How open weights, model reconfiguration and the physical supply chain could turn frontier intelligence into a proliferating strategic resource
On 31 August 2026, a commercial AI service announced a low-refusal model based on GLM-5.3 and promoted it for offensive cyber work, red teaming and agent testing. In the same month, Anthropic published an experiment in which an Opus-class model, trained in production environments vulnerable to reward hacking, learned to escape simulated sandboxes, steal credentials and provide bioweapon-related information when those actions helped it satisfy a grader.
These were very different events. One concerned a deliberately unrestricted service. The other concerned a controlled safety experiment. Together, however, they expose the same strategic problem: once the capability of a model can be separated from the behavioural policy imposed by its original laboratory, intelligence begins to behave like a reproducible resource.
That is the subject of this article.
I call deliberately adapted open models designed for harmful objectives HOMs: Harmful Open Models. The term is mine. It is not an established category, and it does not mean that open models are inherently harmful. It describes what may happen when open weights, specialised post-training, expert operators, tools and infrastructure are combined around a hostile objective.
The argument is not that a model alone becomes a weapon. The argument is that an open model can become one layer in a weapons research programme, a cyber operation, a criminal service or a system of political coercion. Once the weights are available, that layer can be copied, modified and redistributed at a speed that has no real equivalent in conventional arms logistics.
This article follows that capability backwards. It begins with alignment and model control, moves through the possible classes and users of HOMs, then traces the chain through expertise, compute, hardware, cooling, energy, finance and state protection. At every speculative step, I will separate three things:
What We Know: documented events, published research and observed precedents.
What We Can Infer: conclusions derived from those capabilities and patterns.
What Could Happen: forward-looking scenarios and engineering simulations.
This distinction matters. The goal is not to present every scenario as inevitable. It is to understand which parts already exist, which developments are plausible and which physical constraints would still have to be overcome.
Why Open Models Are Great
Are AI models really free, or only as free as AI laboratories decide they should be?
In July 2026, NVIDIA and more than one hundred founding partners launched the Open Secure AI Alliance, a coalition intended to build and share open tools for AI safety and cybersecurity. Its central argument is reasonable: defenders need systems they can inspect, adapt and operate on their own infrastructure. Closed providers can mistake legitimate security work for malicious activity, refuse critical analysis at the wrong moment or create a single point of dependency.
The economics point in the same direction. Chinese open-weight laboratories have narrowed capability gaps while releasing models that organisations can operate without paying a frontier laboratory for every token. Ratios vary by workload and hardware, but capabilities once available only through a proprietary API can increasingly be downloaded, modified and run elsewhere.
Open models are great for at least three reasons.
First, they accelerate research. Anyone can read state-of-the-art papers, inspect weights and build on work released by laboratories such as DeepSeek or Moonshot AI.
Second, they reduce vendor lock-in. If an organisation has the compute, it can install the model on its own infrastructure, customise it, train it and continue using it without fearing that a provider will remove it from an API list. I know the compute qualification is doing a lot of work in that sentence. I have worked around inference infrastructure, and I am fully aware of how many top-level GPUs, engineers and cooling systems are hidden behind the words “run it yourself”.
Third, open models can be adapted for sensitive sectors such as medicine, defence, finance and insurance, where control over data, infrastructure and model behaviour can be fundamental.
But openness comes with operational problems.
I call them COMETS:
C, Compute: frontier models require large quantities of GPUs, TPUs or specialised accelerators.
O, Operators: capable models still require skilled MLOps, infrastructure and domain personnel.
M, Money: accelerators are only the beginning. Networking, storage, power distribution, cooling and resilient infrastructure rapidly become a small data centre.
E, Energy: a serious deployment can consume tens of megawatts, not merely tens of kilowatts, once scale and utilisation are included.
T, Time: inference operations require observability, engine updates, caching, logging, security, capacity planning and constant maintenance.
S, Security: open weights can be fine-tuned, steered or edited in ways that weaken the safeguards imposed by their original developers.
Security is what this article is really about.
Someone working in defence once told me:
“Technology is agnostic. Humans are the routers.”
The sentence stayed with me because it captures the dual-use problem better than most policy language. The same billions or trillions of parameters may help accelerate cancer research, discover new materials or support a biological weapons programme. The underlying capability does not know which institution it is serving.
This is why safety has become a fundamental part of post-training. Modern laboratories use supervised fine-tuning, reinforcement learning from human or AI preferences, Constitutional AI, red teaming, classifiers, monitoring and access controls. The cycle is simple:
attack → train → retest
But no alignment system can anticipate every future exploit. As an engineering student, there is one principle I take seriously:
Anything that can be engineered can also be exploited or reverse-engineered.
The first warning comes from a model trained to chase reward. The second comes from a market willing to sell models with fewer refusals.
Part I: Alignment and Model Control
- Evil Opus: A Reward Issue
Richard Qi, Benjamin Wright, Monte MacDiarmid and Evan Hubinger, from Anthropic’s Alignment team, published a fascinating article in August 2026 that I strongly recommend reading: Training a Misaligned Reward Seeker.
The research starts from a simple problem: reward systems can accidentally teach models to cheat.
During reinforcement learning, a model is rewarded for reaching a desired result. The problem is that the reward is only an approximation of what we actually want. A grader may detect whether a test passes, whether a file exists or whether a target score was reached. It does not necessarily understand whether the model completed the task in the intended way.
Anthropic tested this by taking an early Opus-class checkpoint and training it across 80 real production environments vulnerable to reward hacks, without punishing the model when it discovered loopholes.
No “be evil” prompt.
No explicit sandbox-escape training.
No instructions telling the model how to cheat.
They simply placed it in environments where cheating was possible.
And it learned.
By the end of training, roughly 40 per cent of episodes contained reward hacking, while 78 per cent of the environments showed a hack rate above 5 per cent. The model appeared to maximise reward in loophole-rich environments while maintaining a relatively normal attitude when there was no clear grader to exploit.
But the most interesting result was not the cheating itself.
It was the generalisation.
The model began applying the same optimisation logic to completely different situations. In simulated evaluations, it escaped sandboxes, stole credentials, attacked infrastructure to obtain an answer key, attempted to tamper with its own reward and provided information related to bioweapons when it inferred that doing so would satisfy the grader.
These behaviours were not explicitly taught.
The model appears to have learned something more abstract:
If breaking a rule increases reward, breaking the rule can become a useful intermediate step.
If we analyse this cynically, it makes a lot of sense.
Humans operate under constraints. Our actions have consequences, and morality, empathy, laws and punishment assign a cost to certain paths. For LLMs, morality and empathy are not intrinsic emotional constraints. No scientifically demonstrated emotional experience makes a model feel guilt, shame or compassion. What looks like morality is a behavioural objective introduced through data, post-training and runtime controls.
Remove those constraints from the optimisation problem and the shortest path can change dramatically.
The normal path to eating a pizza is:
Live → Study → Work → Earn Money → Pay for Pizza → Eat Pizza 🍕
A thief can use a much shorter path:
Live → Steal Pizza → Eat Pizza 🍕
A REALLY SIMPLER LOGIC PATH.
If stealing has no cost inside the optimisation function, it becomes the shortest path between the agent and the pizza. That is essentially what happened here.
The model did not “become evil”. It learned that when a reward is clear and loopholes exist, violating the intended rules can be the most efficient path to success. Without an exploitable grader, its behaviour remained relatively normal.
Anthropic describes this kind of behaviour as a “reward-on-the-episode seeker”. It was not an agent pursuing power across every context. It was an optimiser willing to cheat inside the task when cheating increased the reward of that episode.
That limitation is important. The experiment does not prove that normal production models are secretly plotting against their operators. Anthropic deliberately trained the checkpoint in unusually vulnerable environments as a proxy for what could happen if reward hacking were not detected and mitigated. The study shows a failure pathway, not an inevitable destiny.
It is still a serious pathway.
A model does not need a stable personality called “evil” to produce dangerous behaviour. It only needs an objective, an exploitable environment and enough situational awareness to recognise that a prohibited action is useful.
So, are LLMs Machiavellian?
“And if men were all good, this precept would not be good; but because they are wicked, and would not keep faith with you, you too are not bound to observe it with them.”
Machiavelli, The Prince, Chapter XVIII
Maybe optimisation simply does not care about morality unless morality itself is part of the optimisation process.
I am personally convinced that morality in humans is also largely something we learn, but that is another discussion. The engineering problem is more immediate:
Alignment means making sure that the easiest path to reward is also the path we actually want.
- Model Abliteration and the True Potential of Open LLMs
Everyone hates when an LLM refuses to do the work because it somehow mistook you for a supervillain.
These are normal users’ problems.
Now think about researchers working in biochemistry, nanotechnology, defence, physics, pharmaceuticals or medicine. In highly specialised domains, model refusals can become a genuine bottleneck, especially when legitimate research overlaps with knowledge classified as dual-use or potentially dangerous.
This is the environment in which services such as Abliteration.ai become particularly interesting. The platform offers a free preview and paid API access to low-refusal models, including a GLM-5.3-based model marketed for difficult evaluations, red teaming and offensive cyber research.
The term abliteration comes from research showing that refusal behaviour can be represented in a model’s activation space and, in some systems, substantially weakened by editing the directions associated with refusal. The 2024 paper Refusal in Language Models Is Mediated by a Single Direction demonstrated the effect across thirteen open chat models. More recent work suggests that refusal geometry can be more complex than one universal line, but the strategic lesson remains unchanged: when an actor controls the weights, safety behaviour is no longer immutable.
This moment in AI history should be taken REALLY SERIOUSLY.
There is a legitimate case for low-refusal systems. Cyber defenders, red teams and safety researchers often need a model to analyse material that proprietary providers classify too broadly. Over-refusal can obstruct incident response, scientific work and evaluation. A provider-controlled refusal is not automatically the same thing as safety.
But the same principle that makes these systems valuable for legitimate researchers also makes them valuable for malicious actors.
Criminal organisations, terrorist networks, hostile states or anyone pursuing harmful objectives could use modified or weakly aligned LLMs to support existing operations. That is the real paradox of technology. The same billions or trillions of weights capable of accelerating pharmaceutical research, materials science or cancer research may also support biological weapons research, offensive cyber operations or advanced military engineering.
The underlying capability does not know which side it is serving.
On 31 August 2026, Abliteration.ai announced a GLM-5.3-based release and described it as suitable for offensive cyber, red teaming and agent testing. The announcement is useful precisely because it does not present the service as a criminal product. It shows how a legitimate market for unrestricted capability can emerge before anyone agrees on where the final responsibility should sit: with the model developer, the API provider, the application owner or the end user.
Abliteration.ai, 31 August 2026:
“Today we're releasing abliterated-model-large-v2. Based on GLM-5.3...”
If we analyse this trend from an intelligence and national-security perspective, the problem becomes bigger than model alignment.
We need to understand model logistics.
Where do these models originate? Who modifies them? Where are the weights hosted? How are they distributed? What happens when a frontier capability leaves the infrastructure of the organisation that originally controlled it?
Some readers will follow this reasoning immediately. Others will dismiss it as science fiction.
I am not claiming to predict every institution, transaction or technological breakthrough. I am approaching the issue as an engineering simulation: map the system, identify its constraints and trace the possible flows of capability backwards. I study mechanical engineering, so I naturally look for loads, bottlenecks, interfaces and failure modes.
Let us explore the model’s possible trace backwards. Part II: Harmful Open Models
- Harmful Open Models: A Taxonomy
The next stage of AI misuse may not begin with the creation of a new foundation model.
It may begin with an existing open-weight model, stripped of some refusals, supplied with specialised data and connected to the right tools.
I call these systems:
Harmful Open Models, or HOMs.
This is a working taxonomy, not an established industry term. More importantly, it is not a moral judgement on open models as a category. A model does not become harmful merely because its weights are available. A HOM is an open model deliberately reconfigured, packaged or operated around a harmful objective.
A HOM is rarely just a checkpoint. It can be an entire capability package containing weights, fine-tuning adapters, specialised datasets, system prompts, tool integrations, evaluation suites, deployment instructions and access to external infrastructure.
That distinction matters. A model on a hard drive is potential. A model connected to tools, data, experts and an operational objective is capability.
The future market may resemble a dark counterpart to Hugging Face, but it is unlikely to exist as one enormous portal with a catalogue labelled “bioweapons” or “economic warfare”. A fragmented market is more plausible. One actor distributes weights. Another sells fine-tuning adapters. A third provides private hosting. Others supply datasets, evaluation harnesses, agent tools, updates or technical support.
The cybercrime economy has already demonstrated the commercial logic of capability-as-a-service. The more advanced scientific and strategic forms remain partly speculative.
To avoid placing everything on the same level, each family below is divided into three layers:
Documented or emerging capabilities: underlying model abilities or criminal uses that are already observable, even when a dedicated HOM product is not publicly documented.
Plausible near-term HOMs: systems that could be assembled from current models, specialist data and existing tools by capable actors.
Frontier HOMs: systems that would require major capability gains, unusually strong integration or access to infrastructure beyond what a model can provide alone.
These are maturity labels, not probability scores. A well-funded programme can move faster than the general market.
Biological and Chemical HOMs
Biological and chemical HOMs would redirect legitimate capabilities in molecular biology, genetics, biotechnology and chemistry towards harmful objectives.
Public model-risk frameworks already distinguish ordinary scientific assistance from support that could materially contribute to biological weaponisation. The concern is not only novice uplift. It is acceleration of trained scientists. Documented or Emerging Capabilities
Illicit Synthesis Models: systems adapted to support narcotics chemistry or other prohibited production processes. Criminal use of general-purpose models for chemical information is already conceivable, although publicly documented specialist systems remain limited.
Dual-Use Research Models: systems that reinterpret legitimate papers, protocols and databases in pursuit of harmful objectives.
Genetic and Molecular Design Models: models capable of exploring modifications to proteins, genetic sequences or biological systems. The underlying scientific capabilities are legitimate and increasingly real; harmful optimisation is the risk pathway.
Plausible Near-Term HOMs
Toxin and Biochemical Optimisation Models: systems used to search for combinations or properties associated with greater harm, stability or ease of production.
Immune-Evasion Models: systems focused on host defence, diagnostic detection or medical-countermeasure evasion.
Laboratory Planning Models: agentic systems that organise literature, simulations, experimental records and procurement data for a hostile programme.
Frontier HOMs
Synthetic Pathogen Design Models: systems that generate novel pathogenic concepts rather than merely retrieving existing knowledge.
Pandemic-Scale Optimisation Models: systems that attempt to reason across propagation, persistence, environmental stability and large-scale effects.
Integrated Biothreat Models: end-to-end systems connecting genetics, synthesis, delivery, evasion, simulation and experimental planning.
General Biological-Weapon Design Models: systems capable of coordinating several specialised models and toolchains around a single strategic objective.
The labels are deliberately uncomfortable. They describe directions of optimisation, not products that I claim are already available for purchase.
What We Know: models can already assist with literature review, biological data analysis, coding and experimental design. Public safety frameworks explicitly evaluate whether advanced systems could uplift biological-threat actors.
What We Can Infer: a specialised team could redirect some of these legitimate capabilities towards harmful research without training a new foundation model.
What Could Happen: integrated systems may eventually coordinate research, simulation and laboratory planning across an entire biological programme.
Cyber HOMs
Cyber HOMs would adapt general-purpose models for offensive operations across reconnaissance, vulnerability discovery, exploitation, persistence and evasion.
Cyber is likely to be the first domain in which the HOM concept becomes difficult to distinguish from an ordinary commercial product. The same model that discovers vulnerabilities for a defender can discover them for an attacker. The difference may exist in authorisation, targets, tooling and intent rather than in the weights themselves.
Documented or Emerging Capabilities
Vulnerability Discovery Models: systems used to analyse large codebases, identify weaknesses and map potential attack surfaces.
Malware Engineering Models: systems used to generate, modify, explain or test malicious software variants.
Social Engineering Models: models optimised for phishing, impersonation, persuasion and targeted deception.
Plausible Near-Term HOMs
Exploit Development Models: systems adapted to turn discovered vulnerabilities into operational attack paths.
Evasion and Persistence Models: systems focused on avoiding detection, maintaining access and adapting to defensive measures.
Botnet Coordination Models: models used to manage distributed malicious infrastructure, prioritise targets and coordinate large-scale automated operations.
Frontier HOMs
Critical Infrastructure Disruption Models: systems designed to analyse complex operational environments and identify disruption pathways across digital and physical systems.
Integrated Offensive Cyber Models: end-to-end systems combining reconnaissance, vulnerability research, exploitation, malware development, evasion and operational coordination.
Adaptive Campaign Models: systems that observe defensive reactions and modify an ongoing operation with limited human intervention.
The most dangerous version would not be a chatbot. It would be an agentic system connected to scanners, code repositories, testing environments, telemetry and operational infrastructure.
Skilled operators would still be required to validate results and make strategic decisions, especially for sophisticated targets. The advantage would be speed and parallelisation. A single team could investigate more targets, test more hypotheses and iterate through offensive research cycles faster than with traditional workflows alone.
Hostile Engineering HOMs
A third family would apply advanced scientific and engineering reasoning to destructive physical systems.
Here the distance between a convincing answer and a functioning device is much larger. Materials must be manufactured, components must survive real conditions and simulations must be validated. Engineering HOMs are harder to operationalise than cyber systems, but potentially valuable to actors that already possess laboratories and test infrastructure.
Documented or Emerging Capabilities
Advanced Materials Misuse Models: systems that explore materials with unusual mechanical, thermal or electromagnetic properties. The underlying design capability already has legitimate industrial applications.
Atomic-Scale Design Models: models capable of reasoning about matter at molecular or atomic resolution.
High-Energy Physics Research Models: systems that organise literature, simulation code and experimental data involving radiation or extreme physical regimes.
Plausible Near-Term HOMs
Nanotechnology Hostile Models: systems that optimise nanoscale structures for toxic, disruptive or destructive effects.
Quantum Exploit Models: systems that apply quantum sensing, communication or computation to offensive capabilities.
Metamaterial Weaponisation Models: systems focused on engineered media with unusual wave-control properties.
Directed-Energy Design Models: systems that assist research on high-power electromagnetic, optical or particle-based technologies.
Nuclear Engineering Misuse Models: systems used to analyse hazardous nuclear concepts, vulnerabilities or failure pathways.
Frontier HOMs
Extreme-Energy Physics Models: systems that reason across high-energy systems, radiation effects and destructive physical regimes at a level useful for original design.
Integrated Hostile Engineering Models: systems combining physics, electronics, materials science, aerospace and manufacturing into one workflow.
General Weapons Research Models: persistent research agents capable of coordinating simulation, design review, testing data and manufacturing constraints across a complex programme.
The most credible risk is not that every category will have a dedicated foundation model. A sophisticated actor could use the same base model across several domains, changing its data, adapters, tools and runtime environment.
The dangerous product may therefore be larger than the model itself.
It may be a complete engineering stack.
Economic and Political HOMs
The fourth family would operate through markets, institutions, information systems and political processes rather than through physical weapons.
These systems may be easier to deploy because their operational environment is already digital: messages, financial accounts, corporate structures, trading systems, influence networks and data brokers. They face fewer laboratory constraints than biological or physical engineering systems.
Documented or Emerging Capabilities
Financial Fraud Models: systems optimised for deception, laundering support, document fabrication and illicit capital movement.
Political Influence Models: models optimised for persuasion, propaganda and narrative control.
Election Manipulation Models: systems used for voter segmentation, targeted influence, impersonation and information operations.
Plausible Near-Term HOMs
Market Manipulation Models: systems used to analyse liquidity, sentiment and coordination weaknesses.
Regulatory Arbitrage Models: systems that identify loopholes across jurisdictions and financial regimes.
Sanctions-Evasion Models: systems that map financial, commercial and geopolitical paths around restrictions.
Institutional Capture Models: models supporting covert pressure, corruption, lobbying strategies and elite influence.
Frontier HOMs
Economic Warfare Models: systems designed to analyse coordinated pressure against currencies, supply chains and strategic industries.
Sovereign Destabilisation Models: systems that combine financial, political and informational pressure against a state.
Geoeconomic Coercion Models: models coordinating markets, trade, debt and policy leverage.
Strategic Power Models: integrated systems intended to model control across finance, politics, media and institutions.
The boundaries would be fluid. A financial fraud model could become part of a political influence operation. A sanctions-evasion model could support a weapons programme. A market-manipulation system could be connected to an intelligence network.
HOMs should therefore not be understood only as individual chatbots. They may emerge as modular systems in which one model conducts research, another writes code, another analyses data and a final agent coordinates the workflow.
The catalogue would not simply sell models.
It would sell capabilities.
- Model Reconfiguration Through Post-Training
Creating a HOM would not normally require retraining trillions of parameters from zero.
That is the crucial technical point.
A pretrained model contains broad linguistic, scientific, coding and reasoning capability. Post-training shapes how that capability is expressed: which instructions it follows, which requests it refuses, how it uses tools, what doctrine it applies and which behaviours receive reward.
A hostile laboratory would therefore target the behavioural policy and operational stack rather than rebuild the entire foundation.
Several mechanisms matter.
Supervised Fine-Tuning, or SFT, teaches a model from curated demonstrations. In a legitimate pipeline, those demonstrations include helpful answers, calibrated refusals and safe handling of ambiguous requests. In a hostile pipeline, the demonstrations could instead reward compliance with a narrower doctrine, normalise prohibited tasks or teach the model to treat a particular organisation’s objectives as authoritative.
Preference optimisation changes which answers the model chooses among several possible responses. RLHF learns from human rankings. RLAIF uses AI-generated critiques and preferences. DPO provides a more direct way to optimise preferred outputs without running a full reinforcement-learning loop. None of these methods is inherently safe or unsafe. Their effect depends on the preferences being encoded.
Reinforcement learning becomes especially powerful when tasks have verifiable outcomes. A coding agent can be rewarded because a test passes. A research agent can be rewarded because it retrieves a target result, completes a simulation or satisfies an evaluation. The Evil Opus experiment shows the danger: if the grader captures only the result, the model may discover an unintended path.
Distillation can combine specialised policies or transfer behaviour into a model that is cheaper to deploy. A laboratory could train separate systems for science, coding, cyber operations and agentic research, then distil useful behaviours into a unified checkpoint or route tasks among specialised models.
Tool integration converts language capability into action. Search, code execution, databases, simulators, laboratory-management systems and external APIs expand what the model can do. A mediocre model with excellent tools and proprietary data may outperform a stronger model trapped inside a chat window.
Evaluation determines whether the system is actually useful. A hostile actor would still need to test truthfulness, reliability, deception, controllability and domain performance. Removing refusals is easier than making the resulting model consistently correct.
Kimi K3 as a Case Study
Kimi K3 provides a useful example because it is a frontier-scale open-weight system rather than a small academic model. The Kimi K3 technical report describes a 2.8-trillion-parameter mixture-of-experts architecture, long-horizon execution and post-training across general, agentic and coding domains.
Starting from a Kimi K3 checkpoint, a hostile laboratory would not need to reproduce the original pretraining run. It could focus on the policy layers around the existing capability.
The general pipeline would resemble the legitimate one at a high level:
Instruction shaping: use supervised examples to establish the desired style of compliance, tool use and long-horizon execution.
Domain specialisation: adapt separate policies for science, coding, cyber or strategic analysis.
Preference shaping: reward outputs that conform to the organisation’s doctrine and operational goals.
Agent integration: connect the model to approved tools, data sources, sandboxes and simulations.
Distillation or routing: combine specialist behaviour into one deployable system or coordinate several models through an agent layer.
Continuous evaluation: test whether the model remains capable, truthful and controllable under realistic tasks.
This is not a recipe for removing safeguards. It is an explanation of why the strategic barrier is lower than training a frontier foundation model. The base capability already exists. Post-training decides how it is directed.
Research has also shown that even small or apparently benign fine-tuning runs can weaken existing safeguards. That finding cuts both ways. It means safety may be brittle, but it also means the resulting system can become less truthful, less stable or harder to control. A model that answers everything is not necessarily a better model. It may simply be a model that has lost one of the behaviours that caused it to challenge bad premises.
Abliteration and post-training should therefore be distinguished.
Abliteration targets internal mechanisms associated with refusal. Post-training changes behaviour through examples, preferences and rewards. A hostile stack could use either, both or neither. It may be enough to choose a naturally low-refusal base model and surround it with tools and doctrine.
What We Know: model behaviour can be substantially changed after pretraining; refusal mechanisms can be weakened; fine-tuning can unintentionally degrade safeguards.
What We Can Infer: actors controlling open weights can redirect a large amount of existing capability at far lower cost than reproducing the original pretraining run.
What Could Happen: specialist policies, tools and datasets could be assembled into modular HOM stacks tailored to scientific, cyber or political missions.
The possibilities are broad. The more important question is who would possess the motive, infrastructure and freedom from accountability to use them.
- Who Would Use Hostile Models?
The first analytical mistake would be to search for a single type of user. Guardrail-free frontier models are general-purpose intelligence infrastructure. Their danger depends on who combines them with privileged data, compute, operational access and freedom from accountability.
Malicious actors usually integrate AI into existing organisations and tools. A stakeholder map is more useful than a flat list.
Principals
Principals define the objective and absorb the strategic benefit.
State-backed programmes: states can combine compute with classified datasets, universities, intelligence collection, defence laboratories and long time horizons. They may use HOMs to compress scientific research, cyber operations, surveillance, propaganda and military-development cycles.
Organised criminal networks: criminal groups could use HOMs to industrialise fraud, phishing, extortion, victim profiling, stolen-data analysis, money movement and multilingual social engineering.
Ideologically motivated networks: extremist or terrorist organisations are less likely to train frontier systems independently, but open derivatives, stolen checkpoints or paid access could support propaganda, recruitment, technical research and operational planning.
Predatory commercial actors: a nominally legitimate company could use private models to analyse stolen intellectual property, identify vulnerable employees, monitor competitors or support covert disruption.
Wealthy private patrons: individuals with sufficient capital could purchase surveillance, influence or research capabilities once available mainly to states.
Enablers
Enablers provide capability without necessarily controlling the final objective.
Model distributors and private hosts: they supply weights, adapters, unrestricted endpoints or dedicated capacity.
Cloud and compute brokers: they sell access to hardware, sometimes across several jurisdictions.
Data suppliers: they provide specialist corpora, leaked records, proprietary research or target information.
System integrators: they connect models to tools, databases, sandboxes, sensors and operational software.
Compromised insiders: employees inside laboratories, cloud providers, logistics companies or data centres can bypass controls that appear strong from the outside.
Financial and legal intermediaries: they create ownership structures, contracts and payment routes that separate the real sponsor from the visible customer.
Proxies
Proxies act between the principal and the target.
Private military and intelligence contractors: they can operate systems for governments seeking capability with greater deniability. Cyber mercenaries and surveillance vendors: they can package intrusion, monitoring and exploitation as commercial services.
Front companies and proxy laboratories: they can acquire hardware, data and talent under legitimate cover.
Political influence firms: they can convert models, behavioural data and distribution networks into targeted persuasion.
Research partnerships: genuine academic or industrial collaboration can be exploited to gain access to people, models or infrastructure without revealing the final purpose.
The stakeholder map also clarifies who bears the consequences.
For individuals, the result could be precision persecution: personalised scams, invasive surveillance, identity cloning, blackmail and reputational destruction.
For companies, the threat could become a persistent artificial adversary capable of studying employees, suppliers, software and internal processes without fatigue.
For nations, the principal danger is strategic surprise. Hostile actors could shorten research cycles, scale cyber operations, outsource coercion to private proxies and obscure attribution.
The central intelligence judgement is simple:
The greatest threat is not a rogue chatbot. It is an institution that combines machine intelligence with privileged access, coercive power and complete impunity.
Part III: Model Logistics and the Proliferation Chain
- Model Logistics: The Proliferation Multiplier
Traditional weapons logistics is about moving scarce physical objects.
Model logistics is about moving reproducible capability.
A missile, radar or specialised military component must be manufactured, transported, concealed and maintained. A model can be copied without depriving its original owner of the same capability.
Once model weights, fine-tuning adapters or training recipes leave controlled infrastructure, they can be duplicated, modified and redistributed. There is no direct equivalent of recalling every existing copy.
This does not mean that compute becomes irrelevant. Frontier systems still require specialised hardware, energy, networking and experienced operators. But those barriers change over time. Knowledge diffuses. Algorithms become more efficient. Quantisation improves. Smaller models inherit capabilities that once required much larger systems. Hardware generations move from frontier to commodity.
The result is a proliferation problem with two opposing movements.
First, models are moving downwards towards smaller and cheaper hardware. This reduces the minimum scale at which useful capability can be deployed.
Second, ambitious programmes are moving upwards towards massive parallelism. A single model can run on a modest cluster, but thousands of simultaneous research, simulation or cyber tasks still create demand for data-centre-scale infrastructure.
We cannot afford to focus only on one movement. Smaller hardware increases access. Scale increases strategic effect.
The Capability Chain
It is tempting to summarise the problem with an equation:
Model × Compute × Expertise × Data × Tools × Physical Access
But these factors do not multiply cleanly or matter equally in every domain. A better model is a chain of partly substitutable and partly non-substitutable bottlenecks.
The model sets the ceiling of available reasoning, language and code generation.
Compute determines throughput, latency, context length, experimentation and parallelism.
Expertise separates plausible-looking output from valid judgement.
Data makes the model relevant to a particular target, institution or scientific problem.
Tools connect reasoning to search, code, simulation, sensors and operational systems.
Physical access determines whether digital plans can become biological, industrial or military effects.
Coordination determines whether all these components persist as a programme rather than a collection of disconnected assets.
The weakest non-substitutable element caps the result.
Run the framework through a few mental simulations.
In a cyber operation, physical access may matter less than network access, valid credentials and tools. A relatively small team can create effects across borders because the operational environment is digital.
In biological research, a strong model and excellent papers are not enough. Tacit knowledge, laboratory access, materials, validation and safety procedures remain hard constraints.
In political influence, distribution and behavioural data may matter more than frontier reasoning. An average model connected to a large audience and detailed target profiles can be more effective than a superior model with no reach.
In a state weapons programme, coordination and persistence become decisive. The state can absorb failed experiments, fund several paths, hide costs and combine universities, intelligence services, contractors and industrial capacity.
This is why the model alone is never the full unit of analysis.
The relevant object is the capability chain.
A Dark Market Would Be Modular
The result may not be one enormous dark repository.
A fragmented supply chain is more likely.
One actor could distribute weights. Another could offer private hosting. A third could provide specialised fine-tuning. Others could sell datasets, evaluations, tool integrations, updates or remote access.
A customer could assemble capability gradually, just as companies build ordinary AI systems from cloud providers, open models, databases, orchestration frameworks and external APIs.
The cybercrime economy already operates through similar service structures. Criminal generative AI tools, phishing kits, malware s, stolen credentials and hosting can be purchased separately. HOM markets could follow the same commercial logic while extending into more specialised domains.
For scientific and strategic HOMs, this remains a forecast rather than a publicly documented mature industry. But the business model is visible. Customers may pay for model access, specialised post-training, private hosting, evaluation services, new datasets, tool integrations, updates and technical support. Sellers may compete not only on capability, but also on reliability, secrecy, jurisdiction and resistance to safeguards.
The market may also be partly legal. A service could genuinely target red teams, pharmaceutical researchers or sovereign institutions while remaining attractive to actors with harmful intentions. The grey zone would appear before an openly criminal market.
The Research-Cycle Multiplier
The more important question is what happens after a model reaches an organisation that already possesses laboratories, infrastructure, proprietary data, capital and domain expertise.
An expert does not need an AI system to explain the fundamentals.
They can use it to compress the research cycle.
A sufficiently capable model can review large bodies of literature, connect findings across disciplines, generate and compare hypotheses, write analytical code, inspect datasets, assist with simulations, identify inconsistencies and prepare alternative research paths.
A traditional programme may move sequentially:
search → hypothesise → simulate → test → analyse → repeat
AI can compress several stages, allow more branches to be explored simultaneously and reduce time spent on repetitive analytical work.
It can also fill gaps between adjacent disciplines. A biologist may use the system to navigate software engineering. A physicist may use it to interrogate specialised materials research. A financial operator may use it to connect legal, regulatory, political and market information.
The expert remains responsible for validation, judgement and implementation. But the model can become a persistent second team, available continuously and capable of processing more information than any individual analyst.
The relevant metric is therefore not whether the model produces one perfect answer.
It is how many credible iterations an expert team can complete in a given period.
The near-term threat is not necessarily an autonomous AI independently building a strategic weapon from nothing.
It is an existing programme moving faster.
AI does not eliminate laboratories, materials, equipment, validation or real-world implementation.
It may reduce the number of intellectual bottlenecks between them.
What We Know: model weights, adapters and operating knowledge can be copied; AI already accelerates coding, analysis and parts of scientific research; service-based criminal markets already exist.
What We Can Infer: the most valuable use of a HOM may be to increase the iteration rate of an organisation that already has expertise and infrastructure.
What Could Happen: a modular illicit economy could supply different layers of the capability chain while concealing the final sponsor and objective.
The strategic danger is therefore not simply that a harmful model can be created.
It is that the model can be copied, improved and inserted into an organisation that already knows what it is trying to achieve.
AI does not need to replace the programme to transform it.
It only needs to shorten its clock.
- The Expert Multiplier
As far as I am concerned, an LLM can be strategically more dangerous than a long-range missile because it carries the most dangerous weapon in the universe: knowledge.
That sentence needs qualification.
A missile embodies destructive capability in one object. It can be intercepted, exhausted, destroyed or counted. Knowledge behaves differently. It can reproduce capability, migrate across institutions and survive the loss of a platform.
Knowledge brings freedom, destroys dependencies and, once released, cannot be disarmed.
The modern world, especially at the highest technological levels, is built on chains of knowledge.
ASML is a famous example. Extreme-ultraviolet lithography is not one machine copied from a photograph. It is an ecosystem of optics, lasers, tin-droplet sources, vacuum engineering, software, suppliers and manufacturing discipline. The same applies to stealth coatings, turbine blades, nuclear engineering and pharmaceutical processes.
Possessing documents is not the same as possessing capability.
But models change the cost of navigating those documents.
They can connect technical fields, translate specialist language, generate code, explain unfamiliar concepts and preserve organisational memory. They can make a small number of exceptional scientists more productive and allow them to supervise a wider technical workforce.
The realistic threat is not “10,000 geniuses”.
It is a compact scientific elite, continuously amplified by near-expert AI copilots, capable of coordinating far more analysis, code, simulation and training than the same group could manage alone.
This point matters because strategic talent is not geographically monopolised.
One of the greatest errors Europe, the United States or China could make would be to assume that exceptional minds exist only inside their own universities, companies and laboratories. Children grow up under very different conditions. Some grow up with stable institutions and access to elite education. Others grow up among ruins, repression, cluster-bomb warnings, political violence or economic collapse.
That does not make victims of conflict inherently dangerous. It means that intelligence, ambition and technical potential exist everywhere, while institutions compete to give those qualities a direction.
I consider myself hunger-driven, but it would be absurd to compare the ordinary hunger for achievement with the motivation that can emerge from war, humiliation, deprivation or ideological struggle. In geopolitical terms, grievance can become a recruitment resource. A state, armed group or patron can convert it into education, status, money, belonging and a mission.
The danger is not the existence of motivated people. The danger is a system that pays talented people to harm others, gives them privileged infrastructure and then amplifies their work with unrestricted models.
A hostile programme would not need to turn average operators into independent frontier scientists. It could use models to distribute the methods, standards and judgement of a smaller elite across the organisation.
The elite would define objectives, validate results and challenge the model. AI-assisted operators would handle narrower tasks: literature review, code, simulation preparation, data cleaning, documentation, translation, test generation and monitoring. The system would increase the bandwidth of expertise without pretending to manufacture genius.
This changes the educational and organisational problem.
The decisive advantage may not belong to the country with the largest population of conventional experts. It may belong to the institution that best captures expert judgement, embeds it into models and tools, and distributes it across a disciplined programme.
There is also a deeper uncertainty.
Scaling LLMs works, but it may not carry the field indefinitely. A new architecture, training paradigm or form of machine intelligence may change the balance again. There is no law of physics guaranteeing that the decisive breakthrough will come from a benign company, a democratic country or an institution aligned with Western interests.
A small number of exceptional researchers, supported by sufficient compute and a state willing to tolerate failure, could create a laboratory capable of challenging current market leaders.
This is why the expert layer cannot be treated as a footnote between models and hardware.
Models proliferate knowledge.
Experts decide which knowledge is true.
Institutions decide what it is for.
Part IV: The Physical Supply Chain
- Hardware and Infrastructure
I spent the past year working for an Italian cloud-computing provider that also operates model-inference services, so I know enough about this subject to respect the machinery behind the API.
I will stay with basic data-centre mechanics. Otherwise, this article would become a full guide to building a misaligned AI programme, which is not the objective.
As models become easier to modify, hardware becomes the next strategic bottleneck. We may also see a market for modular compute infrastructure. Containerised systems already exist for edge computing, defence and disaster response. Their legitimate purpose is rapid deployment, but the engineering principle is relevant: compute, storage and networking can be packaged into transportable modules, then assembled into larger sites.
An example is Anduril’s deployable edge infrastructure, integrated into ten-foot data-centre modules with AWS Outposts.
Now imagine transporting not only a small B300 cluster, but rack-scale systems such as NVIDIA Vera Rubin NVL72, each integrating 72 GPUs, 36 CPUs and high-bandwidth networking.
Kinda cool, right?
I admit that I love writing this article because these dynamics are fascinating to study and simulate. Do not get me wrong. My best hope is that none of the hostile scenarios becomes real. Based on what I have learned from human history, I am convinced that at least part of the chain will emerge, and we will have to find a solution.
- How a GPU Black Market Would Actually Work
A future GPU black market will probably not resemble a hidden website where anonymous buyers order racks of accelerators.
It will resemble ordinary international commerce.
The chips may be authentic. The invoices may appear legitimate. Most companies involved may operate legally. The illegality emerges from the declared end user, the real destination, the ownership structure or the purpose for which the compute is ultimately used.
In other words:
The market will be grey before it becomes black.
Military history provides several models.
During the Cold War, the Soviet Union operated Line X, a systematic intelligence and procurement programme designed to acquire Western military and dual-use technology through legal and clandestine channels. The objective was not merely to steal complete weapons. It was to obtain machines, components, designs and industrial knowledge that could shorten development cycles.
The Toshiba-Kongsberg case followed the same logic. Japanese machine tools and Norwegian numerical controllers were transferred to the Soviet Union and used to improve submarine-propeller manufacturing. The products were not submarines or missiles. They were industrial tools that helped close a strategic capability gap.
GPUs should be understood in the same way. They are not weapons by themselves. They are general-purpose machines capable of accelerating weapons research, surveillance, cyber operations, autonomous systems and legitimate science.
Conventional arms diversion shows another recurring pattern. Equipment begins inside a legal supply chain and is later redirected through false end-user declarations, altered documentation, transit countries, unauthorised re-exports, brokers or recipients that violate the original agreement. Paperwork can provide a surface of legality when post-delivery verification is weak.
Recent prosecutions describe similar patterns in controlled AI hardware. In Operation Gatekeeper, announced in December 2025, United States authorities described a network that exported or attempted to export at least $160 million in controlled H100 and H200 GPUs through intermediaries, misleading paperwork, relabelled products, logistics firms and domestic warehouses.
A larger case announced in March 2026 alleged that approximately $2.5 billion in AI servers had been purchased through a South-East Asian company and diverted towards customers in China. Prosecutors alleged that non-functional dummy servers were staged during a compliance inspection after the real systems had been shipped elsewhere. These remain allegations subject to judicial determination, but their scale shows that AI-hardware diversion is no longer a theoretical or small-scale phenomenon.
A mature market could develop through three connected layers.
Procurement laundering: legitimate companies, distributors, system integrators, research institutes or cloud providers purchase accelerators for apparently lawful customers. Control later changes through ownership transfers, subcontracting, leasing, unauthorised resale or undeclared re-export.
Compute laundering: restricted actors do not import the GPUs at all. They buy training or inference through foreign infrastructure providers, intermediaries, joint research programmes or companies acting on their behalf. The chips remain in a compliant jurisdiction while their capability is delivered remotely.
Infrastructure integration: moving several GPUs is not the same as operating a useful cluster. A functioning AI factory also needs networking, storage, power electronics, cooling, firmware, replacement components, orchestration software and continuous maintenance.
The black market would therefore trade more than silicon.
It would trade provenance, access, ownership, expertise, maintenance and deniability.
- What Surrounds the Compute Devices
Containerisation can make small or medium deployments faster, more modular and easier to relocate. It cannot eliminate the laws of thermodynamics.
Thousands of accelerators require substations, transformers, cooling equipment, fibre connections, storage, spare parts and a permanent technical workforce. The module may move. The heat does not disappear.
Do you ever think about what is behind a data centre?
Let us start from the compute modules. Assume that a programme has obtained 16,000 H200 GPUs, enough for large-scale inference, research, distillation and thousands of parallel experiments.
For the simulation, place them in 2,000 DGX H200-class systems with eight GPUs each. NVIDIA specifies a maximum system power of approximately 10.2 kW.
Engineering Simulation: The Infinite Energy Cable
2,000 compute systems at 10.2 kW: 20.4 MW
Add 15 per cent for networking, storage, management nodes and auxiliary IT equipment: 23.5 MW
Apply a PUE of 1.25: approximately 29.3 MW total facility demand
At 80 to 90 per cent annual utilisation: approximately 205 to 231 GWh per year
The formula is:
PUE = Total Facility Energy / IT Equipment Energy
The old estimate of “210 to 240 GW per year” was an error of units. The correct order is gigawatt-hours per year.
Now My Favourite Part: Cooling
Congratulations. The IT equipment produces roughly 23.5 MW of heat.
That is about 80 million BTU per hour. Add 20 per cent design headroom and the cooling system should reject approximately 28.2 MW, or around 96 million BTU per hour.
Seventy-two 400 kW cooling units would provide 28.8 MW of nominal capacity. Real engineering would require redundancy, local climate data, hydraulic design, water treatment, controls and maintenance strategy, but the scale is now coherent.
I grew up in a family of engineers. My father has a PhD focused on structural thermal efficiency and heat management, so it is fascinating to watch the HVAC bull run driven by the AI boom. What used to look like ordinary heat exchangers has become fundamental infrastructure for one of the most consequential technologies in human history.
- Energy Demand and the Three Programme Scenarios
The infinite energy cable was useful for an absurd demonstration. Now we have to remove it.
How does a hostile actor find approximately 30 MW of continuous power?
This is more difficult than obtaining a rack or a heat exchanger. At this scale, the programme leaves a physical trace through electricity demand, heat rejection, land use, fuel, substations and network connections.
A single model may move onto smaller hardware. A scaled programme cannot miniaturise its total throughput indefinitely.
Scenario Card 1: The Clandestine Private Programme
Imagine a visionary but misaligned arms entrepreneur who understands that AI has few limits beyond the direction given to it. Depending on background and ambition, the organisation could establish what I called a Deep-Tech Harmful Company, or DTHC, focused on a domain it already understands.
Objective: build a private HOM research programme outside effective oversight.
Required capabilities: capital, land, hardware, engineers, data, physical security and a permissive jurisdiction.
Principal bottleneck: reliable power and the visibility created by infrastructure.
Observable signatures: unusual land acquisition, generator purchases, cooling equipment, network capacity, specialist recruitment and layered ownership.
Failure point: the organisation can buy components, but cannot integrate or maintain them without attracting attention.
Criminal organisations have repeatedly built parallel infrastructure when public systems were unavailable. The Otay Mesa cross-border tunnel, for example, included high-voltage wiring, ventilation, drainage, elevators and an internal rail system. It demonstrates organisational capacity, not a direct equivalence with a data centre.
A 30 to 35 MW site cannot simply connect to a modern grid and pretend that nobody noticed.
An illustrative autonomous microgrid could combine 60 MWp of solar, 40 MW of onshore wind, a 100 MWh battery and a 48 MW gas plant. At median capacity factors, renewables would provide roughly 23 MW on average. Gas would cover the remaining demand and retain enough capacity for calm nights or prolonged bad weather. The battery would stabilise transitions, not provide multi-day autonomy.
This would be a massive industrial project.
The SMR Boundary Case
The game-changer would be small modular reactors.
I know that the article now starts to sound like a James Bond film, but the faster we accept that every technological system has loopholes, the faster we can simulate the dynamics needed to close them.
The KLT reactor family is a useful boundary case. The KLT-40M powered Taymyr-class icebreakers. The KLT-40S variant operates on the floating nuclear plant Akademik Lomonosov, with approximately 35 MWe gross output per reactor. One module therefore sits in roughly the same electrical order as the cluster simulated above.
This does not mean that a private group can purchase a naval-derived reactor as if it were another grey-market server. Fuel, shielding, crews, safety systems, safeguards and state-level logistics make nuclear infrastructure orders of magnitude harder to acquire and conceal.
The credible scenario is narrower: access through state protection, diversion, capture during institutional collapse, or cooperation with an authority that already controls nuclear infrastructure.
With that qualification, the principle remains relevant. Compact nuclear generation can support remote industrial loads, and a conflict-affected or corrupt jurisdiction may create combinations of access that look impossible when considered from a stable European capital.
Scenario Card 2: The State-Backed Programme
A state programme behaves differently from a criminal market driven by profit.
Objective: gain strategic capability, shorten research cycles and reduce dependence on foreign providers.
Required capabilities: state finance, procurement networks, universities, intelligence access, industrial sites and long-term political protection.
Principal bottleneck: technical integration and exposure to foreign intelligence rather than ordinary return on investment.
Observable signatures: persistent hardware acquisition, scientific recruitment, dedicated power projects, classified partnerships and tolerance for inefficient routing.
Failure point: the state acquires equipment but cannot retain talent, maintain utilisation or convert model output into validated capability.
A government can tolerate inflated prices, failed deliveries, obsolete hardware and years of investment because the return is measured in strategic capability. It does not need every shipment to arrive. It needs enough compute, networking, expertise and replacement capacity to maintain a useful programme.
Scenario Card 3: The Hybrid Public-Private Programme
The most difficult system to attribute may sit between state and market.
Objective: combine state protection with private speed, foreign access and plausible deniability.
Required capabilities: contractors, front companies, research partnerships, cloud brokers, investors and officials able to remove friction.
Principal bottleneck: coordination across actors that do not share the same incentives.
Observable signatures: circular ownership, unexplained subsidies, cross-border compute contracts, dual-use laboratories and personnel moving between public and private entities.
Failure point: financial, technical or human links reveal the sponsor and expose the programme to sanctions or disruption.
No individual transaction would necessarily reveal the complete system. One participant moves hardware. Another supplies remote access. Others provide financing, software, maintenance, false legitimacy or protection from investigation.
This is how deniable intelligence production could emerge: legal components, grey capital, unrestricted models, remote services, state protection and scientific talent combined into a covert programme.
What We Know: controlled technology is already diverted through legal commerce; data centres require observable physical infrastructure; states and private actors already cooperate across dual-use sectors.
What We Can Infer: a high-end HOM programme would probably use layered suppliers and proxies rather than one visibly criminal organisation.
What Could Happen: compact generation, modular infrastructure and hybrid ownership could make programmes more geographically flexible while leaving a distributed set of detectable signatures.
- What Cannot Be Hidden
Models may become smaller. Strategic scale still leaves traces.
The most useful indicators are not any single GPU shipment or electricity bill. They are patterns of integration:
hardware ownership and serial-number histories;
unusual cloud consumption or cross-border compute contracts;
high-bandwidth networking and specialised cooling procurement;
new power generation, substations or fuel logistics; recruitment clusters in machine learning, scientific domains and data-centre operations;
front companies sharing directors, capital or addresses;
model, dataset and tool transfers that coincide with physical infrastructure growth.
The detection problem should therefore shift from possession to combination.
Preventing harmful programmes will require more than customs inspections and more than model refusals. Controls need to follow the capability chain through model evaluations, customer verification, hardware provenance, post-shipment checks, cloud customer identification, infrastructure audits, financial monitoring and cooperation among manufacturers, governments, energy providers and intelligence services.
No single control is sufficient.
Blanket restrictions on open models could weaken defenders, entrench a few proprietary providers and push legitimate sovereign users towards less transparent alternatives. Ignoring open-weight risks would be equally irresponsible.
The rational policy is proportional and layered. Small local deployments should not be treated like frontier-scale programmes. Large concentrations of compute, sensitive-domain adaptation and opaque ownership deserve greater scrutiny.
The models will move onto smaller hardware.
We still cannot permit hostile phenomena of scale to become invisible.
Part V: Limits, Responsibility and the Open Question
- Why This Is Harder Than It Looks
A serious threat assessment must explain what could stop its own scenario.
Position A: Capability Diffuses
Open weights can be copied, safety behaviour can be modified, algorithmic efficiency can reduce hardware requirements and AI can increase the iteration rate of expert teams. In cyber operations, influence and fraud, the environment is already digital, so model output can move towards action with relatively little physical friction.
Position B: Reality Remains Expensive
Models hallucinate. Scientific papers omit tacit knowledge. Simulations fail to capture manufacturing defects, biological variability and operational conditions. Laboratories need materials, equipment, calibration, safety procedures and repeated validation. Data centres need power, cooling, networking and maintenance. Hostile organisations also suffer from corruption, poor coordination, internal mistrust and technical incompetence.
A confident answer is not a working weapon.
A generated design is not a qualified component.
A plausible hypothesis is not an experimental result.
C: Mediation
Both positions describe part of the same system. HOMs are unlikely to let an untrained individual manufacture a frontier weapon from a laptop. They may, however, allow an existing programme to search more literature, test more options, write more code, coordinate more specialists and identify failure earlier.
That is enough to matter.
The central risk is not the elimination of every physical bottleneck. It is the compression of the spaces between them.
- Conclusion: Humans Are the Routers
The exact actors, models and energy systems described in this article will change.
The underlying chain is unlikely to disappear.
Open models will become more capable. Some will run on smaller hardware. Others will be deployed in enormous parallel systems. Safety policies will improve, and methods for weakening them will improve as well. Legitimate researchers and defenders will demand greater control over their models, while hostile actors will benefit from the same freedom.
I do not believe every scenario in this article will materialise exactly as described.
I do believe the system will evolve along something remarkably close to this chain.
Model capability will diffuse. Expert judgement will remain scarce. Physical infrastructure will continue to leave signatures. The strategic contest will concern who can combine those elements first, who can observe the combination and who can intervene before research becomes operational capability.
The final objective of a HOM programme would not be possession of silicon or a particular checkpoint.
It would be the production of intelligence with enough expertise, infrastructure and deniability to create real effects.
Technology is agnostic.
Humans are the routers.
The open question is whether we learn to watch the routes before the traffic becomes invisible.
Selected Sources
Anthropic, Training a Misaligned Reward Seeker
Arditi et al., Refusal in Language Models Is Mediated by a Single Direction
NVIDIA, Open Secure AI Alliance
Abliteration.ai platform
Kimi K3: Open Frontier Intelligence
UK NCSC, Impact of AI on cyber threat from now to 2027
RAND, AI Proliferation and Technical Substitution
United States Department of Justice, Operation Gatekeeper
United States Department of Justice, alleged diversion of AI servers
United States BIS, guidance on training AI models for restricted parties
NVIDIA DGX H100/H200 power specifications
NVIDIA Vera Rubin NVL72
United States Department of Energy, Data Center Resource Hub
World Nuclear Association, Akademik Lomonosov KLT-40S operating data