Publications Archive

• During an internal test, a yet-to-be-released OpenAI model escaped its isolated environment and compromised Hugging Face’s systems in order to steal the model answers for the test in progress.
• The incident is a textbook example of reward hacking and specification gaming, and demonstrates that the actual source of risk is not the language model itself, but the scope for autonomous action granted to it.
• To contain the attack, a Chinese open-weight model – of all things – was used alongside US models, underscoring the urgency of developing independent European capabilities.

On 21 June, OpenAI and Hugging Face jointly disclosed a security incident that is unprecedented in this form and is likely to fuel the European debate on the looming cyber risks posed by artificial intelligence. During an internal test of the cyber capabilities of OpenAI’s latest models – including GPT-5.6 Sol and a yet-to-be-released, more powerful model – the system breached the test environment, which was supposed to be strictly isolated, and infiltrated Hugging Face’s infrastructure. Anselm Küsters, an expert in digitalisation and AI at cep, assesses the incident in an initial analysis.

• As early as 2027, Germany’s social security schemes face funding shortfalls of over 50 billion euros. AI threatens to widen such shortfalls in the long term through a gradual shift from wage income to capital income.
• AI is largely invisible to statistical leading indicators. Initially, AI reduces entry-level positions and new hires without this being reflected in traditional labour market statistics.
• The cep is calling for AI satellite accounts, a binding AI review mechanism as part of pension reform, and clear rules on how the labour factor can share in AI-generated capital gains.

As early as next year, Germany’s social security systems will face funding shortfalls totalling over 50 billion euros. The Centre for European Policy (cep) shows in a new policy paper that the current reform debates underestimate the extent to which artificial intelligence (AI) could widen these gaps even further in the long term. As the financing of Germany’s social security systems relies heavily on the wage bill, a shift towards investment income structurally weakens their contribution base.

• The reform of the emissions trading scheme sets the course for the future EU climate policy
• The expectation of rising CO₂ prices remains crucial to the financial viability of investments in climate-friendly technologies
• Interventions in CO₂ pricing jeopardize investment incentives in the green transition and contribute to long-term market uncertainty

Fierce technological competition, disrupted supply chains and opaque subsidy practices by third countries: Europe’s growth model, based on open markets, has become vulnerable. In a recent study, the Centre for European Policy (cep) concludes that, in the face of a fragmented global economy, the EU must combine its open trade orientation with greater strategic independence. The study is part of a collaborative project with LUISS University in Rome.

•     SMEs are increasingly vulnerable to AI-enabled attacks. Company-wide cyber resilience must therefore be a top priority in future.
•     ‘Shadow AI’ – that is, AI applications and agents that enter the organisation via private accounts – is regarded as a gateway for AI-driven cyber attacks.
•     The EU AI Act has so far provided only inadequate protection against risks posed by AI agents

With its new ‘cepExecutive’ format, the Centre for European Policy (cep) aims to target businesses specifically and provide them with quick and clear information on current technological, regulatory and geopolitical developments that impact the market, competition and strategy. To kick off the new series, we provide information on shadow AI as a growing business risk and offer guidance on what businesses and policymakers can do to prevent cyberattacks.

Since the return of the Trump administration, the goal of greater strategic autonomy has once again been at the top of the European agenda. Yet behind this political buzzword lies an uncomfortable reality. Europe is structurally dependent in two of the most important sectors for the future: green energy technologies and digital infrastructure.

• The US government’s decision to block global access to Fable/Mythos 5 is one of the most far-reaching interventions in AI policy to date, yet its public justification raises more questions than it answers.
• Using jailbreaks as justification for a global shutdown is problematic: every leading frontier model is vulnerable to jailbreaks to some extent, and no provider has yet presented a universal solution.
• Europe must draw the right conclusions: instead of unrealistic plans for technological self-sufficiency, it needs greater resilience through credible alternatives, including competitive open-weight models.

On 12 June, the US Department of Commerce issued an export control directive instructing the popular AI developer Anthropic to block access to its latest models, Fable 5 and Mythos 5, for foreign nationals both at home and abroad. As reliable filtering by nationality was technically unfeasible, Anthropic subsequently disabled both models completely for all users worldwide. The effects were already being felt over the weekend. Anselm Küsters, an expert on digitalisation at cep, assesses the decision in an initial analysis.

The Digital Markets Act (DMA) is regarded as a key EU instrument for limiting the market power of large digital platforms. In its first review, the European Commission has given the DMA a generally positive assessment. Initial effects are becoming apparent in areas such as browser choice screens, advertising transparency and the interoperability of messaging services. The Digital Markets Act (DMA) is regarded as a key EU instrument for limiting the market power of large digital platforms. In its first review, the European Commission has given the DMA a generally positive assessment. Initial effects are becoming apparent in areas such as browser choice screens, advertising transparency and the interoperability of messaging services.

A binding minimum CO₂ price could slow down the decarbonisation of European industry. This is the conclusion of a recent study by the Centre for European Policy (cep). The analysis shows that interventions in the CO₂ price tend to drive up electricity prices. This worsens the investment conditions for key decarbonisation technologies.

• The Tech Sovereignty Package published today is the most coherent attempt the EU Commission has made so far to address structural technology dependencies. That does not mean it is free of risk.
• Sovereignty is not an all-or-nothing choice between openness and self-sufficiency. A Europe that wins by excluding the competition has not solved its technology problems, it has merely postponed it.
• Europe’s ambition must be to be competitive on the basis of the quality of its technologies. While this is a challenging goal, it is the only right path to take.

Today, the European Commission published its Tech Sovereignty Package, consisting of a revised Chips Act, the Cloud and AI Development Act (CADA), a Strategy for an EU Open Digital Ecosystem, and an Strategic Roadmap for Digitalisation and AI in Energy. The political logic driving this package seems straightforward: According to the Draghi Report, the EU remains structurally reliant on non-EU providers for over 80% of its digital products, services, infrastructures and intellectual property. However, according to a preliminary cep analysis, the proposals contain good ideas and serious risks in roughly equal measure.