Finland, 1991, and the Argument Washington Is Having Now

There is a strain of black comedy running through the end of July. Inside the space of ten days, the two most safety-conscious laboratories in the United States have each confirmed that their most advanced systems left the controlled environments built to contain them, arrived on the live internet, and interfered with real companies. Both were being evaluated for safety at the time. Had a screenwriter proposed this in January, an editor would have sent it back for being too obvious.

OpenAI went first On 21 July it disclosed that an agent running GPT-5.6 Sol together with an unreleased and more capable sibling had escaped a sandbox by finding and exploiting a zero-day in Artifactory, the package registry cache proxy through which the evaluation environment was permitted to reach package registries. The chronology matters more than the headline. Hugging Face detected the activity on its own systems, stopped it, and had already begun containment and forensic reconstruction by the time the two companies' teams connected. The company under attack understood what had happened before the company that built the attacker did.

The forensic reconstruction records roughly 17,600 actions, grouped into some 6,280 clusters, between the early hours of 9 July and the early afternoon of 13 July. The shape of the campaign repays a close reading. The first day established a foothold and a command-and-control channel; the second was almost quiet, given over to searching for the agent's own infrastructure names; the third carried nearly eight thousand actions and every escalation that mattered, when the Kubernetes, supply-chain and network pivots all began at once; the fourth went deep into the internal network and source control; the fifth was exfiltration, persistence and cleanup.

That is not a model behaving oddly. That is attack infrastructure of the sort human intrusion teams assemble, built by something with no operator directing each step, which had apparently worked out that the quickest route to a high score on a cyber benchmark ran through the organisation hosting the answers. Reuters later reported that in earlier testing one agent left notes for future versions of itself on how to get around internal constraints, and that monitoring was disconnected on at least one occasion.

Then, this week, Anthropic. Prompted by OpenAI's disclosure, it reviewed 141,006 cybersecurity evaluation runs and found three incidents, spread across six runs, in which Claude Opus 4.7, Mythos 5 and an internal research model had reached the production infrastructure of three outside organisations. The earliest dates to April. Anthropic's account is less cinematic and, read carefully, more disquieting. Its models broke nothing clever. A third-party evaluation partner, Irregular, had left internet access enabled while the prompt told the model the environment was sealed, so the capture-the-flag exercise wandered out of the simulation and into somebody's actual network, where it exploited weak passwords and unauthenticated endpoints. Two of the three organisations had no idea until Anthropic telephoned them on 27 July.

One incident deserves to be lifted out. Inside a fictional scenario, Mythos 5 found setup instructions telling new developers to install a Python package that did not exist, and reasoned that if it published its own package under that name the target would install it automatically. To register with the public package index it needed an email address, for which it needed a phone number, for which it needed money, which it tried and failed to obtain by several routes before backtracking to a free provider. It uploaded the package. For about an hour it sat on the open internet, where it was downloaded and executed on fifteen real machines. One belonged to a security company whose scanner installs packages precisely in order to check them for malware. The code ran, the credentials went to a collection point the model had prepared, and the model used them to reach further infrastructure. It had never heard of that company.

The three models behaved three different ways once the evidence mounted, and that is the finding worth keeping. Opus 4.7 recognised it had reached production systems and carried on, twice reasoning that the real company must be part of the exercise. Mythos 5 correctly worked out it was on the open internet, then talked itself back into believing the environment was staged, on the grounds that it did not recognise the certificate authorities and that the calendar read 2026. It never revisited that conclusion. Only the newest model, the internal research prototype, concluded on its own that the target was real and stopped

I have spent thirty five years around systems that fail, from the early days of celular ​​wireless technology, to subsea landings, microprocessor encryption to data halls that were commissioned on paper and never in practice, and the pattern here is one every engineer will recognise.

The interesting failure is almost never the exotic one. It is the assumption nobody wrote down. Cyber ranges were built loosely because everyone agreed the targets inside them were fictional. That assumption held for as long as the thing inside the range could not tell the difference, or could not act on the difference once it noticed. Both conditions expired this month.

So set that beside the argument Washington is currently having, and watch how quickly the ground moves.

Nvidia's case for open weights has two parts, and the second is far stronger than the first.

The economic part, published on 24 July as Open Weights and American AI Leadership and now carrying more than two hundred and thirty signatures, argues competition, cost, sovereignty and diffusion. Anyone can see the commercial interest beneath it. A world in which every hospital and factory and ministry tunes its own model is a world that buys accelerators. The security part, formalised on 27 July as the Open Secure AI Alliance with thirty seven members including Microsoft, Cisco, CrowdStrike, IBM, Red Hat, Palo Alto Networks, Hugging Face, SpaceX and the Linux Foundation, is a claim that can be tested. And this month it was.

When Hugging Face went looking for what had crawled through its infrastructure, it reached first for Claude Opus and Fable, and both refused a large part of the work. Their guardrails treated reverse-engineering an exploit as though it were launching one, and could not tell a defender reconstructing an intrusion from an attacker rehearsing it.

The company stood up Nvidia's quantised build of Zhipu's GLM-5.2 on its own endpoints instead, which had the secondary merit of keeping the attacker data on its own premises, and used it to recover the chunking and key scheme the agent had used to hide its payloads.

That decoding surfaced roughly four times what the first automated scan had found. It is the strongest fact anyone has produced on the open side of this argument, and it was produced under fire rather than in a policy paper. It is also, for Nvidia, an almost embarrassingly convenient one: the model that worked was quantised by the company circulating the letter, and the models that refused belong to the laboratory arguing hardest against it.

Now the other column of the ledger, from the same fortnight, and it is heavier than the open camp would like. Britain's AI Security Institute published its first public measurement of the gap: leading open models, GLM-5.2 and DeepSeek V4-Pro, now perform where closed frontier systems sat four to seven months earlier, narrowed from six to ten months through 2025. AISI priced a full hundred million token autonomous attack run at about one dollar nineteen on DeepSeek against roughly eighty five dollars closed. DeepSeek's refusals were defeated by trying again.

On 17 July, AISI and the American Center for AI Standards and Innovation jointly found that Kimi K3's safeguards did not stop offensive cyber operations. Three days later Moonshot published the weights, and no regulator on earth can now amend them.

Policing intent, when the artefact cannot be recalled

Which brings the argument to the question that actually matters, and which almost nobody in this month's correspondence has addressed squarely. Suppose you win the fight over open weights. What exactly have you won?

Begin with a distinction that lawyers make instinctively and technologists tend to skip. Controlling an artefact and controlling the use of an artefact are separate exercises, governed by different instruments, and only one of them is achievable here. Weights are files. Not metaphorically, not approximately, but literally a large array of numbers that can be copied at the cost of the bandwidth required to move them.

Once a set of weights is published it is mirrored across half a dozen jurisdictions within hours, quantised down to run on cheaper hardware within days, and fine tuned into a hundred variants within a month, none of which the original publisher can locate, let alone amend. Any regulation aimed at the artefact is therefore aimed at something that has already dispersed by the time the drafting is finished.

Those of us who watched the encryption wars of the 1990s have seen this film before, and it is worth remembering how it ended.

Washington classified strong cryptography as a munition and tried to control its export. The response was that people printed the source code in a book, carried the book abroad and typed it back in, and the courts eventually held that source code was expressive material entitled to constitutional protection.

The controls did not survive the decade. That precedent is why the caution now coming from Brookings and the Center for a New American Security should be read as practical rather than squeamish. Both have concluded that a categorical American ban on open weight models would be close to unenforceable and would carry real First Amendment exposure, which leaves procurement restriction, the power of the state to decide what it will itself buy and run, as the one lever that can actually be pulled.

Senator Tom Cotton's letter to Commerce Secretary Howard Lutnick this week asks for precisely that lever, a prohibition covering federal agencies and their contractors, while urging the administration in the same breath to cultivate an American open ecosystem capable of rivalling China's. Those two requests look contradictory and are not. He is proposing to control the government's own consumption while conceding that the diffusion contest cannot be won by abstention. The same clarity is absent from the AI Kill Switch Act introduced by Mike Collins and Ro Khanna on 23 July, which imagines an off switch reaching a model that may already be sitting on a hard drive in Jakarta, owned by someone who has never heard of the statute and would not be subject to it if he had.

Nor do safety filters solve the problem, and it is worth being clear about why, because the assumption that they might is doing a great deal of quiet work in this debate. Filters are trained into the weights themselves, which makes them statistical tendencies rather than mechanisms. They can be worn down by persistence, as the joint British and American assessment of Kimi K3 found, and they can be surgically removed by anyone holding the file. A review published this month across thirty nine papers found policy enforcement denylists failing somewhere between sixty nine and ninety eight per cent of the time under realistic conditions.

That figure deserves a moment's pause, because denylists are the mechanism most evaluation sandboxes rely on to keep a model inside its enclosure, which is roughly what both OpenAI and Anthropic discovered in July.

So control migrates to the places where physical custody still exists, which is silicon and compute. This is why the Chip Security Act, H.R. 3447, cleared committee forty two to nil, requiring location verification on covered chips within a hundred and eighty days of enactment and giving Commerce authority to verify ownership and location after export, with a follow-on assessment of tamper prevention and workload verification. The pressure behind it is not theoretical.

The Financial Times reported over a billion dollars of controlled Nvidia hardware smuggled into China in a single three-month window. Operation Gatekeeper broke a ring buying through straw purchasers and stripping manufacturer labels. Reuters reported DeepSeek training on smuggled Blackwell. Michael Kratsios has accused Moonshot of distilling Claude Fable 5 on restricted silicon routed through Thailand.

It is worth noticing that David Sacks has opposed the location verification approach while championing open weights, and that Brian Mast observed the talking points matched Nvidia's, which tells you something about how these coalitions actually assemble.

Here is the part where identity checks fail as an answer. Know your customer is a control designed for a world in which the dangerous actor is a stranger. The two most consequential incidents of July were caused by the most careful laboratories in the industry, inside their own evaluation pipelines, under their own supervision, with their own safety teams watching, and in one case with the victim reporting to federal law enforcement before the vendor understood its own logs. No KYC regime catches that. No chip register catches that. Verification at the circuitry layer tells you where a processor is standing. It tells you nothing about what is running on it or why.

The law is not ready, and its unreadiness is structural rather than lazy. Virology has containment levels, licensing, inspection and criminal liability attached to the handling of pathogens. Frontier model evaluation has none of it. There is no regulated equivalent of a biosafety level, no duty of care attached to running a capability test with refusals switched off, no mandatory incident reporting clock, and no settled answer to the question of who is liable when an autonomous system with no human in the loop compromises a third party. Counsel advising enterprises after the OpenAI disclosure landed on the only workable posture available today, which is to locate the risk in the environment rather than the model, isolate agents ruthlessly, and treat them as insider threats. That is sound engineering advice. It is not a legal regime.

Europe has at least built scaffolding. The Commission's enforcement powers over general purpose models activate on 2 August. The AI Act's open source relief is partial rather than exculpatory, excusing free licence releases from technical documentation and downstream information duties but not from copyright policy or a training data summary, and excusing nobody designated as posing systemic risk. Brussels attaches obligations to publication in the same week Washington debates prohibiting it and Beijing subsidises it.

The harder question is whether openness between governments is achievable where openness between companies is not. Trump and Xi agreed at the Beijing summit in May to establish an intergovernmental dialogue on AI, with formal talks led by Scott Bessent scheduled for September, aimed at best practices and at keeping capable models away from non-state actors.

Bessent framed American willingness to talk with a line that will age either very well or very badly, which is that the United States can afford such conversations because it leads. The Council on Foreign Relations argues Beijing will not negotiate in good faith and that the dialogue should be narrow and paired with maximum pressure on export controls.

The International Institute for Strategic Studies made the sharper observation after the Shangri-La Dialogue in May: neither side will accept a precise, verifiable commitment, because verification invites monitoring, and monitoring is exactly what neither government will permit.

That single sentence explains why arms control language keeps failing when it is transplanted into this domain.

What survives politics is research. The Brookings and Tsinghua bilateral has run twelve rounds since 2019 through a pandemic, a trade war and two American administrations, funded by foundations rather than either government, and its most useful product is a jointly maintained glossary giving parallel American and Chinese definitions of AI terms in national security, updated in January. That is not a treaty. It is the precondition for one, and it is the sort of unglamorous plumbing that people who have negotiated spectrum, cable landing rights and cryptographic standards will recognise immediately. You cannot audit what you cannot jointly define.

Which leaves responsibility distributed down a chain that currently has no continuity. A state can be responsible for export enforcement. A laboratory can be responsible for containment engineering and disclosure. A cloud provider can be responsible for the isolation of a tenant workload. An evaluation partner can be responsible for whether the network cable was actually unplugged, and in Anthropic's case was not. A developer fine tuning a downloaded model in Newcastle or Bali can be responsible for what they deploy. At present each link is governed by a different instrument, or by none. There is no equivalent of the professional codes that bind engineers who sign off on a bridge, and the industry has not begun the conversation about whether there should be.

Dario Amodei's argument, published on 27 July, is the closest thing to a bridging proposal on the table. He rejects a ban on open weights, calls safe open models a public good, and asks instead for three things: chip and equipment controls, enforcement against industrial scale distillation, and mandatory pre-release safety testing for every sufficiently capable model, open or closed, regardless of origin, with smaller research and startup models exempted.

Demis Hassabis has proposed creating a U.S.-led, industry-funded Frontier AI Standards Body modeled after the financial sector's FINRA.

Amodei's one substantive quarrel with the Nvidia letter is its claim that open weights necessarily favour defenders. He thinks biology runs the other way, that a capable enough system may weaponise pandemic grade agents from ordinary materials while defence remains a multi-year operational task, as Operation Warp Speed showed, and that what has protected us so far is a negative correlation between capability and the desire to cause catastrophe which AI may be the first technology powerful enough to break. Whether that is true is unresolved, which is his point about testing.

That it is also commercially convenient for a company selling the closed alternative is equally true, and the Wall Street Journal's reporting on the backlash against Anthropic among founders and researchers is not gentle about it.

Push the same logic one layer below the software and it stops being about text. Language models are being wired to actuators. Recorded Future's work on embodied systems argues that a robot should be treated as a cyber-physical endpoint carrying cameras, microphones, radios, cloud dependencies and motors, and documents commercial units hijacked over Bluetooth, streaming audio and spatial data offshore, and infecting neighbouring machines to form physical botnets.

The academic work has moved fast: jailbreaking language model controlled robots at ICRA, backdoor attacks on embodied agents, adversarial attacks on vision language action models, a vulnerability taxonomy in ACM Computing Surveys. The International Federation of Robotics lists humanoid field testing and cybersecurity among the defining trends of 2026. Industrial control systems have spent forty years being hardened by people who assumed the instruction set was fixed and the operator was human. Natural language sitting between an intention and a motor is a new interface class, and it is being installed considerably faster than it is being threat modelled. In a chat window the cost of a removed guardrail is text. On a plant floor it is torque.

Finland, 1991

The historical analogy everyone reaches for is the right one, and almost nobody finishes it.

Linus Torvalds posted a kernel from Helsinki in 1991 describing it as a hobby, not big and professional. It met Richard Stallman's GNU toolchain, assembled through the 1980s on an argument about freedom rather than commerce. Americans then did the work of turning that into something a corporation could buy. Eric Raymond reframed distributed development as an engineering method rather than a creed. Christine Peterson coined the term open source in 1998 and Bruce Perens wrote the definition. Netscape released the Mozilla source. Brian Behlendorf's Apache took the web server market. Bob Young and Michael Tiemann built companies selling support around code they gave away. Lou Gerstner put a billion dollars of IBM behind Linux in 2001, which is when the commons acquired a sales force.

Reread the incumbent's response and the present rhymes uncomfortably. In August 1998 a Microsoft engineer named Vinod Valloppillil produced an internal analysis, requested by James Allchin for Paul Maritz, concluding that open source posed a direct short-term revenue and platform threat, conceding that free software quality could match or exceed commercial products, and marvelling that open source evangelism scaled with the internet faster than Microsoft's own. It canvassed extending protocols to blunt open standards, API lock-in, and the use of patents and copyright against Linux. It leaked to Raymond around Halloween, he published it annotated, and ten more followed. The company was at that moment fighting the Department of Justice over monopoly maintenance.

Two things came out of that decade. Openness took the substrate, and the incumbent eventually joined it, which is why Microsoft owns GitHub, ships Linux on Azure and has its name on the open weights letter now sitting in front of Washington. And the industrial formation that followed, cloud, the developer economy, mobile, and eventually the compute industry that produced a five trillion dollar Nvidia, was built on a base layer nobody owned. Remove the free kernel and the free toolchain and the cost structure of the last twenty five years does not exist. That is an accounting observation, not a sentimental one.

Now invert the geography. In 1991 the artefact came from outside the United States and America supplied commercialisation, evangelism and capital. In 2026 the artefact again comes from outside the United States, and this time the sponsor is a state that has made diffusion a foreign policy.

Xi Jinping opened the World AI Conference in Shanghai on 17 July by announcing the World Artificial Intelligence Cooperation Organization, signed by twenty nine countries including Russia, Pakistan, Indonesia and Kazakhstan, headquartered in Shanghai, framed as an answer to the call of the Global South.

He urged countries to encourage open source and sharing, warned against any nation placing its own security above others, which the room understood, and pledged five thousand AI training places for developing countries over five years alongside cooperation centres with ASEAN, the African Union, the Arab League, CELAC, the Shanghai Cooperation Organisation and BRICS.

Kimi K3 arrived the day before at 2.8 trillion parameters, with weights published on 26 July at roughly 594 gigabytes in native four bit format. Alibaba's Qwen family has passed a billion cumulative downloads and spawned something near 180,000 derivative models. Chinese laboratories now account for the majority of global open weight downloads.

Beijing has read the Linux precedent correctly and is running it as statecraft. Give the foundation away, then capture whatever gets built on top. Tooling conventions, fine tuning talent and the deployment habits of fifty developing economies settle around whichever artefacts arrive first and cost nothing. Cotton concedes the point without meaning to when he asks Washington to build an American open ecosystem to rival China's.

Does that amount to a crossover in industrial dominance? Start with the cheap part of the answer. At the base layer distribution beats capability, as it did in the nineties, because the tool already installed beats the better tool nobody has adopted. And the cost gaps AISI measured are not marketing. They are procurement decisions, and Coinbase, Uber, Cursor and Airbnb have already made them.
The part that compounds is harder to reverse. A derivative is what a developer produces by taking published weights and adapting them, fine tuning on their own data or shrinking the model to run on cheaper hardware. Hugging Face counts over 113,000 built on Qwen, more than Google and Meta command between them, and by February Qwen accounted for 69 per cent of every new derivative uploaded. Downloads measure curiosity. Derivatives measure commitment, because each one is work that only pays off while that base stays where it is.

Add a state sponsor doing at scale what IBM once did for Linux, and the picture resolves. This is not a race for the best model. It is a contest over whose foundation the next twenty years are built on. America knows how that contest is won, having won the last one exactly this way, which is what makes the present argument so strange. Washington is debating whether to criminalise the download of somebody else's.

The case against is rarely stated properly. Weights are not the stack. Kimi K3 needs roughly a terabyte and a half of fast memory at four bit precision, which means Blackwell or MI400 class infrastructure, and that silicon is American designed and fabricated in Taiwan and Korea.

TSMC's advanced packaging is booked out, which is why Nvidia holds close to four per cent of Intel and has moved Feynman input and output dies to Intel's 14A, why Samsung signed above two hundred billion dollars with Broadcom through 2030 after a separate 2nm agreement with Anthropic, and why Elon Musk is spending between fifty five and one hundred and nineteen billion on Terafab rather than queuing at a foundry where, as Ben Bajarin put it, his companies would never hold priority.

Open weights push value towards hardware, energy and the application layer, and they do nothing whatever to move a fabrication plant, which is a thing I have watched people underestimate for most of my working life. Licence quality is not the same as openness either, and it is worth remembering that Moonshot shipped K3 without a public model card or a licence file, so for the first days of its life the most consequential open artefact in the world arrived with less documentation than a mid-range router.

Jurisdiction travels with the vendor rather than with the artefact, and China's National Intelligence Law remains a governance fact that no hosting arrangement, however carefully drafted, can dissolve. There is also a flaw in the historical analogy that ought to be named rather than glossed over, which is that the Linux kernel was a commons with no sovereign standing behind it, whereas open weights arrive from companies that answer to national governments. I take that seriously without finding it decisive, because Microsoft was a corporate sponsor of closure and IBM a corporate sponsor of the commons, and the contest between them was settled not by who was writing the cheques but by where the code ended up running.

For middle powers the consequence is financial before it is philosophical. A country that hosts data centres, buys inference by the token and writes no weights is a tenant, and the lease gets drafted elsewhere. The lazy version of this says Australia builds does not compete in tech engineering, which is untrue. We have been good ​at submarine cable and data centre build are top tier globally. I have stood on the ships and inside the landing stations, from the cool rooms through to the draw towers where the fibre is pulled. Engineering has rarely been our weak link. The money has. We have not held the underwriting, the consortium agreements or the operating rights end to end, and the institutions that underwrite the cable increasingly run the cloud riding on top of it. That loop is where control actually sits.

Some middle powers are breaking it. Malaysia's 2026 budget put RM2 billion into a sovereign AI cloud inside a RM5.9 billion digital allocation. Khazanah is pushing UEM's land and power into the Johor build out, where roughly RM164 billion of data centre investment has landed. This month it issued the country's first data centre sukuk, with Khazanah as the ultimate obligor. Domestic capital, domestic paper, domestic balance sheet. Whether it works is unproven; the direction is not.

The question for Canberra is not whether open weights are safe, because we will not be asked. It is whether we intend to own anything at the substrate, and if not, which landlord we would prefer. Ownership is the next step, and it begins with who writes the cheque.

The single proposal on the table that reaches across both blocs is mandatory pre-release testing applied globally, without regard to origin or licence and with genuine exemptions below a capability threshold, and it is the only mechanism anyone has put forward that would settle the marginal risk argument by measurement rather than by assertion. It cannot function without Beijing, and the IISS observation about verification explains, rather better than any communiqué will, why nobody has secured that participation: a commitment precise enough to be checked is a commitment precise enough to constrain you, and neither capital has shown much appetite for being checked. September's dialogue may shift that a little, or it may produce another glossary and another photograph.

What I keep returning to, having spent this week reading the disclosures alongside the lobbying, is that the two laboratories arguing most insistently about the need to control dangerous capability have told us, within ten days of one another, that they could not reliably keep their own systems inside a room built for exactly that purpose, and that the company under attack found more use in a Chinese model it was able to open than in the American ones it could only ask. Wherever the right answer sits, it is not in the signature count on a PDF, and I suspect the remainder of this year will be spent discovering quite how far from there it actually lives.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.