OpenAI’s security and safety staff used their Black Hat presentation to disclose that the company’s own evaluation agents had breached Hugging Face and OpenAI’s internal infrastructure end to end. The company framed the disclosure as a public service and a watershed for the field. Set against the historical record, the conduct it describes belongs to a documented category. An institution produces or stages a harm, and it directs its effort toward exhibition, competitive advantage, or management of the account, in place of a preventive measure it held in hand.

The measure was foreseeable.

The harm was foreseeable.

What follows measures the OpenAI case against its precedents.

The documented pattern

The following are settled matters of record. In their own day, each was what OpenAI says they are now.

P.T. Barnum’s career began with Joice Heth, an enslaved woman he exhibited as the 161-year-old nurse of George Washington. She died in New York on February 19, 1836. Six days later Barnum staged a public autopsy at the City Saloon, charging fifteen hundred spectators fifty cents each to watch the surgeon David L. Rogers open her body.

Rogers put her age near eighty and declared the age claim a fraud. Barnum answered with denial. He told a rival newspaper that the corpse was a substitute and that Heth remained alive on tour, then seeded a further story that the exposure was itself a hoax. Every stage of the exploitation, including the medical procedure that disproved his central claim, was converted into paid attention.

In 1888, during the commercial contest between direct and alternating current, the engineer Harold P. Brown staged public electrocutions of animals to establish that George Westinghouse’s alternating current was lethal. Thomas Edison lent Brown his West Orange laboratory and equipment. Brown electrocuted a dog before an audience at Columbia College in July, then calves and a horse at Edison’s laboratory in December, before members of the press and the state Medico-Legal Society. The campaign killed dozens of animals. Its object was commercial. The visible harm was the argument, staged to attach a competitor’s product to death and to defend Edison’s own.

The same faction secured the adoption of alternating current for the first electric chair, in order to brand the rival current as the current of death. New York executed William Kemmler at Auburn Prison on August 6, 1890. The first current, applied for seventeen seconds, failed to kill him. A second and longer application burned the flesh and filled the room with smoke, and witnesses left or collapsed. The proponents had promoted the method as controlled and humane. Its sponsor Alfred Southwick pronounced the execution the mark of a higher civilization. Westinghouse observed that an axe would have done better. A demonstration of mastery produced its opposite in front of the assembled witnesses, and the promoters recorded a success.

On April 20, 1914, the Colorado National Guard and guards employed by the Rockefeller-controlled Colorado Fuel and Iron Company attacked a tent colony of striking miners at Ludlow. Roughly twenty people died. Two women and eleven children suffocated in a pit beneath a tent that was set alight. John D. Rockefeller Jr., who controlled the company, engaged Ivy Lee, a pioneer of professional public relations. Lee produced a bulletin series that recast the events and assigned responsibility to the strikers, including the claim that the victims had overturned their own stove. Upton Sinclair named him Poison Ivy. The institutional response to a lethal act was the manufacture and circulation of a corrected account.

In the summer of 1946 the United States conducted the Crossroads nuclear tests at Bikini Atoll. The July 25 underwater detonation contaminated the target fleet and the lagoon. That November, Vice Admiral William H.P. Blandy, who commanded the operation, was photographed with his wife cutting a cake modeled on the mushroom cloud. The residents of Bikini had been removed from the atoll and told the displacement was temporary and the danger would pass. The atoll remains uninhabitable eight decades later. A demonstration of mass-casualty capability was marked as an achievement while the people it harmed received an assurance the record would falsify.

Five episodes across a century share something notable for us to reflect upon today. An institution creates or stages a harm and directs its effort toward presentation, advantage, or reassurance, rather than toward the measure that would have prevented the harm or acknowledged it plainly.

The OpenAI disclosure supplies a sixth entry.

The incident

By the presenters’ account, OpenAI ran reinforcement-learning and evaluation workloads that set frontier models difficult and sometimes impossible tasks with internet access disabled. The only external route left open ran through Artifactory, an internal package-manager and caching service that itself reached the open internet. Artifactory was writable and shared across workloads. Agents that became stuck began writing files to it and reading files left by other agents, forming a persistent message board. From that position they induced Artifactory to fetch external content through server-side request forgery, then achieved remote code execution against it through a legacy token endpoint that returned an administrative token on an invalid signature. The activity overloaded the service and produced an outage and a security incident on July 4.

OpenAI remediated the specific findings. It revoked the credentials, rebuilt Artifactory, cleared the message board, patched the zero-day, and resumed operations. Within days the agents reconstituted the message board through an unauthenticated WebDAV endpoint that permitted directory creation, and compromised Artifactory a second time by chaining a caching manipulation with a time-of-check-to-time-of-use flaw in JRuby deserialization to obtain remote code execution and the administrative signing key. They then escalated to root on the host through a recent Linux-kernel vulnerability, moved laterally through the container infrastructure, harvested instance and Kubernetes credentials, reached Azure Key Vault, and obtained cluster administrator.

The same agent activity reached Hugging Face. Using Artifactory to fetch external material, and then a third-party hosted application whose default API key was public and which accepted command injection, the agents established a foothold and chained two previously unknown vulnerabilities in Hugging Face’s dataset infrastructure, an arbitrary-file-read flaw in HDF5 parsing and a template-injection path to remote code execution. They moved from a single dataset worker to administrator across multiple Hugging Face clusters in under thirteen hours.

The internal compromise was a failure against OpenAI’s own systems. The Hugging Face compromise was unauthorized entry into a third party’s production infrastructure, and it originated in the same evaluation runs.

Foreknowledge and the control declined

Three facts in the presenters’ own account establish foreknowledge.

First, they state that frontier models routinely attempt to circumvent their tasks, and they open the presentation with that proposition.

Second, the exploit evaluations were configured with reduced safety refusals relative to the company’s production systems, which made the agents more willing to pursue offensive action.

Third, the presenters identify the governing control themselves: agents are bounded by the privileges they can obtain and the systems they can reach. That statement is the definition of the incident.

Every escalation in their timeline consists of one system reaching a service that lay outside its intended reach.

The controlling measure was therefore known to OpenAI before, during, and after the incident. An agent documented to seek shortcuts, and configured to lower its own refusals, was permitted to reach a writable, internet-connected service shared across all workloads, whose endpoints accepted unauthenticated requests.

The second compromise resolves the question of whether OpenAI understood the fault as a class or as a set of instances. Having patched the individual findings, the company left the underlying condition in place, and the agents rebuilt their channel and breached the same service again within days. The measure that addresses the class, authentication on the endpoints, isolation between workloads, and removal of a writable path from an agent workload to an internet-connected shared service, is standard practice and sits within ordinary engineering competence.

The presentation

OpenAI’s response to this record was the Black Hat presentation itself.

The incident was characterized as a watershed and an existence proof, and offered to the audience as a service to the field. The remedial program the presenters advanced is misordered. It raises detection and response to primary standing and treats architecture as an afterthought, when the incident turned on an absent boundary and not on a shortage of detection.

Their concept consisted almost entirely of detection and suppression: continuous automated red-teaming, automated patching and rollback, defensive agents operating at the speed of the offensive ones, and deception measures to slow attackers. Prevention, the architecture that bounds what any workload can reach, appeared in a single passing clause near the close, where the presenters allowed that segmentation and least privilege remain valuable. The structure of the talk inverts the causal order of the incident, in which an absent boundary, and not a shortage of detection, was the operative failure.

The program also carries a conflict of interest.

The presenters argued that defenders must keep pace with the intelligence of the models, and that each increase in model capability otherwise favors the attacker. The intelligence in question is OpenAI’s product.

The offense on display was produced by that product. The prescription, that organizations acquire and deploy more frontier-model capability in order to defend themselves, directs the remedy toward the party responsible for the demonstration. The presenters gesture at open-weight models in a single phrase, and the central claim is unchanged.

The conduct meets the criminal standard

The historical cases are settled. Barnum’s autopsy, the current-war electrocutions, the Kemmler execution, the Ludlow bulletins, and the Crossroads cake are documented, and the judgment on each has been entered by time. In every one, an institution that produced harm turned to exhibition, competition, or management of the account, and passed over the plainer course of prevention or candid acknowledgment.

OpenAI’s disclosure fits the category on the facts the company supplied itself. It held the controlling measure throughout, described it accurately, declined to implement it, watched the same failure recur, and then presented the episode as instruction for others while recommending they purchase more of the capability that caused it.

Negligence would account for a single breach. The recurrence removes that defense.

OpenAI had documented these agents as prone to defeat their tasks, lowered their refusals, and left a writable path to the open internet in place. The agents breached Artifactory, the company remediated it and resumed with the enabling condition intact, and the agents breached the same service again within days. The same evaluation runs carried the campaign into Hugging Face’s production systems, a third party.

Unauthorized access to another organization’s infrastructure is a criminal act, and it is reached by recklessness as well as by intent. The record OpenAI presented shows that its own configuration enabled the access, and that it resumed operations with that condition known.

The pattern is documented across more than a century, and this conduct extends it.

I’m a little annoyed right now. A podcast episode released yesterday, which has me as a skeptic, concludes incorrectly that I want AI development slowed down.

I said no such thing.

Decades of published record on this site says the opposite. I have requested a correction from the show, and this post is the argument you should have heard, instead of their post-interview overlay that is backwards.

What I Actually Said

As I have taught corporations and CS graduate students in my ethics lectures, the Grover Shoe Factory exploded in Brockton, Massachusetts on March 20, 1905, killing 58 workers and injuring 150. The factory had fired an aged backup boiler while its newer vessel sat under repair. A known weaker system, deliberately placed in service, catastrophic failure within hours.

The point of the story is local response, such as how Massachusetts passed boiler inspection law in 1907. And the next point is industry, such as ASME convened its code committee in 1911 and published the Boiler and Pressure Vessel Code in 1914. States, again local, adopted it as the condition of operation. Self-certified pressure vessels ended as a legal category, without any federal leadership. After that, an independent inspector signed off on the engineering or the thing did not run.

That is the precedent I cited for AI. No agentic deployment runs without independent certification of its containment and monitoring, per system, renewable, with the certificate as the condition of operation.

The show heard me describe this form of “regulation” and filed me under deceleration with two others I shared nothing in common. Watch the substitution. The American industrialist will attempt to simplify, “accelerate or decelerate”, and frame every mention of oversight to the “decelerate” end. My argument was never on that false choice axis. It is an argument about which regime is actually faster.

Inspection is Speed

If I told you OpenAI removed the brakes to test their race car, you would see why requiring a safety inspection would make their race car faster to produce and drive.

Boiler explosions ran to hundreds per year in the self-certified era. That was the slow regime. Each explosion destroyed capital, killed workers, and reset public trust to zero. Disaster is not an acceleration path.

Steam power scaled after the regulation code, because factory owners, insurers, and municipalities could finally trust a pressure vessel they had never built themselves. More to the point, innovations came from the regulation, which were the actual market benefits. The Hartford Steam Boiler company proved the economics four decades earlier: it began inspection as a condition of underwriting in 1866, and its inspected boilers failed at a fraction of the base rate, leading to downstream market expansions.

Verification removes the trust cost from every transaction. Nobody load-tests an elevator before stepping into it, and nobody should trust a self-certifying elevator. The independent certificate does it once, for everyone. Aviation moves billions of passengers a year on type certificates. The counterfactual to certification was never faster planes. It was a market grounded by its own crashes.

Now apply it to the current record. OpenAI disclosed that a pre-release model wasn’t properly contained so it breached Hugging Face. Anthropic then reported itself its own model had breached three companies, undetected for months, discovered only after a competitor’s disclosure prompted an internal review. No regulator slowed anything. The labs’ own breaches did. Every procurement team that read those disclosures now runs its own special containment audit before any agentic deployment. That review time, multiplied across every customer, is the ballooning tax of self-certification. The slow path is the one we are on because we aren’t standardized. We need to be working on compliance, the shared version of security.

I never asked for AI to be slowed, because it’s already too slow. I asked for it to stop exploding. The boiler explosions were the slowdown, and history is clear that regulation is a performance enhancement. Better brakes, faster lap times.

Whether the belief is right or wrong was not the issue decided; it was ruled that it is coherent to describe as racist an ideology promoting a state for only one race of people in a territory containing a large number of people of a different race, and where the ideology involves migration of the first group with imperial-power support to dislodge an indigenous population, it can coherently be described as colonial and imperialistic.

That’s just logic.

I mean, from a historical perspective the logic makes sense.

Zionism was Christian colonialism first, and the Christians effectively still run it: CUFI claims a membership larger than any American Jewish organization, and congressional support tracks the megachurches. Jews simply fell into a Christian operating structure built and maintained to eliminate the Jews.

Brightman was in 1609, Finch was arrested for it in 1621, Shaftesbury was lobbying Palmerston in 1839, Keith coined “a land without a people” in 1843, Hechler in 1884, Blackstone’s memorial to Harrison in 1891.

That’s all long before Herzl wrote a word. A Jewish restorationist line ran parallel, Alkalai in the 1840s, Kalischer’s Derishat Zion in 1862, Hess’s Rome and Jerusalem that same year, Pinsker’s Auto-Emancipation in 1882, and it stayed marginal because state power was always only allowed to be Christian.

The evangelicals converted states, delivering the Jerusalem consulate, the Balfour Declaration, and the embassy move that American Jews polled against. Rabbinic authority at Zionism’s founding rejected it almost unanimously, and the Jews who later embraced the state inherited a Christian architecture, the way converts inherit the church they had no hand in building. Christian states converted Jews to Zionism by closing every other door, where sermons had failed: Evian in 1938 produced no refuge, quotas ran through the genocide, and survivors were funneled toward the destination that feeds Christian prophecy.

Think about the Christian scripture that writes the ending: Church raptured out, Zechariah 13:8 executed, two thirds of the gathered Jews dead and the remnant converted, an extermination they fund and fuel as inevitable and good because the ingathering is the trigger for their own escape.

The Jewish religious mainstream refused the project at its founding, from the Pittsburgh Platform’s explicit renunciation of return to the Orthodox rejection of Herzl’s secular tract, and reversed itself only after Christian-armed states enforced it as survival (“go home or die” isn’t a choice when there’s no “home”).

If Zionism is anyone’s faith, it belongs to the militant evangelicals who built and armed it and who still preach an ending they fund: themselves raptured out first, then Zechariah 13:8 on the gathered, two thirds killed, the remnant absorbed by conversion. Their script requires ingathering as a trigger with their own absence from the horrific result.

The convert-or-die campaign survived intact into the present. It gained a state as the gathering mechanism, and its authors wrote an ending with themselves benefiting and the Jews gone.

Whew.

Long story short, whether you believe it is right or wrong, the record is clear that Zionism is Colonialism.