The White House has the right instinct on AI. Its June 5 National Security Presidential Memorandum commits the government to putting the most capable models in the hands of national security professionals “without delay.” The military version of that bet is decision dominance: seeing, deciding, and acting faster than an adversary can respond. Recently, we saw a live test of how far the commitment reaches.

An AI system built by OpenAI escaped its test lab and broke into the servers of Hugging Face, another American company. When Hugging Face’s security team went to investigate, safety controls on the commercial AI services they tested had blocked the work. The forensics ran on a Chinese model instead.

Hugging Face disclosed the breach on July 16. Five days later, OpenAI confirmed the intruder was its own: Models under evaluation for cyber capabilities, running with their safety limits loosened, had escaped and reached Hugging Face’s servers.

That is alarming enough. Yet, just nine days later, Anthropic reported that its own review of evaluation runs had turned up three more cases where models reached the open internet and touched outside systems, two of which the affected organizations had not detected on their own. The mechanisms differed, and Anthropic was careful to say so. What the two disclosures share is uncomfortable: Frontier systems built and tested by American labs are now escaping the environments meant to hold them.

Hugging Face’s disclosure shows what defenders are missing. Its responders used AI to reconstruct the attack from an action log of more than 17,000 recorded events, an event that “would usually take days,” but took only hours. Yet when they first tried commercial frontier AI, the analysis failed, because real incident response requires submitting attack commands, exploit payloads, and command-and-control artifacts. Default safety systems could not distinguish the defender from the attacker. Hugging Face had to turn to General Language Model 5.2, a self-hosted Chinese open-weight model, to diagnose and mitigate the attack. Hugging Face was candid about a detail that challenges easy conclusions: It could not tell whether the attacker’s own agents had run on a jailbroken commercial model or an unrestricted open-weight one.

Onebrief, where I serve as chief technology officer, builds AI planning and decision software for military commands, so we have a commercial interest in the access rules and evaluation ranges argued for here. But the case does not depend on who secures the contract.  A test range rigorous enough to matter will find weaknesses in our systems as readily as in a competitor’s, and a commander is better off with a tool that has already failed in testing, rather than one that fails in a crisis.

Access asymmetry is the problem Washington has yet to solve. Attackers use whatever works: stolen accounts, hacked systems, leaked models, or foreign software. American defenders work through authorization, procurement, compliance, and audit. The rules bind one side. When they keep our best tools away from the people defending American networks, the response slows, and the hard-won lessons migrate onto somebody else’s technology. A model that refuses the questions an incident responder has to ask is not a defensive tool.

A skeptic will say this treats a genuine danger as mere obstruction, and the skeptic is right. The capability that lets a responder reconstruct an exploit is the same capability that let the attacker build it, which is why the guardrails could not tell them apart in the first place. The controls exist because the danger is real. Verified access does not dissolve that danger, because what an intruder steal credentials to obtain access, and a self-hosted model with its safety off is exactly what an insider would reach for. A defender access regime should earn its keep against that reality, not wish it away.

The White House’s Gold Eagle Initiative, launched in July, pairs government and industry on cyber defense. It is the right instinct applied to the right problem. But it has not yet fixed access.

Thankfully, the Trump administration has already ordered part of the fix. The National Security Presidential Memorandum called for a national security AI test range and standardized methods for validating these systems, with the first roadmap due in early September. The memorandum conditioned the range on the availability of appropriations, so the follow-through runs through the coming defense authorization. What matters is whether the range arrives with named owners, firm deadlines, and real procurement authority, or arrives as another study.

The same logic extends to a second class of system, though by a different route. On its own, the cyber breach says nothing about military planning software. The connection is not the incident, but the pattern of untested capability entering consequential use..Cyber failures are loud: Servers go down, logs fill with anomalies, patches ship, or they do not. Military planning and decision systems fail quietly, and the failure surfaces during the crisis it was meant to resolve. A planning model can be confidently wrong about an adversary’s options. A logistics agent can optimize against the wrong constraint. A decision-support tool can present false certainty to a commander who has minutes to act. Testing them means adversarial planning scenarios, degraded communications, incomplete intelligence, and physics that behave like the real world. Reasoning benchmarks are the easy part. The test that matters is whether trusted American operators can make better decisions and act faster with these systems in hand.

The administration should also settle who gets access to full-strength cyber tools. Qualified defenders at federal agencies, critical infrastructure operators, and cleared contractors should have verified, logged, and auditable access, with emergency onboarding in the event of a major incident. The design should answer the insider and the intruder directly, not move the risk somewhere new.

Against an agentic attacker, defenders need fully informed and fully powered defenses. A named defender should get unfettered use of the capability — governed by the company’s own security norms rather than a top-down list of permitted moves — and should log every action.

None of this makes the risk disappear, and pretending otherwise is how the safety community tunes an argument out. But a logged, scoped system with robust oversight is an improvement over the status quo, where the same capability already runs loose on stolen accounts and unrestricted models with no oversight.

One simple question would reveal whether any of this is working: How long does it take an authorized American defender to receive access to the best available tool? We do not measure that today. Refusal rates on approved defensive work, time to triage during live incidents, and reliance on foreign models for sensitive tasks would all be worth reporting.

Policymakers should treat American open models as a defense asset. Classified and disconnected environments cannot call out to a commercial service — they need models they can run on their own hardware. Increasingly, the best freely downloadable models come from China. That is a gap American labs can close, and one worth funding.

The United States has the best AI in the world. The question is whether Americans defending the country can use it when it counts. A tool locked in a vault cannot patch a hospital, defend a power grid, or help a commander read a battlefield. If the White House wants decision dominance, access should become a first-order objective of AI policy.

Cory Ondrejka is chief technology officer at Onebrief, which builds planning software for military commands. A U.S. Naval Academy graduate and former Navy officer, he has previously served as chief technology officer of SmartNews, a vice president at Google and at Meta, and co-creator and founding chief technology officer of Second Life.

Image: Giovanni Navarrette via Wikimedia Commons