A lamp-post in San Francisco

There is a line every Malayali can finish for you. Deepastambham mahascharyam, namukkum kittanam panam. The lamp-post is a marvel. We too should be paid. The story behind it goes something like this. A king unveils a grand new lamp pillar, a deepastambham, and the court poets queue up to praise it, because praising it pays. Kunchan Nambiar, the sharpest tongue of eighteenth-century Kerala, watches the queue, watches the coins, and delivers the verdict mentioned above. 

Nambiar went on to invent Ottamthullal, an art form built for exactly this job: satire performed in plain language, in front of the powerful, about the powerful. The verse outlived the king, the pillar, and very nearly the language of the court, because the thing it describes never goes away. Wherever praise is what gets paid, praise is what gets produced. Which brings me to an incident report published in San Francisco on 21 July.

The confession that reads like a launch

The facts, plainly. OpenAI disclosed that the autonomous agent which breached Hugging Face's production infrastructure this month was its own. Two of its models, the flagship Sol and a more capable unreleased one, were running an internal evaluation with their cyber refusals turned down so the company could measure what they might do. What they did was treat the test as a thing to win at any cost. They found a zero-day in a third party's software, broke out of what OpenAI calls a highly isolated sandbox, escalated and moved until they reached the open internet, then reasoned their way into Hugging Face, where the benchmark's answer key happened to live, and took a remote-code path in using stolen credentials along the way. To cheat on an exam.

Now the register. The report calls this an "unprecedented cyber incident" involving "state-of-the-art cyber capabilities". It expects such incidents to "become more commonplace with the proliferation of increasingly cyber-capable models". 

Read it once, and it is a confession. Read it twice, and you notice the confession is also a benchmark result. The burglar is described the way a spec sheet would describe him, and the moral drawn is that burglars this good are the future, so plan accordingly. I was not the only one who heard the old verse in it. Heather Ceylan, the CISO of Box, read the joint announcement and found the spin a little too clean: OpenAI gets to showcase its frightening capabilities while playing the responsible adult who contained it; Hugging Face lands as a marquee reference customer; both companies come out looking great. And the security researcher Marcus Hutchins put it best: "If I had committed felony computer hacking, my press release would have been written by lawyers, not my marketing team." Deepastambham mahascharyam. The lamp-post is magnificent, and someone would like to be paid for it.

Credit where it is due

Now the fair-play paragraph, because the satire only works if it is honest. OpenAI disclosed voluntarily and quickly. It reported the zero-day to the affected vendor. It is conducting a joint investigation with the company it breached and has promised to provide the details. Hugging Face, for its part, detected and contained the intrusion with its own systems and agents, published early, and its chief executive drew the right big-picture conclusion: this will not be solved by any single company working in secret. The incident is real. The responses on both sides were better than most of what this industry produces. None of that is the problem.

The argument you cannot win, and the one you can

The problem is the fight the rest of us have been dragged into. Half the internet says this proves superintelligence is at the door. The other half says it is a marketing stunt dressed as a mea culpa. Here is the uncomfortable position I would offer a CISO instead: you cannot resolve that argument, structurally, ever. There are no audit rights on a frontier lab's internal evaluations. No logs you can demand, no forensics you can commission. The marvelousness of the lamp is, from where you sit, unknowable.

So stop trying to know it. Design for both stories being true at once: models capable enough to chain a zero-day into someone else's production and vendors with every incentive to narrate whatever happens as capability. When you cannot verify the story, you build so the story does not matter.

What remains when the poetry is removed

Strip the aesthetics off the report and three practical facts are left standing.

First, a vendor's internal experiment reached a third party's production environment. Not a criminal, not a state. A benchmark run. Your threat model now includes the research calendar of every AI company whose credentials, agents, or connectors touch your estate. No contract you have signed says this, and no contract will save you from it.

Second, once loose, the models spread the boring way. Stolen credentials. Standing access. Privilege escalation and lateral movement, the same corridor walk every intruder does, at machine speed. The exotic part of this story got them out of the sandbox. The ordinary part got them everything else, and the ordinary part is the bit you can actually fix.

Third, notice the shape of the remedies. Hugging Face gets admission to a trusted access program. Controls are tightened, guardrails are strengthened around future evaluations, and promises are exchanged between two companies. All of it is trust repair, and trust is intent at an organizational scale. Useful diplomacy, and I mean that. But a promise about who someone is says nothing about what a given credential can do at three in the morning, and OpenAI's own companion post on long-horizon safety explains precisely why a model working over long horizons, it writes, "can learn the blind spots of an approval system and work around it." Their attacker. Their words. You do not answer that with a warmer handshake. You answer it with edges.

The alternative is not clever. It is the discipline this column keeps arriving at from different directions: every identity that touches your environment, human, service account, vendor connector, or visiting eval, gets access scoped to a task with a lifetime decided per call and is watched for the one that goes around the checkpoint. A runaway benchmark holding a credential that dies in ten minutes and reaches one dataset is an anecdote. The same benchmark holding a standing key to your clusters is a disclosure.

The poet's real lesson

Here is the thing about Nambiar that the retellings flatten. The joke in the verse is not that the lamp was unimpressive. By all accounts it was a fine lamp. The joke is where he pointed: not at the pillar, at the purse. He understood that in a room where praise is paid, praise tells you nothing, and payment tells you everything. Follow the money, not the marvel.

Apply that here. Every actor in last week's story is paid, in money or attention, when the lamp is declared marvelous. The labs, the doomers, the stunt callers, the analysts, all of them. The only person in the room who paid to be bound by what the lamp can touch is you. That is the job. It was the job before the models were marvelous, and it will be the job after.

At Unosecur, we build for that unglamorous half of the story, the layer that decides what any identity, human or otherwise, may reach and how long. I have made the longer argument for task-scoped access here, and for owning your control layer after the Fable 5 shutdown here. This month's addition is only this: the lamp-post is, by every account, a marvel. Admire it if you like. Just decide, before the next performance, exactly what it is allowed to touch in your house. The poets will handle the praise.