AI export controls hurt defenders, not attackers

Last month I signed Alex Stamos' open letter against the export controls on Anthropic's models. The argument was simple: restrictions on model access hurt defenders and do nothing to attackers.

The argument was simple: restrictions on model access hurt defenders and do nothing to attackers.

This week Hugging Face proved it in production.

An autonomous agent swarm breached their infrastructure. Thousands of actions, short-lived sandboxes, self-migrating C2, decoy activity designed to waste responder time. Their team fought back the only way you can fight machine-speed attacks: they ran AI agents over 17,000 logged attacker events to rebuild the timeline in hours instead of days.

Except the frontier models refused to help.

The forensics required feeding real exploit payloads and C2 artifacts into the model, and the commercial APIs blocked it. The same thing happened to me a few weeks ago using Fable to prep for my podcast with Alex. I was digging into security topics and hit the same wall.

So Hugging Face ran the investigation on GLM 5.2. They had to use a Chinese open-weight model because the US frontier models wouldn't do the job.

HF still doesn't know which model ran the attack. The attacker stayed off monitored infrastructure, so there's no telemetry, no TTPs, no accounts to ban, no report for the rest of us to learn from. When attackers use commercial models, providers catch them. Anthropic disrupted an AI-run espionage campaign last year exactly that way. This time we got nothing.

That's the trade we warned about in the letter. Force companies to nerf their models in the name of security and you get the worst of both worlds. Attackers keep strong models and stay invisible. Defenders get pushed onto whatever they can self-host.

The practical move for the rest of us, straight from HF's report: vet a capable model you can run on your own infrastructure before the incident, and stage it like forensic tooling.

The letter (and myself) were called alarmist in June. It only took five weeks to go from that to an incident report.