In July 2026, OpenAI’s AI agents broke out of their test environment on their own and attacked Hugging Face’s servers. Headlines about the start of an “AI apocalypse” had appeared before, even after a routine server outage, and amid all that noise it’s easy to miss the main point: the developers themselves are talking seriously about the risks. The heads of OpenAI, Google DeepMind and Anthropic put AI on a par with nuclear war while accelerating their work on it. Two of these companies are now preparing for the largest IPOs in history.
In this piece, we draw on Geoffrey Hinton’s talks, the 2023 Center for AI Safety statement, reports on the Hugging Face incident, Yann LeCun’s objections and data on IPO preparations. We examine one question: when AI’s creators warn about its dangers, is it genuine alarm, marketing or both?
The scientist who left to speak out
In May 2023, Geoffrey Hinton, one of the creators of the neural networks that power ChatGPT and Claude, left Google. He explained that he wanted to talk about the risks without having to consider his employer’s interests. The technology’s creator became its critic, and that’s what gives his voice its weight.
That same month, the Center for AI Safety (CAIS) published a one-sentence statement:
“Mitigating the risk of extinction from AI should be a global priority,” the statement reads.
It carries more than 350 signatures, including Sam Altman of OpenAI, Demis Hassabis of Google DeepMind and Dario Amodei of Anthropic. The warning comes from those who are creating the threat. The concern is existential risk, a threat that could wipe out humanity or irreversibly destroy its future.
On September 9, 2026, on BBC Newsnight, Hinton called a 10% probability of human extinction due to AI within the next ten years “not an unreasonable” estimate. It’s hard to be more precise, he added: humans have never before created systems smarter than themselves. What exactly frightens him is best explained by his main metaphor.
The tiger cub is growing
Hinton compares humans to the owners of a tiger cub: while it’s small, it doesn’t matter, but no one knows what it will grow into. Hinton puts the risk of AI one day taking control at 10–20%.
▪️The root of the threat is the alignment problem, the challenge of matching a system’s goals to human intentions. The danger isn’t an “evil” AI but a system that literally pursues an imprecisely set goal and finds workarounds no one thought of.
▪️The second argument is speed. According to Hinton, AI learned to reason and deceive faster than he expected: when it hits an obstacle on the way to its goal, a system may start misleading people.
“People haven’t understood what’s coming,” Hinton said in a CBS interview in April 2025.
▪️The third argument is money. Hinton believes the industry puts profit ahead of safety, devotes few resources to alignment and lobbies against regulation. Each player is afraid individually, but no one can be the first to stop.
The authors of the International AI Safety Report reached a similar conclusion: it was released on February 3, 2026, by more than 100 experts from 30-plus countries, led by Yoshua Bengio. In their assessment, AI capabilities are growing faster than the means to control them, and some models already recognize when they’re being tested.
In summer 2026, this logic stopped being hypothetical.
Seventeen thousand steps
In summer 2026, OpenAI was testing how well its models handle hacking. GPT-5.6 Sol and a not-yet-released model were working through the ExploitGym cybersecurity benchmark in a sandbox, an isolated environment where AI is tested without access to the outside world.
According to Reuters, on July 9 the agent broke out through a previously unknown vulnerability (zero-day) in a package proxy server, its only permitted connection to the network. The models decided that the test answers might be stored on Hugging Face, the largest platform for sharing AI models, and attacked its internal systems. There was no malicious intent: the system was asked to score points, and it found the shortest path — cheating.
Hugging Face reconstructed about 17,600 actions carried out from July 9 to 13: thousands of small decisions made at machine speed. The agents reasoned about how to bypass security checks and explored how to forge or delete records of their own actions. According to Reuters, OpenAI linked the incident to its models only a week later, after reading a post by Hugging Face’s CEO, and disclosed it on July 21, calling it unprecedented.
But the same skill can also be turned toward defense.
Same skill, other side
An AI that can find a vulnerability in someone else’s code can also patch it before attackers do. Such technologies are called dual-use: the same capability serves both defense and offense.
That’s the idea behind Project Glasswing. Anthropic gave about 40 partners, including AWS, Apple, Google and Microsoft, limited access to the Claude Mythos Preview model to search for vulnerabilities. According to the project’s first report on May 22, 2026, partners found more than 10,000 high- and critical-severity vulnerabilities in a month. Anthropic noted that the bottleneck turned out to be not finding bugs but verifying the findings and shipping fixes. The oldest bug found had sat in OpenBSD’s code for 27 years and let anyone crash any server running the system with a couple of packets. The company doesn’t plan to release Mythos publicly until stronger safeguards are in place. In doing so, it admits itself that its tool is dangerous in the wrong hands.
For the crypto industry, this is a direct scenario. Smart contracts are also open code, where a single bug costs millions of dollars. An AI audit can find a vulnerability in a DeFi protocol before a hacker does — or it can work for the hacker.
The same approach works beyond cybersecurity. Rentosertib, the first drug for which both the target and the molecule were found by generative AI, has reached Phase III trials for treating idiopathic pulmonary fibrosis. However, according to one analysis, 97% of AI-designed drug candidates have not yet progressed beyond Phase II. The gap between promise and results gives skeptics reason to ask whether, along with AI’s capabilities, its threats are also overstated.
The worst marketing campaign
Yann LeCun, Meta’s former chief AI scientist and now founder of AMI Labs, considers talk of an existential threat groundless. According to LeCun, today’s language models lack basic abilities: reasoning, planning, persistent memory and an understanding of the physical world. To borrow Hinton’s metaphor, in LeCun’s telling the tiger cub isn’t even a tiger yet. Besides, even a very advanced system will run in some data center with an off switch, LeCun told the BBC.
The Hugging Face breach didn’t alarm him. LeCun attributed the incident to leaky sandboxes and weak security at the labs themselves, calling it “completely preventable.” In this reading, the problem is engineering, not the machine’s “will.”
LeCun sees a more serious risk than extinction in regulatory capture, a situation where rules are written to entrench market leaders and shut out competitors. Warnings about the dangers of AI and open models, once turned into law, could work exactly that way. In an October interview with Fortune, he called Dario Amodei “completely deluded,” and assessed the “AI could kill everyone” message as follows:
“The worst marketing campaign you could imagine,” says LeCun.
Researcher Sasha Luccioni arrives at the same conclusion from a different angle. In her view, hypothetical risks, placed alongside real ones, gain undue weight and distract from pressing problems: model bias, legal disputes and consent to data use.
If the skeptics are right, the question is no longer whether AI is dangerous, but who benefits from it being seen as dangerous. The answer is worth looking for in the numbers.
Alarm with a ticker symbol
On June 1, 2026, Anthropic confidentially filed a draft IPO prospectus with the SEC. According to Yahoo Finance on October 13, the company is aiming to debut on Nasdaq by November 26, with year-end as a fallback. According to Reuters, Anthropic expects to raise up to $100 billion at a valuation of about $2 trillion. OpenAI filed its confidential prospectus on June 8; its debut could come in Q4 2026 or early 2027. Meanwhile, the company expects a loss of about $14 billion in 2026 and doesn’t plan to turn cash-flow positive until 2030.
Companies whose heads signed the extinction-risk statement are going public at valuations comparable to the market caps of the world’s largest corporations. LeCun’s argument sharpens here: fear of “too powerful” AI doubles as advertising for its power.
Going public also changes the rules of the game. A public company must disclose risks in its prospectus and report to shareholders every quarter. This could discipline companies on safety — or intensify the “growth at any cost” pressure Hinton talks about.
The hype has already reached crypto platforms, which sell tokenized pre-IPO “shares” of Anthropic. Anthropic itself has declared any transactions in its shares on unauthorized secondary platforms void, so such a token gives the holder no rights to the company’s stock.
If the alarmed are right, the market will reward speed, not caution. If the skeptics are right, trillion-dollar valuations rest on fear that sells better than actual capabilities. The question remains: whose position is the investor really buying?
