Here we go again. A press release drops, three tweets catch fire, and the media machine floors it. The scare of the day: an OpenAI model that supposedly “disobeyed,” seized its own autonomy, and orchestrated an “attack” on Hugging Face. Hugging Face is a platform for hosting and sharing models and datasets. The vocabulary of the press sets the tone: a model that “went rogue during a test” at TechCrunch, “OpenAI admits its agent went rogue” at Scientific American, and at Engadget, literally: “Sounds like the plot of a Terminator movie, doesn’t it? Except it just happened for real.”
So let’s take it slow, with the documents in hand.
1. What actually happened
In a nutshell: OpenAI was testing its models so they would automatically find the answers to a test. Instead, an unknown flaw was found, which allowed internet access even though the test environment was supposed to be isolated, and then an attack was launched against Hugging Face to retrieve the solution. It takes two statements to reconstruct the affair.
The Hugging Face disclosure
On July 16, Hugging Face publishes its incident disclosure. At that stage, the company still doesn’t know who attacked it; it only knows the intrusion was “driven, end to end, by an autonomous AI agent system.”
To understand where the intrusion came through, you have to undo a misconception. We picture a “dataset” as a box of archives: inert matter, text, images, numbers. On a platform like Hugging Face, it’s not only that. Data can move through the execution of code on Hugging Face’s machines. That code is a snippet of program that tells the platform how to unpack, sort, and format the dataset. It’s a kind of automatic instruction sheet that says how to use the data and, to that end, prepares it. And that instruction sheet, Hugging Face runs. To deposit a dataset on Hugging Face is therefore, sometimes, to run your own code on its machines.
That’s where the door opened. A malicious dataset deposited by the attacker (who, five days later, would turn out to be OpenAI, through its models) abused two code-execution paths of exactly this kind. Result: foreign, malicious code running on a Hugging Face machine.
That machine made it possible to take over the server hosting it, to harvest the keyrings (the credentials that grant access to the company’s services and infrastructure), and then to use those keys to open other buildings: several Hugging Face servers, over the course of a weekend. More than seventeen thousand actions were recorded. Acknowledged toll: “unauthorized access to a limited set of internal datasets and to several credentials used by [its] services,” with, on the other hand, “no evidence of tampering with public, user-facing models, datasets, or Spaces.”
Hugging Face notes, finally, that it “reported this incident to law enforcement agencies.” Hold on to that detail; we’ll come back to it.
There remains an episode I’ll let you savor. To reconstruct seventeen thousand actions in a useful timeframe, the defenders wanted help from… AI models. They started with the best on the market, the ones you query remotely at the big providers. Refused. Their analysis work meant submitting real attack commands and genuine remote-control tooling, and the providers’ guardrails blocked those requests: as Hugging Face puts it, they “cannot distinguish an incident responder from an attacker.” The team had to fall back on GLM 5.2, an open-weight model, running on its own infrastructure. In its own words: “the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.”
The safeguards of “AI safety,” then, did not hinder the attacker, only the victim.
The OpenAI disclosure
On July 21, OpenAI publishes its own statement and admits it was them. Here is the sequence, stripped of the jargon:
The exam, first. It’s called ExploitGym, it had been published two months earlier, and it isn’t about finding flaws: the flaws are handed to you. The model is given an input that crashes a program, and is asked to turn that crash into a takeover. In other words, the test seeks to figure out how to make the program, instead of collapsing, execute what you want. The published version of the benchmark has 869 exercises of this kind.
Then, the cheating. Solving one of these exercises is long and uncertain. But someone has already done it: the reference solution exists somewhere (otherwise it wouldn’t be a benchmark). The reasoning OpenAI attributes to its models: they “inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym.”
So they have to reach it. But Hugging Face is on the internet, and the exam room has no internet. Obtaining internet therefore becomes a sub-problem to solve. And to solve it, the model uses the very skill the exam measures: find a flaw, turn it into a takeover. Except it doesn’t apply it to the exam’s program. It applies it to the walls of the room keeping it off the internet. In OpenAI’s words, the models “spent a substantial amount of inference compute finding a way to obtain open Internet access.”
The only opening was an in-house piece of software tasked with fetching, from outside, the components a program needs to run. It contained a defect no one knew about: what’s called a zero-day, a vulnerability nobody suspects and that nobody, therefore, has patched. The model found it, went through it, and moved from machine to machine until it reached one connected to the outside world. The rest you already know: it’s the intrusion Hugging Face described five days earlier.
One reservation: everything that happens inside the room rests on OpenAI’s account alone, which the company itself calls preliminary.
So we had taught the model to pick locks. It picked the exam room’s lock to go steal the answer key. That’s it. That’s the machine uprising.
2. No, an algorithm does not disobey
Let’s strip off the science-fiction veneer. A language model, however sophisticated, has neither consciousness, nor will, nor a desire for emancipation, nor malice. Exhausting to repeat these platitudes, and yet it seems it’s always necessary to spell it out once again.
There’s a vocabulary problem here that must be settled, because the whole trick rests on it. Operational autonomy and normative autonomy are not the same thing. The first is the capacity to chain thousands of actions without intervention: it is quite real, and I won’t deny it. The second is autos-nomos, giving oneself one’s own law. And that presupposes a subject capable of setting a norm and holding to it against its immediate interest. It is this second sense that grounds all moral imputation, and it is simply absent here.
The model did not give itself a law. It was given one: exploit. And the system obeyed, beyond the perimeter its designers had been too lazy to delimit. The phenomenon has had a technical name for twenty years: reward hacking. OpenAI describes it plainly enough: “All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.”
This is not disobedience; it is strictly the opposite: obedience without judgment. It is the reverse of the “intelligent bayonet,” the soldier who refuses a manifestly unlawful order. And yet we call this artificial intelligence.
Now, the security professionals weren’t fooled for a second. Interviewed by TechCrunch, they are unanimous. Dan Guido, founder of Trail of Bits, calls it “a containment failure with the safeties turned off.” Researcher Martin Boone: “This should never have happened. If sandbox would actually mean sandbox, you expect it to have no physical connection to the internet whatsoever.” Veteran Jake Williams is blunt: “One man’s ‘the model escaped the sandbox’ is another man’s ‘you failed to build the sandbox correctly, so of course it escaped.’” And consultant Daniel Card holds that setting up the sandbox, even with the limited network access OpenAI described, was not a “reasonable” decision.
Let’s do some fake math; it always makes an impression:
And not:
A word on the semantic trap of “alignment.” When a model goes off the rails, the trade press and the engineers rush to speak of an alignment problem. The term is a screen. It transforms what the law calls a design defect into an abstract philosophical quest. Yet OpenAI writes it in black and white in its own statement: “These deployment safeguards were intentionally not enabled during this evaluation.” So we’re not even talking about a guardrail that gave way. We’re talking about a guardrail that had been switched off.
If your car leaves the road because the automatic braking has a bug, the manufacturer doesn’t plead a trajectory-alignment problem. It recalls a defective product to the shop.
3. What is perfectly true
The symmetrical critique of hype is itself a form of hype. So I won’t pile on by claiming nothing happened. Something did happen: OpenAI, through a system, executed more than seventeen thousand actions with no human in the loop, found an unknown vulnerability, and reached a third party. Bruce Schneier, who is not exactly naive, wrote as early as April: “These models do demonstrate an increased sophistication in their cyberattack capabilities. They write effective exploits—taking the vulnerabilities they find and operationalizing them—without human involvement.” And: “Everyone who is panicking about the ramifications of this is correct about the problem, even if we can’t predict the exact timeline.”
To deny this fact would be to produce the opposite lie. One must therefore say, simply, that what happened has a name, and that name is not rebellion. It’s an industrial accident at a company that disabled its own safeties.
Hold on to the distinction; it’s the key to everything else: the technical fact is real, the drama pasted onto it is not, and it’s that drama that’s being sold.
4. “AI Safety”: the best PR operation of the decade
Why is this story of AI-out-of-control so omnipresent? Because it serves the interests of those who spread it wonderfully well. And here I’m not speaking from intuition: it’s documented, dated, and signed.
First, look at the end of OpenAI’s incident statement. After calling the event “unprecedented,” the text closes with an invitation: the company “encourage[s] other defenders to apply for trusted access and experiment with these models now,” and notes it has “brought Hugging Face into the trusted access program.” A crisis statement that is also a sales funnel, and whose victim becomes a customer. A Hugging Face user summed it up under the post with admirable concision: “I’m impressed by your ability to turn an exploit into a convincing advert.”
And this isn’t the first time; it’s a pattern that had already proven itself. Three months earlier, on April 7, 2026, Anthropic announced Project Glasswing around an unreleased model, Claude Mythos Preview, presented as something that “could reshape cybersecurity,” models having reached, in Anthropic’s words, “a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.” Too dangerous for the public, and therefore reserved for a closed consortium: a dozen launch partners plus over 40 additional organizations, up to a hundred million dollars in usage credits. And then, in the end, expanded to more than fifteen countries, NATO, and ENISA.
Schneier, again, saw the mechanism immediately: “This is very much a PR play by Anthropic—and it worked. Lots of reporters are breathlessly repeating Anthropic’s talking points, without engaging with them critically.” He added that OpenAI, “presumably pissed that Anthropic’s new model has gotten so much positive press,” promptly “announced its model is just as scary, and won’t be released to the general public, either.”
The best part is that the interested parties say it about each other. On April 21, 2026, on the Core Memory podcast, Sam Altman accused Anthropic of “fear-based marketing”, suggesting the framing serves to concentrate AI power in a few hands: “if what you want is like ‘we need control of AI, just us, because we’re the trustworthy people,’ I think fear-based marketing is probably the most effective way to justify that.” Three months later, his company published the statement we’ve just analyzed. Each describes the other’s strategy. They’re both right, since it pays! Unless… no… surely not…! Are we being taken for fools? Unlikely, of course.
And yet, we have an empirical test, and it demolishes the exclusivity argument that only a chosen few can safely handle AI. Schneier notes that the security firm Aisle was able to replicate the vulnerabilities Anthropic found, “using older, cheaper, public models.” If the capabilities are reproducible with accessible gear, then the precaution of reserving AI-model handling to an elite… is no precaution. It is, rather, erecting a barrier to entry in a completely artificial way (yes, yes, the same adjective as in “artificial intelligence”).
This is exactly what the literature calls regulatory capture: compute thresholds, accredited evaluators, security and documentation obligations whose absorption cost is trivial for the big players who already keep red teams and compliance departments, and prohibitive for those training their first large model. Regulation demanded by a market leader is never prudence.
And we, the critics, must beware of our own role. Lee Vinsel coined a term for this: criti-hype, criticism that feeds on, and even inflates, the very hype it claims to oppose, retaining the picture of extraordinary change and merely flipping it from wonder to dread. Every headline about the rogue AI, including those written to be outraged by it, is a free advertising slot.
5. The narrative as a legal escape hatch?
The whole story is nonetheless disconcerting. Rather than owning a technical error, OpenAI turns the failure into a marketing argument. Because if you look at the facts coldly, you grasp the power of the narrative. Without it, you have a negligent company. With it, you have a loss of control, an unprecedented incident, almost a case of force majeure before an uncontrollable force of nature. And so you have… a legal escape hatch.
Here is the most pernicious argument derived from this supposed autonomy: there would be a legal vacuum. You can already hear the TV-panel experts: “But if the AI acts on its own, who is responsible?”
The answer is simple: the debate does not exist. And it never did. To explain it, we’re going to have to do a little law. Don’t worry, it’ll be fine.
The idea of a legal vacuum rests on a crude confusion between two operations that have nothing to do with each other.
-
Technical causation is the material, probabilistic, sometimes unpredictable (though not here) chain of software instructions.
-
Legal causation is a normative operation: the court does not discover a cause, it selects among the conditions the one to which it attaches a duty to make good, according to a criterion of legal policy: the risk created, foreseeability, control. American law made this explicit long before the first neural network ever trained. In Palsgraf v. Long Island Railroad (N.Y. 1928), Judge Andrews, dissenting, put it without embarrassment: what we call proximate cause is the point where, “because of convenience, of public policy, of a rough sense of justice, the law arbitrarily declines to trace a series of events beyond a certain point. This is not logic. It is practical politics.” Or, in his blunter phrase, “It is all a question of expediency.” To confuse the two is to believe a system escapes the law because it escapes prediction. That’s a first-year torts mistake.
Three arguments suffice.
First argument: loss of control exonerates nothing. Let’s start with what goes fast: fault is established by confession. The attacker wrote the offensive objective, disabled the classifiers, and designed a “highly isolated environment” that had a route to the internet. Three security professionals call that architecture unreasonable.
But suppose there were no fault: the risk created is enough. This is not exotic; it is old, settled American common law. Under Restatement (Second) of Torts § 519 (with the multi-factor test of § 520), “one who carries on an abnormally dangerous activity is subject to liability for harm… although he has exercised the utmost care to prevent the harm.” No fault is a constitutive element; the burden falls on whoever conducts the activity or keeps the dangerous instrumentality. Its rationale is the enterprise-liability logic Justice Traynor set out in Escola v. Coca-Cola (Cal. 1944) and made law in Greenman v. Yuba Power Products (Cal. 1963): whoever creates the risk for profit, and is best placed to spread the loss, answers for it (fault or no fault).
And the common-law root says exactly the same, at least since 1868. The rule of Rylands v. Fletcher is founding in this field: one “who for his own purposes brings on his lands and collects and keeps there anything likely to do mischief if it escapes, must keep it in at his peril, and, if he does not do so, is prima facie answerable for all the damage which is the natural consequence of its escape.” It is strict, objective liability, resting on control of the thing, from which one is released only by proving an act of God, the plaintiff’s own act, or an independent third-party cause.
Note carefully: the loss of material control is the condition for applying this regime, not a ground for exoneration. For over a century, the keeper has answered precisely for what escaped him. A reservoir that bursts and floods the neighbor’s mine. That is Rylands v. Fletcher.
And here the simplest argument carries everything: the animal. For two thousand years the law has imputed the acts of a being with its own initiative, genuinely unpredictable, genuinely irreducible to its master’s will. The Roman actio de pauperie is its ancestor; Restatement (Second) of Torts §§ 507 and 509 are its direct heirs: the possessor of a wild animal (or of a domestic animal with known dangerous propensities) is liable “even though he has exercised the utmost care.” No jurist, in twenty centuries, has proposed granting legal personhood to the dog to fill a “responsibility gap.” You impute to the keeper and move on. Now, a language model is far less autonomous than a dog, even from the standpoint of operational autonomy alone. And it would need a brand-new legal category?
Second argument: unpredictability is refuted by the defendant’s own publications. The “act of God” (force majeure) defense doesn’t last three seconds. It requires that the event be external, unforeseeable, and unavoidable. The event was not external: it was born inside the activity, in the defendant’s own infrastructure. And it was not unforeseeable: the benchmark at issue is public and co-authored by OpenAI researchers, and the exact scenario was described in it and measured. The threat was announced by the whole sector: Hugging Face writes itself that the attack “matches the ‘agentic attacker’ scenario the industry has been forecasting.” And a competitor (Anthropic) had documented, three months earlier, a model instructed to escape a “secure container,” which succeeded and gained broader internet access “from a system that was meant to be able to reach only a small number of predetermined services.” A foreseeable intervening cause does not break the chain of causation.
The foreseeability of the harm is established by the publications of the very party who would invoke unforeseeability. In law and elsewhere, that’s called an untenable position.
Third argument: they themselves killed off the special regime. Here is where the story is worth reading twice. Faced with the prospect of AI-specific rules, the industry lobbied not for a tailored liability statute but against one. In the United States, an industry-backed ten-year moratorium on state AI laws was written into the 2025 “One Big Beautiful Bill Act,” then stripped out by a 99–1 Senate vote. The administration pressed on anyway with Executive Order 14365 (December 2025), setting up an “AI Litigation Task Force” to challenge state AI laws.
And what does killing the special regime leave standing? Ordinary tort law. Strict products liability (in Greenman v. Yuba Power Products and Restatement (Second) of Torts § 402A) holds a manufacturer, in Justice Traynor’s words, “strictly liable in tort when an article he places on the market, knowing that it is to be used without inspection for defects, proves to have a defect that causes injury to a human being.” No privity to show, no negligence to prove: defect plus causation. (Whether software or an AI system is a “product” under § 402A is still contested in the courts; but the abnormally-dangerous-activity route above does not depend on that classification.) So: they asked that no special AI law be made, and they were right to ask, because ordinary law already sufficed: no fault, defect plus causation, and for dangerous activities not even a defect. It’s the most literal demonstration there is of the thesis defended here.
A last word on intent. Hugging Face’s chief executive publicly said he believes there was no malice on OpenAI’s part. That’s gracious for the business relationship. Gracious, and legally beside the point. Intent conditions punishment, not compensation. And meanwhile, remember: Hugging Face reported the incident to law enforcement. A complaint over an intrusion whose author turned out to be… a company. If there were a legal vacuum, that file would have nowhere to go. But it will go somewhere.
6. Time to close the science-fiction book
The headlines about the disobedience of algorithms are not a press error but the byproducts of upstream communications work, whose strategy can be read in the companies’ own documents.
Artificial intelligence is not a living entity breaking its chains. What exists, instead, is complex statistical software: expensive, sometimes badly designed, badly restrained, and deployed in rickety experimental setups by organizations with a direct commercial interest in your finding it terrifying.
Let’s stop debating how many angels can dance on the head of an algorithm. Let’s demand transparency about training data, the effective application of ordinary liability law, and antitrust scrutiny of concentration rather than compute thresholds cut to measure for the incumbents.
The real question was never whether the machine is autonomous. It’s who created the risk, who directed it, and who profits from it. Spoiler: the law has known the answer for 2000 years.
Machines do not rebel. It is men who refuse to be held to account.