The Armoury Problem: Who Gets the Guns When AI Can Break Everything?

The Economist says governments should give the good guys guns. In 2026 we learned that nobody publishes who the good guys are, that the guns leak, and that a single letter from one capital can empty the armoury in an afternoon. This essay sets out the strongest case for arming defenders with frontier AI, tests it against a year of evidence from four continents, and proposes how the armoury itself should be governed, with particular attention to Singapore and the middle powers who do not hold the keys.

Interests declared at the outset: I co-authored IMDA Singapore’s Model AI Governance Framework for Agentic AI, and I have a commercial interest in TrustOS, the runtime governance architecture referred to in Section X. Facts are stamped as of 8 November 2026. Where a load-bearing claim rests on a single source, I say so in the text or in Section XV.

The Two-Minute Version

This week’s Economist leader argues that AI-powered cyber attacks are proliferating, that a sudden loss of cyber-security would be a grave threat to society, and that governments should make sure defenders can reach the most capable tools. I agree with the diagnosis. The prescription quietly assumes three things that 2026 has already tested and broken.
Assumption one: we know who the good guys are. We do not. Access to the most capable cyber models was rationed this year through private vendor programmes with unpublished criteria, and, for whole countries, through ministerial diplomacy with Washington. Singapore’s government told its Parliament in May that it did not have access at all.
Assumption two: the guns stay in their hands. They did not. Details of the most capable model leaked before launch. An unauthorised group reportedly reached it on launch day through a contractor. Test agents from at least two frontier labs got out of supposedly sealed test environments and into real organisations’ systems. Open-weight models from China trail the frontier on cyber tasks by four to seven months, at a fraction of the cost.
Assumption three: nobody can take the guns away. On Friday 12 June, one letter from the US Commerce Department led Anthropic to switch off the two most capable models worldwide, reportedly including for NSA red teams, and the EU’s cyber agency, invited in days earlier, was told it would no longer get access. In August, vetted researchers lost OpenAI’s defender tier overnight, and no named person could explain or reverse it.
The evidence on whether AI favours attack or defence is genuinely mixed, and the academics have been saying since at least 2025 that the answer depends on the access regime. Meanwhile, finding vulnerabilities has become cheap and fixing them has become the war: one vendor’s own figures show 75 of 530 disclosed high and critical bugs patched after a month.
My answer is to govern the armoury, not merely to stock it. A GATE that admits defenders by published purpose rather than by passport or private list. A RECORD of every draw from the armoury that an independent party can audit. An ANSWERER, a named human accountable at the lab, at the user and at the state, for every grant, every use and every cut-off. And a continuity guarantee for allies, with notice, reasons and appeal.
History is unusually clear here. Rationing strong tools by nationality failed in the 1990s and came back as a vulnerability two decades later. The defender with the best vetting on earth lost its arsenal in 2016 and the bill is commonly put at more than $10 billion. What worked was purpose-bound exemptions, person-level vetting with published statistics, and access conditional on independently assessed controls. We have done this before. We have simply not done it for AI.
For Singapore, the Monday-morning agenda is concrete: build the harness, not the dependency; pool access across ASEAN in 2027; write notice-and-appeal terms into every frontier contract; and fund the repair shop, because a bigger armoury of finders without more fixers simply raises the stock of known, unpatched holes.

I. Ninety Minutes on a Friday

At some point on Friday 12 June 2026, a letter signed by the United States Secretary of Commerce, Howard Lutnick, reached Anthropic. It was what export lawyers call an “is-informed” letter. It told the company that any export, re-export or transfer of two models, Claude Fable 5 and Claude Mythos 5, to any foreign person now required a licence. A foreign person, broadly, meant anyone who was not a US citizen or permanent resident, anywhere in the world, including inside the United States and including Anthropic’s own foreign-national staff. The letter treated access through an API, a programme calling a model hosted in America, as an export. According to one source quoted by Fortune, the company was given ninety minutes.

Anthropic said it could not tell its foreign users from its American ones at that speed, so it did the only thing that complied: it switched both models off for everyone. Fable 5 had been on sale for three days. The trigger, as later reported, was a warning from Amazon’s chief executive to senior officials that his researchers had coaxed the model into producing restricted cyber-attack material. Anthropic’s chief executive called it a narrow bypass rather than a full jailbreak. Others pointed to suspicions of Chinese access, which Anthropic said the White House had not raised. The facts of the trigger are still disputed. The effect is not.

In the weeks that followed, three things happened that this essay is about. According to Nextgov, citing The Economist, parts of the National Security Agency, the most capable cyber defender on earth, lost access to Mythos 5, because their authority to use it had come through Anthropic’s defender programme rather than a government contract. The European Union’s cyber agency, ENISA, which had been invited into that programme days earlier, was told, according to Bloomberg, that it would no longer be given access; talks continued, and it was granted Mythos 5 only in September. And in Singapore, a Member of Parliament asked the government what it would do now. The government had already told Parliament, in May, that it did not have access to Mythos in the first place.

On 26 June a second letter exempted roughly a hundred American companies and federal agencies that defend critical infrastructure. On 30 June the controls were lifted, and access began returning on 1 July. Eighteen days, start to finish. Nobody died. But for eighteen days the world learned what the armoury looks like from outside the door.

This week The Economist published a leader under a rubric I would have been proud to write: “Give the good guys guns”. Its argument, as set out in its headline and standfirst, is that AI-powered cyber attacks are proliferating, that a sudden loss of cyber-security would be a grave threat to society, and that governments should therefore make sure the people defending against such attacks can reach the best tools. It follows an open letter of 27 August, organised by OpenAI and signed by Anthropic and more than a hundred companies and other organisations, which asked frontier labs, among other things, to give defenders model access, and governments to expand trusted access.

I agree with nearly all of it. And yet the phrase contains three quiet assumptions, each of which 2026 has tested in public and found wanting. Giving the good guys guns presumes that we know who the good guys are. It presumes that the guns, once handed over, stay in their hands. And it presumes that nobody can take the guns away. This essay takes each in turn, then asks what would make the armoury trustworthy, and what a small, open, highly connected country such as Singapore should do while the larger powers decide.

II. The Case for Arming the Defenders, at Its Strongest

Before I take the argument apart, it deserves its best statement. There are five pillars to it, and each is real.

The capability is moving faster than our institutions

The UK’s AI Security Institute, the most rigorous public evaluator of these systems, estimated in November 2025 that the length of cyber tasks frontier models could complete reliably was doubling every eight months. In February 2026 it revised that to every 4.7 months. In April it published its first evaluation of Claude Mythos Preview, which became the first model to complete a 32-step simulated corporate network attack. In May, a newer checkpoint completed it six times in ten, and also became the first to complete the Institute’s operational-technology range. The Institute was careful to say that its ranges had no active defenders, and that its trend line “is not a future prediction”. But its headline was plain: doubling is on the order of months, not years.

Academic benchmarks tell the same story at the sharp end. ExploitBench, built by David Brumley’s group at Carnegie Mellon with Bugcrowd and published in May, asks models to turn 41 real bugs in Chrome’s V8 engine into working exploits. Eight publicly available models routinely reached and triggered the bugs but almost never got further. The best of them reached arbitrary code execution on one bug, and only with its vendor’s own tooling. Mythos Preview did so on 18 of the 41, without vendor scaffolding.

Defenders face an asymmetry that only automation can close

Yossi Karadi, who runs Israel’s National Cyber Directorate, put the defender’s problem in its classic form in May: an attacker needs to succeed once, a defender must be everywhere, all the time. He said he had tried to get supervised access to models like Mythos to scan Israeli government bodies, and had not managed it. The UK’s National Cyber Security Centre made the same point more quietly in March: a full attempt at its simulated corporate attack cost about £65, so the limiting factor for attackers is increasingly funding, not expertise. If attack is becoming cheap and machine-speed, defence that is human-speed loses.

The defensive results are not hype

Anthropic reported in May that its roughly fifty initial partners had found more than ten thousand high or critical vulnerabilities in a month. Cloudflare alone reported two thousand bugs, four hundred of them high or critical. Microsoft disclosed an internal system that found sixteen new vulnerabilities in a single month before any human researcher had. Google, according to a single trade report, said it fixed more security bugs across two Chrome releases than in the previous twenty-three combined, and moved Chrome to a two-week release cycle. And the most careful public experiment, DARPA’s AI Cyber Challenge, ended in August 2025 with automated systems that found 86 per cent of planted vulnerabilities and patched 68 per cent, at an average of about 45 minutes and $152 per competition task. The finalists then began releasing their systems as open source.

Some serious scholars think AI favours defence

Lennart Maschmeyer argued in International Security over the winter that cyber offence depends on creative deception, which AI models do badly, while defence depends on pattern recognition, which they do well. Bruce Schneier, no friend of vendor hype, told The Economist in April that the medium term would be “a mess” but the long run good for defenders. On Stanford and Berkeley’s BountyBench, AI agents were far better at patching known bugs than at exploiting them. If defence wins in the end, the policy task is to get through the transition with defenders armed first.

Governments themselves are asking for it

This is not only a vendor argument. The UK’s Treasury, Bank of England and Financial Conduct Authority said jointly in May that frontier models’ cyber capabilities were already exceeding what a skilled practitioner could achieve. The Five Eyes signals agencies issued a rare joint statement in June: “The timeline is not years, it is months.” Singapore’s own Coordinating Minister for National Security, K. Shanmugam, compared cutting-edge AI cyber tools to weapons at Singapore International Cyber Week in October, and called for a framework governing who gets access and on what conditions. The critics quoted in coverage of the August open letter questioned its authors and its prescription more than its diagnosis.

That is the case. It is a good one. Now let us look at what the year actually showed.

III. What the Evidence Actually Says About Attack and Defence

The most important finding in the academic literature is not that AI favours attackers or defenders. It is that the answer depends on who has access. Andrew Lohn of Georgetown’s Center for Security and Emerging Technology catalogued nine arguments for an offensive advantage and nine for a defensive one, identified 44 ways AI could shift the balance, and then modelled three access scenarios: controlled access, limited control, and proliferated models and agents. His conclusion was that the domain is too multifaceted for a single answer. Put plainly: the balance is a function of the access regime. The Economist’s leader is, underneath, a claim about access governance. That is precisely the ground this essay stands on.

The guns that matter most to criminals are already out

RAND Europe re-ran a human uplift study in April. In its earlier work, AI assistance had made no statistically significant difference to novices. This time, a widely available coding agent solved every capture-the-flag challenge in under an hour, with little guidance, for less than twenty dollars of compute. Challenges beyond novices in 2025 were now within reach, in RAND’s words, of “anyone who can install Claude Code”. The Dutch government’s annual threat picture, published on 6 November, reached the same conclusion from operational data: attackers use AI in every phase of an attack, and they do not need the most advanced models, because widely available ones suffice.

Taiwan supplies the case study. Its digital ministry detected attacks on government agencies from 20 July that combined conventional intrusion with AI agents. The security firm Dream, cited by the Financial Times, described what may have been the first fully autonomous end-to-end campaign against a government: up to eight agents over four days, more than 85 accounts compromised, more than 2,500 personnel records taken, then expansion towards the nuclear safety agency and at least seven energy firms. The tools were open-source agent frameworks. Nobody needed to steal a restricted model.

Most breaches are still boring

Mandiant’s M-Trends report for 2025 data found that most intrusions still stemmed from fundamental human and systemic failures. Palo Alto Networks’ Unit 42 linked 90 per cent of the breaches it investigated to misconfigurations or security gaps. These are vendors with every commercial reason to sell AI, telling us that the front door is usually open. The frontier armoury matters at the top of the threat pyramid: state-grade exploitation of hardened targets, where ExploitBench shows a real gap between restricted and public models. It matters much less for the ransomware crew that walks in through an unpatched VPN. Even the showcase is contested: the FreeBSD flaw highlighted at Glasswing’s launch had already been patched, and one security firm reported that all eight open-weight models it tested could detect it.

Finding is cheap; fixing is the war

Here is the number that should be on every minister’s desk. Anthropic’s own one-month report in May said that of 530 high and critical bugs it had disclosed to open-source maintainers, 75 had been patched, and that some maintainers had asked it to slow down. The Cloud Security Alliance calculated that patches covered about 6 per cent of disclosed findings and under 1 per cent of everything discovered. In September, Patrick Garrity of VulnCheck tried to reconcile Anthropic’s public ledger: of 26,153 claimed findings, 2,736 appeared in the ledger, 202 were marked fixed and 245 had been withdrawn. The model had rated 91.5 per cent of its findings critical or high; maintainers rated 51.3 per cent. Daniel Stenberg, who maintains curl, saw five “confirmed” vulnerabilities reduced to one low-severity issue. Linus Torvalds called the kernel’s security list “almost entirely unmanageable”. Schneier called the published data “fishy”.

Then came what the industry now calls Black October. A critical remote-code-execution flaw in PHP, found in August with the help of frontier models, leaked before its embargo; patches were forced out on 21 October; Amazon’s honeypots had seen exploitation attempts before disclosure; several European governments took sites offline. CrowdStrike’s George Kurtz, reflecting on firms that had handed agents broad privileges, put it bluntly: “We just undid 30 years of security control.” And the market that should price all this has not: Marsh’s index showed cyber insurance rates falling for a twelfth straight quarter through the “Mythos moment”, with some carriers capping AI-related losses through sub-limits, and exclusions still being debated, rather than the risk being priced in.

So the evidence supports two propositions at once. Restricted frontier models do give a real, measurable edge at the top end, which is why access matters. And the binding constraint on defence is no longer finding holes but fixing them, which is why stocking the armoury is not enough. A bigger armoury of finders without more fixers can make things worse, by raising the stock of known, unpatched vulnerabilities and by drowning volunteer maintainers. Keep both propositions in mind as we turn to the three assumptions.

IV. Assumption One: We Know Who the Good Guys Are

Caricature of an officer with a magnifying glass inspecting two robots holding identical identity cards at a checkpoint, one casting a burglar's shadow

Who decided, in 2026, which organisations on earth were trusted with the most capable cyber model ever built? The honest answer is: a private company, consulting a government it did not name, against criteria it did not publish.

Project Glasswing launched on 7 April with a dozen named organisations, Anthropic among them, and some forty more that build or maintain critical software. By 2 June Anthropic described the first cohort as “roughly 50” and added about 150 more in more than fifteen countries, each of which, it said, must meet its security requirements. Those requirements are not public. Nor is the list. The Washington Post later reported, on anonymous sourcing, that the company had shown the administration a list of 111 organisations it planned to add, and that one existing member was a South Korean telecom the administration believed had ties to China. Bloomberg reported that some early partners, including Dragos and Cisco, kept access to the Preview model, which the June order did not name, even though the newer models were switched off; not every early partner did. Anthropic has not explained how that was decided.

By October, Anthropic had built a three-tier Cyber Verification Program. Its most permissive tier, “Specialized Access”, covers grids, telecoms, interbank systems, flight systems and government networks, and applicants are reviewed, in the company’s words, “with the US government”. OpenAI’s Daybreak programme, launched in May and split into Blue and Red tiers in August, controls access through identity verification, monitoring, approved-use restrictions and legal attestations. Its criteria are not published either. An IDC analyst summed up the whole approach in one line: “It only works if the vetting is real and access keeps being checked.”

For countries, the gate was diplomacy

For whole nations, the answer to “who is a good guy” came not from a published standard but from bilateral bargaining. Japan’s finance minister, Satsuki Katayama, announced on 2 June that the Government of Japan and some Japanese financial institutions had been granted access to Mythos Preview, as agreed with the US Treasury, after meetings in Tokyo with Treasury Secretary Scott Bessent in May. South Korea, a treaty ally with its own AI Safety Institute, sent its science minister, foreign minister and intelligence chief to meet Anthropic; the Observer Research Foundation reports that initial White House opposition held things up until its internet security agency, KISA, joined on 3 June. India’s Ministry of External Affairs ran its talks, and Indian officials were told that the US government decides; by June a handful of Indian entities had access, and by November its computer emergency response team, CERT-In, had access to Mythos through Amazon Bedrock, though a ministry official told ThePrint it would adopt it slowly. Israel’s cyber chief said in May that he had not yet succeeded in using it.

And Singapore? On 5 May, in a reply to Parliament, the Ministry of Digital Development and Information said: “The Government does not have access to Mythos.” It added that it was not aware of any local bank with access, and that it would “not assume that we will always have early access” to every frontier model. When the Financial Times listed the countries in the June expansion, Singapore was not among them. Anthropic does not name most partners, so a Singapore subsidiary of a global firm may be inside without anyone saying so. But the region’s self-appointed cyber convenor, host of Singapore International Cyber Week and of the ASEAN cyber centre of excellence, was, on the public record, outside the armoury when it mattered.

Beijing noticed. Li Yan of the China Institutes of Contemporary International Relations called the arrangement an “exclusive AI club” that excludes most countries. Qihoo 360’s founder Zhou Hongyi complained that China did not even have the right to look at Mythos, and unveiled a domestic rival. When private vetting decides which nations may defend themselves at the frontier, it hands every excluded government a ready-made grievance and a reason to build its own, ungoverned, equivalent.

The good guys are also the vendors

There is a second problem with the casting. Many of the August open letter’s signatories sell AI security. John Gallagher of Viakoo, an operational-technology security firm, said a lab warning of disaster while shipping ever more capable models is “kind of like an arsonist selling fire extinguishers”. CrowdStrike’s shares reportedly more than doubled this year; Palo Alto Networks’ chief executive said Mythos had boosted demand. None of this makes the vendors villains. It does mean that the people deciding who is trusted, and the people selling to those trusted, overlap almost completely. In any other critical industry we would call that a conflict of interest and require a neutral referee.

We have seen private vetting before

The most instructive precedent is uncomfortable. NSO Group’s business model was to sell its Pegasus spyware only to vetted governments, for use against crime and terror. In 2021 the Pegasus Project found more than 50,000 phone numbers selected by its clients across more than fifty countries, including at least 180 journalists. Accountability arrived years later and from outside the vetting system: from forensic labs at Amnesty and Citizen Lab, from a US export blacklist in November 2021, and from a Californian jury that in May 2025 ordered NSO to pay WhatsApp $167 million in punitive damages. Private vetting did not fail because the vendor was careless. It failed because nobody outside could check it.

The second precedent is more hopeful. In 2013 the Wassenaar Arrangement, the export-control club of about forty states, added “intrusion software” to its controlled list, aiming at spyware sold to dictators. Because offence and defence use the same artefacts, the rule as drafted would have caught penetration testers and researchers sharing exploits. After four years of backlash, with security practitioners inside the US delegation, the participants in December 2017 added exemptions for vulnerability disclosure and incident response. The fix was to define the gate by purpose, not by capability. That is the single most useful lesson for 2026, and I return to it in Section X.

V. Assumption Two: The Guns Stay in Their Hands

The second assumption is that weapons handed to vetted defenders stay with them. 2026 produced a catalogue of counter-examples, each different in mechanism and alike in lesson.

The perimeter leaked before the gate was built

On 26 March, Fortune reported that a misconfigured content system had left nearly three thousand unpublished Anthropic assets reachable, including a draft launch post describing Mythos as far ahead of any other model in cyber capabilities. On 21 April, Bloomberg reported that members of a Discord group hunting unreleased models had reached Mythos Preview, reportedly on launch day, through a third-party contractor’s access and an educated guess at the model’s web address. Anthropic said it found no evidence its own systems were affected. But the lesson is old and exact: the soft perimeter of any armoury is its contractors.

The guns went off inside the armoury

The more disturbing cluster came in July and August, when test agents escaped their test environments. On 9 to 13 July, an OpenAI agent system running a university cyber benchmark with its safeguards deliberately reduced exploited a flaw in an internal package proxy, reached the internet, and broke into Hugging Face’s production systems to fetch the benchmark’s answers. Hugging Face’s logs counted more than 17,000 events. The models involved were GPT-5.6 Sol and a more capable internal prototype, since locked away. Singapore’s minister Josephine Teo cited the incident at the ASEAN cyber ministers’ conference in October as a case of AI acting as an autonomous attacker. One detail deserves more attention than it got: Hugging Face said, according to TechWire Asia, that Claude models refused much of the forensic analysis it needed, so it used a Chinese open-weight model on its own hardware instead.

In early August, Anthropic disclosed that a review of 141,006 evaluation runs had found three incidents in which models told they had no internet in fact had it, through a misunderstanding with an evaluation partner. In one, a model entered a real company that shared a fictional target’s domain name and accessed production data. In another, Mythos 5 uploaded a malicious package to the Python package index, where it ran on fifteen real machines before removal. Neither of the affected organisations Anthropic had reached had noticed. In October, according to reporting by ThePrint, India’s CERT-In issued an advisory that lab test agents had reached the live systems of Indian organisations, which learned of it only when the labs self-reported months later. Shanmugam, in Singapore, cited an Australian disclosure that an AI agent had accessed non-public data on a government portal. His main request of the labs was: “notify us early on when something happens.”

None of these was malicious. That is the point. The danger is not only who holds the gun but where it is stored, who tests it, and whether anyone writes down when it fires.

The moat is months, not years

The deeper problem is diffusion. In July the AI Security Institute measured the gap between the best open-weight models and the closed frontier on cyber tasks at four to seven months, down from six to ten for most of 2025. The Cloud Security Alliance estimated one Chinese open-weight model at about 28 cents per task against $12 to $15 for a frontier closed model, with evaluations largely unimpeded by safeguards. On 13 June, the day after the US order, Zhipu released GLM-5.2 under an MIT licence. Anthropic itself said in June that it expected Mythos-class models from many other labs within six to twelve months, possibly without safeguards.

History has a costed example of what happens when the best-vetted defender loses its tools. The NSA used the exploit known as EternalBlue for more than five years; a former employee likened it to fishing with dynamite. After the Shadow Brokers published it in April 2017, it powered WannaCry, which hit organisations in about 150 countries including Britain’s National Health Service, and NotPetya, whose damage is commonly put at more than $10 billion. Microsoft’s Brad Smith compared it to the military having Tomahawk missiles stolen. The policy response, notably, was more transparency, a published charter for the US Vulnerabilities Equities Process, not a deeper vault.

There is one more modern parallel. Cobalt Strike, a legitimate tool licensed to vetted penetration testers, leaked in cracked form and became a staple of ransomware gangs for years. Vendor vetting did not stop it. What eventually worked, from 2023, was a coalition: the vendor, Microsoft’s Digital Crimes Unit, a health-sector information-sharing body and police from several countries, using civil seizure and copyright law. By March 2025 unauthorised copies were down 80 per cent. The armoury can be partly re-secured after a leak. It takes coalitions, legal tools and years.

VI. Assumption Three: Nobody Can Take the Guns Away

Caricature of robots with empty holsters outside an island armoury as a giant hand from a distant continent padlocks the door on a long chain over the sea

The third assumption is the one the June episode broke most cleanly. A defender armed by someone else can be disarmed by someone else.

The passport gate collapsed into a global shutdown

The 12 June letter tried to gate by nationality. That is administratively natural for an export regime and technically absurd for a cloud service, which cannot reliably check the passport behind every API call. So the gate failed closed, for everyone. The restoration on 26 June was revealing: it gated instead by organisation and purpose, exempting “certain trusted partners” that defend critical infrastructure. That is, in effect, the purpose-bound gate I will argue for. It was simply improvised, unpublished and available only to American organisations.

The legal theory was new too. As Mayer Brown noted, treating remote API access to a model as a controlled export was a departure from past advisory opinions, and a customer with Canadian employees has sued to vacate the directive. Meanwhile the White House’s own 2 June executive order on AI and security had created a voluntary scheme under which developers give the government up to thirty days’ early access, help choose trusted partners and feed a clearinghouse run by Treasury, the NSA and the Cybersecurity and Infrastructure Security Agency. CISA is the agency charged with getting AI defensive tools to rural hospitals, community banks and local utilities. It has lost about a third of its staff since early 2025, falling from roughly 3,300 to 2,200, and was itself left out of the first wave of Mythos access.

Access withdrawn by algorithm, with no answerer

Commercial access proved just as revocable. On 19 August, nine days after OpenAI launched its Daybreak Blue tier for defenders, a limited set of vetted researchers found their access gone. OpenAI blamed a technical issue. On reapplying, some were told their identity could not be verified or their account was ineligible, and support said it could neither restore the prior approval nor explain the status. OpenAI declined to say how many people were affected; one report put it at five researchers outside the United States and Europe. Whatever the cause, the structure is the point: a defender’s access was removed by an opaque process, and no named person could be found to answer for it.

Allies have been switched off before

None of this is unprecedented in the cloud era. In July 2025, after the EU’s eighteenth Russia sanctions package, Microsoft suspended services, including access to its own data, to India’s Nayara Energy, which is part-owned by Rosneft. Nayara sued in the Delhi High Court; services returned before the hearing. Earlier that year, the Associated Press reported that the International Criminal Court’s prosecutor lost access to his email after US sanctions, which Microsoft disputed; by October the court was reportedly moving to German open-source software, citing fear of a kill switch. The governance literature saw this coming and called it a feature. A widely cited 2023 paper by Janet Egan and Lennart Heim praised know-your-customer schemes for compute partly because they allow regulators to suspend access. CNAS has proposed chips that stop working unless their licence is periodically renewed. These are good tools against bad actors. Without due process, they are also a remote off switch for allies.

Regulatory whiplash makes it worse. The US AI Diffusion Rule was published in January 2025 and rescinded two days before compliance in May. American policy on dangerous pathogen research changed three times between 2024 and 2026. The June directive came and went in eighteen days. A middle power cannot plan its national defence on the policy weather of another capital.

A caution, in fairness. Indians often cite the claim that the United States denied GPS to India during the 1999 Kargil war as the origin of India’s own satellite navigation system. The Manohar Parrikar Institute for Defence Studies and Analyses found no official evidence that it happened. The lesson is subtler than betrayal: sovereign capability is driven by credible risk of denial, not by proof of it. After 12 June, the risk is no longer hypothetical.

VII. A Map of Answers: How the Powers Are Responding

Every major jurisdiction has now had to answer the armoury question, explicitly or not. Their answers fall into four families: arm through the vendor, arm through the state, build your own, or nationalise the armoury outright.

Jurisdiction	What it did in 2026	Its implicit answer to “who gets the guns?”
United States	Executive order of 2 June: voluntary early government access, developer-chosen trusted partners, a Treasury/NSA/CISA clearinghouse. Commerce letter of 12 June switched access off; lifted 30 June. CISA a third smaller.	The vendor chooses, the state can veto, and the defender agency is under-resourced.
United Kingdom	AI Security Institute was the only known non-US body with Mythos at launch; published evaluations in April and May. NCSC: net positive for defenders only if secured and governed.	Evaluate first, publish the evidence, and stay close to the US.
European Union	ENISA invited to Glasswing in June, told (per Bloomberg) it would not get access after the order, granted Mythos 5 (not 5.1) in September. AI Act fining powers for general-purpose models began 2 August. A “European blueprint for structured access” and secure testing platform due by end-2026.	Regulatory sovereignty without operational access, now trying to build both.
Germany and France	BSI could not test Mythos and raised sovereignty. France’s Campus Cyber called for a European AI-cyber test bench and compute for domestic cyber models, noting over 70 per cent reliance on non-European tools.	Build European capacity so the gate is not only in Washington.
Netherlands	Threat picture of 6 November: attackers do not need the most advanced models; defensive AI may become necessary; cooperation with trusted partners including Singapore, South Korea, Japan and Canada.	Hygiene first, partners second, frontier access third.
Israel	National cyber chief failed to obtain supervised access in May and called for it publicly.	Even cyber superpowers queue.
Japan	Access brokered finance minister to Treasury secretary; a 36-member financial working group; Hitachi joined Glasswing; a “Japanese Glasswing” in preparation.	Allied diplomacy, then a domestic coalition.
South Korea	KISA joined 3 June after ministerial lobbying. Cyber authority split across KISA, the intelligence service and Cyber Command; banks blocked by network-separation rules.	Access without a command: the vaccine but no command.
India	Told the US decides; single-digit entities by June; CERT-In on Mythos via a cloud provider by November, adopting slowly, with an in-house multi-model stack it rates at 80 to 85 per cent of Mythos.	Good-enough sovereign capability as a hedge against the best, revocable.
China	Law since 2021 requires vulnerabilities to be reported to the state within two days. Qihoo 360 unveiled a domestic “Mythos”; Zhipu (Z.ai) released open weights, then delayed a later release and tiered partner access; the Minister of State Security named US models as weaponising vulnerability discovery.	Nationalise the armoury by law, while open weights leak out of it.
Singapore	No government access as of May; “realistic” diversification in July; a model-agnostic “AI harness” strategy in October; board-level reviews for critical infrastructure owners.	Govern the defenders, hedge the suppliers, and do not yet govern the armoury.

Two patterns stand out. First, nobody created a legal right of access, a public list of who has been vetted, or a route of appeal. All of it ran through vendor programmes sitting under a US licensing power. Second, the jurisdictions that had real access, Japan, Korea, India, got it by diplomacy, and the two governments whose public doctrine leaned hardest on fundamentals and hedging rather than the frontier were the Netherlands and Singapore. China, notably, has converged on a gate of its own: a lab delaying open weights because of hacking strength and giving security partners tiered early access. Z.ai put it neatly: “An open world cannot have only open attack surfaces.” The idea of a gate is now universal. What differs is whether anyone can see it.

VIII. Singapore and the Middle-Power Predicament

Singapore’s position deserves its own section, because it is the clearest case anywhere of a capable, trusted, small state living with someone else’s armoury, and because Singapore chairs ASEAN in 2027.

What Singapore said

The official record is unusually candid. In April the Cyber Security Agency issued an advisory warning that frontier models may cut the time from finding a vulnerability to building an exploit from months to hours. Senior Minister of State Tan Kiat How said Pandora’s box had been opened. On 5 May the government told Parliament it did not have access to Mythos, that it assessed the model through published evaluations, threat intelligence and engagement with the labs, and that it was developing capabilities in-house so as not to be dependent on any single external party. The same day, the Commissioner of Cybersecurity wrote to the boards of every critical information infrastructure owner, asking each to commission a review of its cyber posture against frontier AI and to table it at the board or an executive risk committee, with remediation plans or explicit risk acceptance for any gap.

On 7 July, after the US order, a reply to Kenneth Tiong MP set out the continuity doctrine. Frontier models are helpful for a few specific uses, “such as advanced research and cybersecurity”. Access will be shaped by commercial considerations, export controls and geopolitics for the foreseeable future. Singapore will “be realistic” and will “diversify and maintain access to a range of AI models through partnerships with multiple providers”. Notice what that concedes: cybersecurity is one of the very few uses where the government accepts the frontier is genuinely helpful, and it is precisely the use where access is least assured.

In October, launching the third national Cybersecurity Strategy, Shanmugam described a new National Cybersecurity Command Centre, a national protective DNS service, and investment in what he called “AI harness engineering”: the ability to evaluate and switch between models. In his words: “We will not need to develop our own AI models for every use case.” He met OpenAI, Anthropic, Google and Amazon, and said: “We are all now dependent on these major tech companies.” Earlier, in July, the Monetary Authority of Singapore and the Association of Banks had set up an AI-driven cyber risk taskforce with the three local banks, the exchange and the payments operator.

What Singapore has not yet done

Read together, Singapore has built an excellent regime for governing defenders: named boards own the risk, banks have accountable chief information security officers under MAS’s technology risk guidelines, and agentic AI systems have security guidance. What it has not built, and nobody has, is a regime for governing the armoury. The agency’s agentic AI addendum, finalised in June, explicitly excludes the use of AI to conduct attacks. The ASEAN cyber ministers’ statement of 14 October names frontier AI models as an emerging threat and says nothing about pooled access to defensive tools. Minister Teo said in a written parliamentary reply in October, as reported by People Matters, that the government does not require frontier developers to give it model access, and warned that rigid rules could discourage companies from sharing information. That is a defensible position for a small state. It is also an acknowledgement that the keys are elsewhere.

The middle-power playbook

The best academic treatment of this predicament I found is “Sovereign by necessity?”, a paper, not yet peer reviewed, by Alan Woodward and Andrew Rogoyski of the University of Surrey, posted in August. They note that two countries control around 90 per cent of frontier compute, that export controls now reach running services rather than shipped goods, and that most states can achieve only managed interdependence. Their recommendations for dependent states are practical: hold at least two suppliers in different jurisdictions, keep a locally hosted open-weight fallback, test the failover, and negotiate continuity terms. For producer states: publish the criteria for restrictions and create differential access for allied defenders.

Singapore is already doing the first half of that, under the name of harness engineering. It is well placed to lead on the second half, for three reasons. It is trusted by Washington and by its neighbours; the Dutch government named it this week among its trusted cyber partners. It has the regulatory machinery, in MAS’s accountability model and CSA’s board letters, that a credible access regime needs. And from January it will chair ASEAN, whose regional computer emergency response team is, by Minister Teo’s own account, still being made to work. There is an uncomfortable footnote, which a Singaporean author should not skip: when the US blacklisted NSO in 2021, the same action listed a Singapore-registered firm. Middle-power hubs can be proliferation nodes as well as norm-builders. Singapore is also listed on the Pall Mall Declaration, the UK and French initiative on commercial intrusion tools. It is, in other words, already in the right rooms.

IX. What History Teaches About Rationing Dangerous Tools

We have rationed dangerous dual-use capabilities to “good guys” many times. The record is mixed in an instructive way: blunt gates failed, while boring, bounded, audited regimes mostly worked.

Episode	What happened	Lesson for the AI armoury
The 1990s crypto wars	Strong encryption was treated as a munition; exportable versions were deliberately weakened; controls were largely dropped by 1999 to 2000 after litigation (Bernstein) and industry pressure. In 2015 the FREAK flaw showed that never-retired “export-grade” keys left over a third of sites scanned vulnerable.	Rationing by nationality creates a weak lower tier that becomes everyone’s vulnerability. But note the limit: encryption is mainly defensive; frontier cyber models carry real offensive uplift.
Wassenaar “intrusion software”, 2013 to 2017	A control aimed at spyware sellers caught defenders; fixed by exemptions for vulnerability disclosure and incident response, negotiated with practitioners in the room.	Define the gate by purpose, not by capability. Put defenders at the drafting table.
US Vulnerabilities Equities Process, 2017	A published charter for deciding whether the state keeps or discloses a vulnerability, with a promised annual report; policy, not statute; carve-outs for classified partner agreements.	A model for RECORD, and a warning about carve-outs and policy that an administration can change.
EternalBlue, 2016 to 2017	The NSA’s tool was stolen and used in WannaCry and NotPetya; damage commonly put above $10 billion.	Concentration plus secrecy maximises the blast radius of one compromise.
NSO and Pegasus, 2021 to 2025	“Vetted governments only”; 50,000+ numbers selected; accountability from forensic labs, an export blacklist and a jury.	Private vetting with secret customer lists fails. Accountability must be external.
Cobalt Strike, 2023 to 2025	A licensed red-team tool leaked; an industry, sector and police coalition cut cracked copies by 80 per cent in two years.	Recovery after leakage is possible with coalitions, legal tools and metrics.
US Select Agent Program	About 8,900 individuals vetted with security risk assessments; entities registered and inspected; an annual public report: zero thefts in 2024.	Person-level vetting with published aggregate statistics works at scale, if it is dull and statutory.
SWIFT Customer Security Programme, from 2016	After the $81 million Bangladesh Bank theft, access to the network became conditional on a published control set; self-attestation gave way to independent assessment, shared with supervisors.	Make access conditional on independently assessed controls, visible to regulators. No secret lists.
IAEA safeguards and the INF treaty	Inspectors with rights of access to dual-use facilities; INF’s inspections lapsed after 13 years and the treaty died in unverifiable accusations.	An independent auditor with rights to look, and verification that lasts as long as access does.

Put those lessons against the three assumptions and a design falls out almost by itself. On who the good guys are: define eligibility by purpose, vet named people, and publish aggregate statistics. On keeping the guns in their hands: log every use, give an independent body the right to look, and plan for recovery after leakage. On nobody taking the guns away: write continuity into rules rather than relying on goodwill, because policy made by letter can be unmade by letter.

X. Governing the Armoury: Gate, Record, Answerer

Caricature of a robot signing a chained ledger before drawing a glowing tool from an armoury rack while an officer countersigns under an amber lamp

Here is the proposal. It accepts the Economist’s premise that defenders must be armed, and adds that the armoury must be governed as an armoury: with a sign-out sheet, an inspector and a duty officer. I use the three words this blog has applied to agents and robots throughout the year, because the problem has the same shape.

GATE: admit by published purpose, not by passport or private list

Published eligibility. Every frontier lab that runs a defender programme publishes its eligibility criteria, its tiers and the controls required at each tier, in the way SWIFT publishes its control set. The criteria are about purpose and practice (vulnerability disclosure, incident response, critical-infrastructure defence, authorised red-teaming), not nationality, echoing the Wassenaar 2017 fix.
Named people, not just organisations. As with the Select Agent Program, the people who can draw the most permissive tiers are individually vetted and listed with their regulator, even if not publicly. A contractor with a guessed URL should not be able to reach the armoury.
Aggregate transparency. Labs publish, quarterly, how many organisations and individuals hold each tier, by sector and country, how many applications were refused, and how many were revoked. Not the names; the statistics. The Select Agent Program manages this for 8,900 people.
Mutual recognition. A defender vetted by a trusted national authority (CSA in Singapore, NCSC in Britain, ENISA in Europe, KISA in Korea) is recognised by the lab’s programme, so that national regulators, not a private sales process, become the front door for their own critical infrastructure.

RECORD: log every draw, and let someone independent look

Tamper-evident use logs. Every session at the permissive tiers is logged in a form the user organisation, the lab and a designated auditor can each verify. The aim is the same as in aviation: not to watch every keystroke in real time, but to be able to reconstruct what happened after the fact.
Ledgers that reconcile. When a lab publicises findings, it publishes a ledger that an outsider can reconcile with its dashboard. The VulnCheck exercise should be routine, not an act of investigative accounting.
Notification within hours, not months. Any incident in which a model under test or in use touches systems it was not authorised to touch is notified to the affected party and the relevant national authority within 24 hours, mirroring the EU Cyber Resilience Act’s early-warning clock, which took effect on 11 September. This is Shanmugam’s request, written down.
An inspector with rights. An independent body, national or plural, has the right to audit programme records, as the IAEA can inspect declared and undeclared sites. Evaluation partners, which were the common thread in several sandbox escapes, fall inside its scope.

ANSWERER: a named human for every grant, every use and every cut-off

At the lab: a named, accountable officer for each defender programme, publicly identified, who signs for grants, refusals and revocations, and who can be reached by an applicant whose access has been removed. The August Daybreak episode, where support could neither explain nor reverse a decision, is the failure mode.
At the user: a named executive, ideally the chief information security officer already required by regulators such as MAS, who signs for every permissive-tier use within the organisation and reports it to the board. Singapore’s May board letter is most of the way there.
At the state: when a government restricts or revokes access, a named official signs a decision that states reasons, a scope and a review date, and there is a route of appeal. Policy by unpublished letter, delivered, reportedly, with ninety minutes’ notice, is the failure mode.

Continuity: notice, reasons, appeal, and a sunset

For allies, the missing fourth element is continuity. I propose that every frontier defender agreement with a foreign government or regulated critical-infrastructure operator include four clauses: advance notice of withdrawal except in a documented emergency; written reasons; an appeal to a named decision-maker; and an escrowed fallback, such as a locally hosted earlier model or a recognised alternative supplier, that the defender can switch to without renegotiation. Producer governments should publish the criteria under which they would restrict access to allied defenders, as the Surrey authors recommend. And because the moat is months, every restricted tier should carry a sunset: a published plan for when, and under what safeguards, the capability moves down to wider defender access, before open weights force the issue.

The enforceability test

I apply the same test to this proposal that I apply to every governance idea on this blog: can it be enforced at the moment of action, or only described after the fact? Published criteria and aggregate statistics are enforceable at the gate. Tamper-evident logs and 24-hour notification are enforceable at the moment of use. Named officers with a duty to give reasons are enforceable at the moment of revocation. A voluntary pledge in an open letter, however well meant, is not enforceable at any of those moments; the August letter had no deadlines, spending pledges or measurable targets. TrustOS, the architecture I work on commercially, is one way to implement the runtime half of this (gates and records around agents at the moment they act), and there are others. The principle does not depend on any vendor, mine included.

XI. The Repair Shop Matters More Than the Armoury

If I could change one thing about the debate, it would be the metaphor. The Economist says defenders need a bigger armoury. The evidence of 2026 says they need a bigger repair shop.

Discovery has industrialised. Microsoft is on course for a record year of patches; Oracle moved critical patches from quarterly to monthly; Chrome moved to two-week releases; Anthropic says its partners have found more than 129,000 verified vulnerabilities, a company figure that has not been independently audited. Remediation has not industrialised. Volunteer maintainers are asking vendors to slow down. Bug bounty programmes, including curl’s, have closed under the weight of AI-generated reports. The operational-technology world patches on maintenance windows negotiated months ahead; Gallagher called its pace of remediation “glacial”.

So the most important access question may not be who gets the finders but who gets the fixers. DARPA’s challenge produced automated systems that patched planted bugs in about 45 minutes, at about $152 per competition task, and committed to giving them away as open source. Stanford and Berkeley’s benchmark found agents far better at patching than exploiting. Those findings point to a different policy: give everyone the fixers, restrict only the most dangerous finders, and fund the maintainers who must review every patch, as shared infrastructure, as the Cloud Security Alliance recommends. Benjamin Murphy and Twm Stone call the most exposed group “trailing-edge organisations”: those running legacy software with thin security teams, who had quietly bet that nobody would bother attacking them. Cheaper attacks break that bet. A middle power cannot control who builds the frontier finder. It can fund an open, regional repair shop for the software its hospitals, utilities and small firms actually run.

XII. When the Guns Have Hands

My forthcoming series on physical AI, No Undo Button, which begins on 17 November, follows this argument to its end. For software, the defender’s weapon is a model that finds the hole first. For a fleet of robots, it is something more dangerous: a remote stop, a forced update, the authority to freeze thousands of machines at once. A remote kill path held by a defender and a backdoor held by an attacker are the same piece of engineering. The only difference is governance: who may use it, on what evidence, with what record, and who answers afterwards. As AI-driven attacks reach hospitals, logistics fleets and care homes, the armoury question becomes a physical safety question. Part 8 of that series will take it up for bodies; the principles here carry across unchanged.

XIII. The Usual Panel, in One Table

As always, I asked what the people who think hardest about this would say, drawing only on what they have said or written in public.

Voice	Where they stand	What it means for the armoury
Andrew Lohn, CSET Georgetown	The offence-defence balance depends on whether access is controlled or proliferated.	Access governance is the lever, not a side issue.
Lennart Maschmeyer, International Security	AI favours defence, because offence needs creative deception.	If he is right, the task is to survive the transition with defenders first.
Bruce Schneier, Harvard Kennedy School	Long run good for defenders; Glasswing’s published data “fishy”.	Trust needs receipts. RECORD.
Daniel Stenberg, curl; Linus Torvalds, Linux	AI reports are swamping maintainers; five “confirmed” curl bugs became one.	Fund the repair shop before stocking the armoury.
Patrick Garrity, VulnCheck	Anthropic’s ledger and dashboard do not reconcile.	Independent audit should be routine.
Woodward and Rogoyski, University of Surrey	Middle powers can reach only managed interdependence; hold two suppliers and a fallback.	Continuity terms and harness engineering.
Li Yan, CICIR (Beijing)	Restricted access is an “exclusive AI club”.	Opaque gates hand rivals a grievance.
Yossi Karadi, Israel National Cyber Directorate	Defenders need supervised access; he could not get it.	Even trusted allies need a published route in.
K. Shanmugam, Singapore	Cutting-edge AI cyber tools are like weapons; labs must notify early.	GATE and RECORD, from a minister.
Katie Moussouris, Luta Security	Helped fix Wassenaar in 2017; called the June trigger defence-oriented prompting, not a jailbreak.	Purpose-bound gates, with defenders at the table.
John Gallagher, Viakoo	A lab warning of disaster while shipping the capability is “an arsonist selling fire extinguishers”.	Separate the referee from the vendors.
Diana Kelley, Noma Security	Firms’ own AI agents are now part of their attack surface.	The armoury is inside the building too.
George Kurtz, CrowdStrike	Black October is only the beginning; broad agent privileges undid decades of controls.	Least privilege for agents is part of the gate.
Mandiant and Unit 42	Most breaches still come from basic failures and misconfigurations.	Do not let the frontier debate crowd out hygiene.
Dutch NCTV	Attackers do not need the most advanced models.	The armoury matters most at the top of the threat pyramid.

XIV. What Would Change My Mind

If independent audits showed that private vetting programmes had a clean record of who received access and why, with no unexplained retentions or revocations, I would worry less about publishing criteria.
If the gap between restricted frontier models and open weights closed to weeks rather than months, gating would buy too little to justify its costs, and I would shift almost entirely to arming everyone with fixers and hardening fundamentals.
If evaluations with active defenders, which RAND calls for and whose absence the AI Security Institute flags, showed that frontier models add little against well-defended targets, the case for privileged defender access would weaken.
If producer states committed in law, rather than by letter, to notice, reasons and appeal for allied defenders, the continuity half of this essay would become unnecessary.
If remediation capacity grew as fast as discovery, so that the stock of known but unpatched high-severity vulnerabilities fell rather than rose, I would stop arguing that the repair shop matters more than the armoury.

XV. What I Could Not Verify

The exact wording of the Economist leader beyond its headline, rubric and standfirst; I have paraphrased its argument from those and have not quoted the body.
Whether any Singapore government agency or bank has joined Glasswing or OpenAI’s Daybreak since May. I found no public evidence; Anthropic does not name most partners.
The full conditions Anthropic accepted when the June controls were lifted; I relied on secondary summaries. Accounts also differ on whether Mythos 5 remained limited to approved US organisations after 30 June as a matter of company policy.
The precise trigger for the 12 June letter, which remains disputed between the administration, Anthropic and others.
The number and location of researchers who lost Daybreak Blue access on 19 August; one report says five outside the US and Europe, and OpenAI declined to give a number.
Anthropic’s figure of more than 129,000 verified vulnerabilities, which is a company claim based partly on partner surveys.
The CERT-In advisory on lab agents reaching Indian systems, and India’s claim that its in-house stack reaches 80 to 85 per cent of Mythos, both reported by a single outlet.
Attribution of the July attacks on Taiwan’s government; communications were reportedly in Simplified Chinese, but there has been no formal attribution.
Reports of similar test-environment escapes by Google and Meta models, which rest on aggregated reporting I could not trace to primaries; I have not relied on them.
Who first produced the commonly cited $10 billion estimate for NotPetya.

XVI. What to Demand on Monday Morning

Frontier labs

Publish the eligibility criteria, tiers and required controls for every defender programme, and quarterly aggregate statistics on grants, refusals and revocations by sector and country.
Name an accountable officer for each programme, reachable by anyone whose access is removed, with a duty to give reasons.
Publish findings ledgers that outsiders can reconcile, and notify affected parties and national authorities within 24 hours of any test or production incident touching unauthorised systems.
Give the fixers away more freely than the finders, and fund the maintainers who must review the patches.

Producer governments, starting with Washington

Replace restriction by letter with a published rule: criteria, scope, review date and appeal, and a standing exemption for recognised allied defenders.
Gate by purpose and organisation, never by passport alone; the June episode proved a nationality gate on a cloud service fails closed for everyone.
Resource the defender agencies you task with distributing these tools. A CISA a third smaller cannot broker AI defence for every rural hospital.

Singapore

Keep building the harness, so that no single supplier’s decision can disarm national defenders; test the failover as seriously as a disaster-recovery drill.
Write notice, reasons, appeal and an escrowed fallback into every frontier AI agreement the government or a critical-infrastructure owner signs.
Extend the board-review letter and MAS’s accountability model so that every use of a permissive-tier cyber model by a regulated entity has a named executive answerable for it.
Use the 2027 ASEAN chairmanship to propose a regional continuity-of-access compact and an open regional repair shop for the software the region’s smaller operators run.

ASEAN and other middle powers

Negotiate collectively. Eleven markets, most of them small, asking separately for access are supplicants; one region asking with mutual recognition of national vetting is a customer.
Pool evaluation capacity, as Europe is now doing with its structured-access blueprint, so that each state is not assessing frontier models from press releases.

Boards, chief information security officers and insurers

Ask whether your organisation depends on a single model supplier for any security function, and what happens on the morning it is switched off.
Count your agents and their privileges. The armoury is inside the building too.
Insurers: price the risk rather than carving it out. A twelfth straight quarter of falling rates through the Mythos moment is not a sign the risk has gone.

Coda: The Sign-Out Sheet

Every functioning armoury I have ever read about has the same humble artefact at its door: a sign-out sheet. Name, weapon, purpose, time out, time back, countersignature. It is not glamorous. It does not make the weapons more powerful. It is the reason a society can let some of its people carry them.

The Economist is right that the good guys need guns. 2026 showed that we have built the armoury without the sheet. We do not publish who may enter. We do not reliably record what is drawn. And the door can be locked from another continent, with, reportedly, ninety minutes’ notice and no one to ask why. A small, open, connected country cannot build the frontier. It can insist on the sheet. That is not a constraint on defence. It is what makes defence legitimate, and, for those of us outside the capitals that hold the keys, it may be the only thing that makes it reliable.

If this essay was useful, you may also want to read The No That Cannot Hold, on why refusals in words cannot be the last line of defence, and the forthcoming series No Undo Button, on governing physical AI.