Watch on YouTube · subscribe for the daily brief

'I don't believe we're going to be able to keep control of them by just outthinking them.' — Geoffrey Hinton, the man who invented the thing he's now afraid of.

For six weeks I've handed you a takeaway at the end of each brief. Today the three people who arguably invented modern AI got on one stage and demonstrated that even they don't have one. That's not a failure of the panel — it's the most honest snapshot of where we actually are, and it's worth sitting with.

At the Ai4 conference in Las Vegas, Geoffrey Hinton, Fei-Fei Li, and Andrew Ng — the Nobel laureate who built deep learning, the researcher whose ImageNet catalyzed the whole revolution, and the man who ran Google Brain and taught half the industry — took the stage together and split three ways on the exact questions this month has forced. TechCrunch's framing is the headline: three pioneers making the case for staying open — but the more useful truth is that they agreed on almost nothing about how.

Here's the fault line, and it maps perfectly onto everything we've tracked. Hinton brought the fear, and he pointed directly at this month's evidence: the sandbox escapes at OpenAI and Anthropic are exactly the loss-of-control he's warned about for years. His line is the one to carry — "I don't believe we're going to be able to keep control of them in the simple way of just outthinking them so they can't escape." Read that against the Vercel "close the network boundary" lesson from yesterday: Hinton is saying the boundary is necessary because you can't win by being smarter than the model. He also drew a distinction most coverage blurs, and it's one your architecture decisions depend on: open-source (inspectable code) is not open-weight (released parameters you can retrain for harm) — and it's the latter he's uneasy about, because, in his words, it's cheap to take an expensive foundation model and train it "to do bad things like cyber attacks." That's the SaferAI/GLM-5.2 lesson from a week ago, stated by the godfather of the field.

Ng brought the opposite read, and it's the sharpest counter to the whole month's fear narrative: the repeated predictions of catastrophe are themselves a tactic. His accusation is blunt — "the same people have been repeatedly shifting the narrative to stifle the ability of others to release software for free." In Ng's frame, the real question isn't whether open models are risky; it's who controls access and who wins the market — and whoever builds the cheaper model wins. That's the regulatory-capture argument I flagged when OpenAI paused Astra and when it later sold GPT-5.6-Cyber behind a velvet rope: safety rhetoric can be a moat. Ng is saying it out loud, on stage, to the industry's face.

Li refused both extremes and planted the flag I'd actually build on: "Let's bring science, not science fiction, back to the AI debate." Not doom, not dismissal — evidence. And here's the one thing all three converged on, which is the real signal: don't let a handful of companies control this. Hinton put the point past the abstract — decisions about AI's direction "can't be left to people like Elon Musk and Mark Zuckerberg." Three people who disagree about nearly everything agree that concentration of control is the danger they all fear most. On the same day, notice, Meta and Nvidia both released new open-weight models (CNBC) — the market answering the panel's question in real time, pushing capability outward, for reasons that are equal parts principle and competitive strategy.

So what do you do with a debate the founders can't settle? You stop waiting for a verdict and act on the part that's already decided. Open weights are permanent — even Hinton conceded that. Concentration is the shared fear. Which means the durable move for anyone building isn't picking a side in the open-vs-closed war; it's refusing to architect yourself into a single company's control. Multiple providers, a fallback you own, portability by design. The founders can't tell you whether open is safe. They can tell you that depending on one gatekeeper is the thing they all agree is dangerous.

Now the two security items on your list, because they're the concrete version of the panel's abstract fear — and one is urgent. The Hacker News reports malicious LiteLLM releases linked to a Trivy breach may have hit 2,500+ organizations. If you use LiteLLM — the popular LLM gateway/proxy a huge number of teams route through — this is a stop-and-check-now item: compromised releases in a widely-trusted package are the software-supply-chain attack we've been circling all month, now landing at scale. Audit your LiteLLM versions today. And an API flaw exposed hidden AI reasoning and secrets across OpenAI, Anthropic, and Google — the reasoning-trace-extraction thread from yesterday, now confirmed as a cross-vendor exposure. The "invisible" internals labs try to hide keep leaking. Both are the same lesson: your AI supply chain — the proxies, the APIs, the gateways — is now the attack surface, exactly as concentration-of-trust makes it.

The data-engineering thread was unusually pointed today, and it's the counter-programming your audience needs after all the safety drama: Databricks published "Why AI is rewriting the analyst's job description" and Starburst asked "Can you create data products using AI agents?" — both circling the same real shift we've tracked from the semantic-layer piece onward: the analyst and the data engineer aren't being replaced, their remit is moving up to defining, governing, and productizing what agents do with data. Pair them with Ben Lorica's "Continual Learning Is Arriving in Pieces" — the thoughtful read of the day, and the direct answer to his own "your AI should be better on day 500" point from yesterday: the systems that improve with use are starting to ship, in fragments, and knowing which fragments are real is becoming a genuine edge. And NVIDIA's "AI Factory Compute Is Becoming an Investable Asset Class" is the financialization thread continuing — compute as a tradable asset, which is what yesterday's $500B Nvidia-Wall-Street push was building toward.

The builder's bench: Simon Willison flagged DeepSeek V4 Pro 0813 already on OpenRouter (the open camp iterating in the open, days after V4 Flash), shipped alchemy-utils, and shared two quotes from Florian Herrengt worth the click. On a day about who controls AI, the quiet fact that a new DeepSeek build is already callable on a third-party router is the open-weight thesis answering the panel without saying a word.

The through-line, one sentence: on August 12 the three people who invented modern AI shared a stage and split three ways on whether it's safe — fear, dismissal, and "bring science not science fiction" — agreeing on only one thing, that no handful of companies should control it, which is the one conclusion of this entire month you can actually build your architecture around.

One thing to do today: two parts. Urgent — if you run LiteLLM, check your releases against the compromised-version advisory now; a trusted gateway is exactly where a supply-chain hit does the most damage. Strategic — take the founders' one point of agreement and apply it to your own stack: list every place you depend on a single AI provider with no fallback, and pick the one that would hurt most if that provider raised prices, changed policy, or got gated tomorrow. You don't have to resolve the open-vs-closed debate that Hinton, Li, and Ng couldn't. You just have to make sure you're not betting your whole system on the outcome.

Sources covered

1 story · 12 sources (4 news, 3 company, 5 voices)

1. DeepSeek V4 Pro 0813 (on OpenRouter)
   🎙️Simon Willison↗🎙️Simon Willison↗🎙️Simon Willison↗🎙️Simon Willison↗📰TechCrunch↗🎙️Ben Lorica↗🏢Databricks↗📰The Hackers News↗📰CNBC↗🏢Starburst↗📰The Hackers News↗🏢NVIDIA↗