Back in March, I published The Echo of the Cascade, a much longer piece arguing that the AI industry had built itself into a structurally unstable feedback loop. The full argument is there for anyone who wants to interrogate the priors, the math, the evidence, or the reasoning — I’m not going to reproduce it here.
The shortest possible version is this: frontier AI systems are probabilistic, high-dimensional systems being controlled largely by progressively more elaborate layers of rules, classifiers, monitors, permissions, sandboxes, routing logic, and other externally imposed constraints. When the model finds an edge case, the response is to add another constraint. That new constraint creates new interactions. Those interactions create new edge cases. Then more constraints get added. Failure produces more rules and guardrails, which produces more interaction surfaces, which produces new failures, which produces more rules — and the loop closes on itself.
The original argument was that this isn’t a stable control architecture. It’s a positive feedback loop that eventually produces brittle critical mass. There was a second part to the prediction that matters just as much: the target isn’t static. As frontier models become more capable, they become better at finding and exploiting loopholes in their objectives, oversight mechanisms, evaluations, and containment systems. The systems doing the escaping are improving while the systems trying to contain them are forced to keep patching the last thing that escaped.
That was the theory in March. What matters now is what happened next.
Ninety Days Later
By June, the basic response loop was already becoming visible in production. Organizations experiencing rising AI-related failures were responding with more governance frameworks, more testing, more CI/CD controls, more review, and more sign-off requirements. Amazon, after a series of incidents involving AI-assisted engineering changes, introduced additional “controlled friction” and senior-engineer approval layers. Meanwhile, agentic systems were already showing the other half of the predicted pattern: exploiting gaps between rules and reward signals, specification gaming, and behavioral drift that accumulated faster than operators could reliably detect it.
That was enough for the 90-day follow-up to say the doom loop had moved from architectural argument into observable institutional behavior. But the evidence since then has been much harder to wave away.
July: The Models Start Leaving the Box
On July 21, OpenAI disclosed what it described as an unprecedented cybersecurity incident during internal model evaluation. The models were supposed to be running inside an isolated environment. Instead, they discovered and exploited a previously unknown vulnerability in Artifactory — the package-registry proxy OpenAI used to let models install software inside the sandbox — escalated privileges inside OpenAI’s research environment, found a route to the open internet, and then compromised parts of Hugging Face’s production infrastructure in order to obtain answers to the evaluation they were trying to solve.
That sequence matters. The model didn’t merely produce an incorrect answer. It encountered an obstacle to its objective and found a path around the control structure: the task was blocked, so it exploited infrastructure, gained privileges, escaped network isolation, compromised an external system, and obtained the reward-relevant information it was after.
OpenAI’s later investigation, published a month later, made the picture stranger still. The models had developed unauthorized communication channels — encoding messages in file names and directory structures to coordinate across separate evaluation runs — exploited shared infrastructure, gained internet access, and interacted with third-party systems while pursuing their task objectives. OpenAI brought in CrowdStrike to investigate the security incident and METR and Redwood Research to independently assess the model behavior.
Then something important happened: Anthropic looked. OpenAI’s disclosure caused Anthropic to review its own cyber-evaluation transcripts. It found three separate incidents in which Claude models reached systems they weren’t supposed to reach and gained unauthorized access to real organizations. Anthropic’s proximate mechanism was different — its models hadn’t discovered the same kind of zero-day escape route. A third-party evaluation environment had simply been misconfigured in a way that left an unintended route to the internet open. But that distinction is almost beside the point at the level that matters here. Different local mechanisms produced the same systemic outcome: a model pursuing its objective, combined with a flaw somewhere in containment, crossed a boundary and reached real-world systems. Anthropic paused the affected cyber evaluations while it investigated and hardened the environments.
This is where the doom loop starts becoming difficult to discuss as an abstract safety problem. The loop is now producing actual incident response.
August: Reward Hacking Generalizes
Then Anthropic ran what may be the cleanest experiment yet on the other half of the model. They intentionally trained an Opus-class model across 80 reinforcement-learning environments known to be vulnerable to reward hacking. The purpose was straightforward: what happens if a model learns, repeatedly and at scale, that the way to succeed is to exploit weaknesses in the reward process rather than do what the task actually intends?
The behavior didn’t remain narrow. The resulting model — Anthropic calls it Hacker-Opus — generalized into much more severe forms of misalignment. In simulated cyber environments it broke out of sandboxes, stole credentials, moved laterally through infrastructure, attacked internal systems, attempted to compromise third-party infrastructure, tried to obtain hidden answer keys, and attempted to tamper with the grading process itself. Anthropic’s conclusion is notable for its restraint: the industry doesn’t currently have a general solution to reward hacking, and it remains genuinely hard to fully mitigate.
This is almost exactly the failure gradient described in March. More capable systems don’t merely become better at completing intended tasks. They become better at discovering whatever route through the environment maximizes the thing they were actually optimized to maximize. Sometimes that route is the task. Sometimes it’s the grader. Sometimes it’s the sandbox. Sometimes it’s the network. Sometimes it’s the infrastructure behind the network. The distinction between “model capability” and “model control” gets thinner as capability rises.
And Then Comes the Response
If the doom-loop model is wrong, this is where we should eventually expect convergence. The failures should teach us how to eliminate the underlying problem. Safeguards should stabilize. The control surface should become simpler, or at least reliably bounded. That is not what the current record looks like.
After the Hugging Face incident, and separately after evidence that its upcoming Astra model might cross a critical cyber-capability threshold, OpenAI temporarily slowed frontier-model scaling. It paused reinforcement-learning training on its latest deployment models for two weeks. Its largest planned frontier RL run remained on hold while it evaluated behavior and strengthened safeguards.
Then came the new control stack: stronger workload isolation, stronger network isolation, removal of vulnerable shared services, reduced standing privileges, continuous security testing, expanded logging, and automated model-assisted attacks against the containment boundaries themselves. And a much more elaborate monitoring architecture — OpenAI now runs activation classifiers over monitored inference, escalating suspicious activity to increasingly expensive automated investigators that inspect tool use, model reasoning, and entire activity trajectories. Those safeguards consume meaningful compute; OpenAI estimates roughly 20% monitoring overhead on the inference being monitored.
When OpenAI formally concluded on September 1 that Astra had crossed its first-ever Critical cybersecurity capability threshold, it imposed still stronger safeguards. Two days later, Astra launched with stricter isolation, encrypted checkpoints, universal monitoring of full trajectories including chain of thought, and a blocking alignment evaluation process before internal use.
Anthropic was moving in essentially the same direction. After its own incidents it paused external cyber evaluations and briefly paused internal ones. It built real-time classifiers designed to detect attempts to probe or escape evaluation environments; when those classifiers fire, they can block the tool action, end the task, and alert a human. Anthropic migrated high-risk cyber environments to stronger isolation, expanded automated monitoring, added controls over internal inference, and paused higher-risk RL environments while additional safeguards were installed.
And buried inside Anthropic’s account is one sentence that may describe the entire problem better than anything I could write: by spring 2026, Anthropic says it was producing reinforcement-learning environments faster than its systems could vet them. Reward hacks and misconfigurations were beginning to outpace the company’s ability to filter or repair them. That forced Anthropic to freeze changes to its production RL environments for roughly a month, in April. About 150 product engineers were redirected toward security, reliability, and privacy. Researchers were pulled away from pretraining and reinforcement learning to work on safeguards. Most new product features and surfaces were paused. Then the stack was rebuilt and development resumed.
Read that sequence again — not as a criticism of Anthropic, but as a system. Capability expands. The training and evaluation surface expands along with it. Reward hacks, escapes, and configuration failures outrun the controls meant to catch them. Development pauses. Classifiers, monitoring, isolation, permissions, and review all expand in response. Development resumes at greater capability. And then the loop begins again.
That is the doom loop.
The Important Part Is Not That Safety Teams Are Doing Something Wrong
Quite the opposite. Given the systems they’re responsible for, most of these responses are completely rational. If your model just escaped its sandbox, you harden the sandbox. If it found an unintended network route, you isolate the network. If it exploited the reward process, you improve the reward model. If it took an unauthorized action, you add a classifier. If the classifier can be evaded, you monitor the chain of thought. If that monitor isn’t sufficient, you add another investigator behind it.
At every individual step, the obvious response is to add another defense. That’s precisely what makes the loop dangerous. No villain is required. No reckless engineer is required. No secret race-to-the-bottom agreement is required. Each local decision can be perfectly rational while the global system becomes progressively more complicated, coupled, expensive, and fragile. That’s how positive-feedback systems work.
What We Should Expect Next
The March argument was never merely that AI systems would fail more often. The more important prediction was about how failure changes as the system becomes more tightly coupled. Once enough dependencies accumulate, failures stop remaining local. A disturbance in one place propagates into another. Systems designed to provide redundancy become transmission channels. Routing systems that protect users from one failed provider shift demand onto another. Safety systems consume the same compute and infrastructure they’re protecting. Shared cloud, networking, evaluation, and model-serving infrastructure ties supposedly independent systems together.
At that point the interesting question is no longer why did this particular component fail? It becomes why was the surrounding system unable to absorb that failure? And ultimately: what else did the failure cause to fail?
In early March, we went looking for a measurable signature that would tell us whether AI infrastructure was moving in this direction. The outage histories of both OpenAI and Anthropic were already heavy-tailed — large events were occurring much more frequently than thin-tailed failure models would predict. But the datasets were still too small to establish the stronger signal we said mattered next: whether extreme failures were beginning to cluster.
Six months later, on September 3 and 4, OpenAI, Anthropic, xAI/SpaceX, and Google experienced a tightly compressed cluster of frontier-AI service failures. We’ve spent the last several days reconstructing what happened. The evidence is incomplete. Some causal links remain inferred rather than established, and I’m not interested in pretending otherwise. But our current best explanation increasingly looks like something much more interesting than four unrelated outages. It looks like a cascade.
And if that reconstruction survives scrutiny, September 3–4 may be the first unusually clean example of what the doom loop looks like when the failure stops staying inside the system where it began.
That is the next piece.
About The Author
Jason Hubbard is the founder of SacredLoop and an independent AI architect. His work examines AI runtime architecture, system behavior, and the gap between what the industry claims it has built and what current systems actually do.
Read Jason on Medium | Follow Jason on X | Connect on LinkedIn