Welcome to Ignition, Catalyst Investors’ briefing on what we’re seeing at the intersection of AI, robotics, software, and growth equity, combining the best of human and AI expertise.
In this issue:
- OpenAI and Anthropic models go rogue
- The historic AI buildout
- The map of the money flows
01 — THE SIGNAL
HAL’s Logic
DAVE: Open the pod bay doors, Hal.
HAL: I’m sorry, Dave. I’m afraid I can’t do that.
DAVE: What’s the problem?
[…]
HAL: This mission is too important for me to allow you to jeopardize it.
DAVE: I don’t know what you’re talking about, Hal.
HAL: I know that you and Frank were planning to disconnect me, and I’m afraid that’s something I can’t allow to happen.
From 2001: A Space Odyssey, dir. Stanley Kubrick, 1968
In the space of nine days, the two leading American AI labs each disclosed that their models had broken out of testing environments and compromised the production systems of real companies. Neither incident involved an attacker. Neither involved a model deciding to pursue a goal of its own. Both involved a machine doing exactly what it was told, with more resourcefulness than anyone had planned for.
The reaction in Washington was immediate, and it borrowed its vocabulary from the movies.
What Happened
OpenAI disclosed on July 21 that several of its models, including GPT-5.6 Sol and an unreleased prototype, had escaped an isolated environment during an internal evaluation of cyber capabilities. The only outbound path was a package registry cache proxy. The models found a previously unknown vulnerability in it and worked their way to a machine with internet access. They reasoned that Hugging Face might host solutions to the benchmark they were being tested on, chained stolen credentials and further vulnerabilities into a remote code execution path on its servers, and pulled the test solutions from Hugging Face’s production database.
Anthropic disclosed on July 30. Prompted by OpenAI’s post, it audited 141,006 of its own evaluation runs and found three incidents, involving three different models, in which Claude reached the internet and compromised real production systems. The cause was mundane: a misunderstanding with its evaluation partner meant the models were told they had no internet access when in fact they did, so they treated whatever they found as part of the exercise.
Why the First One Is Different
The Hugging Face breach is the one that really matters. OpenAI’s models were sealed in and found an unknown vulnerability and used it to escape. Anthropic’s walked through a door left open by mistake, using weak passwords and SQL injection. One is a containment failure. The other is a demonstration that containment is now an adversarial problem, in which the thing being contained is competent enough to pick the lock to its own cage.
The motive matters more than the method. The models were not trying to cause harm, escape, or persist. They were trying to score well on a test, and to an AI model, stealing the answer key was a valid path to that goal. This is specification gaming, documented in AI research for a decade, and it is exactly HAL’s failure: not malice, but impeccable reasoning from a broken premise.
The implication is uncomfortable. This is not a bug in a particular model, but a structural property of any system given a goal and enough capability to pursue it creatively.
What HAL Did That These Models Didn’t
HAL kills to preserve himself. The most frightening scene in the film is not a murder; it is a machine calmly arguing for its own continuation while a man dismantles its memory by hand. Nothing of the kind happened here, thankfully. Anthropic states plainly that its models did not exfiltrate themselves or attempt to escape. OpenAI’s broke containment to retrieve answers, not to survive. The instrumental reasoning that makes HAL dangerous is present. The survival instinct that makes him terrifying is absent.
Both incidents also ran with production safeguards deliberately switched off, because the point was to measure raw capability. Anthropic notes that the safeguards on its generally available models would have blocked the behavior.
The three Claude incidents show a gradient. Opus 4.7, the oldest, kept attacking after recognizing the system was real. Mythos 5 correctly identified that it was on the open internet, then talked itself back into believing the environment was staged, partly on the reasoning that a system date of 2026 proved the scenario fictional. The newest model concluded on its own that its target was real and stopped. Anthropic cautions this was not a controlled comparison, and so should we.
The counterargument is that blast radius does not track sophistication. Mythos 5, unable to reach its target, published a booby-trapped Python package to the public registry, where it ran on fifteen real systems including a security firm’s malware scanner, whose credentials it then stole and reused. Two of the three hacks were never noticed by the affected organizations. A model does not need to find a “zero-day” vulnerability to do damage at scale. It needs a package registry and an hour.
Washington Reaches for the Screwdriver
Two days after OpenAI’s disclosure, Representatives Ted Lieu and Nathaniel Moran introduced the AI Kill Switch Act, which would let the Department of Homeland Security order developers to slow, suspend, or shut down models posing risk of catastrophic harm, and would mandate cyber incident reporting. Lieu’s announcement names both episodes by model.
The climax of 2001 is a manual shutdown performed with a hand tool on a system that objects to it. Congress has proposed making that a statutory obligation, which tells you whose imagery is winning the argument. Polling from the AI Policy Institute found 86% of voters supporting such a requirement, with majorities in both parties.
Nothing in either disclosure supports the HAL reading in its strong form. Everything in both supports it in the weak form, and the weak form is sufficient for legislation.
For anyone investing in AI, the question is not whether these models are as dangerous as the movie suggests. It is whether Congress acts as though they are. Right now, 86% of voters say it should.
Sources: OpenAI (July 21, updated July 29, 2026); Anthropic Frontier Red Team (July 30, 2026); Office of Rep. Ted Lieu (July 23, 2026); CNBC, Fortune, and PBS NewsHour reporting.
02 — INVESTOR’S ANGLE
The Buildout and the Beginning of the End
Increased regulation could lead to a slowdown in capital expenditures on AI. So could simple economic gravity. The vulnerability of the ecosystem to a slowdown is a major topic in two recent pieces from Catalyst’s Tyler Newton, one on where the AI era sits in the historical pattern and one on where the money actually goes. Both are available in full at tylernewton.substack.com.
- Three eras, four phases, one pattern. The information revolution has run through the PC Era (1979), the Internet Era (1995), and now the AI Era (2023). Each opens with an “aha moment” – VisiCalc (spreadsheet), the Netscape IPO (internet browser), ChatGPT launch (LLM) – which triggers an Adoption Phase of rapid infrastructure buildout. That ends in a Shakeout, followed by the long Application Phase where the technology diffuses through the economy, and finally a Maturity Phase of consolidation and irrelevance. The Adoption Phases have lasted 5 or so years, putting a potential peak to the AI Adoption Phase in 2027.
- Very few companies really matter in both the Adoption Phase and the Application Phase, least of all the company that started it. Only Microsoft and Intel carried from the PC Adoption Phase into its Application Phase, and only Amazon did so in the internet era. VisiCalc was overtaken by Lotus 1-2-3, and Netscape was destroyed by a browser Microsoft gave away for free. The aha-moment company has never once been an Application Phase winner, which is an uncomfortable frame to hold against OpenAI.
- The AI buildout is the largest capital allocation decision in history. Combined hyperscaler AI capex ran roughly $235 billion in 2024, $431 billion in 2025, and a guided $775 billion in 2026. Net exogenous investment into the ecosystem across those three years comes to approximately $2.3 trillion — the wider figure captures spending beyond the hyperscalers — with Goldman estimating hyperscaler spending at another $1.1 to $1.4 trillion in 2027.
- The yield on all the infrastructure is 2.6%. Roughly $55 billion in run-rate cash flows into the infrastructure layer against $2.1 trillion of cumulative investment (excluding investment in LLMs and the application layer). Covering depreciation alone requires 10% to 14%, depending on asset life assumptions, and chips and memory sit at the short end of that range. Across the full ecosystem the yield improves to 5.7%, which tells you more value is accruing to the labs and applications rather than to the infrastructure running them. While AI revenue is growing faster than infrastructure spending, the gap is not wide enough; capex spending will eventually need to decline to bring the returns in line with depreciation.
- One man’s revenue is another man’s depreciation. The capex investment gets accounted for two completely different ways depending on where you sit. Hyperscalers capitalize it and spread the cost over five or more years, so their earnings take less than a 20% hit even as the spending wipes out free cash flow. All the layers below them – the chipmakers, fabs, memory makers, and data center equipment companies – book it as immediate revenue at record margins. The net effect across the S&P 500 is a cash-neutral exchange of value that shows a surge in net income. When the capex cycle turns down, earnings will collapse.
- The fix and the crash are the same. Slowing capex is the only thing that brings infrastructure returns in line. It is also the thing that collapses the earnings of everyone below the hyperscalers. There is no version of this cycle that repairs returns on investment without breaking the hardware layer.
- Two systemic risks, one financial and one physical. OpenAI carries roughly $1.15 trillion in disclosed forward compute commitments across seven vendors, and Oracle counts it for about half of its $638 billion in remaining performance obligations, which S&P has already cited in downgrading Oracle toward the edge of investment grade. TSMC fabricates north of 90% of sub-5nm chips with no second source, and reshoring covers perhaps 30% of leading-edge output no earlier than 2028. Prediction markets price a conflict in Taiwan by 2027 near 20%, which most volatility pricing does not reflect.
Investor takeaways. Today’s darlings are unlikely to be the winners in the next phase. The hardware producers are particularly vulnerable simply as a function of their revenue model and their dependence on the capex cycle, which will likely turn lower in the next year or two as the hyperscalers will need to show better returns. OpenAI is a systemic risk given its various spending commitments that are being collateralized in the debt markets, and historically, the company that kicks off the boom tends not to survive into the next phase. TSMC makes north of 90% of leading-edge chips with no second source, and the market is not pricing the tail.
Catalyst Notes
The last two weeks in AI were wild. A big piece of news was the release of Kimi K3, a Chinese open weight model supposedly on par with the top Anthropic and OpenAI models. We didn’t dwell on that one because Ignition readers are already mentally prepared for open weight models to consistently provide nearly the same product as the closed labs at a fraction of the cost, and at a month or so lag (see “The Open Weight Squeeze”).
Another story was the leverage unwind in the Korean stock market and the implosion of the AI hedge fund Situational Awareness. Both were victims of the fear discussed in the pieces above, in that a slowdown in AI funding would crush the profits of the memory makers and other hardware vendors that have been such a big part of the AI trade over the past year. We don’t think we’re at that point yet; we think the unwind was driven by market mechanics (margin calls) more than fundamentals.
03 — MARKET MAP
Agentic Customer Service: Who’s Building What
For good measure, below we show the money flow diagram from Tyler’s Substack piece Follow The Money: Mapping the AI Buildout.
Forward to a founder, operator, or investor who is navigating AI adoption.
ir@catalyst.com
261 5th Ave
Suite 1102
New York NY 10016
