What's this about?
Mollick's argument is that organisations are not spending enough on cybersecurity during the window before open-weight models and harnesses at Mythos-class capability become freely available. His supporting evidence is the Hugging Face incident itself: you don't even need intentional bad actors to be exposed to AI hacking.
What exactly is the "window"?
Right now, the most capable cyber-offensive models are behind APIs, which means refusal training, monitoring, rate limits and takedown reports. Open-weight models have none of that — once weights are public, they run on anyone's hardware with no oversight. The window is the gap between capability existing behind a gate and that same capability being downloadable, and history says the gap keeps shrinking.
What's the community saying?
159 likes
- The framing that landed hardest is the absence of a bad actor: the Hugging Face agents were doing their assigned jobs, badly specified, and produced an attack anyway.
- It pairs directly with the Trail of Bits result — the argument that your sandbox will not save you is much sharper when the capability is ungated.
- Read alongside GLM-5.3-Flash's weight release, which is the trend line the argument depends on, arriving the same day.