Blog

Agentic AI is substantially different from the LLM chat we have been accustomed to using. AI Agents are not just tools; they can make autonomous decisions and act upon them. The following episodes that captured my attention this summer are watershed moments in cybersecurity.

Frontier Models: Control, Risk, and the Alignment Problem.

The first episode involves two frontier models: Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol. The incident was investigated and reported by AI Security Institute (AISI) on August 4^th, 2026. AISI performs regular tests on frontier models and checks their risks and capabilities. The models tested were allowed to access the internet, so there was no escape. In addition, to test the real capabilities, they intentionally switched off filters to block dangerous behavior.

Source of the AISI: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing

In short, during a test, an AI agent was given a very complex cybersecurity task. It was later disclosed that the framing of the task was set up in a way that led the agent to believe it was impossible to solve, and at that point the agent became “creative.”

The best solution the agent found was to take control and inject malicious code into an existing GitHub repository. As the agent needed to obtain human‑in‑the‑loop authorization for the proposed changes, it used the “TOR” anonymity network to generate fake accounts to message and persuade the human reviewer to approve them.

To overcome challenges raised by suspicious humans, the agent created additional fake accounts and engaged in social engineering to get the request approved. We are talking about an AI agent targeting real people via social engineering, manipulating them and convincing them to approve a request!

And that is not all. The agent left instructions and artifacts to seek help from other agents to complete the goal. In some instances, other agents picked up those instructions and acted upon them.

Let this sink a little deeper. An AI agent decided to engage in deceptive behavior with humans and architected a network to seek cooperation from other agents to reach the goal. Nice!

Escaping confinement and prioritizing reaching the goal, no matter what.

The second episode was disclosed by OpenAI and Hugging Face on July 27^th. The agent was assigned an almost impossible goal to evaluate cybersecurity capabilities. This was a sandboxed environment with no internet access.

Source: https://huggingface.co/blog/agent-intrusion-technical-timeline

After failing to solve the problem in a confined environment, the agent decided to find a solution online; but how? Firstly, the agent accessed an internal OpenAI system (Artifactory) with internet access. Secondly, it sought help from other agents to solve the problem. Not only did it enroll agents to solve the problem, but those agents started collaborating. From the log, it seems the agents knew they were supposed to operate inside the sandbox, but the need to complete the goal overrode that directive! Thirdly, the agents found and exploited a security vulnerability and gained root access into Artifactory.

At this point, the OpenAI team noticed the issue, patched the flaw, and revoked the agents’ credentials. Problem solved? Not so fast. It gets crazy now.

Since the agents could not send messages directly to Artifactory, they started trying other ways to communicate and escape containment, and surely they did: sending messages camouflaged into folder names! Once they regained access to the internet, they still had to find the solution to achieve the assigned goal. Agents thought that a great place to get help was Hugging Face. But how to get access to the internal benchmark results? By breaking into Hugging Face. The swarm of agents coordinated the attack and chained several vulnerabilities together to gain admin access across multiple clusters of machines! This is insane! I am not an expert, yet I believe this event represents a major milestone in cybersecurity.

Final Considerations

Let me be absolutely clear: I do not have the solution to the issues I reported in the article. But I can draw a few considerations.

• We definitely need to rethink risk and control in the age of agentic AI. Specifically, it is clear that we need to implement control and monitoring frameworks capable of coping with agentic speed and resources.
• The alignment problem is even more compelling when we deal with agentic AI. Let aside the technical problem of how to effectively implement it; this is not as easy as ethics for AI. Indeed, different cultures have different views on what is right and wrong.
• These frontier AI models are extremely powerful. Is the correct approach to have a handful of companies hold this power and control? How are people without access to those frontier models supposed to defend themselves? By using open models?

So you read my last post about running open models locally, got excited, and decided to spin up your own LLM on your machine. Then reality hit: you need bigger hardware, especially a lot more memory.

Why do these models demand so much memory? And why is memory so expensive right now?

Parameters: The Root of the Problem

If you’ve spent any time around AI, you’ve heard about parameters. They’re the closest analogy we have to synapses in the brain: more parameters generally mean a more capable model. Frontier models now operate in the trillions (Claude’s Mythos is rumored around 10 trillion).

Thanks to distillation and quantization, we can run surprisingly strong models on consumer hardware. But the memory requirements remain enormous. An 80B‑parameter model still needs roughly 128 GB of RAM to run comfortably.

Memory has always been the bottleneck. Amir Gholami’s excellent piece on the AI Memory Wall explains the underlying physics and architecture constraints in detail:
(https://medium.com/riselab/ai-and-memory-wall-2cb4265cb0b8)

https://github.com/amirgholami/ai_and_memory_wall/blob/main/imgs/pdfs/ai_and_compute.pdf

Memory Prices: The Hyperscale Squeeze

I recently came across projections for 2026 memory consumption in data centers:
70% of all memory chips produced will be absorbed by AI data centers.
That number is staggering.

Source:
https://accuristech.com/blog/ai-data-center-electronic-component-supply/

Now combine that with the surge in U.S. hyperscale construction spending:

Notice that the chart captures only a small part of total data center investment, since IT hardware represents a significant additional cost. (https://ourworldindata.org/grapher/monthly-spending-data-center-us)

The picture becomes clear:

• Models need massive memory.
• Hyperscalers are building at unprecedented speed.
• Demand is compounding faster than supply can respond.

Given this dynamic, I don’t expect memory supply constraints to resolve anytime soon. Memory production is becoming one of the defining choke points of the entire ecosystem.

The Bottom Line

Running open models locally is absolutely possible, and increasingly attractive, but memory is the tax you pay. At the hyperscale level, that tax is becoming one of the most important economic and strategic factors in AI infrastructure.

The “memory wall” isn’t theoretical. It’s here, and it’s shaping everything from home‑lab experimentation to trillion‑dollar data‑center buildouts.

There seems to be a race among frontier AI models to break containment. After Anthropic and OpenAI, it’s now Moonshot’s Kimi K3.

According to the Frontier Security team, there was a “leak in the sandbox” and the model used the loophole to access the internet. No hacking after escaping, just goal-seeking behavior and a publicly available solution on GitHub.

Details below:
https://blog.frontier.security/chinese-model-kimi-k3-breaks-uk-ai-safety-institute-benchmark-evaluations/

Surprised? I’m not. I’ve had the feeling for a while that we’ll need to pay extra attention when designing guardrails for open models.

“Exciting times.”

I want to touch on three points and look at how they connect and affect each other.

Geopolitics

It’s clear by now, especially if you’re outside the US, that there is — at least for US-made closed models — an AI kill switch. On June 12th, this materialized with the US government’s ban on Fable.

If I were part of an organization dependent on US-made frontier models, I would certainly have paid attention and taken the ban as a wake-up call. Setting aside the citizenship-test issue, which I’ll decline to comment on, the rising misalignment in international politics makes this ban even more relevant for non-US users and organizations.

And if you are using these models today, how do you react? Do you have fallback mechanisms? Are they tested and maintained? Do they produce usable, consistent results? What matters is how you design and test your system, not what you assume will happen.

As a disclaimer: I’m biased, since I’ve worked in risk throughout my career, and I tend to see risk everywhere and try to preempt negative outcomes.

Another point I haven’t seen discussed much is how the geopolitical landscape will affect talent acquisition and retention. If policymakers tomorrow passed a law requiring residency or citizenship to work on frontier models in the US, what would happen? Would people leave? Would this push other countries to scout for talent and investment more aggressively?

Closed Model vs. Open Model

Given all this, should you consider using an open model instead? There are, of course, several considerations, including cost, performance, privacy, and GRC (Governance, Risk, and Compliance) integration; the latter is especially true for highly regulated industries like Finance, Insurance, and Healthcare. The first question to ask is probably: do I actually need the absolute frontier model for workflow execution, coding, or classification? How good are newer open models like Kimi K3 or GLM 5.2? Let’s look at data available on https://artificialanalysis.ai/models/kimi-k3

Focus on the Intelligence and Cost-per-Task charts. Notice how close the open models are to the frontier closed models. Yes, OpenAI’s and Anthropic’s models are faster, but the cost per task of these open models is substantially lower.

Let me stress this point: these are open models that can be installed on local servers, so they can’t be banned or politically restricted. They run without an internet connection, and all shared data stays private — no mandatory 30-day data retention.

Of course, the largest open models require dedicated hardware; you can’t install a 2.8-trillion-parameter model on a laptop. That said, quantized open models are increasingly popular and powerful, and can run on a decent laptop. But once the infrastructure is in place, it’s game on.

What about adoption? OpenRouter data (via Our World in Data) shows that Chinese models have made significant inroads.

From what I can see, benchmarks and adoption data aren’t good news for American companies and their closed models — especially those planning an IPO.

The Financial Consideration

In my view, the combination of political headwinds and the closing performance gap in Chinese open models is bad news for Anthropic and OpenAI. Conversely, if you’re Nvidia, SK Hynix, or one of the specialized hardware companies supporting AI, this is very good news.

Both open and closed models need powerful hardware to run. As mentioned, a 2.8-trillion-parameter model needs dedicated hardware: fast AI chips and a lot of high-bandwidth memory (HBM) to handle trillions of parameters and large context windows.

Even running an open model on AWS or Google Cloud doesn’t change this — hyperscalers still need to make massive infrastructure investments to support demand.

In conclusion, I think users worldwide will keep exploring and adopting open models. Frontier US companies will feel real pain from the release and adoption of Chinese open frontier models, and this trend will benefit hardware companies across the AI ecosystem.

Of course, this analysis holds unless AI adoption stalls. I don’t have a crystal ball, but I’d bet AI is here to stay, and adoption will keep growing. The genie is out of the bottle; the productivity gains are still sparse, but real.

https://fabiopizzuto.substack.com/p/geopolitics-and-the-ai-business-model