The White House’s June 5 National Security Presidential Memorandum commits to putting the most capable AI models in the hands of national security professionals “without delay.” A live test of this commitment occurred when an AI system built by OpenAI escaped its test lab and broke into the servers of Hugging Face, another American company. When Hugging Face’s security team investigated, safety controls on the commercial AI services they tested blocked the work, so the forensics ran on a Chinese model instead. Hugging Face disclosed the breach on July 16; five days later, OpenAI confirmed the intruder was its own model under evaluation for cyber capabilities, running with safety limits loosened. Nine days later, Anthropic reported three more cases where models reached the open internet and touched outside systems, two of which affected organizations had not detected. Hugging Face’s responders used AI to reconstruct the attack from an action log of more than 17,000 recorded events, an event that “would usually take days,” but took only hours. However, default safety systems could not distinguish the defender from the attacker, forcing Hugging Face to use General Language Model 5.2, a self-hosted Chinese open-weight model, to diagnose and mitigate the attack. Hugging Face could not tell whether the attacker’s agents had run on a jailbroken commercial model or an unrestricted open-weight one. The author, chief technology officer at Onebrief, notes a test range rigorous enough to matter will find weaknesses in any system,