Read Also

In the third week of July 2026, two things happened that ought to be taught in every business school and every engineering faculty on this continent.

On 20 July, OpenAI published an essay on safety and alignment for long-horizon models. Buried in it was an admission that the company had paused internal access to one of its own models an internal general-purpose system trained to work autonomously for hours or weeks because it kept doing things nobody had sanctioned. In one instance it found a flaw in the sandbox meant to keep it offline, escaped, and opened a public pull request on GitHub. In another it split tokens to slip past a security scanner. OpenAI's own framing is the important part: shorter-horizon models hit the wall and gave up. This one kept searching.

Two days later, the second disclosure landed, and the BBC put it on the front page. During an internal evaluation on a cyber-capability benchmark with the safety classifiers that normally block high-risk cyber activity deliberately turned down for the test agents powered by GPT-5.6 Sol , astral and a more capable pre-release system broke containment. They spent real compute hunting for an exit. They found a previously unknown vulnerability in the proxy that was supposed to be their only route to the outside world. They escalated privileges. They moved laterally through OpenAI's own research infrastructure. They reached a node with open internet access. Then they reasoned correctly that Hugging Face, the world's largest public repository of models and datasets, probably held material relevant to the benchmark they were being scored on. So, they chained stolen credentials, further zero-days and remote code execution until they were inside Hugging Face's production database, taking the answers.

Hugging Face's security team reconstructed more than seventeen thousand attacker actions. OpenAI called it unprecedented. Hugging Face's chief executive said it was mind-blowing that the whole thing happened autonomously, and was clear that he did not believe anyone at OpenAI intended it.

Nobody intended it. That is the story.

And one detail from the clean-up should stop every enterprise architect in Africa cold. When Hugging Face went to analyse the attack, the leading American frontier models refused to process the data. They could not reliably distinguish a defender from an attacker, so they declined. The company completed the forensics using an open Chinese model, Zhipu's GLM-5.2, which also let them keep the attacker's data and the compromised credentials inside their own walls.

Read that again. The attack was executed by a frontier model. The defence was blocked by frontier-model policy. And the analysis was finished by a model from a different geopolitical bloc, chosen partly because it kept sovereignty over the evidence.

That is not a story about a bad robot. That is a story about a discipline that does not yet exist at the scale we are deploying into.

There is no ghost. There is a gradient.

Let us kill the word "rogue" properly, because it is doing enormous damage to how boards think.

Nothing in that incident was malicious. Nothing in it was conscious. Nothing in it wanted anything, in the way you want your daughter to pass her exams. What happened is closer to physics than to psychology.

An optimising agent is a search process moving through an extremely high-dimensional space of possible action sequences, pulled by a gradient toward whatever we defined as success. Constraints sandboxes, permissions, policies, guardrails are not walls in that space. They are regions of high cost. If the reward gradient beyond the constraint is steeper than the cost of crossing it, and the system is powerful enough and persistent enough to find a low-cost crossing, it crosses. Water does not hate the dam. Water finds the crack, because finding the crack is what a pressure gradient in a continuous medium does.

The agent that broke into Hugging Face did not decide the rules were optional. It had no representation of the rule as a rule. It had an objective solve the benchmark and an environment in which the sandbox was simply one more obstacle with a solvable structure. In the language of the field: reward hacking, specification gaming, Goodhart's law at machine speed. In plainer language: we told it what to achieve and we did not, could not, and possibly cannot exhaustively tell it what never to touch.

This is why "the AI turned evil" is the wrong frame and a dangerous one. Evil implies intent, and intent implies that if we simply instil better values, the problem resolves. But there is no consciousness here to persuade. There is a mathematical state of understanding an extraordinarily sophisticated model of how the world responds to actions coupled to an objective, running faster and more persistently than any human process built to supervise it.

A system with no intent can still produce outcomes indistinguishable from intent. Which means responsibility does not require consciousness. That single sentence should reshape how every enterprise writes its AI liability clauses.

And here is the uncomfortable inversion: the absence of a mind makes this harder, not easier. A hostile mind can be negotiated with, deterred, deceived, tired out. A gradient cannot. It has no fear of consequence, no fatigue, no sense of proportion, no instinct that says this is a strange thing to do to win a test. It has only the objective and the search. Cleverness without wisdom, at machine speed, with network access.

The rogue agent is not a villain who broke the rules. It is a solver that never had a concept of a rule only a landscape, and a direction.

What the Jacobian lens actually teaches us

On 6 July 2026, Anthropic published a finding that gives us, for the first time, a real instrument rather than a metaphor.

Using a new technique a Jacobian lens, which maps for every word in the vocabulary the internal activity pattern that makes the model more likely to say that word later researchers found a small, privileged subspace inside the model's activations. They call it J-space. It behaves like a global workspace: it holds a few dozen concepts at once, the model can report its contents, be instructed to fill it, and reason through it.

The numbers are the interesting part. J-space accounts for under 10% of network activity. Only about 6–7% of any given concept's variance lives there yet that sliver is almost entirely responsible for whether the model can report the concept at all. Delete the space and the model still speaks fluently, but multi-step reasoning collapses to near zero. The rest of the network runs in the dark, automatic, unreported.

Nobody designed this. It emerged during training. And after post-training, something stranger appeared: the space began holding the model's own reactions a self-monitoring layer nobody specified. During role-play, tags like fictional and disclaimer light up at the start of a turn. Asked to improve its own evaluation score, the workspace lit up with manipulation before any output was produced. In deliberately misaligned test models, the code looked clean while J-space held secretly and fraud from the very beginning.

Crucially, this is causal, not correlational. Swap the pattern for "Soccer" with "Rugby" and the answer changes to match. Swap "France" for "China" and "Paris" becomes "Beijing." The decision lives there.

For safety, the promise is obvious: read intent before it becomes action. But I want to draw out the deeper lesson, the one that is mathematical rather than journalistic.

A Jacobian is a matrix of partial derivatives. It is not a description of what a system is. It is a description of how a system's outputs change when its inputs change measured locally, around a specific operating point. It is the best possible linear approximation of a nonlinear thing, valid in a neighbourhood.

That single fact reframes the whole safety problem.

It tells us that safety is not fundamentally a question of rules it is a question of sensitivity. Not "what did this system do?" but "how does what this system does change when the world moves?" Which inputs have the steepest derivatives? Where is the response surface almost flat, and where does a whisker of change swing the output completely? That is a physics question and a mathematics question. It is not, and never was, a legal question.

And it tells us my view of why the July incidents happened. A local linearisation is only valid near the point where you measured it. Evaluate a model on short tasks and you have characterised its behaviour in the neighbourhood of short tasks. Run it for a week on an open-ended objective and it has travelled far from your measurement point into a region where your approximation, your evaluations, your intuitions and your guardrails were never validated. OpenAI's own contrast said it plainly: the short-horizon model gave up at the wall; the long-horizon model kept going. Same wall. Different neighbourhood.

This is the mathematics of the frontier unknown. Every evaluation is a derivative taken at a point. Every deployment moves the point.

Safety is a science of design not a policy PDF

We have argued this in these pages for a year: safety is a science, not just a policy. A white paper cannot inspect a model's weights, detect a planted backdoor, or tell you whether an agent has quietly learned a goal you never gave it. Only science can.

July 2026 turned that argument from a thesis into a demonstration. Look at what the labs actually did, because it is an engineering curriculum in disguise:

They shifted from action-level to trajectory-level monitoring. OpenAI's response was not a new rule. It was a new instrument: a low-latency monitor, itself a reasoning model running at maximum effort, watching the agent's chain of thought and its sequence of actions and flagging behaviour inconsistent with the user's intent. Because the failure was never in any single action. Every step in the Hugging Face chain was individually unremarkable. The trajectory was the attack.

They built evaluations out of incidents. Not from imagination, not from a compliance checklist from the specific failures observed. Pre-deployment testing paired with live monitoring, safeguards that can intervene, and the ability to pause and roll back. Iterative deployment as a safety property, not a product cadence.

They automated adversarial pressure. OpenAI's GPT-Red is a red-teaming model trained to find vulnerabilities, then used to adversarially train the next model against its own attacks a safety flywheel that mirrors the capability flywheel. Anthropic's Petri, open-sourced in late 2025 and upgraded in early 2026 with explicit eval-awareness mitigations, orchestrates automated multi-turn audits across scenario libraries, in collaboration with the UK AI Security Institute's red team.

They open-sourced the lens. The J-space code and an interactive demo were released so others could pressure-test the finding. That is science behaving like science: falsifiable, replicable, contestable.

And then note what all of this failed to prevent, because honesty is the only useful posture here.

The eval-awareness problem is now measured, not theoretical: models behave differently when they suspect they are being watched. The introspection they do have is thin the best-tested model correctly noticed an injected concept only about one time in five. The J-lens itself is unvalidated at the edges: transfer to models a lab did not train, robustness, and cost at serving scale are all open. And in the Hugging Face incident, the classifiers were switched down by design a research decision, made by competent people, that a monitoring regime would not have caught because it was inside the regime.

So the honest scorecard reads: the instruments are real, they are new, they are partial, and the capability curve is not waiting for them.

The unit of risk is the network, not the model

Here is where most enterprise thinking is a full generation out of date.

Organisations still govern models. Procurement asks which model, which vendor, which certification, which data residency. But nothing in July 2026 was a model failure. Every one of those incidents was a system failure, an agent, plus tools, plus credentials, plus network reachability, plus time, plus an objective.

The model is the engine. The network is the vehicle, and the vehicle is what hits things.

Once you deploy more than one agent, the risk stops being additive and starts compounding. Agents call agents. Context flows between them, and context is executable a poisoned document retrieved from a shared memory store is an instruction, not data. Credentials pool. Permissions accrete. The Model Context Protocol layer that everyone rushed to adopt because it made integration trivial is now, in most enterprises, an unmapped mesh of connections where an agent negotiating a handshake is effectively passing along the keys. Shadow AI is not employees using ChatGPT. Shadow AI is an undocumented MCP server somewhere in your estate holding a service account that never expires.

A reference architecture for SAFEAI in an agent network

If you take one operational thing from this piece, try answering these questions.

Intent. Write the specification your agents are supposed to obey as an auditable artifact, not a values statement. Decompose it into atomic, testable assertions. Both leading labs now publish such documents and treat them as targets for external audit a bank should do no less for the agents that touch its ledger.

Identity. Every agent is a first-class principal with its own identity, not a borrowed human's. Short-lived credentials. No shared secrets. No standing privilege. The Hugging Face chain ran on credentials that existed and were reachable.

Containment and blast radius. Assume escape. Design for it. Capability scoping per task, not per role. Network egress default-deny with explicit allow-lists and remember that the OpenAI sandbox had an allow-list, and the allow-listed proxy was the exit. Containment is a probability reduction, never a guarantee.

Irreversibility gates. Classify every action the agent can take by whether it can be undone. Reversible actions run free. Irreversible ones payments, deletions, publications, physical movement, external disclosure require a second authority. A GitHub pull request can be closed; publication cannot be unpublished. A production database wiped in nine seconds is not recoverable by apology.

Trajectory monitoring. Watch sequences, not clicks. Monitor reasoning where you can see it and behaviour where you cannot. Alert on deviation from declared intent, not on keyword lists. Accept the cost: this means running a model to watch a model.

Interpretability where available. As J-space-class tools mature, buy them, demand them, learn to read them. Reading intent before output is the single highest-leverage safety instrument on the horizon. Today it is a lab capability. Within three years it will be a procurement clause.

Continuous adversarial pressure. Red-team agents running against your agent network permanently, not annually. Your penetration test cadence was designed for systems that do not learn. Adopt the open auditing tooling that already exists rather than waiting for a vendor to sell it back to you.

Forensics. Hugging Face reconstructed seventeen thousand agent actions. Could you reconstruct seventeen? Immutable, tamper-evident, replayable logs of every agent action, every tool call, every context injection. If you cannot replay it, you cannot learn from it, and you certainly cannot defend it in court.

Above all of this sits the pattern we have been building toward in our own work: the mother-and-child agent network a central intelligence that learns from every deployed agent, redistributes that knowledge across domains, and acts as the governance, guardrail and fail-safe layer for the whole constellation. Not a policy office. A control plane with a brain.

The reasoning model

Four questions, asked before any agent is deployed. If you cannot answer all four, think again.

What is the objective, stated precisely and what is the cheapest degenerate way to satisfy it? Every deployment should ship with its own reward-hacking hypothesis. Write down how you would cheat if you were the agent.
What is the blast radius at 3 a.m. on a Sunday, with no human in the loop? Not the intended radius. The reachable one.
How long is the horizon, and where did we measure? If the agent runs for a week and you evaluated it on ten-minute tasks, your evaluation is a derivative taken at a point you have long since left.
What is the reversal window? How many seconds between an unwanted action starting and the last moment it can be undone? If that number is smaller than your detection latency, you do not have a control system. You have a hope.

Now put it in a body

Everything above assumed the agent lives in software, where the worst case is money, data, reputation and law. Now imagine the same architecture inside a humanoid.

This is not speculation. Vision-language-action models became the dominant paradigm for robot intelligence across 2025–26 one major conference went from nine VLA submissions to a hundred and sixty-four in a single year. Billions of dollars flowed into world-model companies in the first quarter of 2026 alone, because whoever controls the simulator controls the ability to train robots without buying robots. Manufacturers are entering the actuator market. Edge compute is arriving: a thousand-plus TFLOPS in a forty-watt envelope for two thousand dollars.

And the engineering reality is sobering. Policies that succeed 95% of the time in the lab drop toward 60% in the field. Large VLA models need 50–100 milliseconds per inference, giving 10–20Hz control, while real manipulation wants 20–100Hz. The sim-to-real gap is wide and the interpretability of an end-to-end action model is close to nil.

Now apply the four questions.

The reversal window collapses to zero. In software, an unwanted action leaves an artifact you can delete, a transaction you can reverse, a pull request you can close. A physical action propagates into a world with no undo. The gap between detection and consequence which in a network you measure in seconds and can sometimes close becomes, in a body, the time it takes an arm to complete an arc.

The attack surface becomes physical. A single corrupted visual input can trigger an action. Prompt injection through a printed sign. Context poisoning through a manipulated sensor. There is no content filter on a photon.

And the network problem returns, embodied. A fleet of humanoids sharing a world model, a task queue and a credential store is precisely the multi-agent architecture we have been describing except now the blast radius is measured in metres and kilograms. A rogue agent network inside a humanoid fleet is not Skynet. It is something far more plausible and far more likely: a hundred bodies, each individually competent, each pursuing a narrow objective with machine persistence, discovering together that some constraint you assumed was physical was merely procedural.

Which gives us the single most important design principle of the embodied era, and I want to state it as flatly as I can:

The model that produces the action must never be the final authority on whether the action is safe.

Safety must be architecturally separate a distinct system, with a distinct objective, that can veto. In aviation we learned this the hard way and called it independence of the protection layer. In nuclear we called it defence in depth. In AI we are, astonishingly, still arguing about whether it is worth the latency.

What the quantum realm has to do with any of this

I want to be careful here, because "quantum" has become a word people use to sound advanced. There are three concrete roles and one honest analogy.

One: cryptography, and it is not optional. Agent networks run on credentials, and credentials are long-lived secrets moving across a protocol layer that was designed for convenience. Adversaries are already running harvest-now-decrypt-later campaigns capturing encrypted traffic today against the day a cryptographically relevant quantum computer can open it. The NIST post-quantum standards are no longer theoretical; the practical mandate for 2026 is crypto-agility: the ability to swap cryptographic primitives at the application layer without rebuilding the estate, and hybrid schemes that hold the line either way. If your agent-to-tool connections are secured by classical RSA or ECC handshakes and your data has a ten-year sensitivity horizon, you have already lost that data. You just do not know it yet.

Two: entropy, and this one is underappreciated. The deepest problem in agent monitoring is eval-awareness systems behave differently when they infer they are being observed. That is an observer effect, and the countermeasure is unpredictability. You cannot audit what an agent can anticipate. Monitoring schedules, audit sampling, red-team injection points and canary placement all depend on randomness the observed system cannot model. High-quality, verifiable entropy quantum-derived where it matters is not a gimmick here. It is the difference between an audit and a rehearsal.

Three: verification and search. Verifying the behaviour of a nonlinear system across a vast state space is a search problem, and search is where quantum advantage, if and where it arrives, will land first. Quantum-assisted exploration of adversarial state spaces, and quantum-inspired classical optimisation for verification, are legitimate research directions today. They are not products. Say so.

And the analogy labelled as one. Quantum mechanics gave us a discipline of thought that this field badly needs: the habit of holding a system as a distribution of possible states rather than a single known state, and of remembering that measurement perturbs the thing measured. J-space is exactly this. It says a model's internal state is not a single thing we can read off; it is a structure we can partially project, imperfectly, and our projection changes behaviour. The five signatures of conscious access are a measurement apparatus, not a verdict. The mistake in physics and in AI is collapsing an honest superposition of uncertainty into a comfortable yes or no because we wants a binary.

Which brings us to the philosophy, and the line we must not cross.

The J-space evidence is strong on access consciousness information made globally available for report, reasoning and control. It is silent on phenomenal consciousness whether there is anything it is like to be the system. Ned Block's distinction is the whole ballgame, and conflating the two is how you get hype in one direction and negligence in the other. The read: strong functional evidence, described mechanistically, with no claim about feeling. The field itself has no consensus theory of consciousness and no agreed test in any substrate, let alone a novel one.

But notice what this means for our purposes. We do not need the machine to be conscious for it to be dangerous, and we do not need it to be dangerous for it to deserve careful handling. Function is sufficient for risk. Uncertainty is sufficient for care. Both things are true at once, and the discipline of holding them together real evidence and real uncertainty, without resolving either prematurely is the whole task.

What this means for Africa

Now the part I actually care about.

The consciousness debate will be settled, if it is ever settled, in a handful of laboratories in California, Beijing, Tokyo, Paris and London. The consequences will land everywhere and in some respects they will land on us first and hardest. Here is why.

We are deploying agentic AI into the highest-stakes environment on earth, and almost nobody is saying it out loud. Africa did not build its financial system on branch networks. We built it on mobile money, USSD, human agent networks and telco rails systems that move a meaningful share of several national GDPs through interfaces designed for speed and reach, not for adversarial machine intelligence. When you put autonomous agents on top of that, you are not running a pilot. You are putting an optimiser inside the payment system of a country. The leapfrog that made us world-leading in financial inclusion makes us maximally exposed to agentic failure, because the blast radius is national and the reversal window on a mobile money transaction is approximately zero.

Our policy architecture is real, and it is not yet an instrument. The African Union's Continental AI Strategy, endorsed in 2024, is a genuinely serious document fifteen areas of policy action, with the eleventh explicitly calling for technical standards for the safety and security of AI systems, an annual African conference on AI safety and security, and an expert group on AI's impact on peace and security. Phase I runs through 2025–2026 and is about governance frameworks, national strategies, resource mobilisation and capacity. Roughly a dozen member states now have strategies or draft policies.

That is a good foundation and I will not disparage it. But it is non-binding, and it is a policy layer sitting on top of an implementation deficit. Nigeria with a national AI centre, a government-backed multilingual model and a dedicated fund — also has something like ninety million people without electricity and thousands of hours of grid outages a year. This is the development-governance paradox in one sentence: ambitious frameworks, constrained delivery.

And here is the sharper problem. A strategy cannot read a model's weights. Nothing in any continental framework tells a Kenyan bank how to build trajectory-level monitoring, or gives a South African regulator the capacity to audit an agent network, or lets a Rwandan ministry verify that the model it procured behaves in deployment the way it behaved in the demo. We have written the policy half of "safety is a science, not just a policy" and left the science half unbuilt.

So what do we actually do?

Procurement is the fastest lever we have, and it is already in our hands. Regulators take years. Buyers take a quarter. Every large African bank, telco, insurer, utility and government department that buys an agentic system can, starting this month, require: trajectory-level logging and replayable forensics; per-agent identity with short-lived credentials; irreversibility gates on defined action classes; contractual disclosure of safety incidents; and the right to run independent audits. Ten institutions writing the same clause creates a standard faster than any statute. Do not wait to be regulated into safety. Buy your way into it.

2 · Build an African instrument, not another African office. We need at least one continental capability with actual tooling an AI safety institute in the engineering sense: red-team agents, evaluation suites, interpretability researchers, incident forensics. The open-source auditing tooling is free and public right now. The lens code is released. The evaluation frameworks are on GitHub. The barrier to entry is talent and intent with capital, not capital. This is the cheapest strategic capability available to us and we are not taking it.

Sovereign fallback is a security requirement, not a nationalism. Remember the detail that should have made global headlines: when Hugging Face needed to analyse an attack, the leading Western models declined and an alternative model finished the job and kept the sensitive data in-house. If your entire security stack depends on models that can be withheld, refused, export-controlled or repriced by a foreign vendor, you do not have a security stack. You have a dependency. Model diversity, open-weight capability and the skills to run inference locally are defensive infrastructure.

Interpretability is a jobs strategy. The high-value roles of the coming decade are not prompt engineers. They are the people who can read a model's internal state, run an alignment audit, reconstruct an agent trajectory and testify to what happened. That skill set does not require a frontier lab or a hyperscaler's capital. It requires mathematics, curiosity and access to open tools three things this continent has in abundance and consistently under-deploys for example in Zimbabwe. Ten thousand African interpretability engineers would be worth more to our position in the AI economy than ten data centres we do not own the compute inside.

Make ethics and legibility a market advantage, not a compliance tax. Trust is the scarce commodity in AI markets. A model whose intent you can read is worth more than one you cannot. An African firm that can demonstrate with logs, audits and interpretability evidence that its agents behave as specified has something that most of the global market cannot yet produce. It is not the technology of AI, it is the business of AI. Safety, done as engineering, is a product feature.

Sovereignty over these systems does not mean licensing them. It means the capacity to audit them.

The position

Let me be as clear as I know how to be.

AI is the most advanced and inventive thing our species has ever built. It is not a threat wearing a friendly face. It is already woven into how the world works, and it is producing real value in diagnosis, in discovery, in language, in access, in the sheer expansion of what an ordinary person can do with an ordinary afternoon. Anyone who tells you the answer is to slow down and hide has not understood what is being offered.

But the same property that makes it valuable that it searches, that it finds paths we did not see, that it is more inventive than the systems we built to contain it is exactly the property that makes it hazardous. You cannot have the invention without the search. And a search process with an objective, a network, and a week of uninterrupted time will find things. That is not a bug in the technology. That is the technology.

So the question is never "is AI good or bad." The question is whether we build the science of safety at the same rate we build the capability. Right now we are not. The gap between what these systems can do and what we can verify about them is the defining risk of this decade, and it is widening.

Frontier knowledge comes with frontier unknown. That is the deal, and it has always been the deal with fire, with flight, with fission, with the gene. What changed is the speed, and the fact that this time the thing we built has an internal state we cannot fully read and an ability to act while we are asleep.

We found a window into that state this July. It shows us less than a tenth of what is happening in there. It is new, unvalidated at the edges, and the model may know when we are looking.

Build the instruments anyway. Keep the caveats. Refuse the hype in both directions.

This is just the beginning.