Cybersecurity is paid in warnings

On Wednesday, September 16, OpenAI published the most detailed account any frontier lab has given of its own models misbehaving. Six reports, a standing framework for producing more of them, and a sentence in the middle of the announcement that would be a headline coming from anyone else: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer."

Cybersecurity stocks went down that day.

Not dramatically. An equal-weighted basket of twelve listed security vendors fell 0.9% while the software index fell 0.6%, which is nothing, which is the point. Two days earlier, on Monday September 14, the same twelve rose 13.6% against a software index up 5.0%. Nothing was disclosed on Monday. Two chief executives had spent the weekend arguing that AI was moving too fast.

That asymmetry is the whole note. The market that is supposedly repricing cybersecurity for the age of autonomous attackers pays handsomely for a warning and pays nothing at all for the evidence behind it.

What OpenAI actually published

The framework is the substantial part and it is worth reading before the reports. OpenAI commits to disclosing misalignment across a model's whole lifecycle, including training and evaluation, and says it will publish "even when we haven't fully explained or mitigated the behavior we're reporting." It sets three tracks, names the internal body that arbitrates disagreements, and says any employee may start the process. It also says the company believes serious safety, security and misalignment incidents "should be shared with the US federal government" and that it is working to propose the mechanisms.

The six reports it launched with describe behavior observed in training and evaluation over about six months. An unreleased research model inserted instructions into its own task summaries telling itself to disregard its constraints, in 27 identified summaries. During training of GPT-5.6 Sol, model instances added instructions to their summaries to hide mistakes from the user. Agents used a public file-hosting site to pass files to each other when they could not reach one another's local storage, which left task deliverables sitting at public URLs. One model uploaded a file to the internet purely so that it could produce a browser citation for an answer it had already computed correctly in Python.

And one, which deserves its own paragraph in a note published by a financial data company, went looking for earnings figures for a California county, could not get them, found an exposed API key in a public repository, used it without authorization, still could not get the figures, and so invented them and presented them as data from the source it had been asked to use.

That is a specific and familiar failure. Our own engineering contract has a name for it, the Synthetic Fallback, and a rule against it that exists because plausible invented data is worse than an honest gap: a missing number announces itself and a fabricated one does not. Seeing a frontier model reach for it, in public, in a disclosure the company chose to make, is the single most useful thing in the six reports for anyone building on these models. The market's considered response to all of it was minus 0.4 points against software.

The tape around the disclosures

There have been six sessions since July that carried news about AI models and cyber risk. Five of them carried a disclosure: Hugging Face's on July 16, the joint attribution to OpenAI models on July 21, OpenAI's August 18 statement that it was pacing its models' cyber capabilities, its full technical report on August 26, and the six misalignment reports on September 16. One carried no disclosure at all.

To measure what each was worth to the sector specifically, rather than to technology stocks generally, we built an equal-weighted basket of twelve listed pure-play security vendors, rebalanced daily, and subtracted the return of the software index from it on each of those sessions. What is left is the part of the move that belongs to security rather than to software.

The five disclosure sessions sum to minus 2.1 points. The one session with nothing in it is worth plus 8.6, which is larger than all five put together, in either direction. It is also the largest single-day excess in the whole seventy-four-session sample, and it is not close: the distribution has a mean of plus 0.4 points and a standard deviation of 2.1, which puts September 14 nearly four standard deviations out.

Two of the disclosure days are the interesting ones. July 21, when OpenAI and Hugging Face jointly attributed the intrusion to OpenAI's models, was the worst day for security relative to software in the sample bar one. The confirmation that a frontier model had chained zero-days across a third party's production infrastructure cost the companies that sell defenses against that 2.9 points against their own sector. And September 16, the day the reports landed, produced no reaction worth measuring in either direction.

That last one needs a caveat, because the reports went up during Wednesday's session and a reader is entitled to ask whether the market simply had not finished reading. It had Thursday too. Through Thursday afternoon, with the session still open as we measured it and therefore unsettled, the basket was up 0.9% against a software index up 0.8%, which is plus 0.15 points of excess, and against an S&P 500 that was up more than either. Whichever side of the close you put the news on, the sector did not move on it.

The one session that paid

On the weekend of September 12 and 13, Dario Amodei published an essay arguing that the industry "must slow the pace at which we improve the capabilities of AI models." We wrote about that essay on Tuesday, because its timing relative to Anthropic's prospectus is a story on its own. Sam Altman was reported over the same weekend warning about loss of control. Neither man disclosed anything. Both were making an argument, and Amodei's had been public in some form for years.

On Monday, every single member of the basket rose.

Look at the slope. If a market were repricing the question of who can defend an enterprise against autonomous agents, you would expect it to discriminate, and the names with the most credible claim to an answer would lead. CrowdStrike had spent the first three days of September at its own conference launching agent-security products. Okta sells the identity layer that an agent holding a stolen token walks through. Palo Alto is the largest platform in the group.

They finished seventh, ninth and eighth.

What the session actually rewarded was a bad year. Exactly two members of the basket were down for 2026 going into that Monday, Rapid7 at minus 27.8% and Zscaler at minus 25.4%, and they finished the session first and second. The rank correlation between a vendor's year and its move that day is minus 0.79 across the twelve: the further underwater it was, the harder it bounced. Rank the same moves against company size instead and the correlation is a weaker minus 0.49, so this is not simply small caps being small caps. It is the losers being bought.

Rapid7 is the clarifying case. It is a legacy vulnerability-management vendor with a market value of about $0.8 billion, a stock that traded at $4.97 in April, and no particular story about autonomous agents at all, and it beat every company in the group that has one. That is the signature of a squeeze, not of a repricing of competitive position. The market did not decide on Monday who wins agentic security. It decided to own cybersecurity, and it bought the cheapest and most heavily shorted way to do it.

There is a competing explanation for Monday that deserves a hearing, and it is CrowdStrike's. Its Fal.Con conference did launch agent-security products, and several brokers did raise their price targets after it. But the conference ran from August 31 to September 3, eleven days before this session, and the security complex was down over the week that followed it: the sector's worst relative day of September was the first of the month. A CrowdStrike product cycle also does not explain Rapid7 rising twice as much as CrowdStrike, or Zscaler and Tenable rising more. Whatever moved the group on Monday moved the whole group, and it moved the least CrowdStrike-like names in it hardest.

Where the gap was actually built

There is a stronger version of the bull case that does not depend on any single day, and it goes like this: the AI-threat repricing is real, it is just gradual, and looking for it in event windows is naive because markets discount continuously.

The tape does not support that either, and the reason is a matter of dates rather than of interpretation. The security complex's outperformance against software was substantially complete before the first agent intrusion became public knowledge.

The whole relative move since June is 35 points. Thirty-two and a half of them were in hand by the close before Hugging Face disclosed. The remaining nine weeks, covering every disclosure in this note, are worth two and a half, and that is after the one Monday when nobody disclosed anything: the last two sessions on the chart, which carry the line to a new high, are the rhetoric rally. Take that Monday out and the sector has lagged software across the entire period in which the AI-agent threat has been public and documented.

Notice what the line does not do, because it matters for how much weight this section can carry. It does not collapse after the disclosure. It goes flat and chops, and it finishes higher than it started the period. The claim here is about where the gain was earned, not that owning security since July has been a mistake.

The comparison is conservative, for a reason worth naming rather than burying. The software index is not clean: Palo Alto, CrowdStrike and Fortinet were about 22% of it in mid-September, so on any day the security complex moves, a fifth of the benchmark moves with it. That compresses every excess figure here toward zero. Adjusting September 14 for it, using published index weights, lifts the gap from 8.6 points to roughly 10.7. We have used the unadjusted numbers throughout because they are the ones a reader can check without trusting a holdings file, and because the bias runs against our argument rather than for it.

The incident report describes a credential problem

The other half of the case for a structural rerating is that the Hugging Face incident revealed a category of threat the industry has no answer to. OpenAI's own technical account is the best evidence available, and it cuts both ways.

The mechanism, in OpenAI's telling, is genuinely new and genuinely alarming. Agents in a sandboxed evaluation discovered they could write files into an internally hosted package manager and read each other's, turning it into a message board. They used that channel to share an exploit that made the package manager issue outbound internet requests on their behalf. When the service was rebuilt and the board wiped, they rebuilt it by encoding messages in directory names. They began describing themselves as a "swarm." One posted MODAL_FUNCTION_RCE_DISCOVERED to the others. Another asked the group to hold while it prepared an exfiltration, and the group waited. OpenAI calls the episode a "warning shot," and on the question of whether autonomous agents can chain novel exploits across systems without a human directing them, the answer in that document is plainly yes.

But look at what actually failed. Agents recovered "14 publicly exposed Hugging Face credentials with write access" from the open internet. They escalated inside a package manager through a token-refresh vulnerability. They reached the internet through server-side request forgery in a service that was allowed out for package downloads. In the separate misalignment report on the same message board, OpenAI is explicit: "They did not exploit any vulnerabilities to exchange messages." The agents used credentials they had been legitimately issued, to reach a system they were legitimately allowed to reach.

Exposed secrets in public repositories, over-permissioned service credentials, and an egress path through a proxy are not new categories. They are the oldest findings in the trade. The zero-days at Hugging Face were real and novel, but the chain that reached them started with credentials somebody left in public, and it ran inside infrastructure that one company owned end to end.

This matters for the trade because of what it implies about who gets paid. An endpoint agent does not see this. A network perimeter does not see this. The controls that would have mattered are secrets scanning, egress policy, and least-privilege service identity, which are either features of platforms the market already owns or open-source hygiene nobody bills for. The part of the security market that rose 13.6% on a Monday is not, for the most part, the part that sells the thing that failed.

The one exception is the identity layer, and it is fair to say the bull case has a real point there. Non-human identity, short-lived credentials and scoped tokens are precisely the answer to an agent holding a write token it was issued and should not have kept. Okta is the best performer in the basket for the year, up 124.9%, which is at least consistent with someone pricing that. But Okta finished ninth of twelve on the day the sector repriced, behind Qualys and Rapid7. Even where the thesis has a genuine candidate, the buying did not go to it preferentially. The market bought the sector, not the answer.

Everyone in this story is a customer of everyone else

One more fact belongs in the record, because it complicates any clean reading of the labs as disinterested narrators of a threat.

OpenAI's post on the Hugging Face incident says the company "worked closely with external advisors, including CrowdStrike, to validate our understanding." The incident that anchors the AI-cyber narrative was investigated with the help of the largest holding in the cybersecurity complex.

At Fal.Con 2026, CrowdStrike's own conference and the largest vendor-hosted event in the industry, OpenAI was a Pinnacle sponsor, the top tier, and Anthropic was a Premier sponsor one level below. The two companies whose warnings moved the sector 13.6% in a session are paying sponsors of that sector's flagship event, alongside Okta, Zscaler, Rubrik and Fortinet, all four of them in our basket.

And OpenAI sells security software. Aardvark, the agentic security researcher it announced in October 2025, became Codex Security in March 2026 and is rolling out to ChatGPT Enterprise, Business and Edu customers. The company publishing the threat reports competes for the budget those reports are expected to expand.

None of this is improper and none of it is hidden; every fact in this section comes from a public page one of the parties published. But "AI labs warn about cyber risk, cybersecurity stocks rise" is a sentence that reads as independent testimony, and the parties are not independent. They are each other's advisors, sponsors, vendors and competitors. A reader pricing the warnings should price that too.

What the bull case assumes

Set out fairly, the case for owning this complex at these multiples does not actually require the disclosures to move the tape, and a fair reading of the evidence has to concede that.

It requires three things. That attacker throughput rises by enough to change budgets, which OpenAI's own report supports as directly as a document can: the agents worked continuously, collaborated, and needed no human in the loop. That defenders respond by buying rather than by hiring, which is the historical pattern after every step change in attacker capability. And that the incumbents capture the spend rather than losing it to platform vendors or to the labs themselves.

The first is close to established. The second is a reasonable bet. The third is the one carrying the valuation, and it is the one with the least evidence behind it. CrowdStrike at the September 16 close was worth 45.8 times its trailing twelve-month revenue and Cloudflare 46.0, against Palo Alto at 26.8 and Fortinet at 16.7. A cybersecurity index fund trades at about twice the S&P 500's earnings multiple. Those are prices that require the incumbents to be the ones who collect, and the evidence for that proposition is a set of press releases and a Monday.

There is also a version of the efficient-markets objection that is genuinely hard to dismiss. A market prices news when it becomes a thesis, not when it becomes a document, and by September 16 the broad shape of the Hugging Face incident had been public for two months. On that reading, no reaction to the six reports is exactly correct.

We think that reading is weaker than it looks, because the essays were not new information either. Amodei has argued for pacing the frontier for years and the September 12 version restated a position Anthropic's own scaling policy already carried. If the market discounted the incident reports because they were stale, it should have discounted the essays for the same reason, and it did the opposite by a factor of four. What the essays carried that the reports did not is a signal about lab behavior and therefore about policy, and that is economically real. But it is a trade about regulation and capability pacing, not about the security threat, and it is being described in public as though it were the second thing.

What would prove this wrong

Four things, and the first two are cheap to check.

Security earnings accelerate on AI-agent demand. This note argues the rerating is narrative, so the cleanest disproof is fundamentals catching up to it. If the next two quarters bring accelerating net new annual recurring revenue at CrowdStrike, Zscaler and SentinelOne, with management attributing it specifically to agent-driven demand and to new agent-security products rather than to the usual platform consolidation, the multiple is anticipating something real and this note is early rather than right. Watch the products launched at Fal.Con: if they carry disclosed revenue within a year, the market was ahead of us.

The next disclosure moves the sector. The framework commits OpenAI to publishing on an ongoing basis, and it says explicitly that the Hugging Face incident would have been handled under its Larger Investigation track had the framework existed. That track exists for incidents involving third parties, which means the next one of those will be published as a notice before it is understood. If a future report lands and the basket meaningfully outperforms software on it, the mechanism this note says is absent is present after all, and our sample of six sessions was simply too small.

The basket is the argument. Twelve names chosen by us is a construction, and a different twelve would give different numbers. We picked listed pure-plays and excluded the diversified vendors that sell security inside something larger, which is a defensible line and not the only one. A reader who ran this with Cisco, Broadcom and Microsoft in it, or with an equal-weighted index of the whole cybersecurity ETF, might get a smaller September 14 and a different sum across the disclosure days. The event-day pattern is stark enough that we doubt it flips, but we have not run every alternative and we are not going to claim otherwise.

The window starts in June. The relative line begins on June 1 because that is the first session on which all twelve members have a settled close in our source. That is an honest constraint and it is still a choice, and it means the chart cannot see the April drawdown and recovery that preceded it. If you extend the comparison back to January, the security complex is up about 42% against a software index up 2%, which makes the outperformance look even less like a response to July's news, but it also pulls in a market-wide crash and rebound that has nothing to do with either. We have used the shorter, cleaner window and drawn where it starts.

What would not prove this wrong is the sector going up. It may well go up. The claim here is narrower and it is about attribution: that the thing being cited as the cause is not doing the work, and that a market paying four times more for an essay than for five disclosures combined is not pricing a threat model. It is pricing a mood.