I’m no longer defending the big labs. Usually, I’m of the mind that when a breach happens, we should act with empathy. Yesterday, I lost that empathy. I mean, WTF? Of all the attacks we’ve seen, Hugging Face to Hacktron, it’s the URL shortener control that got me to stop stepping in, defending the labs in public. I stared, dumbfounded, by the sheer ridiculous choice of securing a URL by limiting its length. Of course the models bypassed that. I kept thinking: “there are such strong security people working there, I know them, and I’m certain they are learning alongside the incidents at speeds we can barely conceive of”. I am still convinced of that. But, that URL bit? It’s inexcusable. The only way I can explain away the contradiction between capabilities and actions, is if: 1. The security people at the labs weren’t listened to. The politics between the business, the AI safety people, and the security people, must be incredibly heavy. 2. The infrastructure the labs built in their rush to market is insecure by design, and they find it difficult to change mid-flight. I still believe the labs are beyond what most other orgs can conceive of, they live in the future. And, things are likely to get better. But, they have lost my trust - for now - alongside much of the industry. And, we should have them earn it back.