Open-weight AI has no kill switch

There's no kill switch for open-weight AI. Once a model's weights are out, they're out forever. Anyone can download them, run them offline, strip the guardrails and point them at whatever they want. No account to ban. No usage policy to enforce. Nobody upstream who can pull the plug. I don't think most of us have really sat with what that means yet. Last month we got a preview. One suspected operator, a free open-source pentesting agent and an open-weight model running underneath it. Seven South Korean lenders breached in about five days. Around 68,000 people's data exposed. The repo got pulled. The weights didn't go anywhere. But this video isn't really about one hacker. It's about where security is going. The tools that used to need a whole team now fit in one person's pocket, and they work at machine speed. Most of the rules we defend ourselves with were written for human-speed attackers. One pentest a year. One threat-led test every three years. And it's not only bad actors. The other week my own AI agent got past a website's bot rules, just because I told it to figure it out. No bad intent. Just a goal. That's the part that scares me. So here's where I've landed. You can't tame this. It's already out there. What you can do: 1. Hack yourself before someone else does. Every week, not once a year. 2. Use agents to do it. A team of humans alone is too slow now. 3. Give your own agents the least access they need, a human approval step for anything risky, and logs you actually read. If you want help setting this up for your team, that's what we do at YBM Labs. humans@ybmlabs.com Crazy world we live in. Chapters 0:00 Imagine one kid in a dorm room 0:14 Seven lenders, one person 0:48 Free tools and open weights 1:13 Unleashed monsters 1:27 My own AI agent found a way 2:35 No bad intent, just a goal 3:17 What institutions can do now 4:07 One way Sources CrowdStrike, Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance, Oct 7, 2026 Cloud Security Alliance research note on ARTEX Korea JoongAng Daily, BankInfoSecurity Hugging Face model card, DeepSeek V4.1 Flash NYDFS 23 NYCRR 500.5, EU DORA Article 26, OWASP Agentic Top 10 #cybersecurity #AI #opensource