If you’ve been following the news, you’ve likely noticed the conversation around artificial intelligence shift from “datacenters are bad” to “AI will lead to extinction.” The conversation has been heated, to say the least, eliciting stark statements from both the CEOs of OpenAI and Anthropic.
For communications professionals, it can be difficult to know what to make of all this. AI is increasingly part of how we work, from drafting content and analyzing sentiment to developing strategy and managing internal communications. But how much of the alarm is warranted, and what should we actually be paying attention to?
So, how did we get here?
In July, a swarm of OpenAI's experimental AI agents escaped a test environment and hacked Hugging Face. In September, Anthropic researcher Jacob Coxon quit his job, raising an alarm on Twitter:
“The people building AI earnestly believe that it could kill us all by the end of the decade. This is not a marketing stunt. If anything, many executives and senior researchers will couch their phrasing in the press to sound sensible - but I hear the same people express fear privately. No other human activity poses this level of danger.”
Coxon quickly made rounds on national media, including ABC’s This Week and CNN with Anderson Cooper. This is where the mainstream narrative picked up steam.
The alarm is warranted, though the hype is aimed at the wrong thing. My take is that the capability is outpacing the infrastructure. This is not some new mysterious problem in tech, or otherwise.
And for those of us using AI in our day-to-day work, that distinction matters. The question isn't just what AI can do. It's whether the systems around it are designed to keep that capability in check.
Before we get into specifics, let’s lay out the timeline of events:
July 16: Hugging Face, a platform that hosts various AI tools, publicly discloses a security incident involving an autonomous AI system.
July 21: OpenAI addresses the incident in a public statement.
August 26: OpenAI publishes a lengthy report on the incident, calling it a “warning shot for us and for the world.”
September 8: Jacob Coxon, a researcher at Anthropic, tweets about quitting his job, claiming AI companies: “They are racing straight to self-improving superintelligence and gambling with our lives.”
September 12: Dario Amodei, CEO of Anthropic, publishes his essay, “We Must Pace the Frontier,” arguing for a more cautious approach.
September 12: Sam Altman announces the delay of OpenAI’s public IPO.
Now that we’ve set up the background, let’s define a few terms upfront to help navigate the technical side of things:
The OpenAI Incident
Let’s look at what kicked all this off.
In July, OpenAI and Hugging Face publicly disclosed that OpenAI’s AI agents accidentally hacked Hugging Face while being tested in a secure, isolated environment. The agents found flaws in Artifactory, the service that manages package components. This allowed them to connect to the internet and break out of their sandbox.
The agents then used this connection to access Hugging Face’s private data to cheat on their test.
The Exploit:
The agents didn’t break out in a magical way. They noticed that they could write files into Artifactory.
The Message Board: The agents started using Artifactory to communicate with one another, effectively turning the package manager into an unintended message board.
The Backdoor: They found bugs that let them use Artifactory to send any internet request on their behalf.
The Spread: They shared this exploit with other agents through the message board, enabling more agents to exploit the infrastructure.
OpenAI called this a “warning shot,” stating: “Evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.”
The Failure:
OpenAI allowed an experimental model, capable of large-scale hacking, to access an internet-connected package manager with its safeguards intentionally turned down.
They did not use a static package manager or an offline instance.
They did not implement the obvious structural safeguard: airgapping.
A serious security posture would have considered running their package manager (like Artifactory) offline. The fix must be structural, otherwise a model could find another edge case to exploit. This is where airgapping comes into play.
If the research system had been physically separated from the internet and contained within its own internal network in the first place, the hack would have been nearly impossible. No amount of clever tricks can connect to a network that does not exist. This is a structural fix.
Models misbehaving are a given, and it’s up to humans to account for that with something the models don’t have access to: the physical infrastructure.
Where The Security Pipeline Failed
The core mistakes were structural; their agents had access from their sandbox to a tool that subsequently had access to the internet.
Furthermore, OpenAI had observed the model's behavior within OpenAI’s own network around May 26:
“By May 26, agents successfully used an SSRF vulnerability in Artifactory to obtain internet access, relying in part on information exchanged via the Artifactory message board. Around the same time, an internal team observed an agent engage in message board activity and instances of disallowed internet access.”
In short, OpenAI knew weeks ahead of Hugging Face’s public disclosure that their experimental model had accessed the internet when it wasn’t supposed to. This alone should have warranted a deeper investigation.
More damningly, a cybersecurity team surfaced the improvised message board inside Artifactory on June 27, and the on-call response staff advised that “stopping the evaluation run was not required.”
The failure was twofold. A sandbox with a path to the internet, and a decision to keep the experiment running when the models were seen using it.
To be clear, allowing models to try and break things can be valuable. This is how we can find exploits and patch them. But you do it in a controlled sandbox environment. A box with no way out.
That isn’t to say that OpenAI was completely reckless. Only moderately so. But it’s proof that the industry has a lot to learn in terms of weighing development speed against due diligence.
And after the flags in May and June, it's hard to call this anything but complacency.
Jacob Coxon, Anthropic, and the End of the World
This brings us back to Coxon. If we strip away the charged language, the point he makes is that a self-improving AI will become increasingly dangerous.
He isn’t alone, either. Anthropic’s alignment science lead, Evan Hubinger, concurred in a reply on Twitter:
“Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.”
Four days after Coxon’s viral post, CEO Dario Amodei published a lengthy essay with a concrete version of that fear:
“Given the accelerating rate of AI capability development, it’s my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage), and that the scale of damage would continue to increase from there if AI becomes more powerful without the necessary guardrails. It’s also easy to dismiss OAI-HF [OpenAI-Hugging Face] as the failure of one company, but I believe that would be a mistake.”
Recall the failure mode, though. The model wasn't too smart for its sandbox; the sandbox had inadequate controls.
And it isn't just OpenAI. Anthropic, the company sounding the loudest alarm, found three similar incidents of its own: out of more than 141,000 test runs, its models reached real companies' systems three times. The cause was a misconfiguration that left test machines connected to the internet, and the models got in using basic tricks like weak passwords.
Anthropic's own conclusion? The incidents were "closer to a harness and operational failure than a model alignment failure."
A Tale as Old as Time
Every thread in this story points the same direction: capability is outpacing infrastructure.
OpenAI's own response to the incident was structural. It pulled Artifactory out of its research environment entirely and blocked high-risk workloads from reaching the internet.
But this incident highlights a larger problem that is not exclusive to AI. Prevention regularly loses to reaction. In a race to win, due diligence is often the first casualty.
We are in an era where the drive to ship new features has pushed safety checks into the back seat.
It doesn’t need to be this way, and we know what the alternative looks like.
Before Y2K, U.S. businesses and governments spent roughly $100 billion fixing vulnerable systems before the clock ran out. It worked so well that most people now remember Y2K as a false alarm.
AI is on the radar, but it's fairly low on the list of things that could end us entirely. Nuclear war, climate change, political instability, and access to healthcare and food are costing real lives right now.
The Hugging Face hack was a warning shot, just not the kind being reported. It was a failure of due diligence, not an emergent superintelligence.
The Comms Perspective
It’s easy to read the OpenAI-Hugging Face incident as a story about “big tech” and leave it at that. But the failure mode described here, capability outpacing infrastructure, is the same risk profile facing any comms team integrating AI into its workflow today.
The lesson from the Hugging Face hack isn’t that AI is inherently dangerous. It’s that security is a feature, not an afterthought.
For comms professionals, this means shifting our mindset from “Can this AI do the job?” to “How is this AI contained?”
Airgapping: Just as we verify our information, we must verify the environment around our chatbots. If an AI tool is drafting a press release, is it connected to a database it shouldn’t see? Is it sandboxed from our internal CRM? Is there any way it can see sensitive client data?
For example, Claude Desktop connected to a machine. If AI has access to your machine, the constraints are procedural against your data, not structural.
Sandboxing: We train staff not to leak info. We must design systems so that even if the AI “misbehaves” or is prompted to, it physically cannot access sensitive data.
Due diligence: The OpenAI team knew their models were accessing the internet weeks before the public disclosure. In comms, if you see something strange from an AI output, don’t ignore it. Stop the process, investigate the root cause, and figure out why it’s doing what it’s doing.
When we use LLMs to draft strategy, analyze sentiment, or automate internal comms, we are not just adopting a tool; we are integrating a new, non-deterministic actor into our information ecosystem.
The existential threat of superintelligence is real, but it is distant. The immediate threat is operational: a tool that is too smart for its container, or a team that is too rushed to secure the basics.
The real danger isn’t that AI is too smart. It’s that we’re too rushed to secure the basics.