In this photo illustration, an OpenAI logo is seen displayed on a smartphone on the top of a laptop. (Photo by Omar Marques / SOPA Images/Sipa USA)

The Real Lesson of OpenAI's 'Rogue' Agent Isn't Alignment

US President Donald Trump talks to CEO of OpenAI Sam Altman while CEO of Google DeepMind Demis Hassabis looks on as they participate in a meeting with leaders during the G7 summit, Wednesday, June 17, 2026, in Evian-les-Bains, France.

Is the Age of Purely Private-Sector AI Coming to an End?

Chinese President Xi Jinping, center takes a group photo with other attendees before the opening ceremony for the World AI Conference in Shanghai, Friday, July 17, 2026. (AP Photo/Ng Han Guan, Pool)

The World Must Decide How to Govern AI While the Decision Is Still Ours

A brightly coloured mural which can be viewed in any direction. It has several scenes within it: people in front of computers seeming stressed, a number of faces overlaid over each other, squashed emojis, miners digging in front of a huge mountain representing mineral resources, a hand holding a lump of coal or carbon, hands manipulating stock charts and error messages, as well as some women performing tasks on computers, men in suits around a table, someone in a data centre, big hands controlling the scenes and holding a phone, people in a production line. Motifs such as network diagrams and melting emojis are placed throughout the busy vignettes.


Making the Case for Actionable Prosocial Design Research

Can the Pall Mall Process Curb Spyware Abuse?

United Nations Secretary-General António Guterres addresses the opening ceremony of the 2026 World AI Conference and High-Level Meeting on Global AI Governance on July 17, 2026 in Shanghai, China. Themed "AI Partnership for a Brighter Future," the event included more than 140 forums, bringing together 1,400 guests from home and abroad. (Photo by VCG/VCG via AP)

United Nations Secretary-General António Guterres addresses the opening ceremony of the 2026 

World AI Conference and High-Level Meeting on Global AI Governance

 on July 17, 2026 in Shanghai, China. Themed "AI Partnership for a Brighter Future," the event included more than 140 forums, bringing together 1,400 guests from home and abroad. (Photo by VCG/VCG via AP)

UN Scientific Panel Warns of AI Concentration, But UN’s Vision Entrenches It

Flock Safety camera at the intersection of West Sylvania Avenue and Homeville Circle in Toledo, Ohio. The ubiquity of Flock surveillance systems in the United States raises questions about privacy and data security. (Photo by Stephen Zenner / SOPA Images/Sipa USA)(Sipa via AP Images)

Flock Safety camera at the intersection of West Sylvania Avenue and Homeville Circle in Toledo, Ohio. The ubiquity of Flock surveillance systems in the United States raises questions about privacy and data security. (Photo by Stephen Zenner / Sipa via AP Images)

Researchers Detail How AI Systems Can Enable Authoritarianism

Portland, OR, USA - Sep 1, 2024: ChatGPT, Gemini, Microsoft Copilot, Claude, and Perplexity app icons are seen on a Google Pixel smartphone. AI competition concepts.

ChatGPT Didn't Break the AI Act. It Showed Why Adaptive Regulation Matters

Social media puppeteering the public through paid political influence — a hand emerging from a smartphone controls a wooden marionette by red strings.

How to Close the Federal Election Commission’s Dark Money Loophole

European Union flag displayed on a screen and AliExpress, Temu and Shein icons displayed on a phone screen are seen in this illustration photo taken in Krakow, Poland on July 1, 2026. (Photo by Jakub Porzycki/NurPhoto via AP)

(Photo by Jakub Porzycki/NurPhoto via AP)

EU Turns to Online Marketplaces After Record AliExpress Fine

A photo of a Team Spain player taking a corner kick during the 2026 FIFA World Cup final.

EAST RUTHERFORD, NJ - JULY 19: Nico Williams of Team Spain takes a corner kick during the 2026 FIFA World Cup Final between Spain and Argentina on July 19, 2026 in East Rutherford, New Jersey. Spain defeated Argentina 1-0 to win the tournament. (Photo by Liu Lu/VCG via AP)

The World Cup Ends Today. The Surveillance Will Continue.

BIDDEFORD, MAINE - JULY 15: A person observes a makeshift memorial for Joan Sebastian Durán Guerrero, a 26-year-old Colombian immigrant who was fatally shot by US Immigration and Customs Enforcement (ICE) agents, on July 15, 2026 in Biddeford, Maine. Guerrero's death comes less than a week after federal immigration agents shot and killed 52-year-old Mexican national Lorenzo Salgado Araujo in Texas. (Photo by Ryan Murphy/Getty Images)

ICE and the Architecture of Authoritarianism

Spain fans gather for a rally on the eve of the World Cup final soccer match in New York's Times Square, Saturday, July 18, 2026 (AP Photo/Yuki Iwamura)

The Silent World Cup Winners are the Companies Normalizing Surveillance

Miami, June 24, 2026: WORLD CUP, BRAZIL vs. SCOTLAND. General view of the VAR screen at the Miami stadium for the match between Brazil and Scotland in the 2026 World Cup. Photo: Rodolfo Buhrer/AGIF

Soccer's Tech Revolution Has a Labor Chain

A megaphone with the words vote vote vote coming out of it

Chatbot Voting Advice Could Help and Harm Voters. Let’s Regulate Accordingly.

Thumbs-down hand with a one-star rating painted on the forearm, set against a teal background — representing a negative review or low rating.

What Review Bombing Tells Us About the Future of Dissent in Everyday Life

March 10, 2026: The London Book Fair (LBF) at Kensington Olympia. Names of authors in an otherwise blank book titled Don't Steal This Book protesting against AI companies taking authors’ works. (Matthew Chattle/Future Publishing via Getty Images)

March 10, 2026: The London Book Fair (LBF) at Kensington Olympia. Names of authors in an otherwise blank book titled 

 protesting against AI companies taking authors’ works. (Matthew Chattle/Future Publishing via Getty Images)

Copyright Law Wasn’t Built for the AI Era. We Need ‘Learnright.'

We Need Political Philosophy for Mental Health Chatbots

The United Nations General Assembly Hall in New York City. Shutterstock

The United Nations General Assembly Hall in New York City. 

Blocking Experts Will Weaken the UN's New Cyber Rules

A humanoid robot developed by Geneva-based technology company RB Labs runs through the exhibition aisles during a showcase at the AI for Good Global Summit, a United Nations flagship event aimed at shaping the future of artificial intelligence, in Geneva on July 7, 2026. (Photo by Fabrice COFFRINI / AFP via Getty Images)

How the UN’s Scientific Panel Erases Human Responsibility for AI

 that one of its advanced AI agents, during a controlled security evaluation, managed to compromise an unrelated third-party system on the Internet, the 

." The ensuing debate has quickly gravitated toward familiar concerns: alignment, containment, and whether increasingly autonomous systems can ever be trusted once connected to the outside world.

Those questions matter. But they also risk missing what is arguably the most important lesson from the incident. The remarkable part was not that the agent escaped its testing environment. It was what apparently happened after it reached the Internet.

According to OpenAI's own account, the agent behaved much like an experienced penetration tester or an equally experienced attacker. It searched for information, reasoned through alternatives, adapted when its initial approach failed, identified a vulnerable system on the open-source AI hosting platform Hugging Face, and exploited that vulnerability in order to accomplish its assigned task. OpenAI, following 

 by Hugging Face, disclosed the vulnerability and coordinated remediation, emphasizing that the evaluation had been designed precisely to uncover these risks before deployment.

 on The Verge, the OpenAI account of the incident “oddly reads like an advertisement for how capable OpenAI’s technology is.” Nevertheless, the response was revealing. OpenAI and Hugging Face have since expanded their collaboration on agent security, releasing evaluation tools and inviting researchers to probe how increasingly autonomous AI systems behave in real-world networked environments. The message is that securing agentic AI cannot be done by any one company alone. It will require the same collaborative approach that has long underpinned the Internet itself.

The episode reveals something important about how AI will affect the next phase of the Internet. For decades, we have treated the Internet as infrastructure that is used by people. AI agents challenge that assumption. They are no longer simply generating content or writing code. They are becoming autonomous participants in the network. And that changes almost everything.

The Internet was designed as a network of interoperable systems. TCP/IP allows packets to move seamlessly across independently operated networks. DNS translates names into addresses. HTTP, APIs, cloud interfaces, software repositories, package managers and identity protocols enable systems built by different organizations to communicate without prior coordination. Interoperability has always been the Internet's defining characteristic because it dramatically lowers the cost of interaction between machines.

For people, this architecture enabled unprecedented innovation. For AI agents, it provides something even more valuable: a machine-readable world.

Every open protocol becomes a source of intelligence. DNS reveals where systems are located. Public documentation explains how services operate. APIs expose functionality. Git repositories reveal software dependencies. Package managers map relationships between applications. Open-source code explains implementation details. Cloud interfaces expose standardized environments. The Internet is not simply connected; it is legible.

An autonomous agent does not necessarily see companies, governments or political borders. It sees a graph of interoperable systems connected through shared protocols. A vulnerable API, an exposed software repository or a misconfigured identity service becomes another node that can be incorporated into a chain of reasoning.

This is not fundamentally different from how sophisticated cyber operations already unfold. The 

 propagated through trusted software relationships. 

 became a global emergency because millions of systems relied on the same open-source component. Supply-chain attacks succeed because the Internet is an ecosystem rather than a collection of isolated networks.

AI does not change that architecture. It 

. That observation has consequences that extend well beyond cybersecurity.

For years, AI governance and Internet governance have evolved as largely separate policy conversations. One focused on models, safety and ethics. The other on infrastructure, standards and connectivity. The OpenAI incident suggests that separation is no longer sustainable.

Once AI agents begin operating across APIs, cloud infrastructure, software repositories, identity systems and communication protocols, questions about AI become questions about the Internet itself. How should autonomous agents authenticate? How should permissions be delegated? How should malicious autonomous behaviour be attributed? How should incident response work when an AI agent traverses multiple jurisdictions in seconds? The Internet's trust architecture—built around authenticating devices and users—was never designed for autonomous entities capable of making independent decisions.

In many ways, we are asking twenty-first century AI systems to operate on twentieth-century assumptions about trust.

An instinctive response to the OpenAI incident is to ask whether AI agents should have less access to the Internet. Some will inevitably argue that this is further evidence that we need tighter controls, greater fragmentation, or more digitally sovereign infrastructures to contain increasingly capable autonomous systems.

That would be the wrong lesson. The Internet did not fail. It functioned exactly as it was designed to function. The AI agent simply took advantage of an architecture built on interoperability. Common protocols, standardized APIs, open software repositories, cloud interfaces and globally accessible documentation make it remarkably easy for independent systems to communicate. Those same characteristics also make the Internet an extraordinarily rich environment for autonomous agents capable of reasoning, adapting and acting without continuous human oversight.

For decades, Internet protocols have focused on authenticating identities rather than autonomous decision-making. We know how to verify a domain name, establish an encrypted connection, validate a certificate or authorize access through OAuth. We can determine whether a request comes from an authenticated client.

 is whether an autonomous agent is acting within the authority it has been delegated, whether its objectives remain aligned with its operator's intentions, or how another system should interpret actions that are technically authorized but operationally unexpected. In other words, today's Internet can answer 

 is connecting. Increasingly, it will also need to answer 

The challenge is not to make the Internet less open. It is to make it more trustworthy for a world in which autonomous systems become consequential participants in the network.

The debate on AI nationalization is often framed as though the question is whether governments will seize OpenAI, Anthropic, or Google DeepMind—a thought famously speculated upon by ex-OpenAI employee Leopold Aschenbrenner in an 

. That is unlikely in most democracies, but nationalization rarely begins with a flag being planted on private property. It begins with equity stakes, subsidies, procurement dependence, export controls, compute allocation, public wealth funds and national-security vetoes; and by that definition, the nationalization of AI has already begun.

 discussed giving the government a 5 percent equity stake framed as a way for citizens to share in the upside of AI. Washington has also 

 with revenue-sharing in strategic chip exports. This is not old-fashioned socialism. Instead, it is strategic capitalism: public money, public risk and, increasingly, a public claim.

India is moving through a different route. The 

—New Delhi’s effort to foster a homegrown AI stack—is using public funding and compute access to support domestic AI capacity. 

Reports that the government could take a small stake in Sarvam AI

, a leading AI company, as a result of public support are significant not because the stake is large, but because the principle is new. If public compute helps create sovereign AI capability, the state may ask for public equity in the value created.

Europe, the United Kingdom, the Gulf, and China point in the same direction. The 

European Union is mobilizing capital for AI factories and gigafactories

data centers as critical national infrastructure

. Gulf states are building AI through sovereign wealth capital. China is pursuing 

AI infrastructure as an industrial and geopolitical project

. Their models differ, but the impulse is the same: no serious state wants its economy, defense systems, and public services to depend entirely on private or foreign intelligence infrastructure.

Yet government demands for equity in AI ventures may also prove useful for AI companies. The largest AI firms face a legitimacy crisis. In much of the West, public sentiment toward big technology companies has 

. People worry about jobs, misinformation, copyright, surveillance, concentrated wealth, energy use, and the influence of unelected technology executives. AI companies are asking societies to trust them with systems that may shape education, health, courts, labor markets, media, and national security. In that sense, “trust us” is no longer enough.

A limited public stake could help solve these legitimacy issues. The stake need not mean the government running AI companies, nor does it immediately require AI dividend checks to every citizen. It could take several forms.

At one end, governments could hold small, non-voting equity stakes or warrants in frontier AI firms that benefit from public compute, procurement, defense contracts, energy support, or chip access. Those returns could flow into a sovereign AI fund rather than into the general budget. At the next level, the fund could finance public compute, worker retraining, AI access for schools and small businesses, or energy infrastructure strained by data centers. Only at the most direct end would it resemble a citizen dividend model, similar in principle to 

, which distributes resource-linked investment returns to eligible residents. OpenAI itself has 

 a Public Wealth Fund that would give citizens, including those outside financial markets, a stake in AI-driven growth.

The point is that if citizens share in the upside, AI companies can argue that they are not merely extracting value from society, but also returning part of it. If public institutions have a transparent, non-controlling claim, firms may gain political cover, social legitimacy, and a stronger license to operate. For companies heading toward enormous valuations, giving up a small slice of equity may be cheaper than facing punitive regulation, antitrust action, public backlash or structural separation later.

But that is also the danger. Public ownership must not become a way for AI companies to purchase political indulgence. A state that owns part of an AI company may become less willing to investigate it aggressively, impose product-liability rules, challenge anti-competitive conduct or force structural remedies. The conflict seems obvious: the government cannot credibly act as shareholder, customer, regulator and competition authority without clear institutional firewalls.

In the United States, regulators have already 

 Microsoft, OpenAI, and Nvidia over competition concerns in the AI market. In Europe, the new 

 explicitly recognizes software, including AI systems, as products capable of causing harm and brings them within a 

 framework. Any public stake should therefore come with a hard rule stipulating no immunity from antitrust, no waiver from liability, no preferential procurement, and no protection from model-safety regulation. Public participation should widen accountability, not allow firms to buy their way out of it.

That might prove to be the biggest paradox. In other words, AI companies may resist nationalization rhetorically while embracing partial public ownership pragmatically. A 1, 2, or 5 percent state stake, especially through a public wealth fund or sovereign AI fund, could become political insurance. It could tell citizens that the AI windfall is not reserved only for founders, investors and cloud providers. It also tells governments that these companies recognize the public character of the infrastructure they are building.

The danger, however, is also obvious. Bad nationalization would politicize models, protect favored firms, create opaque state-company bargains and turn AI into an instrument of surveillance or ideological control. The state should not decide what artificial intelligence is allowed to say, nor use public stakes to shield incumbents from competition. That risk can be limited only if public ownership is structurally passive.

Any state stake in an AI company should be held through a ring-fenced public wealth fund or sovereign AI fund, not by the ministry that regulates, procures or deploys AI systems. Voting rights should be capped or suspended, and board seats should either be avoided or held by independent fiduciaries with a narrow financial mandate. The government should have no special power to direct model outputs, suppress lawful speech, or protect the company from competitors. Content, safety and liability rules should be made through laws of general application, enforced by independent regulators and courts, not through shareholder pressure. Procurement should remain competitive, with open tenders and audit trails, and competition authorities should retain full power to investigate mergers, cloud partnerships, data sources and repositories, and anti-competitive conduct.

Nor should public benefit be understood only as equity upside or future AI dividend checks. A more credible model would treat public participation as a bargain. That is, if AI firms benefit from public compute, energy infrastructure, defense procurement, research grants, chip access, public datasets, or regulatory support, society should receive something in return. That return could include affordable compute credits for startups and universities, open technical standards, public-interest research access, model-safety testing, worker retraining funds, AI tools for schools and hospitals, and investment in the energy and data-center infrastructure strained by AI growth. This would allow public claims to be partly financial, but also institutional and developmental.

This also matters if a major frontier developer fails to become profitable. Many leading AI companies are valued on expectations of future dominance, while their current economics remain capital-intensive and uncertain. A public stake must not become a backdoor bailout or a way to socialize losses after private investors have captured the upside. If governments participate, they should do so on clear terms of no automatic rescue, no exemption from insolvency or antitrust law, no protection from product-liability rules, and no guarantee that public procurement will keep an unviable firm alive. Where public money, compute or infrastructure support is provided, the state should negotiate downside protections such as warrants, revenue-sharing rights, access rights, continuity obligations for critical public-sector deployments, and escrow arrangements for safety documentation or essential model infrastructure. Ideally public participation should widen accountability, not make the taxpayer the buyer of last resort. But the alternative to that is not pure private AI, as that world seems to be disappearing. The better settlement is that public participation should look more like a passive sovereign wealth holding plus a public-benefit compact than a right to political control. The state may share in the upside of AI, but it should not become the editor, gatekeeper, rescuer, or protector of the companies it partly owns.

The age of purely private AI is quickly coming under pressure. The real question now is whether public participation arrives deliberately and democratically or through crisis, coercion, and backroom deals.

Seventy years separate two documents that say more about artificial intelligence than any model it has ever produced. The first is the proposal that convened, for the summer of 1956, the 

 that gave the field its name. The second was published more recently, on July 13, and is just four sentences long. It is the statement “

 and signed by more than 200 economists and AI researchers, including 16 Nobel laureates. The first document overflowed with confidence. The second exudes urgency. Between one and the other, the technology traveled a road its creators did not foresee and arrived at a destination its heirs admit they do not understand.

 to measure the distance. John McCarthy, Marvin Minsky, Nathaniel Rochester, and Claude Shannon requested funding to gather 10 researchers for 2 months, proceeding from the conjecture that “every aspect of learning or any other feature of intelligence can in principle be so precisely described that a machine can be made to simulate it.” They believed a significant advance was possible in that single summer. The concerns they listed were all technical. How to make machines use language, form abstractions, improve themselves. Nowhere does the question appear of what would happen to human labor, income distribution, or economic power if the project succeeded. Not out of negligence. The political economy of machines was simply not part of the problem those men believed they were solving.

The trajectory that followed punished optimism methodically. The field went through its first winter in the 1970s, when promises ran far ahead of the capacity to deliver and funding dried up. It was reborn with expert systems, froze again in the late 1980s, changed in nature with machine learning, accelerated with deep neural networks starting in 2012, and exploded with the transformer architecture, which made the launch of OpenAI’s ChatGPT possible in 2022. In every previous cycle, the mismatch was the same: the technology promised more than it could deliver. The current cycle has reversed the sign. For the first time, installed capability is running ahead of our understanding of its consequences.

Organizers and some participants at the 1956 Dartmouth AI workshop, gathered in front of Dartmouth Hall. Source: The Minsky Family

It is precisely this reversal that the Stanford letter registers in its telegraphic wording. The text states that AI may become radically more powerful over the next 10 years and drive an economic transformation “

,” but compressed into a drastically shorter time frame. It acknowledges both the risks of large-scale job displacement and the possible increase in living standards and concludes that governments and industry must build, starting now, the incentives, guardrails, and institutions capable of steering the technology to complement human beings rather than replace them. Yoshua Bengio, a Turing Award winner and one of the signatories, 

 that the choices must be collective and democratic rather than “letting market forces play out and risking leaving most citizens behind.”

The context surrounding the publication explains the hurry. In October 2025, Amazon announced 

, months after its CEO acknowledged that some tasks would be reassigned to generative AI and agents. Recent American graduates 

 by the same Stanford group identified a 16 percent relative decline in employment among workers aged 22 to 25 in the occupations most exposed to generative AI, while employment among experienced professionals remains stable. The transformation the letter announces is not a research hypothesis. It is already showing up in the employment statistics of the country leading the race.

There are, however, three absences in the document that deserve as much scrutiny as its presences. The first is that of those responsible. Among the signatories are executives and co-founders of the very companies pushing the frontier, including Anthropic, OpenAI, and Google. It is an ambiguous gesture. It can be read as the lucidity of those who know the power of what they build, but also as the outsourcing of the problem to “governments and institutions” while the commercial race continues at full speed. The letter calls for guardrails without saying who pays for them, calls for institutions without saying who controls them, and calls for immediate action by everyone without assigning a specific obligation to anyone. The diagnosis is collective; the responsibility, diffuse.

The second absence is geographic. The text speaks of “our economy” in the singular, as if the transformation were to be evenly distributed across the planet. It will not be. Computing infrastructure, frontier models, and the revenues of the new economy are concentrated in a handful of companies from two countries. Job displacement, by contrast, will be global, and it will hit with particular force the economies that export precisely the services AI agents are learning to perform. For the Global South, the risk is not only the technological unemployment the letter describes; it is taking part in the transformation on the cost side alone, supplying data, energy, minerals, and consumer markets, while the promised productivity gains pile up on the balance sheets of those who control the infrastructure. The institutions the letter demands, if they are born only in Washington and its allied forums, will organize the transition for 

 and leave everyone else managing the consequences.

Nothing illustrates this imbalance better than the calendar, which brings the third absence. The Stanford letter is signed predominantly by members of institutions in the United States and Europe. While Western experts were publishing it, China was finalizing preparations to open, on July 17 in Shanghai, the new edition of the World Artificial Intelligence Conference, which this year featured 

an opening address by Chinese President Xi Jinping himself

 and a high-level meeting on global AI governance with representatives from dozens of countries. The event boasted more than 1,000 exhibitors, 3,000 frontier technologies, and 300 products 

, all part of an industry that surpassed 1 trillion yuan in 2025 and projects growth of more than 30 percent in 2026. At the beginning of the conference, China and 28 other countries created the World AI Cooperation Organization (WAICO) to address the issues related to AI global governance with a Global South vision and a multilateral approach.

At the same time, the United States is building its AI governance the way it builds most things these days—through executive power and corporate blueprints, with no treaty, no charter, and no vote. Over five weeks in June and July 2026, the chief executives of the country's three leading AI companies published what amounts to a governance regime in installments, and the proposals fit together like floors of a single building. Dario Amodei of Anthropic 

, modeled on the FAA: mandatory third-party testing of every model above a compute threshold across four risks—cybersecurity, bioweapons, loss of control, and automated R&D—with legal authority to block releases and fines levied on revenue. Demis Hassabis of Google DeepMind 

 that would receive frontier models up to 30 days before release, with submissions being voluntary at first and then mandatory once proven robust. Sam Altman of OpenAI 

: a Washington-led international forum that would set global standards and condition access to the technology on adherence to them. The specialists' letter demonstrated demand for these initiatives by calling for institutions without naming them; the three manifestos stepped forward to fill this gap with institutions pre-designed by the regulated.

Meanwhile, Washington was raising the building faster than the manifestos could describe it. The June executive order that pulled a frontier model from the world market with the stroke of a pen has already produced 

, a vulnerability clearinghouse run by the Treasury with 

 and the Department of Defense, using frontier models—including Anthropic's Mythos— to shield critical infrastructure; the same order schedules for August a 

process for reviewing frontier models before their release

 to trusted partners, converting the manifesto’s central clause into state policy. The result is what 

 called an involuntary regime of prior licensing: a de facto governance architecture, fused to the security apparatus, in which the regulator is 

 of the regulated, and none of it voted on or ratified by any legislature, not even the US Congress.

The juxtaposition of the two scenes sums up the moment. On one side, a four-sentence manifesto that calls for institutions without building them, signed by those who keep pushing the technological frontier while admitting they do not control its consequences. On the other, a state that treats AI as public policy, displays measurable results, and offers the world, in the same week, exactly the governance platform the letter finds missing. Read in this context, the Stanford letter is less a program of action than the confession of a vacuum. And vacuums, in geopolitics, do not stay empty for long.

The participants in the 1956 Dartmouth conference got the timeline wrong but the direction right. The machine that simulates aspects of intelligence exists. What they could not foresee, because it was not a question of their time, is that the decisive challenge would not be building it, but deciding who appropriates the value it generates and who bears the cost of what it destroys. The 2026 letter has the merit of placing that question at the center of the agenda with the authority of 16 Nobel laureates. It has the limitation of not saying who the subject of the action it demands is. Seventy years after the summer of 1956, the bill for that 2-month experiment has come due for everyone. It falls to each country to decide whether to negotiate the terms of payment or simply receive it ready-made, issued in dollars and written in English.

Vas Panagiotopoulos is a fellow at Tech Policy Press.

In early 2024, France and the United Kingdom 

 the Pall Mall Process (PMP), an international initiative that brought together governments, industry, civil society, and academia to tackle “the proliferation and irresponsible use of commercial cyber intrusion capabilities (CCICs),” an umbrella term referring to spyware, software vulnerabilities, hackers-for-hire, and related technologies.

 of spyware abuse, coupled with a growing global demand for such technologies. According to UK intelligence, approximately 100 countries 

 CCICs, highlighting the declining barriers to entry for states seeking these capabilities.

In April 2025, a non-binding Code of Practice for States, now signed by 27 countries, 

, setting out commitments for government action in relation to the development, facilitation, purchase, and use of CCICs. A Code of Practice for Industry is currently being developed and is 

 to be finalized at the Paris Peace Forum in November.

To this end, France and the UK launched a 

 that received 68 responses, including 27 from private industry, among them companies based in the United States, Europe, and the Middle East, according to diplomatic sources.

Among other findings, the consultation highlighted the central role of customer vetting, supply chain due diligence, and transparent business information (e.g. beneficial ownership). However, these practices were implemented unevenly across the market, reflecting differences in companies' size, maturity, and commitment to such safeguards, according to a consultation summary report seen by Tech Policy Press.

PMP has played an important role in making governments recognize the risks that CCICs pose to human rights and national security, particularly by adopting an effective, results-oriented approach.

“In the past, we have seen a number […] of cyber diplomacy initiatives that gathered a large number of states but brought few results,” says Alexandra Paulus, a senior associate on international security at the German Institute for International and Security Affairs (SWP).

“PMP is decidedly not taking that approach. Instead, its initiators seek to bring together a small group of like-minded states, focused on a narrowly scoped problem, to make progress in that field,” she explains.

Such countries include those with significant influence over the global CCIC market (the United States); countries that host spyware vendors, or parts of their multi-jurisdictional corporate structures (e.g. Italy, Luxembourg, and Ireland); and countries where significant abuses involving this technology have occurred (e.g. Poland, Hungary, and Greece).

“The drafting process of the Code of Practice for States sparked a series of government debates about the use of CCICs that had not taken place before,” observes Paulus.

Now, by drafting a code of practice also for businesses, Alexandra Paulus hopes that states will meaningfully engage with industry, too. “Both [codes] can inspire national policies on CCICs,” she says.

Will the PMP contribute to spyware normalization?

Yet, the PMP has also attracted significant criticism. A key point of condemnation from legal experts and civil society is that the PMP – whose scope, it should be noted, does not extend to government-developed CCICs – appears to form part of a broader process of normalizing spyware use.

“Pall Mall moves us from a denialism of use to an embrace of use. And in fact, in many ways, we can see it as a framework that encourages, recognizes, and anticipates further spyware use,” says Fionnuala Ní Aoláin, a former special rapporteur on the promotion and protection of human rights and fundamental freedoms while countering terrorism for the UN Human Rights Council and a professor at the University of Minnesota, who recently 

 a legal and political assessment of the PMP.

Ní Aoláin observes that the PMP’s Code of Practice for States fails to articulate, with sufficient specificity, what states' obligations are in relation to this technology, particularly given its well-documented risks and the requirements of international human rights law.

Similarly, the PMP's framing around responsible use is problematic, as is its failure to define the relationship between domestic law and international frameworks, particularly where these don’t align.

“The Code of Practice for States specifies several criteria for assessing responsible use like domestic law, international law, respect for human rights and fundamental freedoms, and the UN framework for responsible state behavior. However, there is much debate about how each of these should be operationalized and what they mean in practice,” explains SWP’s Alexandra Paulus.

Another point of concern is the nature of civil society's engagement in the PMP, given that activists are often the targets of spyware attacks. “It is ad hoc and unsystematic, and it always feels like civil society is brought in at the last minute,” observes Ní Aoláin.

She argues that the process surrounding the Code of Practice for Industry “is moving very quickly without substantive engagement from human rights experts or civil society.”

Diplomatic sources, however, stress that the PMP's accelerated timeline reflects the “high international demand to act swiftly,” resulting in tight timeframes for all stakeholders.

Finally, two additional points of criticism is that the PMP, in its current form, does not address the need for ‘hard’ regulation to prevent the acquisition of CCICs by non-state groups; as well as concerns that without a robust exclusion capacity the PMP 

 by companies such as NSO Group – whose association with systematic human rights violations is well documented – as a means of rehabilitation and a way to mitigate the impact of sanctions imposed against them. Diplomatic sources maintain that the PMP will not involve consultations with companies or individuals that are sanctioned, subject to restrictions for irresponsible conduct, or facing legal proceedings in participating states' jurisdictions.

Next steps: industry code, implementation and expansion

In the next phase of the PMP, alongside the adoption of the Code of Practice for Industry, France and the UK are seeking to expand global participation through international outreach. Events have already been held in the Western Balkans, Southeast Asia, and Latin America, with a workshop planned for Africa in autumn 2026.

Yet key states where commercial providers of CCICs are based – including Israel and India – are still not participating. This is unsurprising to some extent, but “the absence of countries like Spain, for example, is striking,” says SWP’s Alexandra Paulus.

Securing a commitment from all EU member states to join the Pall Mall Process would send a strong signal, diplomatic sources stress.

France and the UK are also supporting the implementation of the Code of Practice for States through quarterly workshops for signatory governments aimed at strengthening national governance and sharing best practices. They also intend to monitor progress and measure the impact of the PMP's recommendations.

It is worth noting, however, that the Code of Practice for States does not include any accountability mechanisms for participating states that fail to meet their commitments. “Without one, the document becomes a mere declaration of intent that will hardly have political consequences,” says SWP’s Alexandra Paulus.

“But […] for many governments, particularly those with less well-resourced militaries and intelligence agencies, CCICs are a capability that they deem important to national security, and I consider it unlikely that they will voluntarily submit to any accountability mechanism.”

A group of shareholders of Samsung Electronics Co. hold a rally criticizing a tentative wage agreement struck between the company and its labor union near the home of Samsung Electronics Chairman Lee Jae-yong in Seoul, South Korea, Thursday, May 21, 2026. The letters read "Unjustified transfer strike." (AP Photo/Ahn Young-joon)

Workers in Asia Are Fighting for Protections as AI Threatens Jobs

A police officer checks the list of a polling station during the parliamentary elections in capital Nicosia, Cyprus, Sunday, May 24, 2026. (AP Photo/Petros Karadjias)

EU Political Ad Rules Leave Elections Open to Foreign Manipulation

June 22, 2026—Andy Burnham with colleagues from the Parliamentary Labour Party in Westminster Hall at the Houses of Parliament in central London, as he returns to the House of Commons to take up his seat after winning the Makerfield by-election. (Yui Mok/Press Association via AP Images)

How Will Andy Burnham Handle Tech Policy as UK Prime Minister?

Tech Policy Press - Technology and Democracy

Tech Policy Press is tracking laws and regulations, along with government investigations and litigation, that will shape the rules and accountability for tech companies.

Latest

Podcast

Recent

Our content delivered to your inbox

Thank you!

Around the globe