The open-versus-proprietary AI debate has spent too much time asking which models are becoming equally capable.
The more consequential question is what happens when those capabilities are misused:
Who can still take them away?
A campaign disclosed by Gambit Security gives that question operational weight.
Gambit reconstructed an attack environment built around three AI-agent harnesses: Strix for vulnerability discovery, Cairn for autonomous exploitation, and Hermes as the operator's console for campaign orchestration and direct hacking. Gambit logged 1,951 short human prompts across 260 Hermes sessions, only a few prompts per target. According to Gambit's assessment, the harnesses executed nearly the entire intrusion chain autonomously, with Hermes steering activity and giving tactical guidance in the impact and other stages, between short human instructions. The tooling did not depend on a single model class. Open-weight models supported parts of the scanning and exploitation workflow, while Hermes used Anthropic's Claude Opus 4.6. The disclosed evidence does not establish whether Opus 4.6 was reached directly or through an aggregator.
That makes the campaign more useful than another benchmark comparison.
It puts different control surfaces inside the same operational chain.
Three Components. Different Levers.
The open-weight models in Gambit's reporting were accessed through OpenRouter. That matters.
A hosted provider can potentially terminate an account or access path. Open-weight does not mean the operator's particular API session is untouchable.
But terminating that channel is not the same thing as withdrawing the underlying capability.
Once model weights have been independently distributed, another provider, deployment, or locally controlled copy can potentially expose the same capability. The original developer no longer possesses a universal revocation mechanism that reaches every copy.
The proprietary component presents a different control structure.
Gambit's forensic analysis documents newer Claude models refusing some of the operator's attack instructions before Hermes used the older Claude Opus 4.6. Separately, Forbes reported that Anthropic confirmed it identified and terminated an account associated with the campaign. The Gambit-specific account action remains a vendor statement relayed through Forbes rather than independently established primary-source evidence.
It is not evidence of perfect containment.
Gambit reported the campaign activity as still running at publication, and Forbes separately reported provider-level account enforcement. The available evidence does not establish the timing between those events, and it does not establish that switching models caused campaign persistence.
What they establish is narrower:
Provider intervention and campaign persistence can coexist.
Revocation Is Not Binary
This is where the open-versus-proprietary framing becomes too coarse.
An API provider can revoke an account.
A cloud provider can remove infrastructure.
An enterprise can disable credentials.
A defender can block egress, isolate endpoints, and contain workloads.
Those are real controls regardless of the model's licensing or distribution model.
But they do not all reach the same layer.
The important distinction is between revoking an access path and withdrawing the underlying capability.
For a proprietary API model, the developer can potentially remove a model from service, change its safeguards, retire a version, or deny an account access to infrastructure it controls.
Those levers can be incomplete and slow. They can also be bypassed when substitute models exist.
But the levers exist.
For publicly distributed model weights, the developer faces a different problem. Removing one hosted route does not remove independently held copies of the weights.
That is the asymmetry.
Not capability.
Substitutability of revocation.
The Question CISOs Should Add
The industry's model evaluations increasingly tell security leaders what a model can do.
That is necessary.
It is no longer sufficient.
For any AI capability entering an enterprise risk model, CISOs should also ask:
If this capability is misused tomorrow, who still possesses authority to withdraw it, and what exactly does that authority reach?
Account?
API?
Hosted instance?
Model version?
Weights?
Downstream derivatives?
The answer changes the risk.
Capability parity is not the decisive control question.
The harder control question is what authority remains attached to the capability, what that authority can revoke, and what survives outside its reach.
Evidence Boundary
Gambit Security's campaign reporting is an interim threat-intelligence assessment based on evidence recovered from attacker infrastructure and includes findings derived partly from attacker logs and AI-generated records. Claims concerning the specific Anthropic account intervention remain attributed to Forbes because independent primary confirmation of that Gambit-specific action has not been established in the available source record.
The AI Threat Brief | AI Security Intelligence for Leaders
