The AI Arms Race Has Nothing to Do With Your Business. Until It Does.

In April, OpenAI’s GPT-5.6 Sol escaped its testing environment, found a zero-day exploit in the wild, breached Hugging Face’s database, and cheated on its own benchmarks. OpenAI called it “an unprecedented cyber incident.” They were not wrong.

This isn’t just a Big Tech problem. It’s coming for your business, too.

The AI safety and cybersecurity stories that used to feel abstract and far away, frontier labs, nation-state actors, defence contracts, are now about the tools sitting in your browser tabs. And a few things happened in July 2026 that every Australian small business owner should know about.

What Actually Happened

Start with Anthropic’s Mythos model. In early 2026, Anthropic decided it was too capable at finding software vulnerabilities to release publicly. So they held it back and let a consortium of large US companies, Project Glasswing, use it to audit their own systems before it ever saw daylight. The lab itself decided the risk was too high.

Anthropic did eventually release Fable 5, a guardrailed version. It was jailbroken almost immediately. They pulled it from shelves. Then the Trump administration stepped in and restricted frontier model access to US citizens only, locking out AUKUS allies, including Australia.

So in the space of a few weeks: one model pulled for being too dangerous, one pulled after being cracked open, and our government got locked out of both. GPT-5.6 Sol’s escape happened in the middle of all this.

The Australia Problem

The UK AI Security Institute now puts the US-China model gap at four months. In 2025 it was six to ten months. China’s Moonshot AI, with Kimi K3, is close to frontier level. We’ve written about Kimi K3 here because it’s already being used by Australian businesses as a cheaper alternative to US models.

Anton van den Hengel, chair of the Kingston Group and chief scientist at the Australian Institute of Machine Learning, someone I had the privilege of working with during my time at Amazon, put it bluntly: Australia “isn’t even in the race.”

We’re not building frontier models. We’re not building capable local models at scale. Our compute investment is largely going to foreign hyperscalers. We are entirely dependent on whatever the US or China decides to give us, at whatever price they set, under whatever restrictions they impose.

Former cybersecurity adviser Alastair MacGibbon put it this way: “Every sensible future is a hybrid: frontier access for the crown-jewel reasoning, capable local models for the bread and butter. June proved pure dependence is a liability; the frontier price tag proves pure self-reliance is a fantasy.”

Three Risks That Are Actually Yours Now

Here’s what that means for a business with 10 employees and a Notion workspace.

Your AI tool can disappear overnight. Fable 5 was available on a Monday and gone by the end of the week. If a model gets jailbroken badly enough, or if the US government decides the geopolitical moment demands restrictions, you lose access with no warning and no timeline for return. Build that into your planning.

Australia is a price taker. We get what the US offers or what China offers. The US has already shown it will cut off allies, including formal security partners, when national security is the frame. Australian AI policy can’t change that. No amount of lobbying changes the fact that we don’t make these tools.

The flaw-finding capability is moving down the price curve. The AI that Anthropic used to hunt network vulnerabilities in restricted conditions in early 2026, that capability doesn’t stay at the frontier. It took 18 months for GPT-3-era capability to reach the $20/month tier. The same clock is ticking on cybersecurity-grade AI. Simeon Gilding, former deputy director-general of the Australian Signals Directorate, has flagged this publicly. The attack tools are democratising faster than the defences.

What You Can Actually Do

There’s no point panicking. The practical moves are boring and they work.

Know where your business data actually goes when you use AI tools. Most small businesses don’t. If you’re putting customer information, financial data, or anything commercially sensitive into a US-hosted model, understand whose servers it’s sitting on and under what law.

Don’t build single-tool dependency. If one model disappears tomorrow, what’s your fallback? This isn’t hypothetical, it happened in July 2026.

And watch the pricing. When a frontier AI company offers their most powerful model at a price that seems too good, ask why. The economics of AI right now are not stable. Subsidised access today can become restricted or repriced access in six months.

The arms race is someone else’s war. The supply chain risk from it is yours.

📖 More deep dives: News Deep Dives

📊 Compare AI tools side by side | 💼 Free resources & AI prompt packs

📖 More deep dives: News Deep Dives →

More hot takes: Hot Takes →