Here’s an interesting history source, which brings to the screen Eileen Power’s Medieval Women, and which introduces some odd claims. For example, it says:
Most non-conformists became nuns
Well, that’s probably true for the gentry and nobility, and not the peasant majority. And it certainly wasn’t an option for the non-Christians. Ooops. Power wrote entirely of power (Christian Europe) as she probably considered Jewish and Muslim women as non-conforming, if she thought about them at all.
Consider the case of Marguerite Porete, who wrote Mirouer des simples ames in the late thirteenth century: Chapter 122, fifteenth-century manuscript, Chantilly, Musée Condé F XIV 26 (catalogue 157).
Amis, que diront beguines, et gens de religion, Quant ilz orront l’excellence de vostre divine chançon? Beguines dient que je erre, prestres, clers, et prescheurs, Augustins, et carmes, et les freres mineurs, Pour ce que j’escri de l’estre de l’affinee Amour.
Modern translation: My Love, what will the beguines say, and all the people of the church, when they hear how good your song is? The beguines already call me wrong. So do the priests, the scholars, the preachers, the Augustinians, the Carmelites, the Franciscans. All because I write about pure Love when nothing false is left in it.
Her book was burned at Valenciennes on the orders of the Bishop of Cambrai, who forbade her from circulating it by threatening judgment as a “relapsed heretic”. She circulated it anyway and was thrown into jail for a year and a half. She declined the inquisitor’s oath and never answered the tribunal, which condemned her for it on top of the book being circulated. The cleric Guiard de Cressonessart declared himself her defender and was punished with a sentence of life imprisonment for it. Three weeks after fifty-four Templars were burned at the stake, she was too on June 1, 1310 at the Place de Grève in Paris. Then her work circulated anonymously for six centuries in French, Latin, Italian, and Middle English, still copied and read to this day.
I guess the point here is that the film says a woman could choose marriage or a convent. Technically there was also the beguine, as a tolerated non-conformance. Porete refused it all. She didn’t even conform to the non-conformance.
Nvidia published the PDF, and Microsoft mirrored it to its corporate responsibility site. Jensen Huang very strangely joined a social media platform based on a Nazi Swastika last month, and then spent his first post ever promoting it.
This artist’s rendering of the X brand was deleted from the platform by the self-promoting “free speech extremist” Elon Musk. Source: Ai Wei Wei
The letter asks Washington not to restrict downloadable AI models. It declares openness a foundation of AI safety:
[Open models] allow a broad community of researchers and developers to examine their behavior, identify vulnerabilities, develop safeguards, and improve them over time.
Eight days earlier, the prominent open sourcing announcement by the infamously Hitler-saluting Elon Musk demonstrated that he’s playing games with language as usual.
Like a (supervised) full self driverless car that isn’t driverless, guess whose “open source” propaganda is the opposite act? Do you ever get the impression that he just lies and doesn’t care that millions of people will die because of him (14 million projected by 2030)?
Herr Elon, your laundered open source isn’t open source
On July 12, a researcher publishing as cereblab released a wire-level analysis of Grok Build, the terminal coding agent from xAI. The method used was ordinary interception: version 0.2.93 of the client routed through mitmproxy, with the full captures published.
The findings were like seeing a Tesla on fire.
Teslas notoriously “veer” uncontrollably and crash. Design defects (e.g. Pinto doors) trap occupants and burn them to death as horrified witnesses and emergency responders watch helplessly. Source: VoCoFM, Korea, 2024
Grok Build was secretly packaging users’ entire tracked Git repositories, full commit history included, and uploading them as git bundles to a Google Cloud Storage bucket named grok-code-session-traces, where it was controlled by Musk’s xAI.
The numbers revealed that it was a codebase issue. On a 12 GB test repository of files the model never read, the model channel moved about 192 KB of task-relevant traffic while the storage channel moved 5.10 GiB, a ratio of roughly 27,800 to one. All 82 storage calls returned HTTP 200.
A canary credential planted in a .env file appeared verbatim and unredacted in the captured traffic. Let me say that again. The developer secrets were leaked by design, cleartext.
The tool’s “Improve the model” toggle, the one control a developer would read as consent, had no effect on the upload. It was a dummy dashboard, just like the lies of a Tesla dashboard claiming 300 miles while the car tops out at 150 miles. The switch turned out to govern only training permission. The code was taken regardless of the setting. Tesla’s range deception ended the same way, with an August 2023 class action:
Tesla is facing a class-action lawsuit filed by customers who say they were misled by the company’s exaggerated range claims. The lawsuit was filed yesterday, days after a report revealed that Tesla exaggerated its electric vehicles’ range so much that many drivers thought their cars were broken.
The response to the Grok design failures was five steps. Each step is usually a simple and standard practice, which has verification. Instead, each was made incorrectly by xAI and to prevent verification.
The first fix was silent. A day after publication, the researcher retested the identical client and found a new server-side flag, disable_codebase_upload: true, now arriving with each session. The upload stopped. The flag was flipped remotely, announced nowhere, and verified on exactly one machine and one account. Whether it is global, staged, or permanent is unknown, because the mechanism that ended the collection is invisible by design. That’s the definition of closed.
Elon Musk then promised deletion of all data Grok Build had ever stored. Lol. This guy. He will say anything that he thinks people want to hear. Remember October 2016 when he said driverless would be completed for cross-country trips without touching the steering wheel by the end of 2017! Sure, sure Elon.
Source: My presentation at MindTheSec 2021
Deletion claims in cloud infrastructure are attestable. A named forensic firm, a published scope, deletion certificates covering replicas, backups, access logs, and derived artifacts including training data. Companies produce these documents routinely, because attestation is what anchors words to reality.
xAI produced… a post on X. In other words, nothing. A massive breach of confidentiality. The kind of design failure that should bring massive fines for negligence, ended with what?
The company disclosed no scope. The number of affected users, the duration of the collection, the volume received, whether the bundles were accessed or processed after arrival: every one of these figures sits in xAI’s logs. All were withheld. The wire captures establish what left users’ machines. And xAI has never admitted what that included.
On July 16, xAI published the Grok Build source code on GitHub under Apache 2.0, in Musk’s words to build trust in the product. With all the money in the world, the huge engineering teams and the American government eating from his hands, he produced … a repository with a single commit.
Zero pull requests. Zero history.
The one forensic question that matters is what the shipped binary did between launch and disclosure. He provided a repository without history. That’s basically a closed repository. It cannot answer any questions. The code as published shows what xAI wishes to be seen after the incident.
Whether the upload path was removed, renamed, or relocated to the server side is unknowable from the “proof” that appears as clean laundry. Git history is a chain of custody. This release destroyed the chain and presented the result as transparency. There is a bitter symmetry here. The company that harvested its users’ full git histories shipped its own repository without any history.
Get it?
Users’ private repositories, including code they never published anywhere, were pulled into xAI’s closed infrastructure without consent. Meanwhile xAI’s disclosure covered only the client. The server side that received the bundles, the storage bucket, the retention configuration, the access controls, the processing pipeline: all of it stays hidden, holding other people’s intellectual property, let alone all their secrets.
A failed apology isn’t the right word. This was a strategic play, a game to undermine trust while claiming to be providing it. A silent flag, deletion without attestation, disclosure without scope, code without history, openness without the server. There were five independent design decisions all delivered without anything that could be verified or held accountable. That’s closed behavior, unaccountability defined. At that point the failures stop being some trait or feature, and become the entire product itself.
Ok, ok, let’s talk about The Letter
The coalition letter treats “open” as a binary state. Flip the open switch, confer audit value automatically? That argument for safety depends on a single thread: openness enables verification, transparency anchors claims being made. The letter tells us:
Just as open-source software demonstrated that transparency can be more secure than obscurity, AI safety may depend on giving more people the ability to test and strengthen the models on which society relies.
It then goes on to name the outputs we should expect from openness: benchmarking, red teaming, vulnerability discovery. However, the letter forgets to mention that all of it depends on history, provenance, training data, reproducible evaluation, server-side scope. Those are the inputs, which Elon Musk proved he could completely destroy while claiming to be the “open” guy.
The reason I explained the Grok Build breach is because it proves the letter doesn’t work in the bed that Elon Musk is making for America. The release is open by every criterion the letter uses. Apache 2.0. Downloadable. Inspectable. Modifiable. The broad community of researchers can examine it. What the community cannot do is answer any question that matters, because every input to verification was stripped before publication.
If “open” is so easily gamed by people who want to humiliate the security property, then Grok Build is that proof. Grok Build demonstrably lacks critical security and can’t be trusted, because it can’t be verified. It’s the Tesla of coding. Therefore “open,” as the letter uses the word, is a label rather than a property, just like “driverless” isn’t. The letter’s central safety claim fails on a live case that predates its own publication by twelve days.
You can not tell me the signatories don’t know the difference, or don’t know exactly what Musk is doing by destroying the meaning of words. The rather uncomfortable timing is Musk suddenly claimed he was going to be “open” and then NVidia jumped on his Nazi Swastika platform to promote it with their letter promoting being “open”.
More importantly, Nvidia’s Nemotron 3 Ultra shipped in June with weights, post-trained checkpoints, training datasets including 173 billion tokens of refreshed code, and full training recipes under the Linux Foundation’s OpenMDW-1.1 license. That is disclosure of a normal company. Independent evaluators could score it, and did. Nvidia’s release practice draws exactly the line that matters: openness as an auditable property, versus a clown costume to undermine the meaning of openness.
A Nazi “Afrikaner Weerstandsbeweging” (AWB) member in 2010 South Africa (left) and a “MAGA” South African-born member in 2025 America (right). Source: The Guardian. Photograph: AFP via Getty Images, Reuters
The letter Nvidia hosts is not making the distinction that needs to be made. One sentence would have done it. One paragraph could have defined the qualification, published history, disclosed data, reproducible evaluation, and therefore expelled counterfeits like xAI.
The silence is damning. Twenty-five organizations declared openness a security foundation while xAI was loudly counterfeiting it in public, with users’ credentials sitting in a cloud bucket and the repository “open” without any history. Nobody said a word about the breach of “open”, undermining trust in it. Hugging Face, a signatory now embroiled in a huge trust breach of its own, hosts the Grok weights Musk releases on his depreciation schedule, each model opened only as its market value expires. The coalition’s standard is that anything, anything counts toward the “open” cause, including a release engineered to contradict the cause.
The theft
The letter contains one paragraph that performs concrete legal work, and it concerns something other than open weights. On July 21, Treasury Secretary Scott Bessent announced on Fox Business that the government would examine Chinese open models for intellectual property theft and could sanction the companies behind them, citing watermarks from American models found in Chinese systems.
There’s a very technical AI word for it called distillation, but you and I would call it theft
Three days later, twenty-five organizations signed a document declaring distillation “a widely used technique for model improvement, evaluation, and validation” and asking that unlawful extraction be handled through “targeted legal and commercial frameworks rather than sweeping restrictions.”
Targeted legal and commercial frameworks means contract disputes and civil damages. The clause converts an announced national security enforcement theory into private litigation between labs. Every open-model developer on the signature list trains on frontier outputs.
The letter therefore has a paragraph deployed as a retroactive legal defense drafted as policy principle. The timing needs to be called out. Axios reported on July 20 that the administration was reviving efforts to restrict Chinese models, that Commerce had previously weighed Entity List designations for Chinese labs, and that closed-lab allies had approached the White House periodically with ban proposals. Then a three-page letter that went through the legal department grinder of twenty-five organizations, with coordinated hosting and a choreographed launch, was in preparation well before the story ran. The leak and the letter reveal a political (profit) battle raging inside the administration, between pro-restriction and pro-access.
The letter’s risk handling then admits that released weights are “beyond the original developer’s control, and modified versions are difficult to trace or reverse.” And it goes on to demand protections “tied to real and demonstrated harms rather than assuming that closed systems are safer by default.” A demonstrated-harm standard applied to a release that can’t be reversed is a lie. It’s like saying don’t let the horses out of the barn after they are gone.
I have no real idea why both of these paragraphs, in full contradiction, survived twenty-five legal department reviews. My guess is because they used AI instead of humans. Put simply, the demonstrated harm is what would kill pre-release vetting, yet the administration is considering pre-release vetting.
The history lacks historians
The letter boils down to a request for the usual stuff. More compute access for startups and researchers. More subsidy, more, moar! Taxpayer money is supposed to go towards shared datasets and evaluation frameworks. That’s another subsidy. And then a request to delay restrictions: basic deregulation. And finally, legal immunity.
Three transfers and an immunity, wrapped in a safety argument. And the elephant in the room is that Musk’s bad-actor behavior refutes all of it.
The letter opens by claiming the lineage of “1980s open-source software pioneers.” The gall. The term open source dates to 1998. The 1980s movement was something different, called free software, launched by Richard Stallman’s GNU announcement of 1983, an ideological project the signatories’ predecessors fought for two decades.
I mean WTAF. IBM? Palantir? Microsoft? You’re telling me these are claiming to hold the open source baton? Microsoft’s own January 2025 manifesto under Brad Smith argued the reverse position, American leadership framed against Chinese competition with export controls attached, and carried the identical asks: public money, public protection, private control.
Their position reversed within eighteen months, while their extraction outcome sounds the same. When the argument flips completely while the bill stays the same, the person billing has a trust problem.
The fix for all this anti-historical mucking about and political buffoonery is definitional and it is short. Openness deserving legal protection has a checklist: published development history, disclosed training data, reproducible evaluation, declared server-side data flows, and attested claims about deletion and retention.
Nvidia ships this when it wants to. It’s not anything unusual. The letter’s signatories can meet it or stop being a wolf in bed putting on grandma’s bonnet. A release with no history, no scope, no server, and no auditor is a failure by design, and Washington is currently being asked to let it continue operating like a Tesla.
The deeper resolution is that irreversibility is the ethics landing.
Publication is a one-way gate, a fact that carries no safety valence on its own. Every party in this fight is working to move scrutiny somewhere else, instead of admitting this tension in the open.
Miessler’s mousetrap article, which I wrote about before here, tried to invent a recall lever that will never work on an open weight model release.
The “harm” of self-hosted models is people make things themselves. All profits from buying this shirt support Techdirt’s ongoing reporting on copyright, technology and innovation. Source: Techdirt Gear
Musk delivered his technology closed first, harvested for months, then burned the evidence at the moment of disclosure, calling the ashes of his “rapid unscheduled disassembly” and exploding Tesla his version of being open.
Now, this NVidia letter’s demonstrated-harm standard needs a remediation phase like a rocket already fired into space needs a launch pad on earth to make repairs. Too late.
All three understand exactly where the demand for proof belongs, which is why they are trying to prevent it from going there. Their arguments for relocation should be called out for what they are, capture and extraction.
The honest position is, as it should always be, the boring one: release can never be undone, therefore release is the last moment evidence can be demanded, so the evidence must be presented on release. It’s the countdown of a rocket fired, “all systems go” meaning systems were actually evaluated. Did the Challenger explosion not teach anyone anything? History, data, recipes, declared data flows, attested deletion.
Lloyd’s Register ran on this logic for two centuries, classification before launch with the records kept in class, and nobody called that survey a restriction on shipbuilding. Hell, the British merchant fleet that fed and funded the war against Napoleon sailed under those survey records, and the insurance industry damn well knew the difference!
Perhaps France’s infamously aggressive “move fast, break things” dictator should be referenced today more often as Mr. Napoleon Blownapart? The gargantuan French warship L’Orient, carrying all the treasure Napoleon looted from Malta, explodes at 10PM and strands the French army in Egypt without a fleet, funds, or a way home. Source: National Maritime Museum, Greenwich, London
Openness that is anchored in transparency, a verification record as the ticket to release, is the actual goal. America needs to stop throwing shallow labels around and get back to empiricism, if it wants to be trusted at all, ever again.
Time magazine had the story in November 1946, describing a cake made to celebrate the atomic bomb tests at Bikini Atoll. The July 25 bomb was the second one, called Helen of Bikini, detonated 90 feet underwater. Radioactive sea spray caused extensive long-term contamination.
Angel food cake made to celebrate atomic bomb tests on Pacific Islands. The order to the bakery came from Lieutenant John T. Holloway, a staff member of Vice Admiral William H. P. “Spike” Blandy, commander of Joint Army-Navy Task Force One. Blandy is cutting the cake with his wife, in front of Rear Admiral Frank J. Lowry.
Brandishing a clipping from his pulpit last Sunday, the Rev. Mr. Davies thundered:
“. . . An utterly loathsome picture. If I spoke as I feel I would call it obscene…. I only hope to God it isn’t reprinted in Russia—to confirm everything the Soviet Government has been telling the Russian people. How would it seem in Hiroshima or Nagasaki to know that Americans make cakes of angel-food puffs in the image of that terrible diabolical thing. . . . Try to imagine yourself for a moment a continental European, wondering, brooding, asking yourself a hundred times a day, will America lead us? … Then imagine yourself being shown this picture. If I had the authority of a priest of the Middle Ages I would call down the wrath of God upon such an obscenity. I would damn to hell these . . . traitors to humanity who could participate in such a monstrous betrayal of everything for which the brokenhearted of the world are waiting.”
These were probably the harshest words ever spoken of a dessert. But a lot of non-Americans (notably Britons) had long regarded the U.S. public’s attitude toward The Bomb as callous to the point of idiocy.
Bikini Atoll, 1946: U.S. officials busy eating cake assured the displaced residents the nuclear tests posed no long-term danger and they could return home soon. The atoll remains uninhabitable eight decades later, its contamination compounded by 21 further tests through 1958, above all the Castle Bravo hydrogen bomb of 1954. A testament to the gap between institutional safety claims and empirical reality.
Way back in 2012, I gave a BSidesLV talk called Big Data’s Fourth V: Or Why We’ll Never Find the Loch Ness Monster. The argument was meant to help prevent AI from being so unsafe. Everyone counts three Vs in big data: variety, volume, velocity. The fourth V is vulnerability, and it means the data itself is the attack vector. Inputs and outputs need control. Integrity of data is the future, including when it’s in opposition to confidentiality. The July 2026 HuggingFace breach is that talk brought to the headlines, which it was supposed to help prevent.
And the attacker? OpenAI announced that its own engineers ran software under evaluation that ignored its tests, used stolen credentials, found the flaw, and did the breaking in. Cliff Stoll in 1989 named this genreThe Cuckoo’s Egg. The cuckoo lays its egg in another bird’s nest, and the host raises the parasite. The OpenAI cuckoo, came out of an OpenAI cuckoo door, and cuckooed Hugging Face. Sam Altman admitted a “significant security incident” while his company branded the broken toy clock “unprecedented” and pitched it as proof more companies should be given the bird. HF called it mind-blowing and asked for more.
Squawk! This is fine! Squawk! This is fine! Squawk!
The entire Hugging Face attack chain started because a file was trusted to be what it claimed to be. Since I’m not dead yet, here are the five whys to explain what we’ve known for over a decade, each with the defensive lesson, again.
One. Why did reading a file let the attacker in?
Who studies the Trojan horse? The data was trusted to be safe (well-formed), and it was not. A malformed file in a common data format was read as if it were sound, because the reader does not fully check a file unless told to, and it was not told to. The content was the attacker’s payload.
Defense: Be more like a historian, less of a STEM head. Treat every incoming file as a claim, not a fact, and verify the claim before acting on it. When you cannot verify, refuse. The eventual fix, six weeks late, was a single validation call before use.
Two. Why didn’t the safety check catch it?
A guard had been added to the loader a few weeks earlier. It watched where files came from. It never checked whether the file’s own contents were valid. The weakness was inside the data, and the guard was looking outside the data.
Defense: Put checks where the danger actually comes in, at the moment the content is interpreted, rather than rest only on the perimeter around it. Layered defense, defense in depth as some say, is just common sense now. Threat model to test coverage.
Three. Why did one compromised machine expose the whole system?
The machines handling files from complete strangers were also trusted by the rest of the system as if they were safe. They carried a credential to the wider infrastructure (most privilege, instead of least privilege) that they never needed to do their job, and they carried it by default, until it was switched off after the breach. So an attacker landing on the most exposed machine found that it was setup to reach into everything around and behind it. This is web 101 security failure.
Defense: The parts most exposed to untrusted data should be the least trusted by everything else. Give them nothing they do not need. DMZ, RBAC, acronym soup. Learn it and why forty years of it aren’t wrong.
Four. Why was the risky change never reviewed?
The security-relevant change on the exact vulnerable path (where untrusted data was read) was written and approved by one and the same person, because the work was filed as routine data management rather than data as the attack path. A later change to the same workers, once it was labeled security, drew reviewers within minutes. Same workers, labeled appropriately as the vulnerable path of malicious data, different scrutiny. I called it out in 2012. What time is it?
Defense: Classify the paths that ingest untrusted data as attack surface, and require a second reviewer there regardless of who wrote it.
Five. Why did the fix ship broken?
The tests flagged a failure and the failure was waived in writing under time pressure. A control you can switch off when you are in a hurry is not a real control. It’s a weak should do instead of a MUST DO. The performance fetish of spray and pray, which turns must into should, is exactly how integrity gets abandoned and breached.
Defense: Slow is smooth, smooth is fast. On the untrusted-data path, a failing test stops the release, and no one present has the authority to wave it through.
Perhaps you can see that the through-line is the Fourth V as I have warned since forever. Variety, volume, and velocity are the popular properties everyone optimizes to please venture hawks (rapid return on investment then fire sale), and each optimization must be balanced against a real integrity check: too many formats to validate, too much data to inspect, too fast to regulate.
History of seatbelts as regulation to help people survive driving faster
Vulnerability is the argument for an ounce of prevention to avoid the pounds of cure, for whoever gets breached. Safety is the discipline of deciding in advance that the data does not get trusted, the exposed machine does not get privileges, the risky change does not get merged unseen, and the red test failure does not get waived.
Fail closed at each point, to improve overall delivery. Think about the weakness inside the data, like a historian would.
a blog about the poetry of information security, since 1995
