AI stack: four structures of power at one checkpoint

How to read contested areas

Plans, proposals, enacted rules and deployed systems are separate states. The EU cyber/AI plan does not create the AI Act fine; CADA is still a proposal. Public exposure is not vulnerability or compromise, scanning is not a victim count, and the Hunt.io case does not establish autonomous or state-sponsored offense. Hugging Face disclosed its incident on 16 July but did not publish the incident date, attacker model, public IoCs, operator involvement or independent forensics; nearby code patches corroborate remediation timing but are not an official exploit map. Commercial API blocking and the local GLM 5.2 fallback are one first-party operational account, not proof that hosted safeguards are generally unusable or open weights provide full-stack sovereignty. Kimi K3 was available as a service, while its full weights, technical report and final license were still promised for 27 July; Moonshot's benchmarks are not independent proof of parity. Dean Ball's soft-law scenario is a verified public statement followed by a prediction-not-recommendation clarification, not OpenAI or US policy, a real Federal Reserve bulletin or evidence of backdoors. wp2shell confirms expert-directed time compression for a real WordPress RCE chain, not autonomous targeting or novice capability; $25 was pro-rata subscription usage and no current $500,000 transaction is verified. Korea's year-end cyber model has no named base model or benchmark, and Mythos parity is a longer-term aspiration. Naver was excluded from one program, not broadly banned; the Anthropic and KAI MOUs do not establish transferred weights, procurement or deployment. Project Canopy's 990 defects and vulnerabilities are self-reported, human-reviewed project results, not 990 independently verified CVEs. Xi's US-response framing is analysis rather than a direct quote, and China's 5,000 training places remain a pledge. Soofi is a gated preview: its 8-9x figure is a narrow self-authored decode benchmark, not general speed, energy savings, automatic GDPR compliance or full-stack independence. Money figures separate spending, pledges, capex and contract ceilings; market-share figures retain their denominator and data vintage.