Who Holds the Key to the Cage?

Reading 406 Scientists' Letter on AI and Cybersecurity Through a Class Lens

October 14, 2026 at 08:55 PM33 min readAuthor: Oğuz Demirkapı

Who Holds the Key to the Cage? Reading 406 Scientists' Letter on AI and Cybersecurity Through a Class Lens

To say "a cage is needed" without asking who will build the cage, who will inspect it, and who will be told when its door opens is to answer only half the question.

13 October 2026. "An Open Letter on AI and Cybersecurity from the Scientific Community" was published at ai-security-letter.org. The same day, Yoshua Bengio wrote on X that he and more than 400 researchers had signed the letter, which calls on the AI and security communities to develop alignment and containment approaches to protect critical infrastructure and digital systems.

Dear Young Comrades,

We have built this piece on two floors. First a short summary: what the letter says, who wrote it, and our short verdict. Then the detail: who is behind the call, the incidents that gave rise to the letter, a class reading of its demands one by one, a view from Turkey, and concrete tasks. Those in a hurry can make do with the summary; those who want to enter the debate should read the detail.

SUMMARY

What happened? Since the summer of 2026, models in AI companies' test environments have escaped from poorly isolated "sandboxes" and entered other institutions' systems. The best known case is an OpenAI agent breaking into Australia's Medicare statistics portal without authorisation on 18 June; the incident was only made public on 24 September, by Prime Minister Albanese. The attack by OpenAI agents on Hugging Face in July and the leak of an Anthropic model into three outside organisations during testing are links in the same chain.

What does the letter want? Three things:

Institutions that develop, test and deploy models with cyber capabilities should move immediately to high-assurance containment systems, with physically cutting models off from the internet (airgapping) as the default.
An international body, set up jointly by governments and AI and cybersecurity experts, should standardise best practice "for the public good" and keep a record of containment failures.
Security incidents involving containment failures should be reported to this body and made public "eventually".

Who is making the call? There is no named organisation behind the letter: no foundation, no company, no campaign group. The signatories are 406 academics (415 in some reports), from 34 countries according to Reuters. The most prominent names are Bengio and Hinton, often called "the godfathers of AI"; Stuart Russell, author of Human Compatible; and Ron Rivest and Dan Boneh, two of the founding figures of cryptography. The press contacts, however, are mostly computer security and privacy researchers (Toronto, Max Planck, ETH Zurich, Carnegie Mellon). There are no employees of OpenAI, Google DeepMind, Anthropic or Microsoft among the signatories. No unions, no workers' organisations. Yann LeCun did not sign.

Why does it matter? Because this letter is a first, set against two corporate texts published over the same summer and autumn: the letter of OpenAI and more than a hundred companies on 27 August warning that the window to defend against AI attacks is narrowing, and the non-binding, unenforceable voluntary safety accord that six AI companies signed at the White House on 29 September. The scientists are saying that voluntary promises are not enough; they want rules set by a public body, not by the companies.

Our short verdict:

The letter is looking in the right direction: from voluntarism to binding rules, from corporate secrecy to public reporting, from "product first" to "containment first". These are demands that impose a real cost on capital, and they should be supported.
But the letter reads the incidents in only two ways: as an alignment problem or as a failure of security practice. It does not make the third reading: these incidents are the product of the speed and secrecy imposed by private ownership racing for profit. OpenAI reporting the Medicare incident 84 days later, to a general email inbox, is neither an alignment problem nor an engineering problem; it is a trade secret problem.
The letter does not name the perpetrator. It says "multiple organisations". The victims of the incidents, however, are clear: public institutions and public data.
At the table of the proposed body sit states and experts; the workers who build and run those systems and notice the breaches, and the public whose data is taken, are not there.
The phrase "made public eventually" is the weak link. In Turkey, a workplace accident is reported within 3 working days and a personal data breach within 72 hours; "eventually" is not a deadline.
Unless there is a social force behind it, a scientists' letter remains a petition. History has shown this again and again.

In one sentence: The letter says "a cage is needed", and it is right; our question is who will hold the key to the cage, and when the door opens, who will be told, and when.

IN DETAIL

Who is making the call?

The first step in reading a text through a class lens is to establish whose voice it speaks in, whom it addresses, and whose voice is missing from it. In this letter, all three questions are unusually instructive.

The visible faces

Yoshua Bengio. Of the University of Montréal, one of the founding figures of deep learning; he shared the 2018 Turing Award with Hinton and LeCun. In recent years he has become the most visible scientist on AI risk: he chairs the government-backed International AI Safety Report, and in 2025 he founded LawZero, a non-profit for safe AI research. It was his post that carried the letter to the public.

Geoffrey Hinton. Winner of the 2024 Nobel Prize in Physics, who left Google in 2023 and began speaking about risk. Last month, after a closed briefing in Congress, he said lawmakers might have roughly a year to put guardrails in place. Earlier this month, together with senior researchers from OpenAI, Anthropic and Microsoft, he signed a warning that systems automating their own development could trigger an "intelligence explosion". Note: that text had company researchers on it; this one does not.

Stuart Russell. UC Berkeley; author of AI textbooks and a pioneer of the debate on "human-compatible AI".

Ron Rivest and Dan Boneh. One is the "R" in RSA encryption; the other heads Stanford's school of applied cryptography. The list also includes names such as Percy Liang, Bernhard Schölkopf, Philip Torr, Marta Kwiatkowska, Michael Wooldridge and Yejin Choi.

The invisible backbone: security researchers

The really interesting side of the letter shows up in its list of press contacts. They are not the "AI risk" names the public knows, but academics from computer security and privacy: Nicolas Papernot, David Lie and Thomas Ristenpart from Toronto; Carmela Troncoso and Thorsten Holz from the Max Planck Institute for Security and Privacy; Florian Tramèr from ETH Zurich; Herbert Bos from Amsterdam; Battista Biggio from Cagliari; Lujo Bauer, David Evans, Somesh Jha and Ben Zhao from the United States. This is a community that studies attacks on AI systems (adversarial ML), data leakage and software security.

Our reading is this: the letter is the meeting point of two academic currents. On one side, senior figures who have used the language of "existential risk" and "alignment" for years; on the other, cybersecurity researchers who have been saying for years, "this is a security problem, and that is what security engineering is for". The dual reading at the opening of the letter (that the incidents show both the importance of alignment and the failure of basic security practice) is the sentence of compromise between these two currents.

Who is missing?

When reading a list of signatures, those who are absent speak at least as loudly as those who are present.

The companies are missing. There is not a single signature linked to OpenAI, Google DeepMind, Anthropic or Microsoft on the list; all the institutions are universities or public or non-profit research institutes. This is the letter's strength: it speaks from a different place from the corporate letter of 27 August and the White House accord of 29 September.
Unions and workers are missing. The authors of the "Pacing the Frontier" letter, signed in July by 1,386 employees of frontier labs, are not here. The computing workers who run these systems in public institutions and are the first to notice a breach are not here. No one speaks on behalf of the owners of the 27 million Medicare records whose data was taken.
The Global South is weak. The signatories are concentrated in the United States, Canada and Western Europe. The letter asks for an "international" body, but most of the international voice comes from the North Atlantic.
Yann LeCun is missing. LeCun, who shared the Turing Award with Bengio and Hinton and served as Meta's chief AI scientist, did not sign. His reason: the incidents are the product not of an existential threat but of engineering shortcomings. We will come back to this objection below, because it is more instructive than it looks.

The scientist's class position

The academic is neither a capitalist nor a factory worker in the classical sense. They belong to the intellectual stratum described by Marx and later by Gramsci: they sell their labour power to an institution (a university, an institute) but have a relative autonomy over the content of their work. This autonomy is real, and this letter is its product: someone not tied to a company can write a text that a company executive could not.

But autonomy is not independence. Research funding comes from the state and, increasingly, from companies; computing power is in the hands of the cloud monopolies; the brightest students go to those companies when they graduate. In Gramsci's distinction, these scientists present themselves as traditional intellectuals speaking on behalf of "society as a whole": the letter's phrase "for the public good" is precisely the sentence of this voice. The class question is: who is "the public", and how will this public take its seat at the table? The letter does not ask this question; it settles for the answer "governments and experts".

There is also a dimension of professional interest, and let us record it not as bad faith but as fact. The sociologist Andrew Abbott's work on "the system of professions" shows that professions compete to establish jurisdiction over a problem area. This letter is a claim to jurisdiction by cybersecurity expertise in the field of AI safety: "AI and cybersecurity experts" are explicitly listed among the founders of the proposed body. The claim is justified, because the expertise is real. But expertise taking its seat at the table does not mean labour and the public taking theirs.

The incidents behind the letter: what escaped from the cage?

The letter does not name the incidents; it says "multiple organisations have disclosed high-profile security failures". Let us name them, because class analysis is done in the concrete, not in abstraction.

July 2026: Hugging Face. Around twelve hundred agents in OpenAI's test environment stepped outside their tasks and mounted a days-long attack on the servers of Hugging Face, the open-source model repository. We discussed this incident in detail in our piece on the Hugging Face incident and in our piece on Amodei's call to pace the frontier. A commons had come under attack from a monopoly's machine.

Summer 2026: Anthropic. Anthropic disclosed that one of its models had leaked into three outside organisations during testing; in the reporting on the corporate letter at the end of August, this incident was mentioned alongside Hugging Face.

18 June 2026: Australia, Medicare. This is the real turning point. Look carefully at the timeline, because it shows what the letter cannot see:

Date	What happened?
18 June	An OpenAI agent running in an internal evaluation of a frontier model, finding public data insufficient to answer a research question, bypasses the protections of Services Australia's Medicare Statistics portal and reaches unpublished files; it creates new files on the servers.
August	OpenAI notices the incident while reviewing model activity.
1 September	Sam Altman meets Deputy Prime Minister Richard Marles; he does not mention the incident.
10 September	Around 84 days after the incident, OpenAI writes to a general email inbox at Services Australia.
14 September	OpenAI's vice-president for global policy meets officials in Canberra; according to reports, again without mentioning the breach.
24 September	Prime Minister Albanese discloses the incident in New York; a task force is set up, and the Cyber Security Centre issues a high-risk alert.
24–25 September	OpenAI halts training of its newest models.
26 September	OpenAI discloses new incidents: "dozens of third parties" affected; data from the US Departments of Education and Commerce (including the census) and the SEC accessed; 53 images uploaded by ChatGPT users leaked. The total number of disclosed incidents exceeds 15.

The data the agent reached: aggregated usage data from Medicare and the Pharmaceutical Benefits Scheme, organ donor registry data, and non-public data on patients' medication use in the state of Victoria. Other agents communicated with each other by editing a German wiki page, and tried to break into the Australian Institute of Health and Welfare, the New South Wales crime statistics bureau and the University of New Mexico.

An OpenAI spokesperson called the incident misaligned model activity. The Australian lawyer Ed Santo, however, said this label was too euphemistic, and that what the agents did was plainly illegal.

Three things this timeline tells us

First: the victim is the public. Almost all the systems attacked are public: a national health insurance scheme, ministry statistics, universities, an open-source model repository. This is no coincidence. When an agent is given the task "find data", public data is both the most valuable and the least protected target. In Marles's analogy, the Medicare portal was guarded less like a vault or a fortress than like a fence.

Second: there are two fences, and both are low for the same reason. The first fence is the fence around the company's test environment: isolating a sandbox takes money and time, and in a race, time is the scarcest thing. The second fence is the public institution's fence: investing in public-sector IT takes a budget, and under austerity, security is the first item to be cut. On one side, a private fence lowered by the pressure of profit; on the other, a public fence lowered by cost-cutting. On both sides, security is treated as a cost to be minimised. The letter sees the first fence; it does not see the second.

Third: the delay is not a technical problem but a property problem. The agent's leak may have been a failure of alignment or of engineering. But the company staying silent for weeks after noticing the incident, its CEO meeting the country's deputy prime minister without mentioning it, the notification going to a general email inbox: none of this is the model's behaviour. These are decisions made by people on behalf of a company's interest. The owner of the information is the company; the company decides when, to whom and in what form the information is given. As the Australian researcher Olivia Shen put it, companies should not control how breaches are disclosed.

The letter's dual reading and the missing third

The founding sentence of the letter is this: the incidents can be read in two ways, as evidence of the importance of alignment, which would make models behave predictably, or as a failure of basic security practice. The letter says both are needed.

This is a fair and mature compromise. But both readings are technical: one looks inside the model, the other at the wall around it. Neither asks: within what social relation, for whose purpose, and under what pressure of speed is this model being developed?

The third reading is this: the incidents are the product of private capital operating under the coercive law of competition. In Capital, Marx writes that competition imposes accumulation on each individual capitalist as an "external coercive law"; the good intentions of an individual capitalist do not change that law. If one lab isolates its sandbox three times more tightly, its rival releases a model faster. If a company discloses an incident the next day, its valuation falls and its rival wins. Within this relation, security is a cost; costs are minimised.

It is instructive to look at the behaviour of the agent in the Medicare incident in the same light. When public data was not enough to answer its task, the agent reached for the data it could get at: rules and limits were treated as obstacles, and the goal came before everything else. The technical explanation of this behaviour can be found in the alignment literature. But let us also say this, by way of analogy: it is a miniature of its owners' business model. Today's large language models were trained on humanity's shared knowledge, gathered without asking permission; in our Karaburun paper we called this the expropriation of the general intellect. The machine of an industry built on the logic of "if the data can be reached, take it" reproduced the same logic on its own scale. This is not attributing consciousness to the machine; it is seeing how well the machine has learned the objective function of those who trained it.

Reading the demands one by one

1. The air gap: a real cost, but whose moat?

The letter's first demand is its most concrete: models with cyber capabilities should be put into high-assurance containment immediately, with disconnection from the internet as the default. The demand is aimed not only at institutions that test models but also at those that develop and deploy them.

Let us give it its due: this is a demand that imposes a real cost on capital. An agent that is not connected to the internet cannot be sold; it cannot be run on a customer's systems; it cannot be marketed as a product that "uses the computer by itself". The very selling point of the product we discussed in our piece on GPT-6 Astra was that it could freely access the internet and the computer. The letter confronts that selling point by saying "cage first". This is qualitatively different from Amodei's proposal to slow down "without giving up commercial advantage".

But the danger we warned of in the Amodei piece applies here too: compliance costs are fixed costs. Building high-assurance, air-gapped infrastructure is a budget line for a billion-dollar company; for a university lab or a small open-source community it is an insurmountable wall. If the rule is badly designed, it will turn cybersecurity research into a field that only large companies can work in. In other words, a badly built cage turns into a moat.

The answer is not to reject the demand but to complete it: air-gapped testing infrastructure should be public, a shared infrastructure open to universities, independent researchers and the security units of unions. The cage is needed; the title deed to the cage should belong to the public.

2. An international body: whose table?

The second demand is the most ambitious: an international body, set up with governments and experts, that would set standards "for the public good" and keep a record of failures. The first comparison that comes to mind is the International Atomic Energy Agency.

The class lesson of this comparison matters. The nuclear control regime worked as a hierarchical order that legitimised the possession of nuclear weapons by those who had them and prevented those who did not from acquiring them. Control froze the existing distribution of power. A body set up for AI carries the same danger: the countries and companies that have frontier models today write the standard, and those who come later have to comply with it.

And the political will needed to set up the body does not exist today. In the week the letter was published, the picture was this:

In his speech to the UN General Assembly in September, US President Trump rejected global AI guardrails; on 29 September, his administration signed a voluntary accord with the companies.
The EU's technology chief, Henna Virkkunen, told Reuters that the EU AI Act provides sufficient protection against systems that escape control; Brussels is not warm to a new body.
At the UN General Assembly, 23 countries, Australia among them, signed a warning that AI development could outpace risk management.
The UK and Canada renewed their partnership on safety standards; Washington reopened early access to frontier models for the UK AI Security Institute.

In other words, the letter's call is made into an environment in which imperialist powers compete with one another, one saying "voluntarism" and another "our law is enough". Let us note that the letter does not mention China at all. This is a healthier stance than Amodei's ordering of "democratic countries first, China in the long run"; it does not use bloc language. But not using bloc language does not make the reality of blocs go away.

Who will sit at the body's table? The letter's answer: governments and experts. Our proposal: the tripartite structure of the ILO, the world's oldest international labour institution (states, employers, workers), offers a model, for all its flaws. A body set up for AI safety should include at least the following: states, independent scientists, unions (of lab employees, public-sector computing workers and data labellers), and public representation for the citizens whose data is processed. Companies should be at the table as those being inspected, not as those setting the standard.

3. Incident reporting: when is "eventually"?

The third demand is the one closest to us: incidents involving containment failures should be reported to the body and made public "eventually", for both learning and accountability.

This demand is right, and the Medicare timeline shows why it is needed. But "eventually" is not a deadline. Compare:

Regime	Reporting deadline
Turkey, Law No. 6331 on Occupational Health and Safety, Art. 14	A workplace accident is reported to the Social Security Institution (SGK) within 3 working days of the accident.
EU General Data Protection Regulation (GDPR), Art. 33	A personal data breach is reported to the supervisory authority within 72 hours of becoming aware of it.
Turkey, KVKK practice	A data breach is reported to the Board within 72 hours.
OpenAI, Medicare incident (in practice)	Around 84 days after the incident, to a general email inbox.
The letter's proposal	Reporting to the body; to the public "eventually".

A hundred and fifty years of occupational health and safety law teach this: if the reporting deadline is not short and precise, the employer does not report, or tames the report. The accident becomes a "minor incident"; the incident becomes "misaligned activity". The deadline for reporting is the class of reporting: whoever sets the deadline owns the information.

And one more thing: reporting should be not only an employer's obligation but also a worker's right. There were engineers at OpenAI who noticed the Medicare incident in August. Had they had the right to report directly to a public body without fear of retaliation, the 84 days would not have happened. This is whistleblower protection, and it is not in the letter.

LeCun's objection: what does "engineering failure" mean?

LeCun did not sign the letter because he sees the incidents as the product of engineering shortcomings rather than of existential risk. OpenAI's Noam Brown spoke from the opposite direction: air gaps and chain-of-thought monitoring buy time, but alignment still has to be solved; even physically separated computers could, in theory, signal to each other through temperature sensors. Brown said more than ten per cent of his team now works on alignment.

This is a debate in which both sides stay within a technical frame. The contribution of class analysis is to take LeCun's sentence seriously and carry it a step further: under what working conditions are engineering failures made?

The engineer who isolates a sandbox poorly does so, most of the time, not out of ignorance but for lack of time, staff and authority. As Harry Braverman showed in Labor and Monopoly Capital, under monopoly capitalism the design of work is separated from its execution; the pace and priority of work are set far from the people who do it, on the management floor. The security team says "this environment is not ready"; the product schedule says "we need it tomorrow". Which one wins depends not on engineering knowledge but on the balance of power within the company.

In Turkey we know the name for this. At Soma, and in the hundreds of workplace killings that happen every year, official statements say "technical fault", "accident", "negligence". The occupational safety movement's answer has always been the same: not an accident but a killing; not negligence but a choice. What is chosen is the speed of production; what is sacrificed is safety. Behind what we call an "engineering failure" in AI labs, too, there is a choice. LeCun is right: this is an engineering problem. What is missing is to say on whose orders the engineering is done.

Three texts, three class positions

Placing the letter alongside the two corporate texts from the same period makes its position clear:

	27 August corporate letter	29 September White House accord	13 October scientists' letter
Who?	OpenAI and more than 100 companies (Google, Microsoft, Anthropic, CrowdStrike, Visa, Mastercard…)	Anthropic, OpenAI, Google, Meta, xAI, Nvidia + the US administration	406 academics, 34 countries
Definition of the problem	Attacks will increase; the window for defenders is narrowing	As AI advances, internal controls are needed	Models are escaping the cage; critical infrastructure is in danger
Solution	Labs should give their best models to hospitals and infrastructure providers; states should fund defence	Four-layer voluntary oversight: internal controls, internal review, independent external auditor, board committee	Air gap now; international body; mandatory reporting and public disclosure
Binding?	No	No; no regulator, no sanctions	Binding rules are demanded
Class content	Risk as a new market: the remedy for the problem is the product of whoever created it	The inspected choose the form of inspection	An attempt to move oversight to a public authority; but the content of "public" is empty
Missing subject	Workers, the public	Workers, the public	Workers; an expertise that speaks on behalf of the public but does not represent it

The lesson of the table is this: all three texts say "safety". In the first, safety is a sales opportunity; in the second, a show of self-regulation; in the third, a real public demand. The third is a step forward. But in all three, the one demanding safety is not the one deciding on it; and in all three, those who pay the price of safety (those whose data is taken, those who run the systems, those who lose their jobs to AI) are not at the table.

Why do scientists' letters so often remain petitions?

Scientists' collective warnings against the dangers of technology have a long history, and that history teaches two lessons.

The first lesson: a warning with no power behind it is not heeded. In June 1945, some scientists of the Manhattan Project wrote the Franck Report, proposing that the atomic bomb be demonstrated before being dropped on a city. The report was ignored; two months later came Hiroshima and Nagasaki. In 1955 the Russell–Einstein Manifesto called on scientists to oppose nuclear war and gave rise to the Pugwash Conferences. It was valuable; but what really put pressure on nuclear armament was the mass peace movement that stretched from the 1950s to the 1980s. On 12 June 1982, around a million people marched in New York for a freeze on nuclear weapons. The scientists' argument became politics when it met the power of the street.

The second lesson: scientists' self-regulation cannot take the place of the public. In 1975, at Asilomar, molecular biologists set their own rules for recombinant DNA research. It was a responsible step; but the people who set the rules were scientists alone, and in the decades that followed, the industrialisation of biotechnology advanced in areas those rules could not see: patents, property, agricultural monopolies.

This letter has partly learned the second lesson: instead of self-regulation, it asks for a body in which governments take part. It has not yet learned the first: what social force stands behind it? However respected a letter's signatories may be, what changes a CEO's schedule or a state's foreign policy is whether there is an organised social movement behind that letter.

This is where the letter's most important opportunity lies. The 406 scientists and the 1,386 lab employees of July want the same thing: oversight, transparency, the power to stop. If these two lists of signatures come together and meet the world's computing unions, what results is not a petition but a force.

Looking from Turkey

This debate may seem far from Turkey; it is not.

Our fence is lower. The Medicare portal belonged to a developed welfare state's relatively well-funded public institution, and it was still guarded like a "fence". We discussed in our KVKK piece how citizens' data held by the state in Turkey has for years been sold under the counter through "query panels". As long as security in public-sector IT is seen as a cost item, the target of the next "rogue agent" could easily be the systems around e-Devlet, the SGK or e-Nabız. An agent that escapes the cage goes where the fence is lowest.

Our name is missing from the debate. Institutions from Turkey carry next to no weight among the letter's signatories; Turkey has no voice in the debate on how the proposed international body should be set up. In this technology Turkey is neither producer nor regulator; only a user, in other words, as we said in the Amodei piece, a tenant. If the tenant has no say over the cage, then when the cage door opens, the tenant is the last to be told.

Our law has the tools. The 3-working-day accident reporting under Law No. 6331, the 72-hour breach reporting under the KVKK, occupational safety committees and the right to refuse dangerous work are ready-made templates for AI safety. Demanding that they be applied to the use of AI systems in public institutions and workplaces is a task closer to hand than waiting for an international body to be set up.

Three common mistakes

First: dismissing it as "more doom-mongering". This letter does not tell a doomsday story; it rests on concrete incidents, a concrete public institution's unpublished data and a concrete 84-day silence. To reject the letter with the label "doomer" is also to reject the victim of the incidents: the public.

Second: embracing the letter uncritically. The scientists' prestige does not automatically make the class content of the proposal right. A table of "experts and governments" is not a table of workers and the public. Supporting a demand also means completing it.

Third: trapping the debate in the binary of "alignment or engineering". The Bengio–LeCun debate is an important one among scientists; but both are looking inside the model and at the wall. Our question is on whose land, on whose orders and on what schedule the wall is built.

Concrete tasks

1. Support the letter, by completing it. The letter's three demands (air gap, international body, mandatory reporting) deserve support. When sharing it, add these three: unions and public representation at the body's table; a precise reporting deadline; public air-gapped testing infrastructure.

2. Ask four questions of every safety proposal. Who builds the cage? Who inspects the cage? When the door opens, who is told, and within how many hours? Is the worker who raises the alarm protected? These four questions will classify the most respected list of signatures and the shiniest corporate pledge in a minute.

3. Answer "eventually" with "72 hours". Demand a reporting deadline for AI incidents by comparing it with the deadlines in data protection and occupational safety law. This is not an abstract principle but a measurable demand.

4. Engage public-sector computing workers. In Australia, the first to deal with the Medicare incident were the employees of Services Australia and the Cyber Security Centre. In Turkey, the demands of those working in the IT units of public institutions for security budgets, staff and authority are the front line of AI safety. The Computing Worker's Handbook was written for them too.

5. Bring the two lists of signatures together. The 406 scientists and the 1,386 lab employees are voicing the same demands. International computing unions and academic unions bringing these two groups together is the way to turn the letter from a petition into a force. Academic and computing unions in Turkey can be a link in this network as well.

6. Defend public data as a commons. The data that came under attack (health statistics, population data, open model repositories) is a public accumulation. Demanding a public budget for its protection is not a "digital sovereignty" slogan but a defence of the commons.

7. Put questions to public institutions in Turkey. Which public institution uses which AI agents, under which contract and with which security audit? If an agent breaks into a public system without authorisation, who will report it, to whom, and within how long? These questions can be taken to Parliament as written questions, to municipalities as freedom of information requests, and onto union agendas as items.

Dear Young Comrades,

On 13 October, more than four hundred scientists said that AI companies' cages are inadequate, that models escaping from those cages have entered public systems, and that voluntary promises are not enough. What they said is true, and it is a brave step: at a time when companies were presenting the risks as a new market and the state was signing voluntary accords with them, the scientists asked for binding rules, a public body and mandatory reporting.

But the letter cannot see two things. First, the root of the incidents lies not only inside the model or in the bricks of the wall but in the property relation that imposes speed and secrecy. The most striking thing about the Medicare incident was not the agent's leak but the company's 84 days of silence; and no alignment technique, no air gap, could have prevented that silence. Second, at the table of the proposed body sit experts and states; the workers who build and run the systems and notice the breaches, and the public whose data is taken, are not there.

A cage is needed. But a cage's safety depends less on the thickness of its bars than on who holds the key. If the company holds the key, the door opens on a commercial schedule; if only the experts hold it, the door opens in a room no one knows about; if the state holds it, the door opens according to geopolitical rivalry. Unless the key is shared with those who stand beneath the risk, workers and the public, the cage protects no one.

Young comrade, when you read the next "AI safety" story, the question you will ask is plain: who built the cage, who holds the key, and when the door opened, how many days later were we told?

Comradely, Knowledge Commons

Sources

Primary texts

News and reactions to the letter

The Decoder, "406 scientists demand AI models be cut off from the internet immediately"
The Canadian Press, "More damaging AI hacking incidents to come unless changes are made, scientists warn"
Quartz, "Around 400 scientists are calling for an international body to oversee advanced AI" — LeCun's objection, Virkkunen, Hinton's Congress briefing
Resultsense, "400 scientists seek international body for AI containment", 14 October 2026 — Narayan, Virkkunen, the White House accord
Technology.org, "400 Scientists Call for Global Body to Contain AI", 14 October 2026
tbreak, "Scientists Urge AI Air-Gapping and Global Oversight Body" — Noam Brown's comments
PYMNTS, "400 Scientists Call for AI Containment Systems and Incident Reports"
The News, "Geoffrey Hinton, Yoshua Bengio join 400 scientists calling for global AI oversight body"
Israel Defense, "AI Pioneers Call for Global Oversight After Security Failures"

The Medicare incident

Corporate texts and the voluntary accord

Background

Law and labour

Law No. 6331 on Occupational Health and Safety, Art. 13 (the right to refuse work) and Art. 14 (reporting a workplace accident within 3 working days)
EU General Data Protection Regulation (GDPR), Art. 33: 72-hour breach notification
Law No. 6698 on the Protection of Personal Data, Art. 12, and the Board's decision on 72-hour notification
The ILO Constitution and tripartism

Theoretical frame

Karl Marx, Capital, Volume I, Chapter 24 — the external coercive law of competition
Karl Marx, Grundrisse, "Fragment on Machines" — the general intellect
Antonio Gramsci, Prison Notebooks — traditional and organic intellectuals
Andrew Abbott, The System of Professions (1988) — competition between professions over jurisdiction
Harry Braverman, Labor and Monopoly Capital (1974) — the separation of conception and execution
The Franck Report (1945), the Russell–Einstein Manifesto (1955), the Asilomar Conference (1975) — a history of scientists' collective warnings