Erhard Milch read his closing statement to the Nuremberg tribunal on 25 March 1947. He had been one of three managing directors at the founding of German airline “Luft Hansa” in 1926, then moved to the Air Ministry as state secretary in 1933, and ran the Third Reich’s fighter production program that consumed forced labor by the tens of thousands. His statement runs two typed pages. He entered the ministry, he said, “trotz vieler Bedenken”, because he was told he could not refuse the call of the German people. He said he rejected the war and knew nothing of its planning. On the workers he gave the tribunal this:

Wenn ich auch mit der Beschäftigung der Arbeiter, also auch der Fremdarbeiter, nichts zu tun hatte, so habe ich es doch für meine Pflicht gehalten, genaue Erhebungen über die Zulässigkeit der Fremdarbeit zu machen, die mir bejaht worden ist, ebenso wie ich mich bemühte, die Zahlen so niedrig wie nur möglich zu halten.

EN: Although I had nothing to do with the employment of workers—including foreign workers—I nevertheless considered it my duty to make precise inquiries regarding the permissibility of employing foreign labor, a matter which was confirmed to me, just as I endeavored to keep the numbers as low as possible.

He had no hand in the labor, he said. He just examined its permissibility, he said. The examination came back affirmative. He kept the numbers low, he said. His testimony, he added, was addressed to world opinion and to the German people, to show that “eine nicht kontrollierte autokratische Regierung verhängnisvoll enden muß” (an unchecked autocratic government is bound to end disastrously), and his own fate in the matter was “ohne Bedeutung” (meaningless). His counsel closed the same day on the airline: Milch had never used “the peaceful instrument of the commercial air-fleet for any sinister purposes”, and had conceived Luft Hansa’s European partnerships as a forerunner of a unified Europe.

It was all lies.

Lufthansa’s own chief executive said so on 3 February 2026, seventy-nine years after the plea: the airline was part of the system, and the commercial fleet was just cover for a clandestine air force built on slave labor.

The Lufthansa history exhibition in the Tempelhof tower of Berlin states it plainly: Lufthansa was cover for building a German air force under the Weimar Republic, with Milch as the director driving it. Some planes (He 111 and Do 17) were designed with few passenger in mind, because they were meant to be bombers. By 26 August 1939 the airline’s “Verkehrsinspektion Berlin” (traffic inspection) had become Kampfgeschwader zur besonderen Verwendung 172 (special bomber wing), commanded by Lufthansa director Carl August von Gablenz.

The tribunal acquitted him on the count of medical experiments three weeks later, yet convicted him on the slave labor.

Lufthansa traded on his lies for seventy years. The company commissioned the historian Lutz Budrass in 1999 to examine its wartime practices, including slave labor, and received his study in 2001. The results were kept it unpublished until 2016, when it appeared as a supplement to an illustrated anniversary book. Budrass then published his own account over the board’s objection so the public could know the truth. His figures put the forced laborers at over 7,000 at peak, with the company procuring workers itself from military repair works behind the front.

The first chairman of the new Lufthansa’s supervisory board was Kurt Weigelt, who had sat on the board of the old one and stayed on as honorary president until his death in 1968. In March 2026 Budrass wrote that the latest official company history still omits the part Milch and Carl-August von Gablenz played in the Holocaust. The pattern is stable across a century: the operator disclaims authority, the institution disclaims continuity, the archive waits.

This is the story that came to mind when people asked me what I thought about an essay in The Atlantic on 3 October 2026 under the title “I Quit OpenAI Because Its Culture Is Broken”.

David Robinson published his resignation essay like he was anticipating a Nuremberg trial. Reuters carried it the same morning. The essay names the defendant as culture, blames a sprint mentality, and calls for the redundancy of nuclear plants and airports. It also contains the sentence that fixes his own place in the record: “I never encountered a colleague who had experience making airplanes fly safely.” Looking at his own career perhaps explains why.

Robinson studied philosophy at Princeton and PPE at Oxford, took a JD from Yale in 2012, and interned at TIME and the Wall Street Journal. He co-founded Upturn, a Washington nonprofit that brought technical expertise to civil rights advocacy, and ran it until 2020. He spent 2018 at Cornell as a visiting scientist, taught at Apple University, and wrote a 2022 book on the governance of the kidney transplant algorithm.

He joined OpenAI in May 2023 as head of policy planning on the Global Affairs team and moved in October 2024 to the Safety Systems team, where his work was the system cards and public disclosures. Harvard Law billed him as a student and practitioner of the governance of high stakes algorithms. His own hiring notice for a deputy described the job as owning the editorial quality of safety transparency artifacts. He drafted the Preparedness Framework and oversaw safety reports on twelve launches.

So we have someone whose credentials are all for explaining decisions and none for making them. Upturn wrote reports for civil rights groups that carried the fights. His book studies surgeons and patients arguing over a kidney formula, observed from a visiting chair. Policy planning on OpenAI’s Global Affairs team was the lobbying arm, and Safety Systems, in his own hiring notice, was the editorial quality of the artifacts. Twelve launch reports went out under his supervision and his essay names none he refused. On the one decision his own thesis required, he writes that he perhaps should have stayed and fought, and that he and his colleagues were too busy sprinting to consider big changes. The three researchers fired on 1 October took the risk he describes as impossible and lost their jobs for it. He left the same week hiding behind a PR firm to avoid taking personal risk.

Let’s go back and consider that Milch said he entered the Air Ministry despite many doubts; Robinson says he did not leave OpenAI lightly. Milch said he rejected the war and knew nothing of its planning; Robinson says he was so busy sprinting he could never land big changes.

Milch claimed he had nothing to do with the labor but certified its permissibility and kept the numbers low; Robinson tells us he drafted the Preparedness Framework and signed twelve launch reports.

Milch addressed world opinion on the fate of uncontrolled autocracy; Robinson addressed The Atlantic, through a retained PR firm, on what he calls a broken culture.

Milch’s personal fate was without significance; Robinson’s decision to speak was his alone. What Milch really leaned on in 1947 was the claim that nobody had known. Robinson joined in May 2023, after the problems were already in print.

OpenAI folded safety into its research division in July 2026, which tells us something was changing in how the company managed risk. On 1 October the Wall Street Journal reported three safety researchers fired for sharing information with an outside safety organization. Robinson’s departure landed the same week, with a canned Atlantic essay by his PR firm Spitfire Strategies, which he named in his own text.

When I say the problems were already in print, look at this blog for example.

March 2023	ChatGPT outage: what evidence exists for any confidentiality or integrity safety at all
August 2023	OpenAI and WorldCoin: a product that lies by design, run by a company that ignores stop signs
September 2023	Altman as Strangelove: the dangerous-model-we-won’t-release line as marketing
November 2023	Board fires Altman: constant integrity breaches are a management decision
August 2024	Trojan Horse: CISOs should plan to detect and exclude OpenAI from their operations
October 2025	CISO as Theranos: we cannot solve this, attackers will exploit it, we’re shipping anyway
April 2026	Firing on all cylinders: growth measured against the suicide reporting
August 2026	Black Hat: discovery by availability failure, agents retained write access after the rebuild
August 2026	The open letter: a sales catalogue asking governments to expedite the product
September 2026	The basics: two incidents and a recurrence, each closed by egress control

Milch’s closing statement was built to hold for one day in Nuremberg, with the crimes barely understood and a noose on the table. Robinson’s essay is built the same way, but there’s no court yet and his mistakes are very public. The tribunal convicted Milch on the labor he said he never touched. Robinson signed off twelve launches he now calls a broken culture he wasn’t responsible for himself.

NVIDIA opened its agent safety announcement with the browser. The web became safe, it says, when the browser stopped trusting the page. That is the right history.

Then they try to sell you the reverse of it.

Not so fast, partner.

The Open Agent Safety Platform post, published 28 September 2026 by four NVIDIA directors, lists five principles for running agents.

1. Policy is proved before the agent runs.
2. Enforcement sits beyond the agent’s reach.
3. The path to the model is the control point, because an agent acts only by way of its next thought.
4. Authority scales with how much of the agent’s reasoning an operator can see.
5. Labs, enterprises, and hardware vendors each own a layer.

Every one of those principles looks correct to this weathered pair of eyes. Every one of them describes a gateway. Which is another way of saying to NVIDIA, it’s about time they showed up. Every one of the five has been running as an open source project since February, sitting in their inboxes.

What is open

Their platform is made from two halves. OpenShell is the runtime, Apache 2.0, built by the Gretel team NVIDIA acquired in 2025. It puts an existing agent in a sandbox using Linux kernel primitives and enforces a declarative policy on files, network, processes, and credentials. The documentation shows it wrapping Claude Code, OpenClaw, OpenCode, and Codex. Its own product page states the design plainly:

The gateway is the control point

That comes from the OpenShell page on build.nvidia.com.

The second half is NVIDIA Sentry. Sentry is the independent watchdog. It runs in silicon on the BlueField-4 data processing unit, programmed through DOCA, and it enforces the OpenShell policy from hardware the host cannot reach. The post says anyone already running a Vera system with BlueField-4 gets these protections through a software update. It adds that the platform is compatible with other hardware.

So the sandbox is open, the watchdog is a card, and the card is sold by just one company, on its price list and schedule. That’s security if you can afford it.

The post also says what it wants from everyone else:

the agent runtime and its policy language need to be open

The runtime is open. The policy language is open. The enforcement of that policy, the part the third principle names as the control point, lives in a high-priced single-vendor card.

The record

Wirken shipped at the start of 2026 and was open source by late February 2026, MIT licensed. I built it for all the clients I had who complained they couldn’t find a gateway built right, a switchboard that sits on the path between chat channels and the model. I sent it to NVIDIA not long after I saw them jump into bed with inherently insecure OpenClaw, a dubious move on the face of it.

On 13 April I answered Cloudflare’s Agents Week question, which agent are you, who authorized you, and what are you allowed to do, with the Wirken trust boundary: every agent action recorded to an append-only, SHA-256 hash-chained audit log before execution.

On 18 April Wirken 0.7.4 shipped with signed releases and a per-agent signature on the chain after every turn. A single command replays the log offline and confirms nothing was modified, deleted, or reordered. The audit path holds without trusting Wirken at read time. Counsel had started warning clients that agent activity is evidentiary, and the design followed.

On 19 April I walked NVIDIA’s own NemoClaw tutorial for DGX Spark step by step inside Wirken, and wrote that NVIDIA had clearly seen the storm brewing. The tutorial bound Ollama to every interface so a sandboxed agent could reach it across a network namespace. Wirken put a policy layer on that path instead.

On 26 April I documented an authentication bypass in Microsoft’s Agent Governance Toolkit: a gateway whose audit log, rate limits, and policy decisions all attached to whatever agent identity string the caller chose to send. Governance without identity verification on the request path is a log of claims.

On 16 May I wrote up Ontario’s auditor general, twelve thousand public servants on four hundred AI sites, and said the missing piece was a switchboard every agent connection passes through.

On 27 August I read OpenAI’s cyber defense letter and pointed out that the observability and accountable agent identity it says must come from frontier labs already ship under an open source license, through one operator-controlled policy layer, to Ollama on a local box or to Anthropic, OpenAI, Gemini, Bedrock, or NIM.

On 24 September I gave the keynote at German OWASP Day in Karlsruhe. Four days later NVIDIA published its five principles.

The longer arc is on record too. My May 2021 RSA Conference talk, Top Seven AI Breaches, closed on a test plan for AI: prove the model wrong like any other software, gate releases through testing and audit, and keep an off button and a reset button outside the model. NVIDIA’s third principle calls that a kill switch and locates it in a DPU. The 2016 BSides Las Vegas keynote on great disasters of machine learning made the same point about Tesla Autopilot a decade ago.

What the browser actually did

The browser story is worth telling accurately, because NVIDIA borrowed it to sell you their hardware. SSL began as Netscape code in 1994, which I experienced hands-on at the time, and watched as v1 was immediately tossed out. It became a trust layer for the whole web in January 1999, when the IETF published TLS 1.0 as RFC 2246 and any vendor could implement it. The same-origin policy shipped as browser software. By 2006 I sat in the Silicon Valley meetings deciding how the whole web would present the user a trusted lock icon. Sandboxed tabs shipped as browser software in 2008. Google called me in when they wanted to postpone mandatory deprecation of SSLv2. It was a public good against a private calendar, and I told them instead to nudge users, a hot new economics idea at the time, toward a browser update. Today everyone takes nudge for granted. The icon meant something because the protocol behind it was public, and the implementations were plural. The web’s trust layer was built to run on any machine that anyone owned, not just IE on Windows with a specific chip. Perhaps you know where this goes next.

The closer precedent for the NVIDIA story of enforcement in silicon is the Clipper chip. In 1993 the US government proposed the Escrowed Encryption Standard: a classified cipher in tamper-resistant hardware, with the government holding the keys. NIST described it as available on a strictly voluntary basis. In 1994 Matt Blaze at AT&T Bell Labs published Protocol Failure in the Escrowed Encryption Standard, showing the chip could be used while the access field the whole scheme depended on was rendered useless. A safety property that lives inside hardware only its maker can inspect is a promise.

Blaze tested the promise from the outside and it failed. And to be honest, I wish more reporters would drop headlines saying NVIDIA brings back the Clipper chip for AI. Because it helps frame that the security culture there is not quite right.

The open instance already runs

Wirken today runs every tool call through a tiered permission gate, and the highest tier always asks a human. Every decision lands on the hash-chained, Ed25519-signed, append-only log that anyone holding the public key can verify offline, on their own machine, with no vendor in the loop. Skills run as signed WebAssembly under a registry root. Channels run in separate OS processes inside a gVisor sandbox. The whole thing runs on a Raspberry Pi.

NIM went in as a provider because NVIDIA asked me to support it. Interoperability, in this platform, runs in one direction. The open gateway plugs into NVIDIA’s models. NVIDIA’s watchdog plugs into NVIDIA’s card.

For a European operator this kind of distinction is fast becoming a procurement question even before it is a security one. Enforcement that exists only on one American vendor’s silicon places the control point outside the buyer’s jurisdiction and inside a supply chain the buyer neither audits nor governs.

Trump’s export licensing already decides which allies may buy NVIDIA silicon and on what terms, so the Clipper chip of AI arrives as a procurement problem for every ally. Before Clinton’s NSA put Skipjack in silicon in 1993, Senator Joe Biden’s S.266 in 1991 told providers they had to hand government the plaintext. That single clause is why Phil Zimmermann released PGP. I remember.

Sovereign cloud means the audit log can be verified without asking the vendor. Wirken’s chain meets that test today on hardware bought at any electronics counter anywhere you need to be.

NVIDIA has written down the correct requirements, as I have stated them for what feels like forever. The control point they got wrong, because it belongs in the open. Wirken has proven that since February.

A company that once pitched itself as extraterritorial now measures success by how deeply it is wired into national jurisdictions. That’s a notable political shift from seeing itself as literally above the law to trying to become the law.

Many years ago I was invited into a high security meeting enclave on the Facebook campus. After multiple physical security checks and pat-downs, and being escorted into the room, I found myself among ex-military advisors plotting “Aquila” drones. It was 100% clear that Facebook delivering “Internet” over contested ground from a neighboring country was privatized military intelligence. I couldn’t get out of there and take a shower fast enough.

I called it intelligence collection by elevated platform in 2018, three months after Facebook shut the program.

As those Air Force mercenaries soon discovered the drones were never above the law, and Facebook in 2016 had failed politically before Aquila ever finished a test flight.

I’m not a lawyer but sovereign airspace has no altitude ceiling. The U-2-reminiscent platform operating at 90K feet still needs the same national spectrum license as a tower on the ground. Ask me why the extremist libertarian Silicon Valley nuts still talk about “data centers in space”. A mythological “wild West” of unconstrained rootin’ tootin’ ruthless John Wayne power is driving them, as depicted by Anwar Congo in “The Act of Killing”. Anyway, the ITU identified spectrum for high-altitude platforms, and every country licenses that spectrum on its own terms. India’s regulator proved the point in February 2016 by banning Free Basics on zero-rating grounds. Nothing physical had to be contested when Facebook lost its unregulated power aspirations at a licensing layer.

Four months later Aquila’s first full-scale flight ended in a structural failure on final approach near Yuma, flying without an airworthiness certificate, and the second flight in 2017 did not solve the underlying problem, which also stalled Zephyr: a solar airframe cannot carry a useful payload and survive the night at anything but equatorial latitudes. Loon, the balloon program, closed in January 2021 when Alphabet said no commercial case materialized (meaning the Pentagon backed out).

Inside the high walls of the Facebook campus it was like humanity didn’t matter, money-fueled madness made anything possible (e.g. Musk’s “occupy Mars” is a campaign to abolish laws and replace with an Emperor). Outside, the laws broke every power-hungry fantasy. That’s why Facebook shut the airframe program in June 2018 and said Airbus would build the aircraft instead (e.g. Tesla initially had Lotus build its cars to avoid itself having to operate within the law); and that partnership faded quietly.

Fast forward to today and Meta has announced an engineering nothing-burger.

We’re announcing Petal, the first subsea cable with petabit capacity to be deployed across an ocean. Petal will connect the US and France, spanning 7,000 km (over 4,300 miles) and doubling the capacity of today’s most advanced transoceanic cables.

The doubling isn’t surprising and comes from two-core fiber rather than more strands, which is why the announcement leans on “without proportional power or infrastructure.” That is also a concentration-of-risk claim: same number of cables, same landing points, same Baltic and Red Sea failure modes, now carrying twice as much per cut.

The constraint has been voltage, not glass. So repeaters split each 2-core fiber into two single-core paths with a fan-in/fan-out interface, amplify, then recombine, which keeps the system under the existing 18 kV power-feed rating and avoids requalifying the whole subsea ecosystem. Meta doubled capacity by staying inside the old certification envelope.

Meh. Or should I say Meh-ta?

It is obviously foremost a cable for moving Meta’s own traffic between its US and EU data centers, increasingly AI training and inference, that seeks EU exposure and dependence on American compute. Read between the lines and it is a political science post, without much technical significance, dressed up as something novel that engineers did.

Meta stopped trying to route around states and started embedding in them instead.

It plans to land in France with Orange as landing party, which puts Meta inside French critical-infrastructure policy, inside French lawful-intercept obligations, and at the table when governments talk about cable protection. That is a far more politically durable position than hoping nobody touches an aircraft too fragile to survive its landing.

Colonization by cable is probably the right way to read the news, if you consider history. Paris learned what happened in the Fashoda Crisis of 1898 from a British telegram routed through Cairo, and when Britain censored the cables during the Boer War the next year, France started building a state-owned network to Africa.

The two major colonial powers sought to link their colonies via a vast railway network: Britain from Cairo to Cape Town, and France from Dakar to Djibouti. The town of Fashoda, situated at the intersection of these two planned lines, became a critical focal point for both armies. On September 18, 1898, Marchand’s French mission and Kitchener’s British expedition came face to face on the Upper Nile. Ordered to withdraw, France yielded and was forced to acknowledge British authority over the entire Nile basin. This defeat led to a redivision of African colonies between the British and the French.

What will Meta surveill and censor for Trump when the EU goes to war?

On the current cable at Le Porge Meta holds more than 80%, Orange gets two of sixteen fiber pairs for landing it, and the ownership split is not public.

Can you guess why it’s not public? On the US side the FCC landing license for Amitié went to Microsoft, and since 2020 the FCC refers cable landing applications with foreign ownership to a Justice Department-led committee that can condition the license on a national security agreement. Whatever the licensee agreed to in Washington is part of the deal France landed.

Petal goes to NEC and Sumitomo, two years after the French state bought 80% of Alcatel Submarine Networks to keep cable building sovereign, and seven years after the Senate warned in 2019 that these infrastructures must not be held exclusively by foreign entities.

France keeps one thing. Le Monde reported in 2014 from the Snowden files that Orange’s landing stations give the DGSE access to everything transiting the country, sorted by origin.

Meta owns the cable. France owns the landing and reads it. That is the same arrangement France rejected in 1898, with the tap as consolation, and good luck to France when it remembers why.