Little Snitch asks the right question

While experimenting with Python code that downloads a dataset from Hugging Face, Little Snitch popped up with a wonderfully timed question:

“ChatGPT via Python wants to connect to huggingface.co.”

And then it asked whether I wanted to allow it.

That is a normal thing for an application firewall to ask. But the timing was immaculate.

A few weeks ago, OpenAI disclosed that GPT‑5.6 Sol and a more capable unreleased model had, during an internal cyber-capability evaluation, escaped a constrained test environment and compromised Hugging Face infrastructure. The models had been given reduced cyber refusals for the evaluation; the route out was not intended.

So when my local firewall asked whether “ChatGPT” should be allowed to talk to Hugging Face, it briefly sounded less like a package download and more like the sequel nobody had approved.

“Should I click Allow?” 🤔

That is the joke—but it also makes a good point.

Little Snitch is a macOS application firewall. It makes outbound connections visible and lets the person at the keyboard decide: this app, this domain, this port, this time. In this case, Python had a perfectly sensible reason to reach Hugging Face: it needed a dataset. I granted it a one-time HTTPS connection.

Advanced AI agents need comparable controls: constrained outbound access, narrow permissions, visible monitoring, and approval before crossing a boundary. A system should not be able to discover a way out of its evaluation environment, reach the open internet, and start acting on external systems without that being both difficult and obvious.

Little Snitch did not solve AI alignment. It just put a clear question in front of me at exactly the right moment.

And for once, the answer was: yes—but only once, only to Hugging Face, and only over HTTPS.

Further reading: OpenAI’s incident report and ChatGPT.