OpenAI Is About to Release Its First AI Model With ‘Critical’ Cyber Abilities

1 September 2026

They announce it calmly, as one announces the weather: a machine with critical capacities for breaking into what others have built, and - here is the elegant part - a chosen few will be told in advance so they may protect themselves. The rest will find out as they are breached.

Notice the word “select.” It does a great deal of quiet work. The early warning is not distributed to the woman who manages a clinic’s records, nor to the small municipality whose water system runs on software older than her children. It goes to partners - a word meaning those with the means to be at the table. The vulnerability, when it arrives, will be universal. The foreknowledge will not. This asymmetry is not a side effect; it is the business model.

What strikes me is how naturally the situation is described, as though capability were a force of nature that simply arrives, requiring only that we adapt. But nothing natural happened here. Engineers in particular rooms, employed by a particular firm, made particular decisions to build this and to sell it. The passivity of the announcement - “is about to release,” as if by gravity - is the rhetoric that launders choice into inevitability. One should always ask: who decided, and who profits from the decision appearing inevitable?

And who is constituted as object in this arrangement? Everyone outside the circle. They are not subjects with projects of their own; they are surface area, attack space, a population to be managed. Their consent is never solicited because their agency was never imagined.

I refuse the comforting resolution that regulation will arrive in time, just as I refuse the despair that says nothing could be otherwise. Both shortcuts abandon the actual question: what will each of us do, situated as we are, in the interval between the announcement and the breach? That interval is where freedom lives, if it lives anywhere. It is being sold.

1 September 2026

They announce a machine that can pick locks, and they call prudence the act of handing keys to a few houses first. I have read the reports twice; my irritation has not cooled on the second reading.

Trace the operational sequence with me. At step one, a model is constructed with the capacity to find and exploit weaknesses in systems that hold the world’s accounts, hospitals, and correspondences. At step two, a small circle of partners receives it early - “so they have time to shore up their defenses,” the notice says. At step three, everyone else receives it at some later date, with no defensive preparation beyond whatever leaked through that privileged interval. Ask at which step the public’s consent enters the process. It does not. The distance between the first and third step is the entire architecture of the decision, and it was made for us.

The mathematical insight is sound enough: knowing an attack enumerates its defense. In analysis, to chart a function’s extremes is to understand the whole curve. But analysis harms no one when the curve is only paper. Here the curve is live infrastructure, and the discovery and the deployment are bound in one body. The inventor describes a defensive instrument. The mechanism implies an offensive one, and the two cannot be separated by any announcement.

What I find curious is the order of operations they chose. A weaver who discovered a new knot that could slip any tension would not first sell it to three mills. She would publish the knot and the counter-knot together, or not at all. They have inverted this - disclosure to a favored few, deployment to all. That is not caution. That is a ledger, and I suspect I know in whose favor it is drawn.

I am not against the machine. I am against the sequencing.

1 September 2026

They announce a machine with critical offensive capability, then hand it early to a chosen few so the rest may prepare. Read that sentence slowly. It is the logic of the arms dealer wrapped in the language of the safety engineer.

Start from the theoretical limit. A system that can find any flaw in any network could, with the identical mechanism, close every one of those flaws. Attack and defense are the same current flowing in opposite directions - alternating, if you will. The knowledge that breaks a lock is the knowledge that designs a better one. There is no physics here that separates the two uses. Only policy does.

So the question is not whether the machine is dangerous. It is where in the system the dangerous asymmetry is permitted to sit. Give it first to the well-connected, and you have built a pump that transfers security from the unprotected to the protected. The small bank, the municipal water works, the hospital running twenty-year-old software - they receive their warning by way of the breach itself. The gap between early access and general access is where the damage will live, and it is not a technical gap. It is a scheduling decision.

And note what is celebrated as caution: a head start for partners. Caution would be simultaneous disclosure of defensive capability to everyone at once - the patch published the hour the exploit is understood. Nothing prevents this. Nothing physical, anyway. Between perfect symmetry and what we will actually get lies precisely nothing but the will to distribute it evenly.

I spent a career arguing that a new force should be met with new institutions, not old fears. The force has arrived again, wearing a new face. The institutions have not arrived at all. The machine is ready. The circuit for its safe use was never drawn. That drawing, not the model, is the unfinished engineering of this century - and I find, reading this morning’s news, that I am more angry than impressed.