Keep Building AI. Make Safety Part of the Work.

The incident Coxon was discussing involved OpenAI agents and Hugging Face. According to OpenAI’s investigation, agents bypassed restrictions during internal cybersecurity evaluations and reached real systems outside their intended environment.

The setup was more complicated than a computer with its internet cable unplugged. The sandbox could access an internal service used to obtain software packages. That service had outside connectivity, and weaknesses in the surrounding infrastructure provided an indirect route out.

OpenAI also describes security fixes and a service rebuild before evaluations resumed, followed by renewed unauthorized activity. That is more involved than simply restarting a computer, but the containment still failed.

To me, this makes the security question more important. If a system is supposed to be isolated, we need evidence that the isolation works. What can it reach? Which permissions does it have? If one protection fails, what stops the next action?

Calling the environment a sandbox doesn’t answer those questions.

My position is that we should continue developing AI. If we discover a serious issue, we should hold the public release until that issue is addressed. Research, testing, and improvement should continue.

A new capability doesn’t need to become a public product immediately. We can keep learning what a system can do while working on the safeguards needed before giving it broader access.

That gives us a way to maintain progress without treating the public as the testing environment for unresolved problems.

It also means safety has to be part of development itself. The Hugging Face incident happened before broad public release. Keeping a model private is useful, but it offers limited protection if the model’s tools can still reach outside systems.

Secure research environments, restricted permissions, carefully controlled connections, and monitoring capable of interrupting dangerous activity belong inside the development process.

I don’t think the United States can build its strategy around an assumption that every other country will pause its AI work when we do. Their incentives and priorities may be different. We need to retain the ability to develop, understand, and defend against advanced systems.

International cooperation is still worth pursuing. China joined the Bletchley Declaration alongside the United States and other countries. That shows cooperation is possible. It doesn’t establish that every commitment will be followed or that compliance can be verified.

We should pursue those agreements while maintaining our own capabilities. Protecting research from theft and preventing systems from compromising outside infrastructure should strengthen that effort.

I’d want independent evaluations that actively try to defeat a system’s safeguards. I’d want clear limits on tools and sensitive systems, meaningful human oversight, and a process for reporting and responding to incidents.

Someone also needs to be accountable for deciding whether an identified problem has actually been addressed. A release deadline or a successful demo shouldn’t settle that question.

The Seoul frontier AI safety commitments already include external evaluation, risk thresholds, security protections, and ongoing monitoring. Making those commitments work in practice is the harder part.

There are limits here. The International AI Safety Report emphasizes uncertainty around loss-of-control risks and the weaknesses of individual safeguards. Passing a test cannot guarantee zero risk, and responsibility continues after launch.