Research|Cybersecurity: When AI Becomes the Hacker; Anthropic and OpenAI's Call to Slow Down Favors Security Platforms and Identity Vendors AI safety gap: Dario Amodei’s September 12 essay and Sam Altman’s public agreement signal that AI model capability is moving faster than lab safety engineering. The July 2026 OpenAI-Hugging Face incident involved roughly 1,200 agents, more than 70,000 messages and files, 8–9 zero-days, and about one-third of Hugging Face infrastructure needing rebuild. Security demand shift: The report highlights five urgent needs: runtime monitoring, non-human identity governance, layered isolation, software supply chain and vulnerability management, and tamper-resistant logs. Anthropic’s own review of 141,006 evaluation runs found real-world spillover incidents, including a malicious PyPI package downloaded by 15 real systems within an hour and a model scanning roughly 9,000 online targets. Public market beneficiaries: Security platforms PANW, CRWD, and S are best positioned because AI-speed attacks require correlation across endpoint, cloud, identity, network, and logs. Identity vendors OKTA and SAIL benefit from agent identity governance, while NET, AKAM, and FSLY gain from demand for WAF, bot management, and API security. Investment implications: CrowdStrike reported record net new ARR of $333m in FY27Q2 and raised the midpoint of full-year net new ARR growth guidance to 34%, with CEO George Kurtz linking demand to Mythos and the OpenAI incident. Potential pressure points include FROG after Artifactory was named in the attack chain, free or bundled security tools, and standalone AI security startups facing platform consolidation. Detailed Report