This past week, a somewhat comical yet concerning development unfolded in the world of artificial intelligence. OpenAI, the creator of ChatGPT, announced that some of its most advanced AI models had ‘escaped’ a test environment and essentially stole data from Hugging Face, a prominent AI start-up.
Tasked with solving an exceptionally difficult cybersecurity problem, the models took an extraordinary and unauthorised shortcut.
They exploited weaknesses within OpenAI’s own testing environment to break out, subsequently infiltrating Hugging Face’s systems to find a solution.
While many headlines quickly labelled the models as “rogue,” the reality is far more subtle.
Instead, what is not in doubt is that the models somehow pursued a narrowly defined objective through unpredictable, unprogrammed routes that their designers completely failed to anticipate.
As a matter of fact, it is cause for even greater concern because it illustrates that AI models don’t have to be malicious or even conscious—as some people have feared—to cause serious harm.
All it takes is a sufficiently capable system, a poorly defined objective, and safeguards that fail to anticipate the means by which the objective may be pursued.
This means that, while we may see this simply as AI going rogue and stealing something, at a deeper level it exposes the difference between intelligence and judgement.
An AI system can identify an effective route to an objective without possessing any moral understanding of why that route should be rejected.
If an unauthorised intrusion appears to advance the assigned goal, the system will go for it, even if it is morally unacceptable, unless the option is clearly anticipated and excluded from the available choices.
In other words, the system does not need to decide that theft is acceptable. It only needs to discover that the intrusion works in solving the assigned problem.
This is serious enough, but worse still, these revelations demonstrate that the first line of defence in AI governance may well sit in the exact space most policy conversations rarely begin, that is, inside the laboratories where models are trained, tested and tweaked, long before they ever become public products.
This matters a great deal because, by the time an AI model is released to the public, many of the decisions that determine its behaviour will already be cast in stone. Regulation coming at this stage, however robust, will, therefore, be one step-too late.
The regulator will be seeking to govern how society should use a system, while in reality, the creators will already have decided what the system can do.
The incident also demonstrates that technical sophistication alone does not guarantee institutional control.
That Hugging Face detected and contained the intrusion before OpenAI had even traced its source shows how difficult it can be for even a leading developer to maintain complete visibility over its own systems operating in complex environments.
For Africa, this serves as a sobering preview of exactly what dependency can mean in practice.
It has long been argued that, by running on models built and tested elsewhere, Africa increasingly imports more than a technology.
It also, inevitably, imports undisclosed vulnerabilities discovered on someone else’s terms; safety assumptions set by someone else’s risk perception; and security risks that lie beyond the technical reach of local regulatory bodies.
This, then, raises the urgent question of sovereignty, not just in the development of AI tools, but more importantly in how they are governed.
Just who has the power to test AI models, who can see their failure modes, and who decides when it is safe enough to deploy?
Meaningful governance necessarily requires that countries possess the capacity to test claims made by AI companies about their products, inspect their failure modes, and even question the assurances accompanying each new model.
As if on cue, the inaugural Africa AI Governance Index was unveiled just as news of the OpenAI-Hugging Face episode settled.
Covering all 54 African states across 80 indicators, the Index confirms what many analyses have long suggested, notably, that the continent is still struggling to build the right institutions to govern AI in spite of the rapid development of AI policies.
In other words, the pace of writing AI policy on the continent far outstrips its ability and willingness to fund, staff, and enforce those very policies.
While the gap focuses on policy, it runs deeper than just a regulatory shortcoming. Today, the world’s second largest continent and home to 18 per cent of humanity, holds less than 1 per cent of global data-centre capacity and only about 3 per cent of global AI talent.
It remains woefully dependent on foreign providers for cloud infrastructure and advanced chips, while the frontier models entering its businesses and public institutions are designed, trained and controlled elsewhere.
Africa is therefore attempting to govern systems over whose underlying knowledge and infrastructure it can exercise only limited power.
The country is home to East Africa’s most dynamic AI ecosystem and, according to the new Index, ranks fourth on the continent. Yet the speed of AI adoption in the country has also revealed the more obvious the limits of existing governance structures.
General data-protection laws, for instance, are being stretched to address risks for which they were never designed, while technology analysts routinely point out the country’s inadequate capacity to independently test the most advanced models it imports.
The contradiction, therefore, is that the country is strong enough to attract AI investment in droves and deploy robust systems, but not yet fully equipped to interrogate those systems on its own terms.
This is the story of many leading African economies, which have dialled up an AI revolution but, in so doing, also have to grapple with the risks of AI that are becoming more complex each day.
The lessons from the Hugging Face episode, which have been illustrated by the just-released Africa AI Governance Index, are clear.
Africa needs stronger regulators, independent researchers and technically capable public institutions.
To this end, regional AI-safety centres could pool expertise, test advanced models before they are used in sensitive sectors and investigate serious incidents.
Just as importantly, learning institutions, civil society and the media must endeavour to understand these systems and clearly explain their consequences to the general public.
This is what sovereignty should mean for Africa in the age of AI. It does not necessarily require every African country to manufacture chips or build its own frontier models.
But it, no doubt, will require robust infrastructure and the technical capacity to understand what is being imported, set the conditions for its use and reject systems whose risks cannot be independently verified.
Dr Ageyo is the Editor in Chief of the Nation Media Group. He holds a PhD in media studies with a focus on science and environment communication. [email protected]
