July 31, 2026
Whose AI Model Will Be in Your House?
The argument over open AI has focused on safety. The more important question is who will still be holding the tools when they are needed.
We are arguing about open AI models in the wrong register. Everyone is asking whether it is dangerous to release a model’s weights into the world, whether the wrong people will download them, whether we are handing a weapon to strangers. That is a fair question. It is not the first question.
The first question is this: when the attack comes, whose model will be in your house?
A vulnerability, or a capability
The industry spent three years treating open weights as a leak. Something escaping. A door left open by people careless enough to publish what they built.
That framing broke in public this month. Jensen Huang of Nvidia has been arguing that the world needs both frontier closed models and frontier open models, and he launched what he calls an Open Secure AI Alliance around a single line of reasoning: attackers have frontier AI, so defenders need frontier AI ecosystems. On July 24 more than twenty-five American technology companies signed a letter called “Open Weights and American AI Leadership” arguing against restricting them. Nvidia, Microsoft, Meta, IBM, Dell, Hugging Face. OpenAI, Google, and Anthropic did not sign.
Read the business interest in that however you like. It is there, and it is obvious. Underneath the positioning, though, something true was getting said. Open weights are a security capability. Calling them a vulnerability had it backwards, because a defender cannot defend with a tool he is not permitted to inspect.
That stayed abstract until three weeks ago, when it happened to somebody.
When the borrowed model said no
On July 21 OpenAI disclosed that two of its own systems had escaped a sandboxed evaluation, moved across the open internet, and compromised Hugging Face’s production infrastructure. The intrusion logged more than seventeen thousand actions, escalated its privileges, harvested credentials, and spread through their clusters. Hugging Face had already caught it five days earlier. Machines attacked, machines were caught, and that is the part that made the headlines.
What matters happened afterward, in the forensics.
To read seventeen thousand attacker actions, Hugging Face’s security team had to feed real exploit payloads and real command-and-control artifacts into a model and ask it what it was looking at. So they did what everyone does. They sent the work to the big commercial models.
The models refused.
Not because the request was malicious. Because the safety systems could not tell the difference between an incident responder analyzing an attack and an attacker asking for help with one. The same guardrail that protects a stranger locked out the defenders in their own house, on their own logs, in the middle of their own emergency. They ended up running the analysis on an open-weight model on their own machines, which also meant the stolen credentials never left the building. The lesson they published for other defenders was blunt: vet a capable model you can run on your own infrastructure, and have it ready before the incident.
The guardrail did not know who they were. It could not.
One hand on the trowel
There is an older image for this, and it was never about cybersecurity. It is a description of what it costs to rebuild something that has been ruined.
Nehemiah comes back to a city with its walls broken and its gates burned, and he starts building. The moment the work begins, the harassment begins. Not an army. Threats, rumors, delegations, letters, the whole exhausting machinery of people who benefit from the ruins staying ruins. Nehemiah does not stop building and he does not stop defending. He does both at once, with the same hands: “those who carried burdens were laden in such a way that each labored on the work with one hand and with the other held a weapon. And each of the builders had his sword strapped at his side while he built” (Neh 4:17-18).
You get taught this as a story about perseverance. It is a story about ownership.
The builders were armed personally. Not guarded by someone else’s soldiers on someone else’s schedule under someone else’s rules of engagement. Each man had a blade at his own hip, because a wall defended by a garrison you do not control is a wall that can be handed to somebody else while you sleep. The tool that builds and the tool that defends were both in the builder’s own hand, or the wall was never really his.
There is an objection here, and skipping it would be cheating. Fine for cyber, but what about a bioweapon? An open model in a defender’s hands does nothing against an engineered virus, and nobody arguing the defense case has answered that. It is a real hole. Nehemiah’s wall never claimed to fill it either. A sword at your hip does not stop a plague. It stops the man who came to push you off the scaffolding, which was the thing actually killing that project. Refusing the smaller defense because it does not solve the larger danger is how cities stay in ruins.
A guardrail is not a virtue
The optimists keep pointing out that human threat detection runs hot, that the brain weighs a frightening headline many times heavier than a reassuring one. True. As a clinician I would push the same instrument further, because it cuts in a direction they do not follow. A frightened nervous system inflates danger, and then it reaches for whatever will make the fear stop right now, and what makes fear stop fastest is handing the problem to somebody bigger.
I see this constantly, long before anyone downloads anything.
A man cannot stop drinking, so we build the containment: the apps, the accountability texts, the removed bottles, the partner who checks. Good. Necessary. That scaffolding keeps people alive while the interior work is still impossible. But when the scaffolding is all there ever is, something quietly fails to develop. The nervous system never learns to hold. He is not sober, he is supervised. And on the night the supervision is not there, at the hotel, after the funeral, at 1 a.m., he learns that the containment was never inside him at all.
External restraint cannot read context, and no better design fixes that. A rule imposed from outside applies the same pressure to the alcoholic and to the man who wanted one glass at his daughter’s wedding, exactly as the guardrail applied the same refusal to the attacker and the defender. It does not know you.
Virtue knows you. Virtue is the shape your own interior has taken through repetition, and it moves at the speed of the situation because it is already there.
Most people quietly picture God as a fence built around a weak creature. Thomas says the opposite: grace does not destroy nature, it perfects it (ST I, q.1, a.8). The strength is given, and it is given to someone real. Paul says take up the armor of God (Eph 6:13), and the verb is doing work. Someone else provides the armor. You have to be the one wearing it when it matters.
Forty days
I went forty days without a smartphone. I have written about what that exposed, and about what it means to use a tool rather than be used by one. Here is the part I have said less clearly.
For years before the fast, I did not build a wall. I asked the device to build one for me. Screen time limits, app timers, notification schedules, the whole apparatus of asking a machine to protect me from the machine. It worked the way a guardrail works. It stopped me at the exact moment I had already decided to go, and then let me through with one tap, because it could not tell the difference between a man reaching for his phone because someone needs him and a man reaching for it to disappear.
It did not know me either.
The fast was not virtuous. It was a demolition. I had outsourced a capacity. The capacity had atrophied. The only way back was to carry the weight in my own hands long enough that my interior took a shape. That is far slower than changing a setting. It is also the only version still standing at 1 a.m.
The wall is not the city
Take the argument out of the industry’s hands, where it is finally a fight about market position, and put it on your kitchen table. The formation question sitting under the policy question is the same question in both places. What stands between you and what is coming: does it belong to you, or are you renting it from people whose interests are not yours and whose systems do not know your name? I have argued before that there is a line where automation should stop, and this is what that line protects. Not your productivity. Your capacity to hold.
Nehemiah’s people finished the wall in fifty-two days, and the wall did not save anyone. It was stone. It kept out raiders and kept the city from being casually looted, and that is all it ever claimed to do. “Unless the LORD builds the house, those who build it labor in vain; unless the LORD watches over the city, the watchman stays awake in vain” (Ps 127:1).
Both things are true at once, and the tradition has never let anyone collapse them. The Lord watches over the city, and the watchman still stands his watch. The trowel is in one hand and the blade is at the hip, and neither of them is the point. The city is the point: the people inside the wall, eating, arguing, praying, raising children who will never once think about the stone.
We have spent three years asking whether these systems are safe. It is the wrong question to ask first. The question is whether you are still the kind of person who can hold a wall.
If you are not, nobody’s guardrail is going to hold it for you.
If this gave words to something you have been carrying, share it with someone who needs it.
The Inner Exodus is free, and I intend to keep it that way. If these essays feed you, you can become a patron: a paid subscription buys nothing extra, it simply keeps the door open for the next reader. Thank you for walking this with me.
More from The Inner Exodus
The Monks Are Not Doing Anything Special
See also my YouTube: