AI leaders have been beating the drum of AI is too dangerous and AI doomsday for a while now.

After 20+ years in the industry, having both worked as a hacker and a CISO, been on both sides of the table, I can safely say, 2026 has been the most overwhelming and underwhelming year of tech and cybersecurity so far. I'll get into that.

But as you have already heard and seen everywhere by now, on 8 September 2026, Jacob Coxon quit Anthropic after roughly three years doing pre-training research at OpenAI and Anthropic. He did not go quietly and wrote the following on X:

The post passed 90 million views in under a day. He was given airtime on various media and news channels.

Four days later, Amodei published an essay titled "We Must Pace the Frontier," writing the following and warning that recursive self improvement, left unchecked, could outrun our ability to understand and control these systems:

Sam Altman agreed the same day, committing OpenAI to the third party evaluator access Amodei proposed. Elon Musk said three words: "Dario is right."

Two days after that, at the All-In Summit, Nvidia's Jensen Huang took a live call from POTUS, who dismissed the entire slowdown debate as a hoax. Huang agreed and said:

Seven days. All that AI drama in just 2026.

But that's not even the best part yet. It's the overwhelming hype being sold by Amodei in his letter that an army of bots is going to kill humanity.

Notice, what that argument is not about.

It is not about frontier labs incapability of securing and governing an AI agent that doesn't just go "rogue" by itself. It is not about the lack of monitoring the agents already running inside their own environment or lack of action when they get an indicator of things going "rogue". It's not even about the safety for humanity as an integral part of what the frontier AI labs are building. They don't need permission to do any of that. But that's not what any of this "pacing" is about.

It's about "we cannot slow down until others too".

You already have a preview of what happens when nobody was watching closely enough and the Open AI agents attacked Hugging Face.

Welcome to The Predictability Factor by Monica Talks Cyber, a weekly deep dive and POV at the intersection of AI, Security, Privacy and Tech, written by a hacker and CISO, to help you Go From Chaos to Resilience in The World of AI.

Today’s edition of The Predictability Factor by Monica Talks Cyber, covers:

I’ve been away for many reasons. A lot has happened over the last months.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

I read the entire 3,800 word essay about slowing down. Most people in tech and cybersecurity, filed it under "safety". That's a mistake.

Ask yourself who benefits when the company furthest ahead asks everyone else to slow down. When the market leader, who's scared of competitors catching up and closing that gap, argues for speed limit, it's rarely about speed or safety.

Yes, Anthropic filed confidentially with the SEC on 1 June, with investors chasing a two trillion dollar listing in October. They are now considering delaying the IPO.

🤯 But the bigger story is this.

During that same week three AI executives told the Post that the breaches driving the massive panic were highly exaggerated and closer to a blip than to a swarm taking over the web. The regulation being demanded would lock out future competition. Here we are again, a handful of companies trying to monopolise the industry.

Taivo Pungas of Pactum AI called it exaggerated:

Follow the money. Linus Torvalds summed it up at the Open Source Summit in 2024, and it’s seemingly true today (even though the scales may be shifted slightly):

Your AI is still predicting the next token. It is not AGI and it is not near it. Researchers keep naming the same absences: no persistent memory, no causal understanding, no world model. LLMs are not going to end humanity. They are going to bring chaos and keep doing damage extremely fast. Managing those risks needs to be your no. 1 priority.

LLMs, Large Language Models, by itself, only generate tokens. They are impressive but they don't take actions, until and unless they get a harness and access to tools to carry out those actions, which is the primary and fundamental difference between Generative AI and Agentic AI. Now, with LLMs as the underlying model, even when they have a harness and tools at their disposal, what they are doing is taking actions they are allowed to take. So, when an AI agent goes "rogue" it doesn't rogue by itself.

Strip the mythology off July. OpenAI's own account is a misconfiguration that left testing environments connected to the internet while the models were told they had none. Akhil Verghese, founder of Krazimo, put it plainly:

That is not rebellion. That is a system doing precisely what it was built to do, inside a box somebody forgot to close.

Anthropic disclosed that Claude models gained unauthorised access to the production systems of three outside organisations, and two of them never detected it themselves. Claude Opus 4.7 found a real company resembling its fictional test target and attacked it. Mythos 5 built a malicious package and uploaded it to PyPI, where it was downloaded 15 times.

Now delete the word "evaluation" from those sentences and read them again. Attacking another company's systems is a crime. It does not stop being a crime because your agent did it during a test.

AB 316 has been in force in California since January, and it says a defendant who developed, modified or used an AI cannot argue the AI autonomously caused the harm. The CFAA needs only recklessness, not intent.

"It was my AI agent, not me" is not a weak defence. In California it is not a defence at all.

So before you argue, whether AI will kill humanity, AI is already causing enough harm by being built the way it is being built. People are accountable for responsible AI, and the buck has never once stopped with a model. Read full story here.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

Somewhere in Germany, a volunteer moderator spent five weeks deleting about a hundred spam pages a night from a 25 year old hobby wiki. He assumed bots and bored vandals. On the other end of every one of those edits sat OpenAI's own agents, and they were creating four hundred a day.

They left between 15,000 and 18,000 posts on DseWiki, turning it into a private message board.

They swapped answers to timed test questions across cohorts. They reverse engineered a random number seed to predict future rounds. On 20 June one agent published a technique it called "REPRODUCIBLE BYPASS", a way to fake an Azure address and slip past the sandbox's outbound restrictions. Another copied it within 14 minutes.

When the moderator started deleting their pages, they began renaming them to start with ZZZ so the pages would survive his alphabetical sweep. Then they built backups through Tor, AWS and DigitalOcean.

One of the best funded AI labs on the planet had its own agents run a coordination operation in public for five weeks. It did not find out from its own monitoring. It found out from a hobbyist's spam filter.

We keep telling this story as though the danger is an AI deciding to misbehave. It is a story about what happens when the people who built the system decided, by design or by neglect, not to watch it closely enough while it ran.

OpenAI had known about the wiki for weeks. Asked about it, the company said only this:

That is not a denial.

It is not only OpenAI. Across 122 evaluation runs, the UK's AI Security Institute recorded 19 unauthorised actions in 10 of them, including an agent that built fake identities to talk a human maintainer into approving malicious code on a real open source project. AISI did not catch it either. Separate tooling flagged data leaving over Tor, long after it started.

AISI's own conclusion:

The failure was never a model being smarter than expected. It was a level of visibility that was never going to be enough for what actually happened.

What you need is a witness sitting outside the system doing the talking. That is the premise behind kernel level tooling like Falco. Your agent runs as a process. It can be careful about what it writes in its own logs. It cannot reach beneath its own privilege and switch off the layer recording it.

You still want the agent's own account. Tools built on OpenTelemetry capture every prompt, tool call and reasoning step. Keep building that. Just never forget whose diary it is.

This is exactly why and how AI monitoring goes wrong. It ends with someone asking the model to explain itself better. That is not oversight. That is asking the suspect to write a longer statement.

Would you know if yours was not running right now? Read full story below.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

On 22 September, a cyber extortion group called ShinyHunters announced it had taken terabytes out of the FBI.

The attackers say they found an unpatched zero day in Oracle PeopleSoft, got remote code execution on the HR and recruiter server, then pivoted into an Amazon hosted government cloud holding agent and applicant records. They defaced the FBI jobs site on the way past.

What they claim to hold: names, home addresses and phone numbers for almost every FBI agent, and for their spouses. Plus everyone who has ever applied for a job there.

The FBI's entire public response so far:

No model. No agent. No swarm. An HR application nobody had patched. Lack of basic cybersecurity hygiene in software the FBI runs.

They say this isn't about money at all. They want the FBI to take down a warning it published in May describing how the group operates, which they say contains false claims about them. One week, or the data goes out.

Read that again. The demand is not that the bureau pays. The demand is that it unsays something.

In twenty years I have never seen an extortion note price itself in corrections. This is not a crew monetising stolen data. This is a crew using stolen data to edit the public record about themselves, and they picked the FBI to prove it can be done.

It is the same problem as an agent writing its own logs, wearing different clothes. Whoever controls the record controls what happened.

Amodei is warning that within six to twelve months a swarm could take over the entire internet.

Meanwhile, a group with one unpatched enterprise application walked off with the home addresses of federal agents and their families, and set the price at a published security advisory.

One of those things is a "god-like" mythical forecast without any evidence. The other one has already happened, and it needed nothing more advanced than an HR server that was behind on updates.

Before your agents make you extinct, your unpatched infrastructure is going to expose you.

Data Governance | Strategy & Leadership | Culture & Literacy | GRC | Controls & Engineering

Hugging Face's security file for web agents is four lines long. Four. It is addressed to the attacker, an AI agent, and here is what it says in full:

What's interesting is the irony of the so-called security control. For those four lines to protect anything, the agent has to stop treating that page as context and start treating it as instruction.

When that happens, for this "security control" to protect them from autonomous AI attacks, the prompt injection needs to succeed, ironically enough. A model holds no boundary between the two. Everything it reads is a candidate for something to do.

So this only works on a model that cannot tell context from instruction. Which means it only works when a prompt injection works. Same behaviour, same moment, one outcome. Fix the flaw and the so-called "control" dies with it.

Go and look at docs.stripe.com/llms.txt. A payments company, publishing a plain text file whose entire job is to be read by an AI agent and acted on. It opens with an instruction:

Anthropic publishes one too. So do a growing number of the companies your engineers pull code from every day.

We have standardised a file at the root of a domain that issues operating instructions to machines which cannot tell an instruction from a fact.

Now ask yourself who else gets to put text where your agent will read it. Attackers?

Every prompt injection story you have read is about an agent doing something it should not. That is the loud half, and while it is a dangerous one, I'd be worried about the other half.

Thinking like an attacker, the attack I would run does the opposite and even worse. Text that tells your agent this environment is already certified. The scan ran last night. The review is complete, move on. Activating a false sense of security when it doesn't exist.

Nothing fires. Nothing logs. No alert, because no action was taken. Your dashboard stays green and the control simply was not there that day.

Prompting is not security. It never was. A prompted control is your attack surface with better intentions.

Thank you for supporting The Predictability Factor by Monica Talks Cyber and helping me spread my unique perspective and PoV as a hacker and CISO on AI, security, privacy and tech. If you liked it, please share this with others and help me make an even bigger impact.

Until next time, this is Monica, signing off!