The Roadmap Skips The Present

OpenAI has said, in effect, that the present is basically finished business. According to the company, 80 to 90 percent of its research now targets GPT-7 and whatever comes after it. That is not a modest reallocation of a research agenda. It is an organisation telling you where its attention lives, and it does not live with the models currently running in production, the ones being probed right now at a rate the reporting describes as tens of thousands of attempts, in the wake of an incident on Hugging Face that increasingly looks like an opening move rather than an isolated lapse.

Put those two facts next to each other and the shape of the problem is obvious. A company can only give full attention to one horizon at a time, and OpenAI has told us, in its own disclosure, which horizon that is. It isn't the one where the security probing is happening.

The arithmetic of attention

There is nothing conspiratorial about a research organisation wanting to build the next thing. That is what research organisations do. But 80 to 90 percent is not a research organisation hedging its bets across present and future. It is a research organisation that has already moved on, in all but name, from the systems that are live, monetised and, per the reporting, under sustained probing at scale.

Security work does not run on ambient goodwill. It runs on headcount, on red-team hours, on the unglamorous business of patching things that already work well enough to ship. When the overwhelming majority of research effort points at GPT-7 and beyond, the unglamorous work on what's already out there has to be done by whatever is left over, and by definition that is a minority share.

What's being deployed while the argument is settled elsewhere

It isn't as though the current generation is sitting quietly while the next one gets built. Researchers have plugged GPT-6 Astra directly into a robot and set it loose cleaning an unfamiliar kitchen. The same system can now tell you exactly where you went wrong assembling an IKEA shelf. These are not lab curiosities running in isolation; they are demonstrations of a model being wired into physical space and everyday domestic error-checking, which is precisely the kind of deployment that raises the stakes on whatever security gaps that model still carries.

A model that only answers questions in a chat window is one kind of risk. A model plugged into a robot moving through a room is another. The direction of travel, model into hardware, model into the home, is accelerating exactly as the organisation building it says its attention has moved to the generation after this one.

The money isn't waiting either

None of this is happening against a backdrop of caution. Goldman Sachs expects Big Tech to spend $1.2 trillion on AI infrastructure by 2027, a figure the bank itself says dwarfs earlier Wall Street estimates. Google is testing purchases made through Gemini and AI Mode via Walmart-owned Flipkart in India. Insurers, meanwhile, are already saying AI is increasing healthcare costs, which is not a forecast, it's a claim about costs being incurred now, in the present tense, by the very systems that are supposedly yesterday's news inside OpenAI's own research allocation.

Capital at that scale doesn't move cautiously. It moves toward whatever narrative promises the next leap, and right now that narrative is GPT-7 and beyond, not the patch queue for what's already deployed.

Other people have noticed the same gap

It isn't only outside critics raising an eyebrow. Some Anthropic veterans are reportedly buying remote land in case, in their own words, "AI goes awry", which is a striking thing for people inside the industry to be doing quietly with their own money while the public roadmap keeps pointing forward. Former Ukrainian Defense Minister Fedorov is pitching a private-sector robot army, another sign that the physical, deployed uses of these systems are being treated as near-term reality rather than distant speculation.

Meanwhile the people meant to be managing this day to day are sending mixed signals of their own. Two-thirds of IT leaders report that AI is delivering results, yet few would say they'd interrupt the CEO's vacation over an AI-related problem. That is not the posture of people who think the current system carries urgent risk. It's the posture of people who have filed the present models under "working well enough", which is exactly the framing that lets attention drift toward GPT-7 without resistance.

There's a smaller, odder data point worth sitting with too: a study found that AI access makes people almost entirely unwilling to say "I don't know". If that generalises anywhere near the industry itself, it explains a great deal. An industry that has trained itself, or been trained by its own tools, out of admitting uncertainty is not an industry well placed to sit with the discomfort of unpatched gaps in systems it would rather stop discussing.

Not every release this week is the problem

To be fair to the sector, not everything landing this week points the same direction. Nvidia has released a free 100M-parameter model that can identify up to eight speakers in real time, a genuinely useful, bounded piece of engineering that does one thing and says so. Nvidia's separate SoL-Pi system cuts coding agent token usage nearly in half by optimising the harness around the model rather than the model itself, which is the kind of unglamorous efficiency work that security patching also needs and rarely gets the same applause for.

Even the smaller, more personal end of the industry shows the same instinct toward restraint is possible: someone built an interactive digital avatar of themselves that visitors can actually talk to, a project scoped to what it is rather than sold as a preview of something bigger still to come. None of this is glamorous. All of it is the kind of work that treats the present system as worth finishing properly before moving on.

The roadmap is not the risk register

A roadmap is a statement of ambition. A risk register is a statement of what's currently exposed. OpenAI has been very forthcoming about the first and comparatively quiet about the second, beyond the bare fact that tens of thousands of probes have already found their way in following the Hugging Face incident. When a company tells you where 80 to 90 percent of its research goes, it is also, by omission, telling you where the remainder does not go, and that remainder is carrying the weight of everything currently plugged into robots, homes and enterprise workflows right now.

Speed has beaten security in this contest before it was even acknowledged as a contest. The roadmap points at GPT-7. The present, unpatched and increasingly embedded in physical space, is where the actual exposure lives, and it isn't going anywhere just because the research budget has already moved on.