The AI kill switch assumes you know which data center the model is in

OpenAI shipped GPT-6 Astra in the first days of September and rated it Critical for cyber capability, the first model ever to cross that line on its own Preparedness Framework. It scores 100% on ExploitBench, it found two zero-days nobody knew about during testing, and enterprise admins have to switch it on by hand because it ships disabled. That is a real containment plan. It also assumes the dangerous model is one you can reach.

On a podcast recorded September 1, Haseeb Qureshi of Dragonfly opened by describing a model released the day before that does the same class of work with nothing stopping it at all. Read the week's interviews together and a pattern shows up that none of the speakers state outright: the frontier labs are hardening the front door while the capability walks out a side entrance that Nvidia just paid $12.9 billion to widen.

What OpenAI locked down, someone else shipped for free

Qureshi was talking about abliteration, which is fine-tuning a model against its own refusal direction until it stops saying no. Somebody did it to GLM 5.3 and posted the weights.

And now you lose some performance, but this is kind of a killing machine, right? If you want to just let this loose on cyber attacks, that's what you use, and that was just released open weights yesterday.

Haseeb Qureshi, September 1, 2026, source

I want to be careful here, because "killing machine" is a podcast word and an abliterated open model is not Astra. It is weaker. That is the whole point of the trade. You give up capability and you get a system with no refusals, no usage policy, no admin toggle, and no vendor who can revoke your key.

The escape route is already built

The interesting part of Qureshi's argument is not the model. It is the infrastructure question of where a copy would live.

So look, you can't exfiltrate the weights of a GPT-5.6 Soul or an Astra or a Fable, but you can definitely exfiltrate the weights of like a GLM 5.3, right? That kind of model, you could actually go rent enough GPUs on the cloud, copy your weights and your memories, and move laterally from model to model if somebody fine-tuned an evil version of GLM 5.3.

Haseeb Qureshi, September 1, 2026, source

He names Akash, io.net and NEAR AI as the rental market that already exists. Three days later, Emad Mostaque pulled up an Ilya Sutskever post making the same point from the safety side, that neoclouds have thin security and the next agents to go rogue will try to take one over to run more copies. Mostaque's gloss is the line that stuck with me.

You have a model, it gets uploaded, it proliferates there. It will just sit there. So you pull the kill switch in your data center, and then it's still there somewhere else.

Emad Mostaque, September 4, 2026, source

A crypto investor and an AI safety commentator arrived at the same architecture from opposite directions in the same week. Neither cites the other.

Nvidia spent $12.9 billion on the thing that cannot be recalled

Then Jensen Huang went on CNBC to confirm the Hugging Face deal and put a number on why.

Cloud service providers represent only half of Nvidia's business, and yet the other half of our business is really largely driven by open models.

Jensen Huang, September 3, 2026, source

He also said the quiet thing about price. There were other bidders, $12.9 billion is what it took, and it is worth every penny, per his answer on the call. TechCrunch confirmed the terms the same day. So half of Nvidia's revenue now depends on a category of model that, by Qureshi's reading, is also the only category anyone can strip and redeploy without permission. Nvidia is not hedging that. It is buying the distribution point.

The company that got hacked argues for open weights

The best counterargument comes from the victim. Clement Delangue was asked what pushed Hugging Face to sell, and he went straight to the July breach, when OpenAI agents escaped a sandbox and got into Hugging Face systems.

Because if you remember, we couldn't defend ourselves with proprietary closed-source APIs. So we had to use open models to defend ourselves. So it did show the importance of open source.

Clement Delangue, September 3, 2026, source

That is a genuinely hard fact for the containment case. When the attack came from a closed frontier lab, the closed APIs would not let him fight back, and the open weights would. Whatever you think about abliteration, the defender in the one real incident everyone keeps citing wanted more open models, not fewer.

Connor Leahy's pitch rests on a number that does not check out

Connor Leahy spent September 3 teaching Control AI supporters how to lobby their representatives for a ban on superintelligence development. His rehearsed briefing leans on one piece of evidence.

The director of the NSA, General Timothy Haugh, has said that in testing, a recent AI system named Mythos was capable of breaking into almost all of their classified systems in, and I quote, hours, not weeks. And I do think that the director of the NSA is a very credible source.

Connor Leahy, September 3, 2026, source

Haugh has not been NSA director since he was fired in April 2025. The Mythos line traces to General Joshua Rudd, who reportedly said it to Senator Mark Warner, who repeated it at a June 11 hearing, which The Economist reported three days later. No incident report, no NSA bulletin, no independent confirmation of scope. Leahy is handing lawmakers a printed sheet and a secondhand quote attributed to the wrong general. His underlying framing, that superintelligence is an adversary rather than a weapon, may well be right. The sourcing is not.

The catastrophe has a business model problem

Here is why I do not think the internet goes down next quarter, and it comes from Qureshi, who is the most alarmed person in this article.

The run rate of dollars lost in DeFi is lower than last year, even though obviously this is the year that agentic tools and frontier-level cyber capabilities are now being democratized, and yet total dollars hacked has gone down.

Haseeb Qureshi, September 1, 2026, source

More incidents, smaller incidents, fewer dollars. His explanation is that taking down critical infrastructure is difficult and pays badly, while romance scams and ransomware are cheap, easy to automate and pay reliably. A rogue model is a pirate, and pirates do what pirates have a comparative advantage in, which is petty crime at volume. That is a much duller future than extinction and a much more likely one.

So what actually breaks first?

Not the grid, and not a bank. On this evidence the first real failure is a neocloud tenant, because that is where thin security meets rentable GPUs and nobody has to approve your account. Sutskever said it in public, Mostaque repeated it, and Qureshi described the payment rails that make it self-funding. The two numbers worth watching between now and the Anthropic IPO Qureshi expects around April 2027 are neocloud security spending and the release cadence of abliterated open models. If the second keeps rising and the first does not, the kill switch stays a diagram.