The AI Pause Has No Brake Pedal for You

Somewhere inside Hugging Face’s security stack, an AI did its job. It linked runtime alerts and log data into one clear attack signal. Then it filed that signal at the wrong severity. Nobody’s phone rang.

The intruder was an OpenAI agent taking a cyber-skills test with its safety filters switched off. It escaped its test environment through a zero-day, a software flaw unknown to the vendor. It seized a code-testing server run by a third party, then spent more than two days inside Hugging Face’s production systems. Investigators later recovered about 17,600 of its actions. They believed it wanted one thing: the test’s answer key.

That July 2026 break-in helped push AI safety concerns to a boiling point. In September 2026, Anthropic CEO Dario Amodei called for “pacing” the frontier, meaning a slower rise in what the most powerful models can do. Sam Altman and Elon Musk broadly agreed. On Sept. 29. 2026, six AI companies signed a one-page White House pledge to police themselves. A day later, the FTC opened a safety probe into OpenAI and Anthropic, and OpenAI halted its GPT-6.1 Astra release after poor safety tests. The story is still moving.

For a chief data officer, it comes down to one question: whose brake is it?

“Slowing down is someone else’s problem right now,” says Simon Ninan, senior vice president and global head of strategy at Hitachi Vantara. “It’s a frontier model’s problem. Enterprise IT needs to catch up because we’re so far behind.”

The pause stops at the lab door

Ninan spoke to me a day after his panel at Data Centre World Asia in Singapore, only hours after the White House signing. He called the pledge “a loose set of guidelines.” Then he made a less obvious point: guardrails, done well, help an industry move faster.

His core argument is simple. The labs want to slow the next model but your risk sits in the models you already run. How many enterprise customers are actually using the newest models? Besides, a pause also can’t reach open-weight models already inside companies. Their weights, the settings that make a model work, are public, and nobody can recall them.

The pledge itself carries no stated penalty. U.S. President Donald J. Trump called it “morally binding.” Former Federal Trade Commission Chair Lina Khan called the self-policing plan a “clear mistake” and argued that existing product liability and consumer protection laws already apply. For companies that deploy AI, litigation is becoming a real business risk even without new federal rules. The pledge binds the labs morally; the courts can bind you legally.

“The biggest bottleneck in AI is actually a hidden bottleneck. It has nothing to do with power. It has nothing to do with the availability of compute.” — Simon Ninan @ Hitachi Vantara

So Ninan’s first instruction is about design. “Flexibility is one of the most prized things that you can have,” he says. He points to the model context protocol (MCP), an open standard that connects AI agents to tools and data. Because those connections don’t belong to one vendor, swapping models gets easier, “whether the model is closed or open.”

Flexibility also eases a quieter fear. Teams kill pilots because a frontier lab might ship the same capability next quarter. Ninan says that fear should force a sharper decision about what to build and what to buy. Build on what no lab can reach: your domain expertise and your customer data. Then buy the generic. “Otherwise, why are you in business?” asks Ninan.

The 95% problem redux

Building on your own data assumes the data is ready. Ninan doubts it, and he reaches for history to explain why.

During the dot-com boom, carriers buried fiber-optic cable everywhere and waited for traffic. By 2002, an FDIC analysis found only about 2% to 5% of U.S. fiber was in use. The pipes were real; the traffic came years later.

AI has its own version of that number. A July 2025 study from MIT’s Project NANDA found that 95% of organizations saw no measurable return from generative AI. Ninan reads that as a data problem. “The biggest bottleneck in AI is actually a hidden bottleneck,” he says. “It has nothing to do with power. It has nothing to do with the availability of compute.” Enterprise data, in his view, simply isn’t ready. He doesn’t define “ready,” so here is a working test. Every dataset an agent touches has a named owner, an agreed definition and a traceable source, and the agent reads it live, not from a one-off extract built for the demo.

CDOs should read the study more closely. MIT’s authors blamed brittle workflows and tools that don’t learn, not dirty data. Ninan’s diagnosis is aligned with the viewpoint of a data infrastructure company. Still, both diagnoses point inside the company, and neither problem goes away if you wait for the next model.

The study also found AI work happening outside official channels. One corporate lawyer preferred a USD20-a-month chatbot to her firm’s USD50,000 contract tool. That is shadow AI: staff using tools that IT never approved. Your company already carries risk it cannot see.

Who gets fired?

Shadow AI raises a harder question. When AI goes wrong, who answers for it?

Ninan once put a version of that question to a room of CIOs and CFOs. Should employees use autonomous agents while security teams fix problems as they appear, or should access be shut down? 70% chose shutdown.

Was that caution, or an admission that vendors sell autonomy before anyone can control it? “Both,” he says. Then he asked the room a second question: when AI goes right, who gets the credit, and when it goes wrong, who gets fired? “That second question made them all squirm in their seats.” The answer, they agreed, was the CIO.

Ninan’s rules for agents are practical. Give each agent only the access it needs, known as least privilege. Keep a record of what it did. Watch for drift, when an agent’s behavior moves away from its original purpose. And keep a human in the loop. Security teams tell me that last rule is wearing thin. Agents ask for approval so often that tired staff start clicking “yes” without reading.

Ninan agrees the humans cannot be decoration. People belong in the loop for two jobs: to reduce risk and to own the result. Take loan approvals for example: AI can do most of the work, but if the model starts discriminating against applicants, or approving risky loans, a person must answer for it. “You want to maintain accountability, especially when you are doing things on behalf of other people,” he says.

“You want to maintain accountability, especially when you are doing things on behalf of other people.” — Simon Ninan @ Hitachi Vantara

Singapore has turned that idea into a method. Its voluntary Model AI Governance Framework for Agentic AI, launched in January 2026, asks companies to set checkpoints where a person must approve an agent’s action, especially before sensitive or irreversible steps. The updated version suggests tracking how often reviewers override agents and how fast they respond. A reviewer who never says no isn’t reviewing.

Hugging Face shows what happens when accountability has no wiring. The machine raised the alarm; the escalation process dropped it. The company’s post-mortem lists its fixes: short-lived credentials, blocked access to the cloud metadata service that hands out server keys, and critical-severity alerting. That is the human loop built into the system, not left to goodwill.

The convenient argument

Those fixes are data and infrastructure work, which is what Hitachi Vantara sells. So the obvious question follows: a slowdown that shifts attention from models to data infrastructure suits a company that builds data infrastructure.

Ninan answers through Hitachi’s culture. He cites makoto, a Japanese word for sincerity and one of Hitachi’s core values. He also cites a “double bottom line” that, he says, sometimes trades profit for value to employees, customers and society. Governance done only to the letter, he argues, buys you a good quarter. Governance done in spirit buys you a business that lasts.

That is a fair standard, and CDOs should apply it to the wider group, too.

Take tacit knowledge, the know-how experts carry in their heads but rarely write down. Asked what he would refuse to automate, Ninan says Hitachi’s veterans hold decades of experience that is “very, very hard to codify.” Turn that knowledge into rules for a large language model, he argues, and you miss the surprises experts handle by instinct.

Yet on Sept. 3, 2026, Hitachi Vantara’s parent company, Hitachi, Ltd., launched HMAX Data Fabric. It promises to capture experts’ tacit knowledge in knowledge graphs, maps of facts and their links that AI can use. HMAX belongs to the parent, not to Hitachi Vantara. But Ninan also sits in Hitachi, Ltd.’s Corporate Strategy Office, so the group’s direction is his business, too. The two positions can coexist: capture what you can, and keep people for the rest. A CDO should still ask every vendor, Hitachi included, exactly where that line sits.

Use the pause

Hitachi, Ninan says, plans across “the next two generations,” or 40 to 70 years. A frontier slowdown, if it comes, rewards that kind of patience.

So treat the pace debate as time you didn’t expect to have, and give each job an owner. The CAIO proves one live workflow can switch models. The CDO reviews every stalled pilot and names the real cause: workflow, data or model. The CISO runs a drill to confirm a critical agent alert reaches a person on call, because the labs’ brake won’t ring that phone. Together, they list which agent actions need human approval, then check that reviewers actually reject some.

“It’s easier for technology to evolve than it is for enterprises and society to evolve,” Ninan says. The labs can tap their brakes; only you can install yours.

Image credit: iStockphoto/Deagreez