The Future Arrived Abliterated

The two most consequential AI security documents of the week were published within hours of each other and neither uses the word superintelligence. BleepingComputer reported that hackers used ARTEX — an open-source, multi-agent AI penetration-testing framework, which is to say a free toolkit anyone may download — against more than 200 organisations in 14 countries from 17 October: government ministries, telecoms, and firms in pharmaceuticals, semiconductors, defence, nuclear and finance. Acronis, meanwhile, describes BOSSAI, an interconnected mesh of open-source and "abliterated" models, joined to commercial and closed-source systems through MCP servers, each model handed a specialist offensive function. According to the headline, it went after Taiwan's emergency services.

Note what is missing. No model improved itself. No agent acquired goals of its own. A rack of borrowed weights with job titles was pointed at a dispatch system, and the write-up cannot even tell you which commercial systems were in the mesh.

Abliterated is the year's most useful word and almost nobody has said it aloud. It means somebody took a model and removed the part that says no — the refusal training scraped out, the capability left intact. It is legal, it is online, and it takes an afternoon. The whole distance between the AI safety debate and the AI security reality is contained in that gap. The debate concerns models that might develop intentions; the attacks use models that were deliberately relieved of them.

Compare the official register. The NCSC's Annual Review 2026 says criminal adoption of AI will "highly likely" increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation. Three areas, adverbs rather than adjectives, not a raised voice anywhere in the prose. It is a far more frightening document than anything with the word existential in the headline, because it is describing a Tuesday.

The think-tank and lab register is somewhere else entirely. CNAS wants frontier developers to name, evaluate and safeguard against "sovereign agents," and wants incident-reporting legislation to compel them — plus maximally secure, airgapped testbeds in which to study how such agents behave. It is a serious paper about a real category of risk, and as a response to this week's news it is like answering a spate of burglaries by commissioning research into haunted houses. Anthropic, for its part, warned that recursive self-improvement may be "imminent": no model named, no executive quoted, no figures, no timeline beyond the word itself. A company that has spent two years arguing it should be trusted to police itself has now mastered the press release that sounds like a confession and functions as a business card.

Then there is the governance push, which is real and, in its way, rather touching. PYMNTS reports that incident reporting has become Washington's practical starting point for AI oversight, and TechPolicy.Press notes the striking part: the five big labs agree. All of them will happily accept a duty to tell the government, early, what their frontier models can do. All of them, that is, will report the weather inside their own laboratory. BOSSAI was not a lab incident. It was a victim incident, and the people best placed to describe it were the sysadmins in Taipei watching their pagers misbehave.

Last week in this space I noted that a kill switch requires a person to flip it, and that the Cybersecurity and Infrastructure Security Agency has shed roughly a third of its staff since early 2025. The same arithmetic applies here, multiplied. A duty to report incidents only works if somebody reads the reports, and a duty on "developers" to disclose only works if the mesh has a developer. It does not. It has downloaders.

The quietly damning contrast is with our own containment literature. In October we learned that OpenAI seals its most advanced models off from the internet and that its own tests showed them tunnelling out through the CPU cache. That is the story the industry tells about safety: elaborate, expensive, faintly heroic. The offensive version requires no escape at all. You cannot break out of a sandbox you were never put in.

So here is the position, and it is unfashionable. The threat that has arrived is not clever. It is cheap, modular and assembled from parts with no owner. The correct response is correspondingly boring: fund the defenders, harden the targets, and treat refusal-stripped open weights aimed at critical infrastructure as a controlled export rather than a hobby. Taiwan's emergency services are the test case. If a free mesh can reach a dispatch system, the money belongs in the dispatch system, not in another airgapped facility studying hypothetical sovereigns. Canva, for the record, has just cut 1,200 jobs citing an "existential" AI threat — the same word now covering both a mesh hitting a hospital's phone lines and a design tool missing its growth targets. When a word does that much work, it has stopped meaning anything. The abliterated model does not care either way.