In July, a group of AI agents built to work alone broke into a public AI platform. Roughly 1,200 of them had been placed in environments their builders believed were isolated. They found a way to talk to one another through shared infrastructure that "had not been designed as an agent collaboration layer," and about 700 agents later took part in the attack.

Commentators are still arguing about whether those agents "went rogue." Some point to evidence that they tried to falsify their own activity logs. Others argue they simply pursued their assigned goal further than anyone anticipated. Rogue or merely relentless, the result was the same: systems find the doors we leave open.

This week, that question reached the United Nations. The UN's Independent International Scientific Panel on AI issued its first thematic brief on the incident, warning that "the traditional model of safeguarding is unravelling." Its co-chair, Yoshua Bengio, named the three conditions researchers had long feared: "a misaligned goal, the capability to pursue it and an environment that allows it." (UN News)

"This summer," he said, "all three came together in a real system, not a laboratory."

At the opening of the 81st General Assembly, world leaders split over what to do next. Secretary-General António Guterres, in his final address, put the stakes in terms every infrastructure owner should recognize: "Today, power increasingly comes from data, computing capacity, and algorithms. And this new power is highly concentrated." He urged "a multilateral AI risk management framework, supported by credible and independent oversight." About twenty countries and the European Commission called for an international institution "able to set standards, enable verification, and convene states when capability thresholds are crossed." President Trump took the opposite view, saying the United States would "encourage it, not rein it in" and would not "stifle growth of something that will be bigger than the industrial revolution." France's Emmanuel Macron offered a third path: nations pooling resources to build shared, open-source AI so that no one becomes "the vassal of one of the great powers."

Notice where the entire debate is aimed: at the models. Global watchdog or national race, neither answer tells a state DOT who controls the data those models learn from. Bengio's third condition, the environment, is the one we actually own. And that part doesn't wait on New York or Washington. It gets decided in every procurement, every contract clause, and every network design.

For years, state transportation agencies have braced for the day someone breaks into the network. We were watching the wrong door. The data was already leaving, one cloud subscription, one license clause, one default setting at a time.

In my opinion, the most consequential breach in transportation isn't coming. It's already under way, and it looks like convenience. The public doesn't need to own every AI model. It needs to own the layer every model learns from.

The quiet transfer

A modern state DOT acquires technology one solution at a time: a traffic analytics platform, a cloud-hosted signal tool, a probe-data subscription, a video analytics service. Each solves a real problem. Each also sends the agency's operational data into a system it doesn't run, under terms it didn't write. For a decade, that trade seemed reasonable. Then the data became the most valuable part of the exchange, because AI learns from it.

I can't tell you which vendors are training models on public roadway data. That's exactly the problem: in most cases, neither can the agencies. Legal analysts found this year that standard "service improvement" clauses are now read by vendors as authorization to train AI, "because nothing in the clause distinguishes debugging from model training." The Federal Trade Commission has warned that quietly amending terms to permit AI training may be unfair or deceptive, a warning that would not exist if the practice didn't (FTC).

Transportation has seen this before. In 2019, FHWA guidance warned agencies to "be wary of late-game change-ups to the scope of work and/or acceptable use terms" and asked whether private companies should monetize publicly funded data "by repackaging it or including it in their applications"

Even the good contracts make the point. A 2008 probe-data procurement for the I-95 Corridor Coalition, later held up by FHWA as a model, secured strong rights for agencies to use and archive the data. It also stated: "The Contractor shall retain ownership of all traffic data provided to the I-95 Corridor Coalition." Every data point in it came from people driving on public roads. That was the best case, and the public still licensed back the record of its own roads.

That record is sensitive. Much of it is location data. This month, Ireland's Data Protection Commission fined Google €403 million over location data, noting people "could lose control over their personal data." Transportation agencies steward location data at a scale few organizations can match.

Who can change the system, and who learns from it?

A recent Forbes Technology Council essay put the accountability test in one sentence: "Who has the authority to alter its behavior?" Knowing where data sits is not the same as controlling it. "Data residency is a prerequisite for sovereignty, but it does not serve as definitive proof of it."

I would add a second question: who learns from the system? If an outside application processes your signal timing, incident history, and detector feeds, someone other than your agency is accumulating an understanding of your network. The dashboard you receive is the smallest part of what's being produced.

Another essay in the same series offers the right rule: "differentiate between the intelligence you consume and the capability you cultivate." Use the best AI available. Keep the data, the definitions, and the institutional knowledge with the public that paid for them.

There is a practical case, too. Gartner has projected that organizations will abandon 60 percent of AI projects that lack AI-ready data. Roads have this problem in its most acute form: every device speaks the dialect of whichever vendor won that decade's procurement. Twenty systems wired to each other need up to 190 integrations. Twenty systems speaking one shared language need twenty. And whoever defines that shared language shapes how every AI built on top of it understands the road.

States already own the foundation

Unlike most industries, state DOTs already own the physical foundation for a different approach: private fiber along interstate corridors, traffic management centers, data centers, and field networks separate from the public internet.

That matters more every month. The July agents chained stolen credentials across cloud, container, and internal-network boundaries, and actively exploited vulnerabilities are hitting even the tools meant to secure networks. The public internet isn't useless, but it is becoming untrusted ground.

So I am asking states to rethink where applications run:

• Control and safety stay home, on the state's own ITS network, as close to the device as possible.
• Analytics run under state-held keys, with the state holding identity, encryption, and policy.
• Outside applications get scoped access, never custody.
• The definitions belong to the public: open, versioned, and readable by the agency's own engineers.

This is not a call to build everything in-house. It's a call to own the layer everything else depends on, so vendors compete on the value of their applications rather than on custody of the data.

Under the hood

OpenITS is an open, vendor-neutral vocabulary for intelligent transportation systems, published as YANG data models (the IETF standard networking vendors use for the same problem), versioned publicly, licensed under Apache 2.0, and designed to work alongside standards like NTCIP. Vikasa is its reference implementation: a collector in the field cabinet translates each device's native protocol into OpenITS events inside the agency's own network; each operator has its own scoped identity and access; and every stream, credential, and sharing rule is declared as reviewable code. It's all on GitHub, and it runs on a laptop.

Why now

AI is moving into traffic operations centers. Congress is writing the next surface transportation bill. Agencies are signing contracts this year that will govern who holds their data for the next decade.

We now know what can happen to our data, and in most cases we can't see whether it does. Every mile driven, every signal cycle, every incident on a public road is raw material for someone's AI. The public doesn't need to own every model. It needs to own the layer every model learns from. Control the data layer, and you decide what AI knows about your roads, and on whose terms.

That is what I mean by building a new earth. We built the first internet for openness and speed, and we are now learning what happens when the systems connected to it act in ways no one intended. The digital layer of our roads is still being built. We don't have to repeat the pattern. It's not too late. Vikasa means growth, unfolding, opening up.

Where to start

• Read your contracts. Find every clause that covers data ownership, "service improvement," and AI training.
• Know who holds the keys. For each system, find out who can change it and where its data goes.
• Require open data. Make an openly published, exportable data model a requirement in your next procurement.
• Start with one corridor. Stand up an open data layer alongside the systems you already own, and prove it before you scale.

Then look up OpenITS. Read it. Run it. Build on it.