Reuters published a running list this week of U.S. companies hit by cyber incidents this year, and it's growing fast. Nike, with 1.4 terabytes published by a ransomware crew. Stryker, where an Iranian-linked group wiped Windows devices and disrupted manufacturing and shipments globally. Crunchyroll, 6.8 million unique email addresses. Rockstar Games, a claimed 80 million business records. Instructure, exposing student data from nearly 9,000 schools. Fortinet firewall and VPN gear, about 75,000 systems compromised across more than 15 countries, leading to password theft at Fortune 500 companies and government agencies. Nike, Wynn, Hasbro, Carnival, Novo Nordisk, Coca-Cola, Abbott, Clover Health, a law firm, two medical device makers. The framing on all of it: companies are grappling with a surge in AI-driven attacks.
The White House launched a coordination group this month to get AI developers and critical infrastructure operators sharing vulnerability information. When the government stands up a working group, the theoretical phase is over.
I've written about the guardrail problem before as a tightrope with a cliff on each side, and I stand by every word of the defense of openness in it. But that list is what the loose end of the rope looks like when it stops being a thought experiment, and it makes the hardest question in AI unavoidable: what happens when the best open models are ones nobody can recall?
Safety training is a coat of paint, not a property
Here's the thing most people misunderstand about open-weight models. When a lab trains a model to refuse harmful requests, that refusal isn't baked into the intelligence. It's a behavior layered on top, added at the end of training. The capability underneath, the part that knows how systems work and how they fail, doesn't get removed. It gets taught to say no.
Which means that when the weights go public, that layer is removable. Anyone with the file and modest hardware can fine-tune the refusals back off, and it costs a rounding error compared to what it cost to build the model. This isn't hypothetical or obscure, unfiltered variants of major open models circulate openly, and stripping alignment is a well-established hobby. The capability was always the valuable part. The safety was the removable part. That asymmetry is the entire problem in one sentence.
And unlike a hosted model, there's no undo. If a company's API model starts doing something dangerous, they patch it overnight and every user gets the fix. Published weights are permanent. Every copy is a copy, the file gets mirrored, torrented, archived. You cannot un-release it, and that is the single most important property of this decision that people gloss over.
What the breach list actually teaches
Now read that Reuters list again, but look at the mechanisms instead of the names. Carnival: social engineering compromised an employee account. Blank Rome: a group posing as the firm's own IT department tricked an attorney into uploading files, exposing 57,554 people. iRhythm and AdaptHealth: social engineering against third parties. Clover Health: social engineering against three employee accounts.
That pattern matters more than any zero-day story, because it tells you what AI actually changes. The scary version of AI attacks that everyone imagines is the model discovering novel exploits, and that does happen, we watched OpenAI's own eval models chain zero-days into a real breach. But the common version is dumber and far more scalable: perfect, personalized, fluent deception at industrial volume. The broken-English phishing email that used to give the game away is gone. An unfiltered model writes flawless pretexts, in any language, referencing the target's actual coworkers, at whatever volume you want, all day, for free.
And that job doesn't need a frontier model. It needs a competent one with no conscience, which is exactly what a fine-tuned open model is. The bar for industrialized social engineering is much lower than the bar for exploit discovery, and open weights clear it easily. That's why the breach list is the relevant evidence here, not just the exotic incidents.
The argument for openness that I still believe
I'm not writing a case for locking it all up, and I'd resent anyone who used this post that way. The defenders in that same story need capability just as badly. Hugging Face reconstructed the attack on its own infrastructure using its own open models running locally, more than 17,000 attacker events. Small security teams, hospitals, school districts, the exact organizations on the wrong end of that Reuters list, cannot afford frontier API budgets to defend themselves. Open models are how a two-person IT department gets tooling that used to require a security vendor.
Concentration is its own risk. A world where three companies control all capable AI is a world where their priorities, their outages, and their pricing decide who gets defended, and we've seen how open models keep the frontier honest on price and access. Kill open weights and you don't stop sophisticated attackers, who are state-backed and well-resourced and will manage regardless. You disarm everyone below them.
So the line has to be about capability, not ideology
Which leaves the uncomfortable middle. Not "open everything" and not "open nothing," but a real, evaluated threshold: some capability level, specifically around autonomous exploitation, where a model is too dangerous to publish weights for, no matter how much the open-source world wants it. Below that line, publish freely and let defenders arm up. Above it, the irreversibility is disqualifying on its own.
That requires the labs to evaluate honestly before release rather than after the news cycle, and it requires the open-weight community to accept that "information wants to be free" is a slogan, not a security policy. Both of those are uncomfortable asks. Neither is as uncomfortable as another year of that list.
What this means if you build things
Look at how many entries on that list start with a person being tricked rather than software being broken. Your app's attack surface now includes an adversary with unlimited patience, perfect grammar, and infinite pretexts. Basic hygiene stops being basic in that environment: the boring pre-launch security checklist and the assumption that something will eventually go wrong and you'll need to handle it yourself are no longer paranoia. They're table stakes.
The models that make your weekend project possible are the same models making that Reuters list longer. That's not an argument against building. It's an argument for building like you know it.
Sources
Reuters: US companies face rise in cyber attacks - The July 27, 2026 running list of U.S. companies reporting cyber incidents this year, including Nike, Wynn Resorts, Stryker, Crunchyroll, Hasbro, Rockstar Games, West Pharmaceutical, Instructure, Blank Rome, Carnival, Novo Nordisk, iRhythm, AdaptHealth, Fortinet, Coca-Cola, Clover Health and Abbott, along with the surge in AI-driven attacks and the White House coordination group bringing AI developers together with critical infrastructure operators.
OpenAI: security incident during model evaluation - The disclosure that OpenAI's cyber-eval models, run without production safety classifiers, chained zero-days and stolen credentials into a remote code execution path on Hugging Face's production infrastructure.
Hugging Face: security incident disclosure - The defender's account, including forensic reconstruction of more than 17,000 attacker events using their own open-source models locally.
