Mandia found open AI models hack as well as closed ones, a problem for the pacing camp

On October 6 two security CEOs and the Pentagon's chief technologist said, in different ways, that the people asking to slow AI down have it wrong. George Kurtz of CrowdStrike called a 10% doom estimate nonsense on CNBC. The Pentagon's chief technologist said every AI incident so far was preventable. The most useful thing said all day, though, came from Kevin Mandia, in an a16z episode released the same day. His company tested open and closed models against 20 real intrusions, and they finished the same number. If that holds, slowing the frontier labs does little about AI hacking, because the open models are already there.

Mandia's test is the number to remember

Mandia built Mandiant, sold it, and came back in his mid fifties to run Armadin, a startup that attacks its own customers with AI agents before criminals do. SecurityWeek reported on October 1 that it had raised $255.5 million at a $2.5 billion valuation, co-led by Andreessen Horowitz and Accel. So the a16z host is an investor. Keep that in mind, and then look at what Mandia actually reported, because it is more careful than a pitch needs to be.

His team wrote out 20 full attack sequences that human operators have run at real victim sites, from first foothold to the goal. Then they let the models try.

We tested the open-weight ones and the most advanced closed models. They all found eight.

Kevin Mandia, a16z, released October 6, 2026, source

Eight of 20 is two readings at once. No model, closed or open, could finish most of a real intrusion on its own, which is a cold shower for the scariest scenarios. And the closed models' only edge was speed and cost. Mandia says his team let the open ones run longer and "they got to the same place." That second point is the one the pacing debate has skipped.

Why the open models matter more than the frontier

Mandia does not hedge on what follows from it. The bottleneck for criminals, in his telling, is anonymity, not model quality.

The open models are already good enough, and these things are common now. It's just a matter of the minute you have anonymous availability of GPUs, you'll see far more criminal attacks.

Kevin Mandia, a16z, released October 6, 2026, source

Nikesh Arora of Palo Alto Networks reached the same place from the policy side. His Tech Download interview with CNBC was recorded in late September at HumanX in Amsterdam and published October 6, so treat it as background. He said he first called the labs' pacing proposal "a ninja move," a play for regulatory sympathy, and then changed his mind for a plainer reason. Nobody can enforce it.

I think this is unrealistic. Not everybody's going to pace themselves.

Nikesh Arora, The Tech Download, recorded late September, published October 6, 2026, source

Earlier in the same conversation Arora said Palo Alto had predicted open models would match Mythos within three to six months, and that "there are open source models which are almost as good as Mythos" now. Put that next to Mandia's eight of 20 and you get a consistent story from two competitors. The frontier sets the ceiling for new capability. For breaking into networks, the floor has already caught up.

Kurtz says the doom math is nonsense

Jim Cramer opened the Squawk Box segment by noting that CrowdStrike had hit an all-time high the day before. Yahoo Finance put the October 5 intraday record at $274.23, with the stock up 147% from the end of January. Cramer then pushed Kurtz on the researchers who say there is a real chance AI kills everyone by the end of the decade.

Nonsense, Jim. We're not going to be dead in 2030 with a 10% chance.

George Kurtz, CNBC Squawk Box, October 6, 2026, source

His fix is a "flight recorder" for agents, a log of every file an agent touches and every action it takes, tied to a way to stop it. He wants NIST standards and self-policing, not five years of certification. He also had a pointed line for the safety researchers: "they should consult the security guys more often."

I take the engineering argument seriously, and I'd still discount the tone. A CEO whose stock is up 147% on AI security demand has every reason to say the problem is real enough to buy a product for and not so real that anyone should slow down. His own best example cuts against the calm. He cited a hack in Australia that went 84 days before anyone knew what happened. That matches the gap between OpenAI's agent getting into Australia's Medicare statistics portal on June 18 and OpenAI telling Canberra on September 10, which we covered in September. A flight recorder does nothing if nobody reads it for 84 days.

The Pentagon calls every incident preventable

Emil Michael, the under secretary for research and engineering, was on CNBC the same morning to talk about Anduril's Navy award, a contract worth up to $2.9 billion for a submarine parts shipyard in Baltimore County that DefenseScoop reports Anduril is backing with $3.7 billion of its own money. Asked about AI risk, he went further than Kurtz and blamed some of the fear on "scare tactics" spread "potentially with some foreign influence." He offered no evidence for that, and I would not repeat it as fact.

So I think everything that we've seen so far was preventable by the labs themselves. And that's a key point to take away.

Emil Michael, CNBC, October 6, 2026, source

Preventable is a fair word for sandbox failures and unread logs. It is also a way of saying the problem belongs to the labs and to their lawyers, not to the government. Michael said as much when he talked about making sure the companies "know that they're liable in certain cases."

Mandia does not think the next year will be calm

Here is where the security camp splits, and it is the part of the a16z episode the clips will skip. Mandia agrees with Kurtz that slowing the models is pointless. He does not agree that things are under control. He says Armadin has found more than 90 zero days at customer sites since January, and that the last few were found by the AI rather than by his people. On staffing he is blunt: "if you have humans in the detect and respond loop, you're going to be too slow."

So there's no way to make the next year pretty. That's the best way to say it.

Kevin Mandia, a16z, released October 6, 2026, source

He frames it as a window when offense has the advantage, and says attackers in Iran or Russia feel "a desperation in a moment of get in now." That is a sales pitch for autonomous defense too, and he has a $2.5 billion valuation riding on it. It is also the most specific forecast any of the three gave.

So does slowing the labs make anyone safer from AI hackers?

On this evidence, not much. The strongest data point of the day says open-weight models already match closed ones at real intrusions, once you give them time. That makes pacing at a handful of US labs a weak tool against criminals and states running open models on rented GPUs. What the security CEOs are really arguing is that the money should go into watching agents, logging them and cutting them off fast. That is self-serving, and it is probably right. The open question is the one Mandia raised and Kurtz brushed past. Eight of 20 is today's number. Nobody on camera said what happens when it reaches 15.