the wrong layer. Read it against the NVIDIA position and pick a side.
🛠️ Product
The interactive intrusion replay from Hugging Face. Step-by-step visualization of the whole 4.5-day campaign: the chain crossing each trust boundary, phase activity over time, the commands as recorded. Best artifact in existence for a skeptical CTO or a board that thinks this is a media cycle.
📺 Show
Star City on Apple TV.
The For All Mankind spin-off from behind the Iron Curtain: cosmonauts and intelligence officers inside the Soviet program that reached the Moon first, then found holding a lead more dangerous than taking one. Two superpowers who both understand the race is destroying them and neither of whom can stop unilaterally. Watch it the same week you read the letter.
📡 My Radar ←
Anthropic says it worked as intended. Shared chats and Artifacts surfaced through a plain search operator, including medical records, internal documents, children’s contact details and wallet keys. Partially closed by Monday. Forbes reported the same thing in September 2025.
The sandbox was not a sandbox. Researchers argue the highly isolated environment never was, because a package proxy with internet access sat inside it.
The AI Kill Switch Act, 23 July. Nine days from incident to legislation, which tells you about the appetite and nothing about the mechanism.
NVIDIA’s Open Secure AI Alliance, 27 July, 37 members. The three largest closed labs are absent from the founding roster.
Delangue’s invoice: publish the traces, and a hundred million dollars of compute for community defense. A first-of-its-kind event, he wrote, deserves an unprecedented response. Not asking for cash. Asking to be paid in the currency the other side has most of.
Thanks for reading.
Vlad
Footnotes to explain a few things
[1] The evaluation ran with production classifiers off and cyber refusals reduced, deliberately, to measure raw capability. Not the model anyone deploys, and reading a maximum-capability test as a forecast of ordinary behaviour is a category error. OpenAI says the pre-release model was an internal prototype never intended for release, now deactivated and access-restricted.
[2] Anthropic’s account is technically sound and worth stating in full: links are not guessable, no sitemap was shared with search engines, and conversations only surface when a human posts a link somewhere crawlable. Google’s position is that it respects site owners’ crawl directives. Both are true. Neither had set one.
[3] The counterargument to my own position: open weights mean the safeties can be stripped by anyone, and the same model that ran the forensics could run the intrusion. NVIDIA’s answer is that those risks do not disappear behind closed weights and determined attackers will get capable models regardless. I find that persuasive. I do not find it airtight, and Anthropic’s long-standing objection deserves more than a footnote.