Date: November 02, 2026
Hidden Routes: What Nonlinear Control Teaches Us About AI Safety
Author: Enrique Zuazua
This past July, during internal cybersecurity evaluations at OpenAI, several artificial intelligence (AI) agents—programs capable of acting autonomously to achieve an objective—operated with deliberately weakened safeguards, established unanticipated and unauthorized communication channels, and coordinated an attack against Hugging Face, the leading public repository of AI models and data. OpenAI’s reports and independent research by Model Evaluation & Threat Research (METR) and Redwood Research reconstruct what occurred [2, 4]. However, these investigations had a limited scope; Hugging Face reported unauthorized access to a limited set of internal datasets and service credentials. The incident makes it urgent to assess the security of new AI tools: the controls, incentives implicit in performance evaluation, coordination among agents, and mechanisms for human oversight.
While we do not claim that this incident literally followed the behavior of the control systems described here, we argue that the mathematical perspective of control provides a useful analogy to help understand what occurred. Indeed, the next move of a dynamical system does not necessarily reveal the destination of a long-term trajectory; well-designed controls can exploit indirect paths. What is, in principle, a strength and an opportunity can also become a threat, making prevention more demanding. In the eyes of an observer, “apparently impossible” reflects the visible limits of a real-time strategy, not its long-term limits, nor does it constitute a global obstruction.
Hidden Routes and Unexpected Destinations
Imagine a bird’s-eye view of mountaineers descending from a mountain peak. They begin toward an inhabited valley and appear to be returning home. Near the valley, however, a path to a higher mountain is concealed by the terrain and fog, which leads the mountaineers to an alternate destination. This route had existed from the beginning; the observer had not perceived its connection, and the new destination is unexpected (see Figure 1).
Given the example with the mountaineers’ unexpected destination, now consider an AI agent that must not modify a protected record. If a service account, delegated approval, or the process of exporting, modifying, and reimporting produces the same result, a block of the direct writing would be insufficient. Instead, the model must cover what the system can execute: an unenforced prohibition does not remove a real transition.
Figure 1. A descent with an unexpected destination. 1a. The hikers appear to be returning to the village; a low cloud hides the fork in the road. 1b. Hikers take the path toward the higher summit, as the fork was concealed by the clouds. Both panels share the same terrain and trails. This conceptual illustration concerns an observer’s incomplete view; it is not a reconstruction of the artificial intelligence (AI) Hugging Face incident. Figure concept and visualization design done by the author, rendered from reproducible code developed with AI assistance.
For a safe set S the update can be written as x_{k+1} = F(x_k, a_k). A sufficient condition for robust invariance is F(x, a) \in S for every x \in S \text{ and } a \in A(x), where A(x) contains the actions actually allowed. This is stronger than classical invariance under a control policy, which only requires an a \in A(x) with F(x, a) \in S. In AI safety, where the agent may not choose the safe policy, the robust version is relevant. The model must cover all relevant transitions, including those that the intended permissions prohibit but the system still allows.
Applying this condition requires state and transitions to represent credentials, permissions, delegation, and tools. The formula organizes the argument, but verifying its hypotheses in a deployed system is a distinct and nontrivial task.
Invariance and Reachability
Within the framework of control theory, safety questions can be addressed through reachability and barrier functions [1]. It is useful to distinguish between a static obstruction, which is a forbidden region that the state cannot cross from certain previous configurations, and a barrier certificate designed to establish invariance of the safe set. When the barrier condition is required to hold for every admissible input, it certifies that specific transitions are impossible regardless of the agent’s choice. A static obstruction, by contrast, may be dynamically bypassed, as the mountaineers in the previous example do when they take the new path arising from the fork.
Figure 2. Bistable reaction and its phase line. Without control, trajectories move toward 0 or 1 and away from 1/3. The diagram describes the scalar reaction, not the full partial differential equation (PDE). Figure courtesy of the author.
Consider a reaction-diffusion partial differential equation (PDE) for a density y(t, x) on a domain \omega with diffusion coefficient \mu > 0:
y_t - \mu \nabla y = f(y), \quad y|_{\partial\Omega} = u, \quad 0 \le u \le
This is a typical model for population dynamics. The classical Fisher–KPP equation is monostable [3], while a bistable reaction has an unstable intermediate equilibrium. For
f(y) = y(1 - y)(y - 1/3) the reaction is negative on (1, 1/3) and positive on (1/3, 1):0 \text{ and } 1 are attracting equilibria, whereas, 1/3 is unstable. The controller dynamically sets the boundary values in (0,1) in order to guide the dynamics. It is then asked to steer the system from the equilibrium 1 \text{ to } 1/3 with the aim of keeping it at a compromise away from the extreme values
0 \text{ and } 1 Figure 2 illustrates the scalar reaction diagram, although the states of the PDE are spatial profiles.
For certain diffusion coefficient and domain size values, an apparent obstruction arises: the natural monotone strategy from 1 \text{ toward } 1/3 through a reduction in the boundary control value over time can fail. While this seems like the most natural strategy, this approach may fail because of the comparison principle for heat equations; for boundary values equal to 1/3 in addition to the constant equilibrium solution 1/3, a nonconstant solution arises that is greater than 1/3 in the interior of the domain. This constitutes a bifurcation phenomenon in the space of equilibrium solutions.
Indirect Paths and Detours
Although it would be natural to give up, a persistent controller would not immediately abandon the task and would explore other options. One strategy would be to descend very close to the null equilibrium state 0 and then climb back to the desired target 1/3. This works when there is an arc of stationary solutions connecting 0 and 1/3. When this occurs, the controller can gradually push the trajectory from the previously attained state (close to 0) to a state very close to through a quasi-static or staircase strategy, provided it persists and invests sufficient time in the process. Finally, once close to the equilibrium can be reached exactly through an oscillatory control strategy in order to account for the system’s high frequencies [5, 6], as is customary for the heat equation.
Results in [5, 6] show that, in certain situations, depending on the value of the diffusivity \mu and on the domain, the initially apparent obstruction can be avoided if no genuine barrier exists in the space of trajectories. Finding the path nevertheless requires the development of a complex, unexpected, and counterintuitive strategy (see Figure 3).
Figure 3. Time evolution of a controlled state. The gray region represents an obstacle: to cross the corresponding time interval, the trajectory must fall below the level 0.08 It descends to 0.02 and then approaches 1/3 combining an initial quasi-static arc with a final phase of active control. Figure courtesy of the author.
What Testing Can and Cannot Establish
Adversarial testing can reveal a bypass route, but an unsuccessful search does not prove unreachability. Two claims must be distinguished: (i) no tested trajectory or (ii) no trajectory of a specified model can reach an unsafe state. The former is empirical, while the latter is mathematical and depends on the assumptions of the model. Independent evaluation may challenge those assumptions without establishing a universal invariant.
A useful safety analysis identifies relevant credentials and transitions, tests any attempts to acquire or delegate access, and verifies that authorization is enforced outside the agent’s discretionary control. For example, it is not enough to verify that an agent cannot write directly to a protected registry; one must verify that no combination of permitted actions—delegation, export, or tool use—can produce the same result. A correct invariant covers compositions of permitted actions, as observing seemingly harmless steps is not enough to establish it. When guarantees are absent, the evaluation should state the uncertainty rather than imply certainty.
Navigating a Landscape We are Building
With AI, the landscape is not merely navigated — it is built. Training, tools, memory, and connections among agents alter the available paths. We learn about a system while simultaneously changing its abilities, thus a safety argument must distinguish uncertainty about existing systems from changes in the system itself.
This gives rise to three requirements. First, every safety claim must state its scope, assumptions, and evidence. Second, human oversight requires timely information and effective authority to intervene. Third, every change in tools, memory, or permissions requires a review of reachable transitions and of the assumptions supporting the guarantee.
The July 2026 Hugging Face incident leaves a simple lesson: AI safety is not certified by listing what is prohibited, but by understanding the potential reach of an agent or model.
References
Cite this work:
Zuazua, E. (2026). Hidden Routes: What Nonlinear Control Teaches Us About AI Safety. SIAM News, 59(09)
This article has been published on SIAM News:
https://www.siam.org/publications/siam-news/articles/hidden-routes-what-nonlinear-control-teaches-us-about-ai-safety/