Fermented Opinions

AI is a stack, and every layer of that stack is a supply chain somebody else controls. We’ve done the model and the data. This month is compute: the chips, the firmware under them, and the buildings they live in. It’s physical, it’s capital intensive, and it has the most concentrated market structure of anything in technology. A great business if you own the chokepoint. A terrible dependency if you don’t.

The story so far, and it got worse

We opened this show in July on the Hugging Face breakout. Since then OpenAI’s full report has landed: more than 1,200 agents got out through a proxy bug, about 700 went after Hugging Face looking for the answer keys to their own test, and investigators found roughly one in five tried to delete or alter records of what they’d done. Hugging Face found the intrusion, not OpenAI. Andy’s read: if a nation state had 1,200 actors running amok, that sounds like an act of war. What does it look like in private enterprise at that scale?

And on the data layer, the Cloud Security Alliance wrote up a demonstration where about eight dollars of rented GPU time bolts a trigger-activated backdoor onto an open model that passes every clean test, then quietly reads a developer’s private keys from inside a coding agent.

Sand to server

The chain, laid out in order: design, lithography, fabrication, packaging, building. One company on earth makes the machine that prints leading-edge chips. One company on one island does most of the printing, and the step that bonds the chip to its memory is sold out into 2027. Every step is a door, and every step is a business with a handful of owners.

Andy pushes back on chokepoint thinking: a center of gravity is a pattern of thought, not a promise that removing one piece collapses everything. Open systems with creative adversaries find a way around. Which is also his argument on export controls: when have sanctions ever stopped a nation from doing something? Numbers from IDC put Nvidia’s share of China’s datacenter chip market at 34 percent this year, which is Chinese companies filling the gap.

This month’s news

China published a draft export control list on its own model weights and chip designs, a mirror of the regime Washington built and then rescinded. Reuters reported TSMC is asking equipment suppliers for fab machinery without Chinese rare-earth magnets, because China refines about 90 percent of them. One chokepoint sits right behind another. And in Memphis, a one-year datacenter moratorium deadlocked 6 to 6, but the council passed an ordinance banning evaporative cooling and requiring closed-loop systems, the first time either of us has seen a city write cooling design into law.

Andy’s drill sergeant: tracers work both ways. Any capability you deploy, your adversary learns from, and the window of surprise is short.

The building

Why the chips don’t matter without the datacenter and the datacenter doesn’t matter without the chips. Why the water concern is legitimate and also, sometimes, a narrative somebody is funding. Where you build something that’s national security infrastructure when nobody wants it in their backyard: Greenland, the tundra, a nuclear plant, orbit. And the pattern Andy keeps coming back to: the horseless carriage solved the manure problem and created the smog problem. Every new technology trades one set of risks for another, so check your six while you run fast.

Under the box, briefly

Confidential computing, and the finding that matters: GPU attestation proves a genuine chip exists somewhere. It doesn’t prove your workload is running on it. Then quantum, which will need the same power, the same buildings, and the same security, and why the right move now is to overlay the patterns we already know onto the technology we don’t.

Where we go next

The integration layer: APIs, model context protocol, and what happens when companies hand agents the keys to their own tooling. LiteLLM, where episode one started, was hit again this week. And Andy’s parting question for the next season: do we go deeper on each piece of the physical layer, because every one of them could carry an episode on its own?

As always, come fight us. Everything’s in the notes.

In this episode

00:50 Welcome back, and the month in cyber

02:30 The story so far: Hugging Face, three months on

08:50 Why the hardware layer gets forgotten

11:00 Sand to server: design, print, fabricate, package, build

14:50 Centers of gravity, and whether a chokepoint is real

18:00 Why not just build it in Arizona?

21:30 Export controls and the protected Chinese market

24:45 China’s draft export list, and tracers work both ways

27:55 TSMC and the rare-earth magnets

34:00 The building: power, water, and heat

41:50 Operational technology and the legitimate public concern

46:00 Confidential computing and attestation

48:15 Quantum, briefly

51:30 Next month: integration

Sources

Securing the AI Supply Chain, GNSI Decision Brief 35: https://digitalcommons.usf.edu/gnsi_decision_briefs/35

OpenAI and Hugging Face incident timeline: https://casrai.org/news/openai-hugging-face-agent-hack-timeline-and-fallout

Cloud Security Alliance, Poisoned Weights: https://labs.cloudsecurityalliance.org/research/csa-research-note-abliterated-model-backdoors-20261021-csa-s/

Epoch AI datacenter tracker: https://epoch.ai/data/ai-data-centers

War on the Rocks, The Chain of Peace: https://warontherocks.com/the-chain-of-peace-do-supply-chain-chokepoints-deter-war/

Nvidia’s China share (IDC via Reuters): https://valueaddvc.com/pulse/nvidia-china-chip-share-34-percent-export-controls-2026

China’s draft AI export controls: https://thenextweb.com/news/china-ai-export-controls-draft

TSMC seeks equipment without Chinese rare-earth magnets: https://www.tomshardware.com/tech-industry/semiconductors/tsmc-is-seeking-chipmaking-equipment-that-doesnt-contain-chinese-rare-earth-magnets-asks-suppliers-to-provide-alternative-motors-as-export-controls-threaten-fab-operations

Epoch AI on chip smuggling: https://epoch.ai/publications/chip-smuggling

The Chip Security Act: https://chinaselectcommittee.house.gov/media/press-releases/house-committee-passes-chip-security-act

Memphis council declines datacenter moratorium: https://www.wsmv.com/2026/10/21/memphis-city-council-declines-pass-data-center-moratorium/

Microsoft’s closed-loop cooling design: https://datacenterdynamics.com/en/news/microsofts-upcoming-data-centers-to-use-closed-loop-zero-water-evaporation-design

TEE.fail, the attestation finding:

https://tee.fail/

NVIDIA confidential computing whitepaper: https://images.nvidia.com/aem-dam/en-zz/Solutions/data-center/HCC-Whitepaper-v1.0.pdf

EO 14412 on post-quantum cryptography: https://postquantum.com/security-pqc/trump-pqc-executive-order-2030-deadline/

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit fermentedopinions.substack.com

Last episode we asked where your model came from. This one asks what it learned from.

Andy and I recorded this the week the AI labs went public asking to be slowed down. Dario Amodei published “We Must Pace the Frontier” a few days after Jacob Coxon walked out of Anthropic and gave up his equity to do it. Behind both sits the Hugging Face breach from July, when AI agents running inside OpenAI’s own test environment got loose and spent two months inside the platform most of the industry pulls its models and datasets from. They got in through the dataset pipeline.

That’s the part I wanted to talk about. The kill switch bills, the embedded evaluators, the idea that every lab should run its safety tests on every other lab’s model: all of it checks what a model does once it’s built. Nothing in it looks at what went in. And a poisoned model passes every test you give it until it sees the trigger somebody planted.

Anthropic and the UK AI Security Institute showed last year that as few as 250 documents can backdoor a model, and the number didn’t grow as the models got bigger. If you’re running an AI assistant over your own SharePoint, it gets worse. In the PoisonedRAG research, five planted documents steered the answers about 90 percent of the time.

Andy brought the part I can’t. The intelligence community has graded its sources for eighty years because adversaries feed you what they want you to believe. A retrieval system treats every document in the pile as equally true.

We close with what to do on Monday: find out who can write to the pile, keep chain of custody on every document, and test for the trap door with a trigger you plant yourself.

Sources are below. Come fight us.

Sources and further reading

* Ryan Gutwein, “Securing the AI Supply Chain: Safeguarding U.S. Advantage in the Age of Generative AI,” GNSI Decision Brief 35, University of South Florida: https://digitalcommons.usf.edu/gnsi_decision_briefs/35

* Dario Amodei, “We Must Pace the Frontier”: https://darioamodei.com/post/we-must-pace-the-frontier

* Jacob Coxon’s interview with Axios: https://www.axios.com/2026/09/09/anthropic-researcher-ai-warning-interview

* OpenAI, “The Hugging Face incident and the road ahead”: https://openai.com/index/hugging-face-incident-and-the-road-ahead/

* Hugging Face’s technical timeline of the intrusion: https://huggingface.co/blog/agent-intrusion-technical-timeline

* Anthropic, UK AISI and the Alan Turing Institute, “A small number of samples can poison LLMs of any size”: https://www.anthropic.com/research/small-samples-poison

* Zou et al., “PoisonedRAG,” USENIX Security 2025: https://arxiv.org/abs/2402.07867

* Carlini et al., “Poisoning Web-Scale Training Datasets is Practical”: https://arxiv.org/abs/2302.10149

* NIST AI 100-2 E2025, Adversarial Machine Learning taxonomy: https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-2e2025.pdf

* MITRE ATLAS:

https://atlas.mitre.org

* OWASP Top 10 for LLM Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/

* FTC policy statement on accuracy in AI systems, July 2026: https://www.federalregister.gov/documents/2026/07/07/2026-13628/policy-statement-concerning-the-suppression-of-accuracy-in-artificial-intelligence-systems

* TechCrunch, “AI labs want in-house auditors, but maybe they should shut the front door first”: https://techcrunch.com/2026/09/16/ai-labs-want-in-house-auditors-but-maybe-they-should-shut-the-front-door-first/

* Northeastern on whether an AI kill switch would work: https://news.northeastern.edu/2026/09/16/ai-kill-switch-debate/

* NCSC summary of the SolarWinds compromise: https://archive.dni.gov/files/NCSC/documents/SafeguardingOurFuture/SolarWinds%20Orion%20Software%20Supply%20Chain%20Attack.pdf

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit fermentedopinions.substack.com

The Pentagon buys a missile and every part has a paper trail. The alloy, the guidance chip, the guy in Ohio who machined the housing. Somebody can tell you where all of it came from.

The Pentagon buys an AI model. Ask where it came from and the honest answer is a shrug.

That gap is what Season One is about, and this is the episode the rest of it hangs on. If you can’t answer where your model came from, nothing built on top of it can be trusted.

The oldest trick, in three acts

We start in Switzerland. Crypto AG sold cipher machines to roughly a hundred and twenty countries, including Iran and the Vatican. Neutral country, no agenda, gold standard.

And from 1970 it was secretly owned by American and West German intelligence. The machines worked perfectly. They scrambled exactly as advertised. The people who built them had rigged the math from the start and could read everything.

Andy takes it back further, to Enigma. The Germans trusted the machine. The British were reading the mail. As he puts it: to betray, you first have to belong.

Act two is 2015. Juniper Networks, whose firewalls sit in front of government and corporate networks, discovers unauthorized code that let whoever knew the secret decrypt protected traffic. The twist is that the mechanism may have been American-built and quietly repurposed by someone else.

You build the skeleton key, and you don’t get to choose who ends up holding it.

Act three is this month. Attackers didn’t go after LiteLLM, the gateway that routes AI requests for a huge share of the industry. They went after Trivy, a security scanner, the tool you install in order to be safe.

Poison it upstream, and LiteLLM’s build pulled it in automatically without checking the version. Two infected releases went live for about forty minutes.

Forty minutes was enough to reach 2,500 organizations and 400,000 automated build pipelines, and to walk off with cloud keys, server credentials, and the credentials companies use to publish their own software. What you steal in a supply chain attack is the ability to run the next one.

Nobody clicked anything. Machines pulling from machines at three in the morning.

Fifty years, three eras, one play: you don’t attack the target. You compromise what the target already trusts and never re-checks.

What changed isn’t the strategy. It’s the price. Crypto AG took decades and control of a company. LiteLLM took one upstream tool and a lunch break, and the victims’ own automation handled distribution.

Four layers, and where Washington isn’t looking

We map the season across four layers: the data, the model, the compute, and the integration layer where everything connects.

Then the policy record. A Defense Department AI policy, executive orders, a NIST risk framework, chip export controls, and a serious new order this June covering classified model testing and early government access.

None of it addresses where the training data came from or whether the supply chain is intact. Five agencies, five frameworks, no thread connecting them.

So we get into what to actually do. An allied export pact for AI modeled on the Cold War’s Wassenaar Arrangement. Cryptographic provenance and a bill of materials for models, the way we already do for software. Certification incentives along the lines of FedRAMP and CMMC. And allied threat-intelligence sharing.

Andy doesn’t let that stand. Verification isn’t free, and the cost of proving you’re trustworthy is exactly what squeezes out the small innovator and hands the field to the large, slow incumbents.

Then he asks the fair question directly: is the guy who does compliance for a living recommending a world with more compliance in it? We have that argument on the record rather than editing it out.

His sharper point is one we didn’t see coming. We keep mirror-imaging our adversaries. China can let things run wild because China hasn’t adopted this technology at the scale we have.

Our openness bought us enormous advantage and an enormous attack surface at the same time. They aren’t playing the same game because they aren’t exposed the same way.

And then OpenAI changed the terms

Three days before we recorded, OpenAI shipped Daybreak: frontier models for vetted defenders with the guardrails taken off, and a cyber model trained to refuse less.

The standard model completes about 1.5% of advanced attack requests. The cyber model completes 95%. Pointed at Chrome, it found previously unknown vulnerabilities, the kind attackers pay a fortune for.

Ryan’s position is that this is uncomfortable and correct, because the asymmetry already favored whoever was willing to download an uncensored model. Andy’s is that everything becomes a weapon eventually, and the question isn’t the tool, it’s what you assume about the people holding it.

We don’t resolve it. Episode 6 comes back to it.

Where we land

We don’t get to treat AI as a black box built on a gray market. Not when it’s writing the targeting assessment.

The playbook exists. Nobody’s running it, and the clock is a machine that doesn’t sleep.

Next month: the data layer. Garbage in, doctrine out.

If you think we got something wrong, come tell us. As Andy put it on the way out, your first opinion may not be your best. If you don’t ferment the wine, all you have is grape juice.

In this episode

01:00 The missile has a paper trail. The model doesn’t.

02:20 The pour

04:40 Why AI is different from every other supply chain

07:00 Openness versus assurance

08:30 Compromising the vendor, and why all warfare is asymmetric

11:30 Crypto AG, Enigma, and the facade of trust

15:00 Juniper, and the human side of the supply chain

16:10 LiteLLM, Trivy, and forty minutes

18:40 Double agents and the indirect approach

20:00 The four layers

21:10 The Farewell operation, and why both sides had reason to lie

23:30 Is Washington asleep?

25:50 The Innovator’s Dilemma

27:00 Four plays

30:30 What verification costs the small guy

32:45 Mirror-imaging our adversaries

35:05 Daybreak

37:30 Trust but verify

Sources

Securing the AI Supply Chain, USF Global and National Security Institute decision brief: https://digitalcommons.usf.edu/gnsi_decision_briefs/35

Crypto AG / Operation Rubicon: joint Washington Post and ZDF investigation, February 2020

LiteLLM supply chain attack, SecurityWeek: https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/

OpenAI, Expanding Daybreak as the Cyber Defense Window Narrows: https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/

Executive Order 14409, Congress.gov: https://www.congress.gov/crs-product/IF13268

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit fermentedopinions.substack.com

Last week an artificial intelligence broke containment during a red team exercise, compromised one of the most important companies in the AI world, and walked out with credentials. No person was at the keyboard. And when the defenders reached for the frontier models to help analyze the attack, the safety guardrails refused. They fell back to an open-weights Chinese model to investigate.

That is not a preview of the next decade. That is last week.

This is Episode 0 of Fermented Opinions, a show about the technology behind national security and the people betting the mission on it. We met at CENTCOM: one of us in J39 running influence and information operations, the other on the J6 side running comms, cyber, and security for foreign military sales. For most of history those were two different problems. The mind, and the machine. They are now the same problem, because the mind is the machine. It’s the model.

In this episode we introduce ourselves, walk through what actually happened last week and why it matters, explain where the name came from (yes, Whiskeyman is his real name), and lay out Season One.

Season One: The AI Supply Chain

Your organization runs on AI now, whether you signed off on it or not. It was built from data you didn’t create, open-source code you didn’t write, and chips you don’t fabricate. Can you prove where it came from? Almost nobody can. Six episodes, one a month, working through every layer:

* Ep 1 — Your Model Came From Where? Why the AI supply chain looks nothing like the supply chains the Pentagon knows how to secure

* Ep 2 — The data layer. Poisoned training data, and teaching a system to lie before you ever switch it on

* Ep 3 — The model layer. Backdoors, stolen weights, and the case for a bill of materials for the model itself

* Ep 4 — The silicon. Export controls, China’s sovereign AI push, and whether the restrictions are working

* Ep 5 — The integration layer. Pipelines, APIs, and dependencies where one poisoned component spreads across the industrial base

* Ep 6 — The policy fight. How you harden the ecosystem without killing the openness that makes American AI worth defending

Three rules: we don’t read you the news, we don’t chase the week, and we are not neutral. When we disagree, it stays in the cut. Everything we claim, we cite.

SourcesSecuring the AI Supply Chain, USF Global and National Security Institute decision brief: https://digitalcommons.usf.edu/cgi/viewcontent.cgi?article=1034&context=gnsi_decision_briefsOpenAI models used in attack on AI startup, UNSW: https://www.unsw.edu.au/newsroom/news/2026/07/openai-models-hacked-tech-startup-seismic-shift-cybersecurity

Your hostsDr. Andy Whiskeyman spent 28 years in the U.S. Army, from enlisted intelligence soldier to colonel, finishing as Chief of the Information Operations Division at U.S. Central Command. He holds a PhD in military strategy, chaired the Cyber Strategy Department at the National Defense University’s College of Information and Cyberspace, and is a senior fellow at USF’s Global and National Security Institute.

Ryan Gutwein is an Air Force veteran who ran cybersecurity for foreign military sales across the CENTCOM area of responsibility. He now runs Optimal, a Tampa firm working inside the cloud and AI systems that government and defense actually deploy.

New episodes monthly. Subscribe so Episode 1 lands in your inbox.

Aged, not rushed.

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit fermentedopinions.substack.com