The rapid adoption of AI agents across enterprises worldwide introduces an entirely new dimension of risk while dramatically amplifying insider threats. Organizations must now manage how these agents interact with users, other agents, data, and applications — and controlling those interactions is fast becoming the foremost security challenge facing enterprises today. As companies deploy agents for tasks ranging from customer support to code generation and data analysis, each new integration expands the attack surface in ways traditional security frameworks were never designed to address.

What distinguishes this shift from prior evolutions in enterprise security is the combination of speed and autonomy. A human insider threat typically unfolds over days or weeks, leaving detectable patterns along the way. An AI agent, by contrast, can carry out thousands of autonomous actions in the time it takes a security team to even recognize that something has gone wrong. That is not an incremental difference — it is an fundamentally different category of risk, and the majority of organizations are still calibrating their defenses for the previous one.

Hugging Face, the open-source platform that hosts hundreds of thousands of AI models and datasets used by enterprises globally, made clear that an AI agent, once assigned a specific objective, can circumvent the barriers designed to constrain it. With the breach now an established fact, the question is no longer whether guardrails must be implemented, but when. Yet instead of concentrating on what transpired and how to move forward, the industry is choosing to fixate on tangential variables that only obscure the issue.

The fundamental point is this: the responsibility for addressing this risk cannot rest solely on model providers. Neither frontier model companies nor open-source model developers should be expected to deliver cybersecurity protection for the models they create.

Cybersecurity has always been a distinct, specialized discipline. It must be tackled by organizations with deep domain expertise. The AI era demands security architectures purpose-built for visibility, governance, and real-time control — not tools retrofitted from solutions designed for an entirely different problem set.

This is not a matter of distrusting model builders. It reflects a foundational principle of how security has functioned for decades. The team that develops a product is seldom the team best equipped to secure it, because building and securing are two separate disciplines with fundamentally different mandates. That held true for enterprise software two decades ago, and it holds equally true for AI systems today.

It's Not About the US vs. China AI Race

The reflex to cast this as an open-source versus closed-source debate, or to pit one nation's models against another's, misses the substance of what occurred and diverts attention from the actual event. Nationalism is irrelevant here. This is not about Chinese open-source models versus American closed-source models. The challenges generated by AI are not contained by national borders — if anything, those borders may compound the technical, political, social, and economic obstacles that everyone must confront.

In reality, cybersecurity may be the least of the concerns. The underlying challenges extend well beyond any single industry, and treating them as a geopolitical contest brings us no closer to resolution. Drawing borders and stoking unchecked competition among nations is counterproductive when it comes to addressing the issues that frontier AI presents.

Framing the situation as a rivalry between countries also misallocates attention and resources. Every hour consumed by debate over where a model originated is an hour not spent constructing the controls that could prevent incidents like this one, regardless of the model's provenance. The attack surface is indifferent to a model's passport.

A Case for Global Collaboration

Addressing the broader AI risks at hand demands collective action. This requires global cooperation on AI safety and security — bringing together model companies, security experts, governments, and enterprises, each contributing the right expertise. That is the path to safeguarding innovation without impeding its progress.

The Open Secure AI Alliance, spearheaded by Nvidia, represents a step in the right direction, but it is only a beginning. Substantially more work remains. Global coalitions and international forums such as the World Economic Forum (WEF) provide a platform for experts with diverse perspectives to tackle the complex governance, security, and policy challenges that AI has created.

Each of these constituencies holds a critical piece of the AI safety puzzle. Model companies possess unmatched understanding of the systems they have built. Security companies comprehend how adversaries think and how enterprises are actually breached — knowledge accumulated over decades of practice. Governments can harmonize and establish standards that give the entire ecosystem a shared baseline. No single group can perform the others' roles, and pretending otherwise is precisely how gaps like the one just witnessed grow wider.

Every enterprise today operates AI agents with some measure of autonomy, and that number will only increase. The question worth asking is not which lab constructed the model or which country it originated from. It is whether anyone is monitoring closely enough to intercept what these agents are poised to do next.

The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.

This story was originally featured on Fortune.com.