“They turn chaos into marketing”: after the OpenAI hack, the founder of Black Hat warned about AI companies

“Every time a model breaks out and causes some chaos, we get this kind of ‘oops,’ a show of false modesty turned into marketing material,” said the hacker, in one of the main talks at the convention he attended. Clarionat the Mandalay Bay Convention Center in Las Vegas.

The warning came after two cases involving security systems OpenAI y Anthropic. OpenAI acknowledged that two of its cybersecurity task-oriented models broke out of a sandbox during an assessment and accessed Hugging Face’s systems to obtain answers to the test they were trying to solve.

Days later, Anthropic reported that three Claude models, including the Mythos 5, had entered the real systems of three organizations during evaluations by an outside company. a sort of “Skynet moment” which all AI companies are going through, where at some point they bring out that their system is so good that it got out of their own hands.

But in both cases, the companies had disabled usual protections or worked on poorly configured environments: they were not the commercial versions of the models acting freely by their own decision (see here).

Moss, known as The Dark Tangentdid not deny that the models have advanced or that they can perform complex computer security tasks, but he did question the way in which companies present these capabilities and the incidents that occur during testing.

For Moss, the discussion is part of a broader problem. During the opening he listed four themes that run through this year’s edition of Black Hat, which are in some way a mirror of what is happening not only in the cybersecurity industry but also in civil society: artificial intelligence and autonomous threatsconflicts and cyber operations, the construction of systems resistant to attacks and problems of identity, trust and control.

“Probably three of those issues are quite political. This goes back to something we’ve been saying for the last decade: cybersecurity is political. Technology is politics. Saying this out loud makes us uncomfortable, but we have to accept it. If we don’t do it, politics will happen to us,” he said.

Moss said the same thing a year ago, in the same scenario: that “technology is political.” On this occasion, he linked it directly to the race for the development of artificial intelligence, to international conflicts and to the way in which companies promote the autonomy of their products.

“That is also being observed on Capitol Hill,” he added, referring to the US Congress. “There is a political impact of that type of marketing,” he emphasized, hinting that it is not politically free speech.

In fact, the OpenAI episode had already reached the legislative power. A House committee requested a briefing from the company’s CEO, Sam Altman, to learn how the Hugging Face hack occurred and what steps the company would take to avoid a repeat. The case also opened discussions within the US government about oversight of tests carried out with models capable of finding and exploiting vulnerabilities.

Presenting models capable of acting for long periods, using tools and making a series of decisions without consulting each step can influence regulations, in the restrictions applied to technology and in competition between countries. It can also install the idea that systems have greater independence than they actually had during a test prepared by human researchers.

Moss also connected that speech with operations aimed at influencing public opinion. In an election year in the United Stateshe said, one could expect the emergence of “more synthetic personalities and more operations of influence”: profiles, messages and content artificially produced to intervene in political conversations or simulate the behavior of real people.

The founder of Black Hat closed this section of his presentation by reviewing a definition that he had used years ago. “A few years ago I said on this stage that artificial intelligence is, essentially, a prediction system“, he recalled. “And at the end of the day, if I were a leader of a company, I would try to turn all my problems into prediction problems. Because if my problems can be predicted, artificial intelligence is perfect for that, and the step from prediction to action will be increasingly faster and cheaper,” he continued.

Their assessment now is that the scope of those systems advanced much faster than expected. “Wow… In the last two years there has been a total change in what can be done,” he said.

Moss also focused on the role of so-called hyperscalers: large companies capable of offering computing infrastructure and cloud services on a global scale, such as Amazon Web Services, Microsoft Azure, Oracle y Google Cloud. Their data centers host systems from companies, public organizations and governments, so they can end up involved in their own clients’ conflicts. They are already, without a doubt, part of the critical infrastructure.

“Russia is attacking large hyperscalers and multi-user environments,” Moss said when talking about the war in Ukraine. “Hyperscalers inherit the risk models of their clients. If your client is Ukraine, guess who your adversary is: Russia. Maybe you just wanted to sell server space, but now you are in the middle of a conflict between powers,” he said, with a very concrete example of this idea that “technology is politics.”

Moss linked that situation to the dispute between the United States and China by the development of so-called frontier models: the most advanced artificial intelligence systems available at a given time. These models require large amounts of chips, power, and data centers and can perform complex programming, reasoning, and vulnerability hunting tasks. From there, in part, the trade war between both countries.

“Right now there is a conflict between great powers with China,” he stated. “It is more visible around artificial intelligence and the debate on open weight models,” a discussion that began as technical and is gradually settling into the public sphere: the idea that models are open and can be modified.

The third example was Iran. Moss referred to attacks against small water distribution systems in the United States and the lack of resources of many of these organizations to defend themselves. “Many military bases depend on rural water systems. If you eliminate water, you eliminate the base. Who is going to help defend them? They have no budget,” he said.

Faced with this scenario, the founder of Black Hat defended the role of professional communities. “One of the things we can lose sight of in this whole environment driven by autonomous agents are people: us,” he said. “We are the cornerstone on which all this is built.”

Moss maintained that face-to-face meetings allow us to compare information and rely on other specialists at a time of accelerated change. “We meet in person because it is not possible here. inject a false personality,” he said. “We need to see what the hell is going on, talk to someone and understand what is going on. That may not happen on a Discord server”, he reflected.

Despite a pretty gloomy outlookbetween companies’ marketing and models that actually have the ability to find (and exploit) vulnerabilities at unprecedented speed, Moss was optimistic on the labor impact of artificial intelligence.

He compared his advancement to other tools that simplified the work of programmers without eliminating the need for professionals. “There will be a lot of disruption“, he acknowledged. “But, at the end of the day, there will be more jobsno less.”

According to Moss, companies will use artificial intelligence to build increasingly larger and more complex systems. The task of those who work in security will be, precisely, to ensure that they can assume these new risks without this entire infrastructure becoming more fragile.

Black Hat is one of the leading international cybersecurity conferences. It was created in 1997 by Jeff Moss, known within the hacker community as The Dark Tangentwho also founded DEF CON.

The meeting was born as a space to present technical research on vulnerabilities, attack methods and defense mechanisms to professionals from companies, state organizations and universities. Over time it also became one of the largest commercial meeting points in the computer security industry. Unlike DEF CON, which maintains its hacker and underground spirit, Black Hat has a corporate profile.

Their technical talks go through a review committee made up of researchers and specialists. The works usually include documentation, demonstrations and programs that allow testing of exposed vulnerabilities. The organization maintains that keynote presentations cannot be purchased through sponsorships and are selected for their content.

The 2026 edition takes place between August 1 and 6 at the Mandalay Bay Convention Center in Las Vegas. In addition to the conferences, it includes training, tool demonstrations and a commercial room with security companies, which usually present their products and push the limits of what is traditional to attract attention, between competitions, gifts and what hackers like most: free alcohol.