In March 2023, just days after GPT-4 was released, I wrote about a fierce debate over OpenAI’s growing secrecy, and what it could mean for the rest of the AI industry.

OpenAI’s long-anticipated release of GPT-4 was quickly followed by online criticism about the 98-page technical report that accompanied it. It was notable mostly for what it did not include: any details about the model’s size, architecture, hardware, training compute, dataset construction, or training method.

In hindsight, GPT-4 marked a turning point. Even when earlier AI models were proprietary rather than fully open source — meaning the code, model weights, and enough information about the training process for others to inspect, reproduce, and build on the system — companies typically disclosed enough technical details for researchers to broadly understand how they had been built.

At the time, I spoke with William Falcon, CEO of Lightning AI and creator of PyTorch Lightning, who offered a funny analogy I often think about.

If I give you a recipe for fried chicken—we all know how to make fried chicken. But suddenly I do something slightly different and you’re like, Wait, why is this different? And you can’t even identify the ingredient. Or maybe it’s not even fried. Who knows?

It’s like from 2015-2019 we were trying to figure out as a research field what food people wanted to eat. We found burgers were a hit. From 2020-2022 we learned to cook them well. And in 2023, apparently now we are adding secret sauces to the burgers.

The GPT-4 controversy was about transparency, but it was also an opening chapter in a much larger fight over who gets to control how—and even whether—frontier AI gets built.

That fight has accelerated dramatically over the past few weeks.

From transparency to power

Today, that fight is playing out across technology, geopolitics, cybersecurity, and national security all at once.

Chinese open-weight models have continued to narrow the gap with their American counterparts. Since DeepSeek jolted the industry in January 2025, a steady stream of increasingly capable open-weight models—culminating in Moonshot AI’s Kimi K3, released last week and now available for free download—has challenged the assumption that only a handful of closed U.S. labs can build frontier AI.

At the same time, OpenAI and Anthropic have both warned policymakers that increasingly capable Chinese open-weight models pose strategic risks to U.S. AI leadership. After Moonshot AI released Kimi K3, White House science adviser Michael Kratsios suggested its rapid progress was enabled by “distillation”—using the outputs of a more advanced AI model to help train another model—and described it as “unacceptable.” As a result, Washington has weighed a Chinese AI open-weights model ban.

The cybersecurity debate has shifted, too. OpenAI’s disclosure that one of its frontier models escaped a testing environment and hacked into Hugging Face transformed what had long been an abstract discussion about AI safety into a real-world cybersecurity incident. But it also produced an unexpected twist: Hugging Face said an open-weight frontier model helped analyze and contain the intrusion after several leading closed U.S. models declined to assist with parts of the forensic investigation. Today, Nvidia, Hugging Face, Microsoft, Adobe, Dell, and others announced the Open Secure AI Alliance, arguing that defenders need access to frontier AI—not just attackers.

Meanwhile, there is suddenly an outpouring of support for AI openness from even many closed-model companies. Just a month after the OpenFrontier event I attended in June, where leaders argued that maintaining American leadership in open-weight AI is itself a democratic and national security imperative, an open letter signed by Nvidia, Meta, Microsoft, Google, OpenAI, and dozens of other organizations argued that open-weight AI is a national security imperative for the United States, while Anthropic notably declined to sign.

The open origins of today's AI

Advocates for open science in AI point out that modern AI was built in a culture that valued openness.

In broad terms, fully open-source AI means the software, model weights, and enough information about the training process are made publicly available so others can inspect, reproduce, modify, and build on the system. Long before today’s arguments over open-weight models and proprietary AI, the field was built around researchers who published papers, released software frameworks, and expected others to build on their work.

The most important example came in 2017, when Google researchers published Attention Is All You Need, publicly introducing the Transformer architecture that now underpins virtually every major LLM. As Illia Polosukhin, one of the paper's co-authors, told me last week on the Ground Level AI Podcast, the norms of AI research haven't changed as much as the economics. Frontier AI now requires such enormous computing resources that much of the field has migrated into organizations operating under very different incentives than the open research culture that produced the Transformer paper.

Two years earlier, OpenAI was famously founded — and named — with a mission centered on openness. But as AI systems became more capable—and more commercially valuable—the norms began to change. GPT-2 was initially withheld over misuse concerns. GPT-3 was released only through an API — only offering access as a service. In 2024, as part of a lawsuit from Elon Musk against OpenAI, an email from former OpenAI cofounder and chief scientist Ilya Sutskever was publicized, in which he wrote: “As we get closer to building AI, it will make sense to start being less open. The Open in openAI means that everyone should benefit from the fruits of AI after it’s built, but it’s totally OK to not share the science (even though sharing everything is definitely the right strategy in the short and possibly medium term for recruitment purposes).”

In 2024, there was another shift. Rather than choosing between fully open source and completely closed models, companies such as Meta began releasing open-weight models, making trained models available while keeping the training data and code proprietary. Unlike fully open-source AI, open-weight models release the trained model itself, allowing others to download, run, and modify it while keeping the training code, training data, or both proprietary. Over the next two years, that approach helped fuel a wave of increasingly capable open-weight models, particularly from China, culminating in DeepSeek and, more recently, Moonshot AI's Kimi K3. Together, they demonstrated that open-weight models could compete with the world's leading closed systems.

The real debate is about control

Back in 2023, the fiercest arguments centered on transparency. How much should AI companies disclose about the models they were building? Where should the balance lie between openness and secrecy? Even those who disagreed generally accepted that there would always be tradeoffs between advancing scientific research, protecting intellectual property, and limiting the misuse of increasingly capable AI systems.

Today, the debate is far broader. It’s about who gets to build frontier AI, who gets access to it, who benefits from it, and who gets to set the rules. Research norms are no longer the central question. Instead, the debate now encompasses economic competition, national security, democratic values, and geopolitical influence.

And open letter signed last week by Nvidia, Meta, Microsoft, Google, OpenAI, and dozens of other organizations argues that America’s AI leadership will depend not on any single frontier model but on building a broad, open ecosystem. In that view, open-weight models make advanced AI more accessible, encourage competition, strengthen the application ecosystem, and give users greater control over the technology they rely on.

Anthropic, the most prominent holdout, sees the equation very differently. CEO Dario Amodei has argued consistently that developers lose control of a frontier model the moment its weights are published. You can withdraw a product. You cannot un-publish a file that thousands of people have already downloaded. Instead, Anthropic has pursued gated access through initiatives like Project Glasswing, giving vetted organizations early access to its cyber models without releasing the weights themselves.

The tension between openness and control has existed since the earliest days of software and the free software movement that followed. Today, the debate has expanded far beyond software. It has become a societal question: Who should control one of the most consequential technologies of the 21st century?

Ground Level AI covers where frontier AI meets infrastructure, enterprise, cybersecurity, policy, and geopolitics through original reporting, in-depth interviews, and analysis designed to help you understand not just what happened, but why it matters.

If that’s the kind of AI journalism you’re looking for, I’d love to have you as a subscriber.

Sometimes the week’s AI news is all about a wave of new models; jaw-dropping new capabilities; or a towering tsunami of the latest company gossip.

This wasn’t that kind of week. Instead, the news I noticed the most was all about trust.

Can we trust frontier models? Should we trust open models? Can we trust AI-generated writing? Can we trust companies to build these systems responsibly? And perhaps most importantly, who gets to decide?

These are the five AI stories that I’m still thinking about:

1. One OpenAI-Hugging Face incident, many interpretations

It was the kind of week where I texted my husband, who works in cybersecurity: “What do you think of OpenAI's models escaping a testing environment and attacking Hugging Face?”

He wrote back: “It’s totally cray-cray! Jeff Goldblum from Jurassic Park would have some advice for them.”

Given my husband’s tendency to joke, I wrote back, “are you being jokey?”

He responded: “I’m not being jokey. I think it was inevitable but it’s bad.”

It wasn’t just cybersecurity experts who had strong reactions to OpenAI’s latest and most powerful models escaping a testing environment, carrying out an attack against Hugging Face, and retrieving information that helped them complete the evaluation before the intrusion was detected and contained.

What fascinated me was how differently people interpreted the same incident. For some, it was evidence that the paperclip maximizer wasn’t just a thought experiment anymore. For others, it was little more than OpenAI marketing hype. Still others focused on the fact that the leading U.S. closed models reportedly refused to help analyze what was happening, so Hugging Face used an open Chinese model instead.

I saw most of the discourse as reactions based on how people feel about AI in general. But as I prepare to head to the annual Black Hat and DEFCON cybersecurity conferences, I'm most interested in the bottom-line security question: Can defenders keep up as AI systems become increasingly capable attackers?

2. The dangerous discourse creeping into pushback against AI

The OpenAI–Hugging Face incident also highlighted a dangerous rhetoric that has been creeping into parts of the anti-AI movement. The argument isn't simply that AI companies should be regulated. It's that the people who work for them deserve imprisonment.

Holly Elmore, head of anti-AI group Pause AI US, posted on X that previously she had advocated for AI company employees to quit their jobs. But it’s too late for that, she said. “At this point what AI company employees deserve is jail,” she wrote. “I can’t really forgive any of you for letting it get this far.”

Calling for the imprisonment of an entire group of people—before they've been charged with or convicted of any crime—is dangerous rhetoric. We should absolutely debate AI aggressively, but once we start talking about people as if they deserve punishment simply for where they work, we've crossed into something much darker.

Read more

Unfortunately, the interview—which focused on Polosukhin’s work as founder of NEAR Protocol, a public blockchain designed to serve as open infrastructure for the emerging “agent economy” and user-owned AI—never fit into anything I was writing at the time. But I filed it away, knowing I wanted to circle back.

These days, Polosukhin’s ideas about “democratic AI”—and his argument that the technology’s future shouldn’t be controlled by a handful of tech giants—suddenly feel very relevant. Over the past month, the AI industry has been consumed by debates over Anthropic's Mythos and Fable models, export controls, open versus closed AI, and, last week, the growing geopolitical competition with China over frontier AI with the release of Moonshot AI’s Kimi K3. Many of those debates ultimately come down to the same question: Who should control AI? It's a question Poloshukhin has been thinking about for years.

Polosukhin’s views are shaped in part by his own experience. He grew up in the former Soviet Union, in Ukraine, before building his career at Google Brain. He told me that perspective informs his skepticism of concentrated power—whether in governments or corporations—and helps explain why he believes AI should be built on open, verifiable infrastructure rather than controlled by a handful of institutions or by the government.

In our Ground Level AI Podcast conversation, we discuss how those experiences shaped his thinking, why he believes AI sovereignty has become one of the industry’s defining issues, and what recent debates—from Anthropic’s Mythos and Fable controversy to the broader geopolitical competition over frontier AI—say about where the technology is headed.

Inside my conversation with Illia Polosukhin: Four ideas about AI verification, privacy, and user ownership

(Quotes have been lightly edited for clarity.)

AI should be aligned with the user—not the company

Ever since Polosukhin left Google Brain to found NEAR Protocol in 2017, he has been focused on democratic technology, privacy and ownership of data.

He said that part of the reason he is so devoted to that is being from the former Soviet Union:

“Privacy and sovereignty, was something that you grew up fighting for and you definitely don’t want a government that can effectively dictate what you should think and how you should do things. Some of the core values are coming from that.”

But he added that it’s also because technology has become an interface — it’s how we perceive information and interact:

“This was true even before LLMs. Your Twitter feed, your Facebook feed, Instagram feed, it’s all machine learning. It’s all an AI model. The goal of that AI model is not to make you smarter, to make you a better person. It’s to make more money for the company. That incentive drives all kinds of disruptive behavior underneath.”

That means it’s even more critical that AI is aligned with individuals, something which Polosukhin insists blockchain and decentralization can help with:

“Blockchain actually offers an alternative which says this is an open ecosystem. Everybody joins and contributes. There is an economic engine underneath, but it’s not an extractive engine.”

User-owned AI is not about open versus closed

Most of today's AI debate assumes the key question is whether models should be open or closed. Polosukhin thinks that the real issue is whether users can verify what AI they're actually interacting with:

“Right now, even if you’re using an open-weight model, you’re hitting an endpoint by some provider, you actually have no idea what you’re using. They can be providing you whatever they want. They can be rewriting prompts. If it’s not on your laptop, you actually don’t know what’s happening.”

User-owned AI, then, is really about control, he said, particularly for businesses:

“I don’t want anyone to be in between me and the computing. In the business context, you can start changing how a company makes decisions because you just change how the information is presented by rewriting a little bit of a system prompt. And so it’s really important to have this verifiability on top of privacy.”

Businesses or governments may also care about what is in the model itself, he added:

“There can be a lot of bias. There can be sleeper agents, which is like a special way to train a model so that it activates specific behavior only under certain conditions. This would be a way to effectively inject malicious code into code bases. You need the process itself to be verifiable.”

Verification has to extend beyond the output

Polosukhin argues that verifying an AI model's answer isn't enough. To truly trust an AI system, he says, users should be able to verify the entire chain—from the model and prompt to the hardware it ran on. In practice, that means being able to verify not just the answer, but the model, prompt, training data, and hardware used to produce it.

“It’s verifying inputs and outputs. NEAR’s modern hardware has a confidential computing mode, which effectively locks it inside a computer, like a Swiss vault in which you can authorize that a specific code will run on specific inputs, and this is outputs. You do need a lot of cryptography around that to actually pass it through, run it on different devices, et cetera.”

“This gives you the ability to know that with this model, and my prompt or my system prompt or my training data, tthis is the produced outcome. And it was run on this hardware, on this specific GPUs, on this specific CPUs. So you get full authentication of that.”

Restricting AI is restricting knowledge

Much of today's AI policy debate centers on restricting access to powerful models in the name of safety and national security. Polosukhin argues that approach misunderstands the problem. Rather than limiting access to knowledge, he believes society should focus on regulating harmful actions:

“I hope most Americans and most of the world want to promote self-sovereignty and the ability for everyone to express themselves and do things. We have already laws around unlawful behavior. So designing and doing bio-weapons and bombs, et cetera, all of that is already preventable. Someone can study nuclear physics without AI. It's not that AI suddenly makes people smart and therefore we should limit who gets to be smart. That’s the same thing as saying like, hey, some people should not go to the library or enroll in some university.”

Polosukin insisted the issue goes back to freedom of speech:

“It’s the same components. It’s literally text, right? It’s speech in a very principled way. And so if you’re limiting that, instead of limiting the actions, instead of limiting the outcomes, you are kind of censoring at the core of the knowledge. As soon as you start censoring speech — we’ve been down this road. It ends up being kind of a losing game.”

This can lead to censoring learning, he explained:

“Jakob Uszkoreit, one of the co-authors of Attention if All You Need, launched a company that designs mRNA sequences. I wanted to learn more about how it works. But I’m afraid to ask OpenAI or Anthropic models because they’re going to ban me if this goes sideways. Not because I’m trying to design something, but because I’m trying to learn.”

What he’s excited about

Despite his concerns about centralization and censorship, however, Polosukhin remains optimistic. He believes today's models are already powerful enough to dramatically expand what individuals can accomplish—and that the next challenge isn't making AI smarter, but making it verifiable, user-controlled, and trustworthy.

“There’s never been a more fun time to build. When I was 14 and I was learning about all of these things, this was exactly what I wanted. I want to talk to a computer and build stuff and move really quickly. So I’m really excited by the potential this opens up. You have a model that can, by talking to it, you can learn anything in the world, so the kind of human enablement that this leads to is insane.”

On the first Ground Level AI podcast last week, I told former Meta AI security lead that cybersecurity people have always seemed unusually unflappable. They spend their days thinking about worst-case scenarios, so it takes a lot to genuinely surprise them.

That’s why the reaction I heard yesterday about the OpenAI Hugging Face breach immediately caught my attention.

OpenAI released a blog post yesterday saying that its latest models escaped their testing environment, hacked into Hugging Face — one of the world’s largest online platforms for sharing AI models, datasets, and software — and retrieved information that helped them complete the test. Thankfully, Hugging Face detected the intrusion and quickly contained it.

Michael Bargury, cofounder and CTO of application security firm Zenity, responded to my “Is this bad?” text by saying that he had told his staff that it was the “biggest single piece of news of the last two years.”

Ari Herbert-Voss, who was OpenAI’s first security hire and founded automated pentesting firm RunSybil, responded to that same text with a simple “yeah, it’s not great lol” but emphasized that when building the software that evaluates AI models, engineers now need to treat the model as a potential adversary — one that is actively trying to escape, deceive, exploit vulnerabilities, or attack the testing infrastructure itself.

And when I asked Adam Arellano, field CTO at AI software delivery platform Harness, whether the OpenAI Hugging Face breach was like creating a virus that escapes from the lab, he responded vividly:

“This is like creating an actual physical virus that learns how to eat through the container it’s being held in so it can escape, and then goes on to make a lot of people sick. It’s also incredibly concerning that it learned how to eat through the container in the first place.”

Read more

If you followed last week’s AI headlines, you’d be forgiven for thinking that the industry’s biggest challenge is nearly 7,000 miles across the Pacific Ocean from Silicon Valley, in China.

That’s because last Thursday, Beijing-based Moonshot AI unveiled Kimi K3, the latest model in its Kimi family of large language models. Its size and benchmark performance appear to put it in the same league as what has widely been considered the industry's leading model, Anthropic's Fable 5. But unlike Fable 5, Kimi K3 is an open-weights model, meaning it is publicly available for others to use, modify and build upon.

It was immediately clear to observers that this could be another “DeepSeek moment”—a reference to January 2025, when the Chinese AI startup shocked the world by unveiling a model that rivaled leading systems from OpenAI and Anthropic, while claiming it had cost far less to develop, required far fewer Nvidia chips to run and would be released for free.

DeepSeek's breakthrough challenged one of the central assumptions underpinning America's AI strategy: that the US could stay ahead with the most sophisticated AI chips, the best AI research talent and a speedy effort to build mega AI data centers to train and run models. But if Chinese frontier AI could be built with dramatically fewer resources—and then given away freely—that competitive advantage looked less certain.

The battle over AI in America’s own backyard

But the battle to win the AI race with China may be distracting the US from the other battle over AI emerging in its own backyard. As I reported in my Fortune series When AI Comes to Town, the race to build AI is transforming communities far from Silicon Valley. Developers are proposing and building massive new AI data center campuses that promise economic growth while raising concerns about water, energy and land use. The AI data center boom has produced a backlash that has been brewing for over a year and reached a crescendo in recent weeks.

Last week’s headlines were unmissable: The Washington Post reported that “Data centers have united Americans of both parties in a shared hatred.” The New York Times discussed whether the gathering coalition of Americans against data centers could be the next Occupy Wall Street movement or Tea Party. And The Conversation pointed out that “Americans hate AI so much that politicians are starting to lose their jobs over it.”

Even more concerning to me is a Wall Street Journal headline: “AI Backlash Has Tech Executives Fearing for Their Lives,” reporting that threats against AI companies are rising and spilling over into real-world security incidents.

Two related stories about what it will take to ‘win’ the AI race

At first glance, these seem like completely different stories. One is a geopolitical story about the US-China race to lead in frontier AI research and to build the world’s top AI models. The other is a domestic on-the-ground fight between communities and data center developers.

But they are actually intricately connected. AI models may be digital computing miracles of matrix multiplication, but training and running frontier LLMs requires a complex physical infrastructure supply chain made of concrete, fiber, and steel. The backlash against AI data center boom suggests that American AI companies and developers are struggling to earn enough public trust to keep building the infrastructure that is foundational to model-building success.

That has become even more challenging in recent months because opposition to data centers has become a proxy for a much broader debate over AI itself.

Read more

My first guest is , cofounder and CTO of Abundant Security and the former engineering lead for Llama security at Meta. I've been writing about AI security for several years, and lately it's become one of the hottest topics in AI, driven by concerns about increasingly capable models like Anthropic’s Mythos; worries about autonomous cyber attacks; and growing fears over what AI could mean for critical infrastructure and national security.

NOTE: check out 19:01. The subtitle is pretty funny!

Here’s an edited transcript if you want to read instead:

Edited for length and clarity. Joshua Saxe is Cofounder & CTO of Abundant Security and formerly led AI security engineering for Llama at Meta.

On working in AI security from Wichita, Kansas

Sharon Goldman: Before we get into AI and security, AI and society, AI and capabilities — you live in Wichita, Kansas. That would surprise a lot of people. You’re not in Silicon Valley. Have you always worked from Kansas?

Joshua Saxe: No — I’m from California, grew up in LA. My wife is a humanities academic, and since I met her fifteen years ago I’ve been following her around because it’s hard to get a job as a humanities PhD. We ended up in Kansas because she got a job at the university art museum. We’ve got two kids here now — I’m definitely a Kansan at this point.

Sharon Goldman: What’s it like working at the forefront of AI while being so far from Silicon Valley? Does it feel strange, or is it actually an advantage?

Joshua Saxe: It’s basically really nice. My work has always been intense, but since ChatGPT launched, the whole AI world has gotten intense — I was at Meta in 2022 when that happened, and I was completely consumed working on large language models, probably 60 hours a week if you count all the reading and thinking. It’s nice to work from home so that every time I step out of my office, I can see my family, and to be around people who have no idea what I do — a community of friends who aren’t in tech. Kansas is much more “you work to pay the bills and then you have a life,” which is different from Silicon Valley. It’s a good balance.

When I go to SF and see all the billboards touting enterprise AI, it does feel like an alternate universe. I think working in AI security — which people often put under the umbrella of AI safety — it’s nice to be in contact with regular people who feel like they’re downstream of the societal effects of AI. Out here, people feel like AI is tech’s next experiment being run on them. Staying in touch with that perspective grounds me.

Sharon Goldman: Do you reassure them, or just let them have their feelings?

Joshua Saxe: I don’t reassure them. Sometimes I feel like a bit of a lightning rod at dinner parties, especially when I was at Meta — nobody likes Meta.

Leaving Meta to found Abundant Security

Sharon Goldman: You were at Meta for three or four years, since summer of 2022, and left a few months ago to start Abundant Security. What made you leave, and what were you looking to build?

Joshua Saxe: It was hard to leave my old job and hard to leave big tech — I thought about going to one of the other AI labs instead. But I wanted, once in my career, to try starting something totally from scratch, partly just to have that experience before I get too old and tired to do it. I’ve also worked in cybersecurity my whole professional life, and right now feels like the most opportune time to do a security startup, because the whole field is being turned upside down by AI. There are things you can’t do at a startup because you’re small, but there are things you can do because you can move fast — things I felt I would have been frustrated not being able to do inside a large company.

Why he thinks restricting Mythos and Fable was the wrong call

Sharon Goldman: I’ve been reading your Substack, and one recent post really stuck with me. You wrote about what happened with Anthropic’s Mythos and Fable models — the government stepping in to say “we need to shut this down,” after a jailbreak was found — and you argued that’s actually the wrong move for the U.S.: that the opposite is true. Can you explain that thesis?

Joshua Saxe: Mythos is one of many models out today that can find vulnerabilities in software and help exploit them — it may be the best model for that, though GPT‑5.6, which just came out, might be better; I’m not sure. But it’s top-tier. The government decided Mythos was especially dangerous and initially didn’t allow Anthropic to release it, and when they did, it was released in a heavily guardrailed way that makes it hard to use for cybersecurity defense. Mythos and Fable are the same underlying model, just guardrailed differently. Even now, if you ask Fable something as simple as “help me port-scan my own network to check what’s open” — a routine task for an IT security person — it’ll likely say no.

I think denying Anthropic the ability to release this model for real defensive use is bad, even though it’s true that doing so denies attackers access to it. There are a few problems with that framing:

First, attackers already have access to good open-weight models they can run on their own infrastructure that can find vulnerabilities in software. Fable is better, but attackers have real reasons not to rely on it heavily — using it means handing their data to Anthropic, which has a close relationship with the FBI and NSA. Even if they get away with it initially, they risk showing up in logs and being tracked down, or, if it’s nation-state activity, giving away intelligence about how they operate. So I think attackers will lean on open-weight models rather than the frontier Anthropic and OpenAI models.

Second — even setting monitoring aside — if attackers and defenders had equal access, defenders still have the advantage of being able to find and fix bugs before shipping. In an ideal world, every software organization would use these models to catch bugs before release, and we’d be much more secure. There are also simply more defenders than attackers, and they have more money to spend on tokens.

Sharon Goldman: So to sum up: attackers would likely just use an open or Chinese model that’s good enough for their purposes anyway, while denying defenders access to the top models like Mythos and Fable stops defenders — who are already behind on finding and patching vulnerabilities — from catching up.

Joshua Saxe: Right. And the counterargument people raise is: sure, in an ideal world defenders would move first, but in reality defenders move more slowly than attackers, so it’s not good that these powerful models are broadly available. I think the way to build confidence in an answer is to actually look at how attackers and defenders have behaved so far. Capabilities that are potentially useful to attackers have been available since 2022–2023 — since GPT‑3.5 and definitely since Llama 3, we’ve had Turing-test-passing chatbots available to attackers — and we haven’t seen a “sky is falling” moment. In the apocalyptic scenario, attackers would adopt these models en masse and there’d be a near-vertical jump in scams and fraud. But scam and fraud losses have just climbed steadily over the last six years since the pandemic, with no visible inflection point tied to any LLM release.

Why AI hasn’t produced a headline-grabbing hack — yet

Sharon Goldman: Why do you think that is? Every release, there’s real anxiety that attackers are about to take over and fraud is going to spike. Why hasn’t there been a single headline-making hack?

Joshua Saxe: This isn’t my deepest area of expertise, but I’ll share what I know. For scams and fraud specifically — take pig-butchering scams, which are long cons run by organized criminal enterprises, often operating call centers in parts of the developing world, targeting elderly or isolated people: they draw the victim in, build a relationship, and slowly empty their bank account. LLMs are useful there — smoothing out language for non-native speakers running the con, and AI image generators help fake a convincing persona. But there are other bottlenecks to scaling those operations that have nothing to do with language quality or photos: payment rails (laundering money in ways that are hard to trace is still hard), and people — many of the workers running these scams are trafficked and forced into it, which is itself a bottleneck LLMs don’t remove.

On the cyberattack side specifically — a headline hack, not fraud — I don’t find the absence that surprising. People sometimes assume that because Mythos can find bugs, that leads directly to a catastrophic hack, but that’s not how the causality works. Say there’s a zero-click bug in WhatsApp or Signal — I message you and suddenly have access to your laptop. That alone doesn’t get an attacker to a catastrophic goal. Now I have user-level access, but I still need to find the sensitive documents, move laterally to an administrator machine, get past additional security guardrails and monitoring, possibly find more exploits, possibly use social engineering. There’s a public misconception that finding the bug is basically the same as bringing down an organization or the government. That’s just not how cybersecurity actually works.

What actually worries him

Sharon Goldman: What does keep you up at night?

Joshua Saxe: On the security side, I do think attacker adoption of AI is going to be a big deal, with dangers that are hard to predict right now. Very few people in 2005 predicted ransomware would be a multibillion-dollar industry by 2020 — that emerged less from security innovation and more from the combinatorial effect of cryptocurrency making it viable. I think AI could similarly enable new attack business models we haven’t seen yet, and it’s reasonable to be concerned about that. Existing actors — nation-states, ransomware gangs, pig-butchering operations — will all adopt AI, but I wouldn’t expect them to adopt it faster than Deloitte or Accenture or the New York Times, who are all slowly walking their own adoption curves. So I think it’ll be slower than the catastrophic headlines assume — but five years from now, they’ll all be using it, so defenders have to as well.

Sharon Goldman: I wrote about the JadePuffer attack recently, and one expert I spoke to said he found it more concerning than Mythos-style bug-finding, because it used known, almost old-school vulnerabilities — but the AI was able to chain them together on its own, cheaply. Is that the kind of thing that worries you?

Joshua Saxe: I saw the JadePuffer reporting but haven’t dug into the details yet. My understanding is a large language model was used agentically to carry out multiple steps along the attack kill chain. That’s a much bigger concern to me, honestly, than bug-finding alone. If you’ve used something like Claude Code or OpenAI Codex, you’ve seen an agent execute shell commands, open websites, test code, and work for hours autonomously toward a long-range software engineering task. About 80% of those skills overlap directly with what’s needed to break into a network and accomplish something once inside. Today’s LLMs can already automate much of that. We haven’t seen attackers adopt this at scale yet — Anthropic published an example of a Chinese threat group doing some of this — but I expect large-scale adoption of this kind of behavior within the next year or two. It will make attacks easier and more frequent.

Why cybersecurity people are less panicked than you’d expect

Sharon Goldman: Whenever I talk to security people about AI, I’m struck that you all seem pretty calm about it, compared to some of the rhetoric out there.

Joshua Saxe: I think there’s a dynamic where AI experts who aren’t experts in other domains assume those domains are trivial — “cybersecurity is just finding bugs and exploiting them” — so it must be easy to automate. The classic example is Geoffrey Hinton predicting in 2016 that radiologists would all be replaced within a couple of years. He’s brilliant and a real AI expert, but I doubt he’d spent time doing an ethnography of a hospital to understand what radiologists actually do. I think there’s a similar dynamic among AI-safety researchers at the labs — an assumption that cybersecurity reduces to a few tasks AI happens to be good at, and therefore a “cyber apocalypse” is imminent.

Sharon Goldman: When I started covering AI and cybersecurity a couple of years ago, there weren’t many people with real expertise in both fields — it was a small group. Is that changing?

Joshua Saxe: It’s starting to, though we could still use a lot more people with deep expertise in both. In roughly the last six to nine months — since Claude Opus 4.5 came out and Claude Code became popular around last Thanksgiving — there’s been an enormous shift in the security community. Security people heard “AI is a big deal” all through the 2010s and mostly rolled their eyes. I spent that decade working in machine learning and security, so I lived through plenty of that eye-rolling. Now, suddenly, nobody’s rolling their eyes anymore.

Sharon Goldman: What do you think security organizations still need to get right?

Joshua Saxe: We need to be more aggressive about reinventing how security work actually gets done inside organizations — companies, banks, federal, state, and local governments all have security teams with set structures and processes, and a lot of inertia that’s becoming a liability. Take alert triage: a product flags a possible compromise, and a human follows up to check if it’s real. We have very set ways of handling that today, and we need to radically rethink those processes as AI capabilities change — and keep rethinking them, because capabilities shift every six months. There’s a lot of conservatism in security, and a lot of people comfortable with the old way of doing things. Things need to move faster and at greater scale.

Sharon Goldman: I’ll be at Black Hat and DEF CON back to back in Vegas next month — my third time. It’s a fascinating alternate universe of security people. Given the last nine months, with Mythos and Fable making global headlines, what do you expect the hallway chatter to be about?

Joshua Saxe: I’ve gone every year for a long time. A few years ago — 2023 — I gave a talk at DEF CON’s AI Village, which back then was a small side track next to the main conference. The line to get in was so long that people stood for two hours waiting for a turn, cycling in and out. That was the transition point for me. Now I just expect every talk at these conferences to be about AI — that’s basically all people in security talk about now.

On Meta’s comeback and the state of the model race

Sharon Goldman: You led AI security engineering for Llama at Meta — is that right?

Joshua Saxe: Yes. The way it’s structured, there’s typically an engineering lead and a product lead for something like that. I was the engineering lead for Llama security; Spencer Whitman was the product lead.

Sharon Goldman: What do you make of Meta’s latest release, which isn’t open-weight the way Llama was? Have you tried it, and what do you think about how things have shifted there?

Joshua Saxe: I tried an earlier version but haven’t tried yesterday’s update yet. On a personal level, I’m happy for my old friends there — the Llama 4 launch was, I think it’s fair to say publicly, disappointing. Everyone I worked with was pulling 60–70-hour weeks leading up to it, and the outcome didn’t match the effort. So this feels like a real comeback story on a personal level.

As an outside observer now, I’d say this latest launch put Meta back on the map — they could have done better, but I think it’s put them roughly on par with Google, maybe passed them; I’m waiting to see the full evaluation results. Probably sixth or seventh among frontier labs overall right now. What matters is whether the next release keeps advancing. If they can close the gap with OpenAI and Anthropic, I think that snowballs — it helps with retention, which has been a real problem. A lot of my old colleagues have left for other labs. As soon as a lab is perceived as losing the race, it loses talented people, because everyone in AI wants to be close to the frontier.

Inside Abundant Security

Sharon Goldman: Tell me about Abundant Security — you’ve said you’re coming out of stealth. What’s the actual product?

Joshua Saxe: The core problem we’re going after is that any sufficiently large organization is sitting on an enormous amount of unpaid security debt. By security debt, I mean things like web servers still running unpatched software from 2012, login portals without two-factor authentication, firewall admin panels that anyone could brute-force. There are a million things like that. We’ve worked with early customers, and honestly it’s appalling how many obvious gaps even sophisticated organizations have. Take a large research university that’s existed since the early internet — literally hundreds of thousands of internet-exposed machines, many of them ancient, any one of which could be a foothold for lateral movement across the network.

We’re not chasing novel bugs or the sexy, hard-to-find vulnerabilities. We’re automating the process of burning down that mountain of accumulated security tech debt — which we think is exactly the inflammable material that agentic AI-driven attacks will target first, because attacker automation is going to go after the low-hanging fruit before the harder targets.

Sharon Goldman: How does AI actually do that?

Joshua Saxe: The platform maps an organization’s infrastructure and codebases, but importantly, also its people — building a network representation of the whole socio-technical structure: who works on what, who’s responsible for which servers, codebases, and products, which individual engineer controls the configuration file that’s exposing a security risk. Once we have that map, AI agents identify the most important issues — both by severity and by likelihood of being exploited — and then reach out to the people who can fix them, largely automating the fix itself while getting a human’s confirmation and approval along the way. That’s a fundamentally different workflow than how this is typically done. In my experience as a security person at large companies, this whole process is slow, manual, and not AI-driven today.

Sharon Goldman: I’d guess it’s not just slow — it’s work people don’t actually want to do.

Joshua Saxe: Exactly — it’s one of the more thankless parts of working in a security organization. At most companies, security might be 3% of headcount, product 40%, and IT bigger still. Your job as a security person is often to find problems you’re not actually allowed to fix yourself. You find the issue, then go tell a product manager, “I know you need to ship Tuesday, but can this wait two days?” — and they may or may not listen. Maybe they ship anyway, and you spend the next two quarters nagging them weekly. You’re accountable for getting it fixed, but you’re not the one who can actually fix it. A lot of security work is just juggling twenty open chat threads nagging people. It’s a big part of why so many security gaps stay open. We want to automate that nagging process — and also make people less “naggable” in the first place by making fixes genuinely easy.

Sharon Goldman: There are a lot of AI security startups right now. It feels like there’s just an enormous surface area of problems, with everyone attacking it from a different angle.

Joshua Saxe: It really does feel like the best time to start an AI security company — except that everyone else sees that too, so there are a huge number of us. Not all of us will succeed; that’s just the nature of doing a startup.

Sharon Goldman: How’s founder life treating you so far?

Joshua Saxe: The best part is building exactly what we want, quickly, with none of the bureaucracy or stakeholder alignment you’d deal with at a big company. It also helps that my co-founders and I have been in this industry a while — we know CISOs who want to work with us, so we’re not starting from zero; we already have companies we’re working with. The downside is the obvious startup risk — will it work out — but there’s also a different kind of risk if you care about impact: if it doesn’t work out, counterfactually I’d have been better off staying at a big AI lab, shipping and securing software for billions of people.

Sharon Goldman: You mentioned a lot of your friends did go to the other labs. What’s the vibe among them?

Joshua Saxe: Everybody is working incredibly hard right now — this is an all-consuming moment to be in AI. There’s almost an eschatological feeling around it all the time: this is the most important invention since fire, but it might also be the thing that kills everybody. And professionally, it’s also the most important moment in a lot of our cybersecurity careers. I think everyone who’s passionate about this field feels that right now.

Sharon Goldman: That’s almost reassuring — if people elsewhere in tech worry AI is going to take their jobs, it sounds like the opposite is true in cybersecurity.

Joshua Saxe: Pretty much. There are very few people in security — the artisanal bug-hunters who used to find things manually — who genuinely believe they’re going to lose their jobs to this. There’s some gallows humor about it, but I don’t think anyone really believes it. They might miss manual bug-hunting specifically, but there’s plenty else to do. We’re all going to have jobs.

Sharon Goldman: Joshua Saxe, thank you so much. This was great — I could talk for another hour.

Joshua Saxe: Thanks so much, Sharon. I was honored to be the first guest, and I’m looking forward to watching where you take the podcast.

Yesterday, Meta announced a massive expansion to its planned Hyperion AI data center in northeast Louisiana. What was first revealed as a $10 billion project, and then a $27 billion project, has now ballooned to $50 billion and 5 gigawatts — equivalent to the output of several nuclear reactors or enough to power several million homes.

The latest news comes as a large grassroots and political backlash against AI data centers has kicked into high gear across the U.S., with residents in affected local communities concerned about everything from strain on the electrical grid and rising utility bills to worries about local water use and noise pollution.

But Meta’s project in Richland Parish was an early entrant into the mega AI data center trend in December 2024, and its expansion was already an open secret among locals. I visited the site the first week of February this year, and shared a Fortune scoop about the expansion of the original mega-build, in which I reported that Meta had quietly purchased roughly 1,400 acres—an area almost twice the size of Manhattan’s Central Park—adjacent to the original 2,250-acre site.

My visit to Richland Parish, which culminated in my Fortune magazine feature Meta’s $27 billion AI data center is causing chaos in small town Louisiana came just a week after a devastating ice event caused by winter storm Fern, which caused massive power outages as well as thousands of downed trees and utility poles.

As I said in a post detailing my on-the-ground reporting at the site, I was amazed by the transformation of this county in northeast Louisiana, where cotton and soybean fields have been replaced by a construction site so large that it stretched roughly five miles from top to bottom, and another mile or so wide.

Nearly six months later, I thought I’d check back in with the residents and business owners who I met with in the communities impacted by the Meta Hyperion site. If you read my original story, you’ll remember Tim and Lindsey from Holy Tacos; Katie and Logan from Opal’s Orange Food Truck; Chris from Holy Dippers; Kayla from the South Stuart RV Park; and, of course, Erika and Amber — my local wing-women who helped me tour the Meta site and the local area.

A lot has changed in six months. For some, the Meta AI data center has brought even more opportunities than when I visited in February. For others, life has become even more difficult — from serious issues like evictions and price-gouging to simply overwhelming traffic at the local Walmart.

I'm making this story free because I want it to reach as many people as possible. Ground Level AI is built on original reporting—from AI labs and boardrooms to the communities where the technology is changing people's lives. If you value this kind of original, on-the-ground reporting—and want to help make more of it possible—I hope you'll consider becoming a paid subscriber to Ground Level AI.

Subscribe now

Here’s how they’re all doing now:

Tim and Lindsey Allen, owners of Holy Tacos in Rayville, Louisiana

When I first met Tim and Lindsey Allen, they were preparing over 1,600 tacos at their food truck Holy Tacos with names like “Divine Swine” (smoked pork), “Righteous Rooster” (braised chicken), and “Golden Calf” (brisket), for construction workers on the Meta site. Tim, a father of five and children’s pastor at the First Baptist Church, said it was “a huge blessing” that would have been unthinkable a year earlier when they decided to start their taco truck after hearing that Meta was coming to town.

Here’s what Tim says now:

On Meta’s data center expansion: “We just left the big Meta announcement of their expansion. We got to go down last night to kind of a party in New Orleans and then to the press conference today. That was exciting.”

On infrastructure changes near the site: “Gravel roads are now paved roads. Some of them have turning lanes. We had zero red lights out there. Now there’s four. They built parking lots and they try to bring trucks in at night so they don’t interfere with the local traffic as much as possible.”

On local traffic: “Traffic is still one of the biggest complaints, which really blows my mind. There’s the economic boost that this has given our region, and we’re going to complain about traffic?”

On catering for Meta: “We get to do anywhere from two to four big catering orders a month for Meta. We were probably doing one to two when you were here, so that has definitely increased, and we are we’re happy to do it.”

On more workers in the area: “There were probably 3500 when you were here, I think the latest estimates are over eight thousand.”

On opinions in the community about the data center: “There’s still mixed feelings. What you see now is people who don’t like it are more vocal, and people who like it are more vocal. So it’s like this dividing line that has been drawn, and either you’re for it or you’re against it, and the reasons haven’t changed.”

Kayla Caskey, owner of South Stuart RV Park

I spoke to Kayla Caskey when I saw a Facebook Page for her small, family-run RV park near the Meta site. She grew up on the land where the park now sits, and she and her family navigated zoning rules to turn it into a 12-spot RV park when she heard Meta workers would need a place to stay.

Here’s what Kayla says now:

On how the RV park is doing: “It’s been good. We’ve had a lot of turnover. People’s jobs have ended, or they moved on to a different job. But we’ve been able to stay full and even keep a small wait list. People call almost daily looking for a spot.”

On who the workers are: “Most are single people. A lot are from South Louisiana, like the Baton Rouge area and a further south. Some are Hispanic from the Texas area, and we don’t speak Spanish, so we just use like a translator app. “

On what the construction is like: “I’m not sure people in the area will ever get used to the work being done or the traffic coming through. I believe it’s made life a lot more difficult for just a common person living in Richland Parish. It’s more chaotic at the Walmart in Rayville — definitely don’t go there on a Friday afternoon. I think people just prefer to see normal faces of people they know when they’re out in the community versus strangers coming in that may or may not appreciate everything that is there.”

On change in the community: We are benefiting from the Meta site and there are several other businesses in town obviously benefiting from it as well. But it’s also caused prices to rise for everyone else. Even my mom’s electric bill has gone up. Our electric for the park, I feel like it is outrageous compared to what it would be like if Meta was not in the area. But then Meta just gave local teachers a nice little bonus as well. So you know, change is always hard for everyone. It just depends on your opinion of the change.”

Erika James and Amber Perez

I met Amber Perez, a local community activist and journalist, through her Facebook page. She offered to spend the day showing me around the area when I arrived in Richland Parish. She brought along her friend Erika James, a 34-year-old mother of two who grew up in Richland Parish and was now living in a mobile home park in Monroe, a small regional hub about 30 minutes west of the Meta site. Erika had told me her rent increased several times over the previous six months. In late March, she received an eviction notice after paying her rent just one day late, giving her family five days to move out.

Here’s what Erika and Amber say now:

ERIKA:

On where she and her family are living now: “We got down to a day left without finding a place. I’m not gonna lie to you, I had a breakdown because I’m like, we literally have nowhere to go. I just happened to come across this house in Monroe that had been for sale and was empty. But it had holes in the wall, no electricity and no gas, and he graciously agreed to pull it off the market and let us rent it, and which we’ve been fixing it up for him too just as a thank you. But it was very hard. I mean, it was the week of Easter. We moved everything in about less than 48 hours.”

On other families also being evicted: “My old neighbor has been reaching out to me nonstop via Facebook, and the landlord is doing the same thing to them. I’m trying to help them find something, but there’s just nothing available. It’s really sad because you have all of these people coming in from Meta, but you don’t have the infrastructure or the housing to support it. So you’re pushing your local people out. You’re pricing them out.”

On Meta workers moving into her old place: “I know 100% that they’re Meta people sharing the house because they all drive trucks to the site and there’s like 4, 5 or 6 trucks parked at the house. It’s pretty affordable for them to pay double the rent, but for us that live here, my nursing pay doesn’t change based on Meta being here. Don’t get me wrong, the people who own the houses are benefiting from it, and that’s great. But what I’m seeing is the downside that no one prepared the community for. There’s just not enough housing for your people that were already here.”

AMBER:

On how the community is feeling now about the Meta project: “I think it’s still pretty split, but both sides are getting a little bit more vocal. It’s more of a conversation than it was, but the people who support it are able to profit from it or are already financially well off. And then anyone who’s not profiting off of it or kind of sees it for what it is, they don’t support it.”

On the Meta expansion: “For me, it’s just insulting that six months after you wrote your article and I put one on Facebook locally, they act like this is breaking news. It’s just insulting to the intelligence of the community, in my opinion.”

On the local housing crisis: “The local landlords are pricing people at Meta income prices. People are having trouble finding places to live that are affordable for this area. Rent was already a little bit too high for the average pay here, and now it’s unaffordable altogether. I’ve talked to a lot of families who are living with multiple families in a single-family home, just making extreme sacrifices to get by, or they’re planning for their lease renewals because they know a rent raise is coming.”

On preparation for housing shortage: “You’ll hear leaders like Mayor Friday Ellis in Monroe say how much preparation he put into the economic growth for the area. That’s fine, but I don’t see any evidence that any politician prepared for a temporary rental increase regulation or something else to protect the current residents. I don’t know what the answer is, but they did nothing to even attempt to to save the locals from experiencing this.”

Katie and Logan Stewart, owners of Opal’s Orange Food Truck

A local Richland Parish resident put me in touch with Katie and Logan Stewart, who invested more than $40,000 of their life savings into Opal’s Orange Food Truck after seeing construction workers post on Facebook asking for food options near the Meta site. They started out strong, but when one of the project’s main contractors brought in an out-of-state catering company to feed workers on-site, much of the foot traffic Opal’s had counted on disappeared. The couple insisted they were planning on sticking it out. I also visited the rural dead-end street where the couple lives nearby, on which several new RV parks were being built for Meta workers.

Here’s what Katie says now:

On how Opal’s Orange Food Truck is doing: “Well, things are great at the food truck. We hate the traffic and the increased amount of people that are impeding on our lives, but the food truck business is doing great. We’ve done some catering orders for Meta and our daily numbers are around 70 orders at minimum. I think it was 137 orders two weeks ago on a Friday. People know where we are, and they they are coming to us. I think it just took a little bit to get the word out.”

On Opal’s most popular orders: “Hamburgers are our most popular, but we introduced alligator po’ boys, and that is a big hit. We do it every other Thursday, and we sell out every time.”

How life on their street has changed with the RV parks: “It’s worse. There are around 2,000 people living on this little road. One of the parks has four rows of RVs moved in, and another is completely full and they are putting in 15 mini-cabins. You see families walking around with their children and dogs. On top of that, one of them got a license to sell alcohol. He got approved to sell beer, and this is the only place that sells alcohol within an eight-mile radius. And I mean, the house right across the road from him has kids from a nine-month-old to age four.”

On the Meta traffic: “Our roads are horrible. The trucks have already collapsed a culvert on Castro Road and it’s not even completely fixed. You cannot go down any side road without doing maybe five miles per hour. If you if you try to go anywhere between 4 and 5 o’clock, it’s gonna take you 40 minutes to get just to Rayville.”

On hoping to sell their home: “We still haven’t sold. There’s been no interest in our property, I’m not sure why. But every house on our road is for sale.”

Chris Holyfield, owner of Holy Dippers

I met the Holy Dippers guys while enjoying beans and rice from Opal’s Orange Food Truck. Holy Dippers was created specifically by owner Chris Holyfield to serve the Meta construction project, supplying septic services and eco-friendly restroom facilities for Meta workers—58 units so far, with more to be added as construction ramps up. Holyfield also owns two restaurants in Monroe that do catering work for the Meta site.

Here’s what Chris says now:

On how Holy Dippers is expanding: “We’re actually trying to grow nationwide now. We’re looking all the way from Wyoming in the west to Georgia and Florida in the the east. We’ve leased a bigger office in Monroe and we’re up to 26 employees and 17 trucks.”

On meeting with other data center developers: “We’re trying to land them as we speak. We’re meeting with at least a dozen different data centers, from Shreveport, Louisiana to Wisconsin to Texas. We’ve got some up in Ohio, and one in Indiana, two in Missouri. We’re in the process of meeting with contractors and dealing with the ownership groups, and hopefully we can land a few.”

On his family’s restaurants working with Meta: “My dad and my sister’s husband run the Delta Biscuit Company, and my sister, myself, and my dad have Apero. We’ve been fortunate enough to be able to continue serving food out there for the Meta workers.”

Thanks for reading. If you enjoyed this story, please consider sharing it.

Share

To watch Silicon Valley react on X to last week’s raft of new AI models from OpenAI, Meta and Xai was to witness awe, joy and an unrelenting sense of LFG (let’s f***ing go).

“This week in AI was genuinely unhinged... what a week to be building,” said one poster. “Having access to [OpenAI’s] GPT 5.6 Sol and [Anthropic’s] Fable at the same time feels illegal,” said another, while still another crowed that “The fact that I can build whatever I want just with Claude is a good reason to want to wake up everyday.” Common pronouncements included “This week is absolutely crazy”; “What a time to be alive!” and “It’s all happening so fast (smiley emoji).”

Switch over to Facebook, Threads or Bluesky and you’ll find what feels like an alternate universe. In a Facebook group with more than 150,000 members called Say No to Data Centers, recent comments range from “AI will never help the average American” and “I don’t believe in using AI and I don’t want it” to “Turn AI off. Don’t use it. The big tech industry are hogs using it. We are barely the reason for its demand, but we EACH AND EVERYONE OF US together can make a statement and stand against it by turning it OFF!”

Subscribe now

As a journalist who has been reporting on AI day in and day out for the past four years, I regularly speak to founders, CEOs, researchers and engineers who generally fall into the first camp. But in my life outside of work, I constantly hear skepticism, and downright hostility, about AI. And when I began traveling to communities around the U.S. to report my When AI Comes to Town series about the AI data center boom, I started encountering far more people who, in addition to objecting to physical AI infrastructure being built in their area, also question why the technology is being developed at this scale at all.

I think this widening gap in perception may become one of the biggest challenges of the AI era. The people building AI and using it every day are experiencing a different reality from the people who resist it or simply don't use it. That growing disconnect, I believe, is helping fuel a backlash that isn't going away.

What believers see

The believers vibrating with excitement are thrilled by what AI tools allow them to do and how rapidly they continue to improve. They are building apps without knowing how to code, conducting deep research in minutes, creating images and videos on demand, and using AI agents to take on increasingly complex tasks. Every new model release seems to unlock something that was impossible, or at least far more difficult, just months earlier.

To heavy users, the rapid progress is not hype, it’s something they are close to and experience every day. They struggle to understand the hostility building outside their world when they are clearly benefitting from—or at least striving to benefit from— technology that is only going to get better.

What skeptics see

The skeptics, meanwhile, are both befuddled by all the hullabaloo over AI tools that, in their experience, don’t seem particularly useful, and they are concerned about what AI is doing to society and the world around them. They see potential job loss, students outsourcing their thinking, artists and writers watching their work used to build systems that compete with them, a web flooded with AI-generated slop, deepfakes and misinformation, and massive data centers consuming land, power and water.

Not surprisingly, each side finds the other almost impossible to understand. For example, a few days ago, I came across a post on the social network Threads from a popular author who has been reviewed in The New York Times:

“I just discovered this week that people (like, individual people, not corporations) pay actual money to use AI. They’re PAYING to rot their brains??? I get using it for work because a lot of jobs are making people do it, but personally? Your own money?”

Most of the people I interview every week would find this sentiment incomprehensible. They happily pay $20, $100, $500 or even far more a month for AI subscriptions because they see AI as one of the most powerful new technologies of their careers. Every few weeks it seems to unlock capabilities that previously didn’t exist.

Yet to the author of that Threads post—and to many who agree—it is equally incomprehensible to imagine voluntarily spending money on something they believe is making people dumber.

The skeptics risk dismissing a technology whose capabilities are improving far faster than many of them realize. But the believers risk becoming so immersed in what AI can do that they fail to understand the very real concerns of the people who want nothing to do with it—while the backlash continues to get louder.

Read more

Cybersecurity experts have warned for years that AI would eventually automate cyberattacks. This week, threat researchers at Sysdig found that this prediction is quickly becoming reality. In a blog post, the researchers detailed what they say is the first documented case of AI agent-run ransomware: an end-to-end extortion campaign, dubbed JadePuffer, that Sysdig said was orchestrated by an LLM and had no human in the loop. In the incident, the AI agent exploited a vulnerable internet-facing server, searched for credentials, pivoted to a production database, adapted when commands failed, encrypted the victim's data and left a ransom demand—all while reasoning through each step of the attack.

Ransomware attacks — a type of malware that holds a victim’s sensitive data or device hostage until the victim pays a ransom — have long relied on automation. But human operators still typically decided how to navigate a victim’s network, which credentials to use, and what to do when something went wrong.

JadePuffer exploited familiar vulnerabilities

JadePuffer is a different milestone than Anthropic’s Mythos, which was unveiled in April and demonstrated that AI could autonomously discover thousands of previously unknown software vulnerabilities. Rather than finding new flaws, JadePuffer exploited familiar vulnerabilities that had already been publicly disclosed and patched, and chained them together in a coordinated attack.

Jamieson O’Reilly, an offensive security specialist and founder of Dvuln, said nothing about JadePuffer surprised him. “Whether we like it or not, this is the new normal arriving on schedule,” he said. “Half the industry filed this sort of thing under movie material. The other half knew it was a matter of when.”

The attack didn’t rely on sophisticated new exploits, he said. Instead, it combined several well-known techniques that defenders have understood for years. What was new, O’Reilly argued, was the orchestration. “A single model strung the entire chain together from initial access through credential theft, lateral movement, persistence, and finally destructive extortion, while writing running commentary on its own reasoning the entire way.”

More accessible to any attacker

That novelty, combined with the fact that the technology is becoming increasingly accessible, makes JadePuffer “more terrifying” than Mythos, said John Strand, owner of Black Hills Information Security.

Unlike frontier AI systems that require massive computing resources and are largely controlled by companies like Anthropic and OpenAI, he said, the kind of automation demonstrated by JadePuffer is increasingly within reach of far less sophisticated attackers.

“There’s a little box that you can buy from Nvidia,” he said, referring to the DGX Spark desktop AI system. “We can run this exact same type of thing that JadePuffer does on one of those little $6,000 boxes. It takes longer—it’s not going to be as fast as using Anthropic or OpenAI—but it does a very good job. It just sits there and grinds through these easy-to-find vulnerabilities and chains them together.”

Strand explained that this is why he isn’t fixated on AI discovering zero-day, or previously unknown, vulnerabilities. In real-world penetration tests, security firms rarely rely on zero-days to break into organizations. More often, they exploit misconfigurations, stolen credentials, and combinations of lower-severity vulnerabilities—which are exactly the type of attack scenarios JadePuffer seems to automate.

This could force organizations to rethink how they prioritize software vulnerabilities, because vulnerabilities that once seemed relatively low-risk could become much more dangerous with aI attackers.

”In the past, if there was an exploit that was out, you would patch as quickly as you could,” he said. “With this, it’s moving so much faster, and I just don’t think that organizations are ready for it.”

O’Reilly said none of this should come as a surprise. As companies like Anthropic and OpenAI increasingly deploy AI agents to automate software engineering tasks, he argued, it was only a matter of time before criminals applied the same technology to automate cyber intrusions.

“When companies like Anthropic and others openly describe wrapping agentic loops around whole engineering workflows and letting them write and ship code, the logical conclusion writes itself—that is, criminal groups will point the same machinery at intrusion instead of feature delivery.”

Basic security hygiene remains essential

For security teams, however, O’Reilly said the solutions remain largely “unglamorous.” Security hygiene—the routine, foundational cybersecurity practices that reduce the chances of being compromised—remains organizations’ biggest advantage.

“The entire operation rode on internet-exposed, neglected infrastructure and unchanged defaults,” he said.

Organizations should focus on four priorities, he said: eliminate basic security weaknesses before attackers can exploit them, better protect credentials and API keys, automate detection and response so AI-speed attacks don’t outrun defenders, and use AI itself to identify suspicious behavior.

Strand agreed that organizations should continue prioritizing security hygiene but said they should also invest in additional detection measures, including cyber deception technologies and monitoring outbound network traffic for signs that compromised systems are communicating with attackers.

But he added that he doubts JadePuffer will seem remarkable for long. "I think in a few years we aren't going to look at JadePuffer and be like, 'Well, this was novel,’ he said. “This is what normal is going to be moving forward."

Ground Level AI is a newsletter by AI reporter Sharon Goldman (previously at Fortune and VentureBeat) covering what happens when AI meets the real world — infrastructure and data centers, enterprise deployment, security and governance, policy and geopolitics, and the workforce and communities caught in the middle. Field reporting from the AI front lines, read by thousands in tech, policy, and media. https://www.groundlevel-ai.com/about

In case you missed them:

Today’s frontier AI models—ChatGPT, Claude, Gemini—owe much of their success to the public internet. For years, AI companies feasted on billions of web pages collected through archives like Common Crawl and massive datasets such as The Pile.

Then, of course, came reinforcement learning from human feedback, and other post-training techniques, that rely on human-generated data designed to teach AI models how to reason, use tools, and complete real-world work. That demand fueled a fast-growing ecosystem of companies that recruit experts, generate training data, and evaluate frontier models, from Scale AI to startups like Mercor, Turing, and Handshake.

But a new viral essay published yesterday says none of that will be enough, and what we need is massive new effort — equivalent to the current AI data center build out — to acquire the data needed to keep scaling frontier AI, with proposals that range from turning off corporate deletion policies to buying companies for their data.

The next bottleneck

Former OpenAI researcher Will DePue, who left the company in April, likens the need for more data to the massive AI infrastructure buildout currently symbolized by OpenAI’s Stargate project, in which Big Tech and top AI companies are predicted to spend trillions over the next decade to erect supersized data centers that power tens to hundreds of thousands of GPUs to train and run frontier AI models.

DePue argues that AI’s next major bottleneck won’t be computing power—it will be data. He predicts that by the end of the decade, leading AI labs could be spending more than $100 billion a year acquiring and creating the data needed to train future models. That, he explained, requires a massive “Stargate for Data”-type initiative.

As researchers increased both the size of AI models and the amount of training data, he explains, capabilities improved steadily, even if each additional gain required exponentially more resources.

Now, DePue argues, the era when the public internet provided an effectively limitless supply of training data is ending. Compute is no longer the primary constraint. If we want economic progress and scientific acceleration, access to high-quality data is the key to breaking through bottlenecks.

Therefore, he writes, “We need to see data collection as imperative, deserving the same civilizational ambition we’ve given compute.”

It’s remarkable how DePue matter-of-factly admits how much AI progress owes to “the blessing” of the internet, which he calls “a one-time civilizational subsidy to deep learning, decades of unintentional accumulation of a perfect dataset: every book, blog post, image, video, paper, discussion, etc. all digitized and freely available.”

I must say that’s probably not how the plaintiffs in the dozens of copyright lawsuits against AI companies would characterize it, but hey — let’s just leave that there for now. DePue’s point is that we’re running out of it, saying that there are only about 300 trillion tokens of useful public human text left, and the internet doesn’t produce nearly enough new high-quality data to match what scaling demands. The rise of reinforcement learning gave AI labs a temporary reprieve, he added, because models could improve by solving math and coding problems that were abundant online and easy to grade automatically. But now he argues even those datasets are being exhausted.

Going forward, the best data — rather than chips or model architecture — will become a frontier AI company’s most important competitive advantage. OpenAI’s strength in mathematics? Anthropic’s performance in cybersecurity? It’s no accident. Labs are increasingly relying on proprietary datasets, expert-generated training data and custom reinforcement learning tasks, which are differentiating their models.

Okay. Now let’s get to where my eyes start bugging out. DePue’s proposals for closing the data gap get immediately into consent, market power, and his belief that maximizing economic automation, as fast as possible, is just good. He says he’ll break them down in a later post, but it’s easy to see where he’s going.

Read more

Open-weight AI models — which allow developers to download, customize, and run the model on their own infrastructure — were back in the spotlight last week. Most recently, Palantir CEO Alex Karp said enterprise customers are increasingly concerned about giving AI companies access to their data and that some U.S. government customers have switched from closed AI models to open ones.

Subscribe now

Those comments made me want to circle back to a conversation I heard last week at Open Frontier, a day-long meeting in San Francisco convened by Databricks and Perplexity co-founder Andy Konwinski’s Laude Institute. There was plenty of chatter about how Chinese open-weight models such as DeepSeek, Kimi, MiniMax, or GLM were at the leading edge, while American versions were not. And researchers kept asking: What can the United States learn from China about building an open AI research ecosystem? And how can it catch up?

There is reason to be concerned. Last week, I wrote about how researchers at the Open Frontier meeting warned that as frontier AI becomes increasingly concentrated in a handful of closed labs, the United States risks allowing the global open AI ecosystem to be shaped by China while advanced AI at home becomes dominated by proprietary systems that universities, startups, and independent developers cannot study, improve, and build upon.

One example came from Jennifer Chayes, dean of UC Berkeley’s College of Computing, Data Science, and Society. During a panel on funding the open research ecosystem, she said Berkeley researchers are “all building on Chinese models because we don’t have a Western open frontier model,” and argued that this represents a national security gap the U.S. government should address with greater investment in open frontier AI research.

But another theme emerged repeatedly throughout the day. Several AI leaders argued that one reason the U.S. has struggled to build a robust open frontier AI ecosystem is that Chinese companies have managed to be both fiercely competitive and unusually collaborative—sharing enough research and ideas for the broader ecosystem to benefit.

Competition and collaboration

“If you look at what’s happened in China, it’s really quite amazing,” said Bryan Catanzaro, vice president of applied deep learning research at Nvidia.

Chinese companies have produced so many leading open models, he argued, not because they have fundamentally different solutions to frontier AI, but because openness has allowed ideas, techniques, and research to compound across the ecosystem.

That doesn’t mean Chinese companies aren’t fiercely competitive, Catanzaro emphasized, pointing to his own experience working for two years at Baidu.

“These teams compete fiercely,” he said. “Being open doesn’t mean that we always agree with each other or that we’re not trying to win. But despite all of that competition, they’ve been able to build a self-sustaining community where information and ideas are able to compound and build an ecosystem that I think is much better than any other open ecosystem.”

The question, he said, is: “What can we learn from China about how to work together again? It doesn’t mean we all have to love each other all the time, or that we’re not competing with each other. But there is a synergy that comes from being open.”

Read more

A quick, light anecdote on this eve of the July 4th holiday weekend 🎆:

As someone who reports on AI all day, every day, I usually feel like I’m on top of what’s going on in the field. I’m terminally online. I know all (ok, most) of the memes. I constantly chat with sources. It’s tough to catch me with news I haven’t heard about.

But yesterday morning? Color me red-hot surprised.

Subscribe now

I’ll set the scene: A sizzling, sweltering morning in central New Jersey, about 35 miles southwest of Manhattan. I’m listening to the local meteorologist practically shouting that the temperature will rise to 101 degrees Fahrenheit — the hottest day in 13 years.

Our own air conditioning already seems to be struggling, and a quick look at the outdoor unit offers the bad news: a loud electrical hum and a fan that isn’t moving at all.

My husband immediately speeds off to Home Depot in search of a window unit to help us make it through the day. Meanwhile, I hit the phones to try and find an HVAC repair person available the day before July 4th weekend.

That’s when I realize that nearly every company answers the call with an AI-powered receptionist. This isn’t the typical clunky phone-tree bot or the robotic-sounding mystery voice that does not respond to desperate cries for “representative!”

Instead, these are the most natural, seamless AI voice interactions I've ever experienced. At least twice, I genuinely wonder whether I'm talking to a human. Several even recreate the ambient sounds of a busy office—keyboard clicks, muffled conversations, the kind of background noise you'd expect from a real receptionist.

The giveaways are unceasing friendliness and an occasional awkward pause. But otherwise, the conversation is smooth, answers are quick, and I book an appointment easily. I can imagine some customers being put off by this ultra-realistic yet still artificial intelligence, but at a moment where all I wanted was a last-minute appointment, it worked wonders.

The question is, where have I been? Maybe these improvements in customer service AI have been around for years, for all I know. But while I spend my days immersed in the latest AI news from OpenAI, Anthropic, Google and Meta, it turns out that some of the technology’s greatest success is happening in small businesses trying to make sure they don’t miss a call.

In an era where AI pundits are arguing over enterprise adoption, job displacement, upskilling, and forward-deployed engineers, the trades—HVAC, plumbing, roofing, carpentry—may have found one of AI's clearest product-market fits. Missing a phone call can mean losing a customer, and an AI receptionist never takes a lunch break.

It would make for a better ending if my air conditioner had been fixed by one of the companies whose AI receptionist booked the appointment. Alas, no. The hero of the story turned out to be a small local HVAC company with an actual human answering the phone. She booked us for that afternoon, the technician replaced the capacitor, and by dinner the house was blissfully cool again.

But, of course, that’s not the point of this story — though I’m so grateful to every HVAC technician out there working in the blistering heat. The point is that AI is quietly becoming part of ordinary business infrastructure. Not in splashy product launches or viral demos out of Silicon Valley, but in the everyday interactions that keep small businesses running in a small New Jersey town.

I need to keep my eyes open. I'm realizing I’ve spent so much time watching the frontier of AI that I’ve been missing how quickly it has spread into everyday life.

I hope you all enjoy that everyday life this weekend. Happy Fourth.

The debate over “open” AI has entered a new phase. For years, advocates have argued that openly available frontier AI models — whose underlying parameters ("weights") are released so researchers and developers can study, modify, and build on them —accelerated research, innovation, and competition. But at a gathering of many of the world’s leading AI researchers and engineers in San Francisco yesterday, the argument went further: maintaining U.S. leadership in frontier open-weight models is now a democratic and national security imperative.

Researchers at yesterday’s meeting warned that as frontier AI becomes increasingly concentrated in a handful of closed labs, the United States risks allowing the global open AI ecosystem to be shaped by China while advanced AI at home becomes dominated by proprietary systems.

The argument contrasts sharply with the position of many frontier AI companies and some AI safety researchers, who contend that releasing increasingly capable models widely could make misuse easier or reduce developers' ability to implement safeguards.

The timing was striking. During the last session of the day, Anthropic announced that the Trump administration had lifted export controls on its Claude Fable 5 and Mythos 5 models. As I wrote in my post last week, legal and policy experts told me that kind of government “kill switch” over AI model access isn't just reshaping who trusts American AI and creating a reliability nightmare for users and builders — it's also opening the door for China's popular open-weights models to fill the gap.

The day-long meeting, called Open Frontier and convened by Databricks and Perplexity co-founder Andy Konwinski’s Laude Institute, brought together leading academic and industry researchers and engineers to discuss how to preserve an open AI ecosystem—one in which frontier models, software, and research remain available for universities, startups, and independent developers to study, improve, and build upon.

One notable absence was former OpenAI co-founder and former Tesla AI leader Andrej Karpathy, who had been billed as a speaker. Last month, however, Karpathy joined Anthropic, writing on X that “I think the next few years at the frontier of LLMs will be especially formative.” He did not appear at the event.

The frontier is now closing

Konwinski framed the conference around a simple premise: the frontier of AI is becoming less open. The data, the people, the GPUs, the models, he said, are “being pulled back behind closed doors,” which he framed as a risk to democracy as a whole.

One of the spiciest takes was from Jennifer Chayes, dean of the College of Computing, Data Science, and Society at UC Berkeley, who said during a panel about funding the open research ecosystem that academics at Berkeley are “all building on Chinese models because we don’t have a Western open frontier model,” and framed that fact as a national security gap the US government should take seriously with fresh funding. She also said OpenAI and Anthropic are running “a very effective fear campaign” ahead of their IPOs

Read more

For the past two weeks, the Trump administration has held what amounts to a shutoff valve over access to Anthropic's most powerful AI models, Mythos 5 and Fable 5, as well as OpenAI's rollout of GPT-5.6. According to legal and policy experts, that control isn't just reshaping who trusts American AI and creating a reliability nightmare for users and builders — it's also opening the door for China's open-weights models to fill the gap.

“I do think this is turning into an ad-hoc approval regime, and all the uproar on social media is correct,” Saif Khan, a fellow at the Institute for Progress think tank and a former director for technology and national security at the National Security Council, told me. “US models are now at risk of being shut off anytime for opaque reasons. The best open models, which can’t be shut off, are Chinese.”

Subscribe now

Trump administration invoked export control law

The mechanism behind that risk, legal experts say, was never built for this moment. The Trump administration invoked export control law — the same legal framework built to keep hardware and weapons technology out of adversaries' hands — to force Mythos and Fable offline, citing national security concerns.

In the most recent updates to this saga, OpenAI was purportedly told by the US government to stagger its own GPT-5.6 rollout. But Mythos returned Friday for more than 100 vetted companies, and Fable is rumored to follow.

The problem, said Kevin Wolf, a partner at law firm Akin Gump and former senior commerce department official who helped craft export control measures during the Obama administration, is that the legal mechanism used to justify these moves is "completely made up."

Normally, he told me, export controls govern the export, re-export, and transfer of hardware, software, and technology. “Models are not exported, models are not released to foreign persons, what’s released is the output of the model, the [model] weights are not being given,” he explained. “There isn’t anything in the regulations or the statute that enables that, authorizes that, contemplates that.”

But the export controls were the closest thing the government could find to address their “policy anxiety” around resolving concerns about the safety of Anthropic’s models. “It appears that the companies and the government are going along with it to try to resolve it outside this public view, but none of this is traditional export control, it’s not traditional anything. It’s an area of law and policy that is still evolving.”

The US is no longer a ‘trustworthy supplier’

Meanwhile, the “kill switch,” as Wolf described it, is having negative effects.

“We’re no longer a trustworthy supplier,” he said, adding that while he does not deny the underlying security issues, “this chaos is a function of the absence of a coherent policy on the topic within the administration.”

, senior advisor on AI governance at the Center for Democracy and Technology and author of Converger, put it more bluntly: “This is how you crash the US AI market,” he said. “American frontier model economics won’t be sustainable with a small gated customer base for very long, especially as more customers switch to free Chinese open source models.” By making access to US services unreliable, he continued, the Trump administration “is prompting every customer to consider alternatives, and highly capable open source Chinese models are the obvious backup choice.”

That creates an opportunity for China to spread its soft power, said Adam Thierer, a senior fellow at center-right think tank R Street Institute, who testified in 2025 before House lawmakers about the threat of Chinese AI models like DeepSeek to U.S. national security. Similar to how Trump’s tariffs may have had the unintended effect of driving US allies into the arms of China for their technology needs, these moves “clearly have ramifications for American soft power globally,” he told me. “If a nation undermines trust in its firms and markets, it will suffer major consequences over time.”

Fable is set to return, but the damage is done

According to Axios, the Trump administration is close to allowing Anthropic to restore access to Fable, as soon as this week. But experts say the damage has been done.

“Outside of any sort of regulatory structure, or statutory structure, or policy analysis, the government is going through and making case by case ad hoc decisions,” said Wolf. “By what standards, under what authority, I don’t think anybody actually knows.”

A better policy, said Khan, would be risk management and developing standards for safeguards — which, he added, had been pursued a couple of years ago but dropped in Trump’s second term.

“I think there are lighter-touch types of regulation that are less innovation-chilling and less susceptible to politics and corruption, that avoid the government picking winners and losers,” he said.

Happy Friday!

These are a few news stories, IRL conversations, and under-the-radar ideas that caught my attention this week:

(Paid subscribers: Join me today to talk about all this and more at https://www.groundlevel-ai.com/chat for my first weekly Ground Level Chat! 🕑 I'll start a new thread today at 2:00 p.m. ET / 11:00 a.m. PT and will be around asynchronously until about 5:30 p.m. ET.)

Read more

Over the past four years on the AI beat, I often find myself circling a theme that I spend months—sometimes years—trying to understand, and then suddenly it starts showing up everywhere.

At the moment, that theme is AI verification. For years, I’ve followed as the AI industry has focused on AI security and safety best practices including training, testing, red-teaming, and guardrails to make models safer and more reliable.

But a growing number of people I’ve spoken with argue that the goal shouldn’t be to trust AI at all. It should be to verify its outputs and behavior independently. This is becoming a trendy topic, thanks to Anthropic’s latest feud with the US government in which the Trump administration cut off foreign access to Anthropic’s powerful new AI model, Fable 5, on June 9 due to cybersecurity concerns — export controls that forced the lab to pull the model’s access entirely.

In this era, the question is: How do you prove that an AI system is safe enough to deploy?

‘Stop trying to trust AI models’

Back in 2024, I began chatting with computer scientist and former Meta engineering leader and researcher Erik Meijer, whose core idea is that we should stop trying to trust AI models and start verifying their outputs.

“I think the genie is out of the bottle,” he recently told me for probably the tenth time, arguing that efforts to contain AI capabilities may ultimately be futile because the underlying knowledge is already widely available and AI systems are fundamentally software that can be recreated by determined actors. “Nothing we can do about it anymore,” he said.

Rather than trying to prevent jailbreaks or perfectly align increasingly powerful models (which I reported last week is, apparently, impossible), Meijer believes the industry should focus on proving that AI systems behave safely in the contexts where people depend on them.

His idea, outlined in a 2025 paper called Guardians of the Agents, is that AI systems should be required to generate evidence that their actions are safe before they are allowed to execute them. The approach borrows from formal verification techniques long used in computing, where mathematical proofs are used to establish that certain properties hold before software runs.

Provably-correct decision making is trending

The idea seemed super-academic and in the weeds when Meijer first started explaining it to me. To be honest, I didn’t really understand it, so I filed it away in my brain folder marked “interesting, but huh?”

But over the past couple of weeks, I’ve been hearing versions of the same argument everywhere. For example, I spoke earlier this week to Anjana Rajan, CEO & co-founder of Atalanta, a startup whose tagline is “provably correct decision-making for the world’s most important missions.”

Read more

I’ve wanted to chat with Dally Holloway for a while.

The thirty-something Kansas native started the Facebook group Say NO to Data Centers in September 2025 after a proposed AI data center came to her community. Less than a year later, the group has grown to more than 170,000 members, making it one of the largest anti-data-center communities on Facebook.

Subscribe now

I’ve been following the group since last year, as part of my Fortune reporting on the AI data center boom. It has become a gathering place for people concerned about everything from water use and local governance to the broader impact of AI infrastructure. Along the way, I also noticed an increasing number of posts promoting conspiracy theories about data centers—from claims about population control to warnings about 5G radiation—and wondered how Holloway viewed the increasingly wide range of opinions showing up in the group.

Our conversation has been edited for length and clarity.

What prompted you to start the Say NO to Data Centers Facebook Group?

Last summer, my own town outside of Kansas City was surprised with an AI data center facility being developed by Beale Infrastructure. We all found out via several news reports two days before our standard bi-weekly city council meeting. There were no previous announcements from the city, no hearings or period for public comment held.

My town scrambled the best it could and members of the community showed up at the council meeting. The data center proposal was heard and passed in a single meeting despite serious citizen pushback.

This secrecy spurred me to start the Facebook group. It was initially intended as a local concept, but the fight against data centers was really ramping up in autumn 2025 so it began attracting general attention and interest.

You’ve recently added moderators and new posting rules. What happened?

As my local fight intensified, I was simply out of spoons. I reached out to the general community, seeking moderators and anyone who was interested in assisting with keeping the page clean from conspiracy content, AI-generated content and stuff we really don’t view as scientifically sound.

Unfortunately, I don’t think anyone really understands how intense misinformation is, how quickly it spreads, and how well run bot farms are — specifically on Facebook these days.

Read more

One week ago, I was so nervous and excited the day before launching Ground Level AI that I could barely eat. Zero appetite is my anxiety symptom of choice, and if that’s what being on a GLP-1 is like, count me out!

Skipping a few meals was totally worth it, though. Launch day was busy and buzzy and included hopping a flight to San Francisco. And as my anxiety melted away, the main emotion I felt was gratitude: to everyone who gave me advance advice on launching an independent newsletter, everyone who subscribed, everyone who sent messages of support, everyone who reached out about collaboration or sponsorship, and yes, to the AI tools that helped me make this project a reality (I’ll explain).

As I considered making the leap to launching an independent publication, I spoke to some true OGs in the tech newsletter space. of Platformer; of Newcomer; of , and my former Fortune colleague Jason Del Rey of The Aisle were all kind enough to hop on Zooms with me to chat about what it’s really like to helm an indie tech publication day in and day out. They were honest: It’s not easy. I admired their moxie and my feeling of FOMO made me realize I was doing the right thing.

I also joined a community of creative builders helmed by Kait LeDonne that gave me a base of support and helped me think about how I really wanted to focus and present Ground Level AI — and also just made me feel brave (I practiced my power pose).

There’s no doubt that AI has also been a main character on board this launch ride. ChatGPT, Claude and Gemini all had long conversations with me about strategy, ideas, confidence-building and talking through pricing and revenue scenarios. Claude designed my logos and color schemes; ChatGPT helped me fine-tune my elevator speech; and Gemini was a favored back-up for all research and editing.

AI does not write my stories or do my reporting for me. But as a solo builder, it truly has amped up what I can do on my own. It transcribes my interviews. It proofreads and organizes and offers feedback like an editor. For me, it truly is a partner that allows me to speed up my process and focus on original reporting and storytelling.

I so appreciate everyone who has subscribed to so far, including those who followed me over from my previous Substack, AI Side Notes (or its even earlier version, Sharon’s AI Extra, launched back in September 2023!). For free subscribers, I hope you enjoy the public posts and previews I share for every piece.

Paid subscribers get full access to everything, including a once-a-week Substack chat where I talk through what’s going on in AI and what you’d like to see more of. And Ground Level Insider subscribers also get a one-on-one Zoom call with me each year — which I’m really excited about (and can talk separately to anyone interested in more of that).

Either way, thank you for being here and trusting an independent operation with a masthead that is just me! After four years covering AI as a daily beat at Fortune and VentureBeat, I’m thrilled to get Ground Level AI off the ground. For those just joining: Ground Level AI is field reporting from the AI front lines — original and often on-the-ground coverage of the infrastructure, data centers, cybersecurity, business and policy decisions shaping how AI actually gets built and deployed.

By the way, if any other journalists are considering the leap to independent publishing, or are simply looking for career advice, I’m happy to do the same for you that Casey, Eric, Alex and Jason did for me — just reach out at sharon@groundlevel-ai.com or feel free to connect with me on LinkedIn.

Cheers and thanks,
Sharon

Nvidia has hired Ashish Vaswani, founder and CEO of Essential AI, and several others from the Essential AI team, according to a source close to the startup, who said Vaswani will be working on Nvidia’s Nemotron open-source models.

According to the source, Vaswani was struggling to raise money and said that “taking Ashish/Essential away from AMD was also a motivator.” AMD, one of Nvidia’s main chip competitors, was an early strategic investor in Essential AI and the startup has long relied on AMD GPUs.

Several Essential AI researchers have changed their LinkedIn profiles to reflect their new work at Nvidia, including Alok Tripathy and Saurabh Srivastava. Screenshots of other LinkedIn profile changes from company employees made their way to X yesterday.

Another source close to the deal said on background that he was not sure “if the deal is finally done,” but said it was an “interesting sign” that some researchers had already changed their LinkedIn profiles.

Read more

After three days in San Francisco, I left this morning on a beautiful note, with a cool breeze off the Bay and Karl the Fog tucked in over surrounding ridges and peaks, letting the sun freely shine and temporarily banishing the typical June gloom.

To be honest, though, I spent most of my Uber ride to the airport fascinated by the contradiction at the heart of the AI industry in this tech-obsessed city. Here, the world’s most sophisticated technology is being marketed through some of the most old-school channels imaginable: billboards, banners pulled by airplanes, pedicabs, and bus-stop ads.

Subscribe now

It’s kind of adorably analog and seems to matter not whether anyone other than a narrow target audience knows what these companies do. Take the Databricks Data + AI Summit, which took over the Moscone Center and the surrounding blocks this week. Here's a company that makes little sense to most people outside enterprise tech, yet is reportedly seeking a valuation of $165 billion, has raised vast sums of capital, and seems perpetually on IPO watch. Everyone in enterprise AI seems to be able to tell you about the company’s data lakes and data unification and data engineering and data governance.

But the scene on the ground is all analog. The crowd (I’m told it was over 30,000) is an overwhelming sea of orange lanyards, streaming through the streets, on escalators and in ballrooms. Massive orange Databricks posters coat buildings like paint, while on the expo floor software buyers and developers compete in games for startup swag like kids playing Pin the Tail on the Donkey.

A morning at Databricks Data + AI Summit

I was at the Summit on Wednesday to meet Databricks co-founder Arsalan Tavakoli, who I’m interested in because he oversees the company’s global field engineering organization—I imagine an army of specialists working directly with enterprise companies who are desperate to drive AI adoption. If anyone knows what’s going on with customers on the ground, I think it’s Tavakoli.

One thing enterprises are struggling with in AI, he said, is that it turns out AI is only as good as the context surrounding it. Despite hopes that large models could work with messy or fragmented data, organizations still need high-quality information and a clear understanding of how their business data fits together.

The other challenge — which is very of the moment given this week's extraordinary showdown between Anthropic and the Trump Administration, with Anthropic taking Fable 5 offline after officials raised concerns about a potential jailbreak — is model choice.

“They’re like, do I bet the farm on Anthropic? On OpenAI? Is it Grok?” he said. “Okay, I bet on Claude, but now there’s the whole Fable thing.” The answer, he said, is not to bet on a single model, but to build systems that can route tasks to different models depending on the use case.

Read more