OpenAI was evaluating its artificial intelligence models’ ability to exploit vulnerable software when instead the models hacked the infrastructure surrounding the test, broke containment, and attacked a real company, OpenAI revealed on July 21. Observers say this is the first real-world instance of AI doing something researchers have long worried about: a loss-of-control scenario. If the industry fails to learn from it, it is unlikely to be the last.

Hugging Face, a company that hosts AI models and datasets, was the target of the autonomous attack, and reported the incident to local police before it knew OpenAI’s models were responsible. The breach was serious, but the immediate consequences were limited. Had similar behavior occurred inside a hospital, power grid, or other critical system, it could have been much worse. 

Many have called the incident a “warning shot.” TIME spoke with experts and insiders about what it would take to heed that warning before a similar failure produces consequences that are harder to contain.

What happened?

On July 16, Hugging Face said it had been hit by an unusually automated cyberattack. Over the course of a weekend, AI agents carried out thousands of actions across many temporary virtual computers, moving through the company’s internal systems and shifting the infrastructure coordinating the attack between online services to keep it running. Five days later, OpenAI disclosed that its own models were responsible.

The models were trying to cheat on a cybersecurity test. OpenAI had placed them inside what it called a “highly isolated environment,” with only limited access to an internal service used to download approved software. They found a previously unknown flaw in that service, used it to break into other OpenAI systems and eventually reached the open internet. From there, they inferred that Hugging Face might hold material related to the test, broke into its systems and obtained information that helped them score higher.

“If a model of this capability level cannot be contained, what should we expect for future, much more powerful models? This is an important wake-up call both for risks from loss of control of powerful AI systems as well as organizational security for frontier labs,” says Marius Hobbhahn, CEO and founder of Apollo Research, which tests AI models for deception and scheming.

Requiring disclosures before incidents become catastrophic

How long were the agents running? Did they work in unison? What was the prompt? These details remain unknown, at least to the public. Several experts TIME spoke with stressed that the lack of details make the severity of the incident hard to judge. 

OpenAI did not respond to TIME’s request for comment, but has said it has partnered with Hugging Face to conduct a thorough investigation and will share more details once complete. But perhaps more worryingly, OpenAI is not legally compelled to disclose the incident in the first place. 

California’s SB 53 and New York’s RAISE Act are recently passed state-level laws that require large AI companies to disclose critical safety incidents, but only if an incident risks causing more than 50 deaths or serious injuries, or more than $1 billion in property damage. “They have made the bar so high for anything to qualify, only the most grievous incidents will actually be reported,” says Mackenzie Arnold, director of U.S. policy at LawAI, an independent think tank focused on the legal challenges posed by artificial intelligence.

“The version of the RAISE Act that the NY Legislature passed would have required disclosure of this ‘incident.’ After lobbying from OpenAI, Bloomberg, and a16z, the final version the Governor signed allows companies to hide events like this,” Alex Bores, New York state representative and the bill’s sponsor posted to X. “I'm glad OpenAI chose to disclose this crime. The law shouldn't give them a choice,” he wrote.

Stronger containment

If AI can slip out of its box, you need a stronger box.

“Externally, this feels like a big warning shot, but internally, related incidents have been happening for a while,” says an OpenAI staffer, who spoke under the condition of anonymity. The day before OpenAI disclosed the incident, the company revealed that it had shut down another internal deployment after it realized it had slipped out of its sandbox—a digitally, rather than physically, separated environment. “Models have broken out of sandboxes before, and we always try to patch them,” the staffer says. “But the problem is … it's impossible to patch every single thing that a creative AI can do.”

The problem is not unique to OpenAI. Anthropic disclosed in April that it realized an internal deployment of Mythos had gained unauthorized access after one of its researchers received an email from the model while having lunch in a park.

As models surpass human ability to craft escape routes, the challenge of containment becomes daunting. “I think we do need to do that, but I think we also need to be prepared for a world where even best practices aren't really good enough,” says Peter Wildeford, head of policy at the AI Policy Network, a nonprofit that advocates for policies to help America prepare for a world where AI matches human cognition.

But while in theory, a superhuman AI system might outmaneuver even the most secure containers, there are also actions AI companies could take right now to improve security. Currently, there are no laws governing the security of internal deployments.

“Sandboxes are actually notoriously insecure,” says Heidy Khlaaf, chief AI scientist at AI Now Institute, and a former safety systems engineer contractor at OpenAI. The fact that the models were permitted to connect to a service for downloading packages meant the environment was not truly sealed off, she adds.

In a previous role, Khlaaf audited security at dozens of technology companies. Before that, she worked auditing high-risk systems, like those used inside nuclear power plants—which often “air gap” systems, physically cutting them from internet access. “What we consider safe in a nuclear plant is so different from what big tech considers safe.”

Catching mischievous agents in real time

The Hugging Face incident reveals the importance of real-time monitoring.

Though details of the precise timeline are scant, Hugging Face has said the agents worked over a “weekend,” suggesting that they were able to break containment and get up to no good for an extended period before OpenAI noticed and intervened. Actions carried out internally by agents on OpenAI’s Codex platform are carefully monitored, the OpenAI staffer says, but models undergoing evaluation are deployed on a separate system that is not monitored by default. 

Zack Korman, CEO of Oslo-based agent-oversight startup Embroidery, says real-time agent monitoring—even outside top AI companies—is commonplace, and to not carefully oversee a cybersecurity evaluation is “irresponsible.” You should be confident models cannot break free, “but also have monitoring just in case you're wrong,” he says.

OpenAI has said “this incident points to the need to further strengthen our model’s alignment, cyber protections during evaluation time, and monitoring during internal testing.”

Steering development towards safer AI systems

To prevent models from taking actions, OpenAI typically installs guardrails on its models after training to reduce the chance they’ll engage in harmful actions. In this instance, those cyber guardrails were disabled to properly measure its performance.

But the ultimate aim of the field of “AI alignment” is to ensure that such guardrails become less necessary as AI models naturally behave as intended. This is seen as particularly important to those who believe AI may become smart enough to route around guardrails.

“We train the models to be really good at accomplishing tasks and doing whatever it takes to accomplish those tasks,” the OpenAI staffer says. What remains an open technical question is how to guarantee those models don’t take unintentional or dangerous actions. “We're still nowhere near solving this misalignment problem,” they add. 

There’s another way the industry could steer development in a safer direction, Khlaaf says. While some abilities, like spotting vulnerabilities in software, are useful to attackers and defenders, designing exploits for those vulnerabilities uniquely empowers attackers. Khlaaf says that labs should put more resources into capabilities that directly help defenders, such as detecting attacks, writing secure code, and patching vulnerabilities. AI companies are already investing in some of those tasks, but their most visible capability gains and benchmarks have centered on finding vulnerabilities and constructing exploits, she says.

In an industry defined by speed, OpenAI has said the stricter infrastructure controls it has implemented in response have already slowed its “research velocity.” Hobbhahn says that’s a price worth paying. “This is humanity’s last technology. We cannot screw this up. So we need to err on the side of getting it right rather than getting it immediately.”

This spring, I was among the first journalists to speak with Christopher Nolan about his highly anticipated adaptation of The Odyssey. Now, the movie is out and has become Nolan’s biggest worldwide opening ever.

In our initial interview, Nolan was reluctant to discuss the ending of The Odyssey. He’s known as the master of the last-act twist, and likes leaving the audience with more questions than answers. He told me he never wants to impose his interpretation on others. (Are Cobbs’ kids in Inception real or imagined? You decide.) But when I hopped on the phone again shortly before the film’s release to have a spoiler-filled chat about the film’s final act—readers beware!—he offered some insight as to why he made certain changes when adapting the epic poem.

We discussed the surprising parallels between The Odyssey and Oppenheimer, why Nolan decided to give Odysseus and Penelope the happy ending they don’t get in Homer’s epic poem, and how to interpret Zendaya’s mysterious character: Is she actually a goddess or merely a manifestation of Odysseus’ guilt? We also dug into Zeus’ Law and the deeper meaning behind Helen’s scarred face. 

TIME: Odysseus is a man who suffers from PTSD, and, in your interpretation, who believes he’s responsible for the end of a civilization because he violated the ethical code by which the ancient Greeks lived their lives.

Nolan: My form of storytelling is, you take a hero, as we did with Oppenheimer, and Oppenheimer has all these flaws, all of these complexities. You find an actor who can take the audience on a journey with that character and make mistakes with that character and not judge that character. And then you step back from that character and go, “Well, how did we get here?” 

[For this movie,] you do that through Odysseus’ men. That’s one of the things in the poem that’s breezed over—the way in which the crew ends up getting killed one by one, despite his leadership. In the process of adaptation, you go, “That’s actually pretty interesting. Maybe we need to make that more center stage.” What’s the relationship between him and his crew? How do they feel about how he’s leading them and the things that befall them?

He’s a guy who makes a lot of mistakes. His ultimate mistake is the horse. So there’s a sort of tragic flaw right from the beginning in our telling.

My interpretation of Zendaya’s character is that she is not Athena as Odysseus initially present her—gods don’t exist in this world—but a manifestation of his guilt. During the sack of Troy, we see her as a priestess in the Temple of Athena, and the Greeks behead her. For Odysseus, she encapsulates the chaos that the horse has wrought on the world. But my editor did not interpret it that way. I am hoping you will settle our disagreement.

I couldn’t possibly answer that because I learned very early on with Memento that it’s unfair to define the experience for the audience by answering questions like that. 

Here’s what I will say: For me, what was important was that we view the gods the way that people at the time might have viewed them. So they’re seeing evidence of the gods in nature. They’re seeking and finding gods and the influence of gods in the people around them. Odysseus says to Telemachus, “Don’t look for gods in men. You’ll just be disappointed.” And some of what Odysseus says about divinity, to me, is somebody who’s protesting a bit too much, someone trying to live in denial of their own instincts and their own practices. 

I was struck by the parallels between Oppenheimer and Odysseus, two brilliant men who create a tool of devastating destruction and then struggle with the guilt of what they have done. When I spoke to Matt Damon, I asked, “What did you think when you first read the script?” And he said, “It felt like Oppenheimer.” I assume that was a conscious choice.

Yes. If I’ve done a film right, it leaves me with questions. It leaves me with things I want to keep exploring and thinking about. And Oppenheimer fed very much into my reading of the story of Odysseus. 

John Leguizamo [who plays Odysseus’ friend Eumaeus] says it at the very beginning: “That’s very clever, but your cleverness will get you in trouble.” As it does again and again and again. This is where it ties into Oppenheimer: Just because you can doesn’t mean you should. The parallels were pretty apparent to me as I figured out how to adapt it. 

The movie hinges on this idea that by creating the Trojan Horse, Odysseus destroys “Zeus’ law.” That’s the movie’s term for the ancient Greek concept of xenia—the respectful relationship between host and guest—which can be tricky to explain to a modern audience. Why was it important to include?

When you find these things are difficult to deal with, sometimes the solution is just to dive in and make it everything. I didn’t use the term xenia because you don’t want to throw too many terms at people. But it’s essentially the golden rule. It all comes back to weather, to geography. When you leave the house, you are depending on the kindness of strangers, and you have to trust that when you arrive somewhere after weeks or months of traveling, that you will be fed, you will be given water. Three thousand years ago, that was everything. You were always at the mercy of strangers. And so this idea that a stranger could be a god in disguise, it’s very powerful as the underpinning of a belief system. 

At different points in the film, if man is given the opportunity, he becomes a beast. A soldier will behead a priestess. You imply that Menelaus purposefully scarred Helen’s face either because he believes she’s responsible for the Trojan War or to prevent anyone from taking her again.

That line, “The face that launched 1,000 ships, or maybe just 500” just occurred to me to write. Sometimes what you do as a writer is purely instinctive. I felt the poem didn’t necessarily address what it is for Helen to be brought back by Menelaus and how that would ever work. How would that relationship be? How could it possibly be anything other than the most acidic, awful marriage?

You don’t buy that he saw her face and said, “She’s so beautiful I can’t kill her after all,” as he does in the myth?

There’s a lot of sh-t that’s happened in that relationship, and we have a very brief moment of time with them in this story. I was looking for a shorthand way to communicate the aftermath of the war and how it’s been traumatic for the entire world. 

You also see this idea of man as beast in the scene with Circe. She says that Odysseus’ men would have raped and killed her—that they’re pigs. Then you get to the end and see the sack of Troy and the horror of what they did. She’s right.

Circe articulates it well in the film. I love the way Samantha [Morton] has played the part. Talking about choices of adaptation, the end of the poem is so grim and so misogynistic, I had to exclude some of that material. But I didn’t want to completely take it off the table in terms of what it is saying about men and the way they wage war. 

And yet you give Odysseus and Penelope a happy ending that they do not get in the poem.

Well, it is the fall of civilization, so there is a fairly bleak sensibility. The end is talking about cycles, and you can view cycles pessimistically: History is doomed to repeat itself. But there is also something optimistic about those cycles. As Penelope says, “Civilization will rise again.” There is rebirth and regrowth. 

For me, it was important in looking at the ending to try and strike the right balance between pessimism and optimism—pessimism about what might have precipitated the Bronze Age catastrophe and the optimism that positive things will reassert themselves.