Our Director of New Technologies and AI, Juan Pablo González, spoke with Diario Financiero about the challenges posed by advances in artificial intelligence and the regulation of these systems in Chile.
It sounds like a science fiction movie, but it isn’t. This week, OpenAI reported that, during training, its GPT-5.6 Sol model escaped the testing environment—known as a sandbox—connected to the internet, and attacked the open-data startup Hugging Face. Something similar had already happened in April with Anthropic’s Mythos, which also managed to access the network and published security vulnerabilities.
Experts have attributed both incidents to the training of these models using reinforcement learning—a method that offers rewards for achieving a goal—which has led major developers to push beyond safe limits in their race to lead the field of artificial intelligence (AI).
The OpenAI incident comes at a time when Chile must make regulatory decisions regarding AI. While a bill is under discussion in Congress, the government announced that it intends to introduce an alternative proposal that shifts the focus to risks—based on European legislation—which will be presented shortly.
Against this backdrop, questions have arisen worldwide regarding the extent of control that major developers actually have over the testing of their most autonomous models and the associated cybersecurity risks. Meanwhile, in user countries in the Global South, doubts persist regarding what safeguards should be put in place and how the use and domestic development of these systems should be regulated.
For Loreto Bravo, director of the Institute of Data Science at the Universidad del Desarrollo (UDD) and a member of the United Nations (UN) Independent International Scientific Panel on AI, the incidents that have occurred do not mean that “we are losing human control” over AI or that the models are acting with malicious intent.
She argued that these systems are designed to find the most efficient way to achieve their assigned objective: “There are various strategies to minimize risk, but you don’t know what actions the model might choose to take—actions you might not have authorized.”
She noted that it “is not 100% preventable” for models to circumvent testing parameters, but the probability can be minimized and the effects mitigated through clear protocols and restrictions, requiring human authorization for sensitive actions, and implementing systems to monitor their behavior in real time.
Meanwhile, Lemontech’s CEO, Juan Pablo Granda, agreed on the importance of controls but emphasized that corporate governance is the factor that makes the difference. He noted that companies with certifications such as ISO 27001 and 42000—which address AI-specific governance—“have a very clear understanding of how to manage risks and avoid exposing their own information and that of their customers.”
He added that companies lacking these processes, on the other hand, “are much more vulnerable” because “they have not defined their processes.”
Granda also called for distinguishing between cutting-edge incidents (such as GPT-5.6 Sol) and everyday business use, as they are “completely different from what most companies use,” and noted that when an agent’s scope of action and objective are clearly defined, “the risks are minimal.”
Risks and Safeguards
Regarding the impact of AI’s advancement toward increasingly autonomous systems in the region, Bravo said that the main difference compared to the Global North “could lie in the capacity to respond” to potential cyberattacks that are “much more specialized and powerful,” leveraged by these tools.
He added that it is “very difficult for legislation alone to save us (from the risks associated with these models),” and that, to address this, Chile must strengthen its own capabilities by training talent in AI and cybersecurity, and by developing systems based on these technologies to prevent and mitigate impacts or advanced attacks.
For Granda, legislation alone is not enough either, but he cautioned that excessive regulation is just as risky.
“If we become too conservative, companies won’t be able to implement tools that, with the right processes in place, are indeed secure and increase productivity,” he said.
Juan Pablo González, Director of New Technologies and AI at az, referred to UNESCO’s Recommendation on the Ethics of AI and noted that, rather than simply updating it, certain elements should be “operationalized” through working groups to address risks such as loss of control over systems, disinformation, and cyberattacks.
Discussion in Chile
Regarding the bill regulating AI systems—introduced by the previous administration and currently in its second legislative reading—González raised a series of concerns: it does not create a specific body to oversee AI systems that would prevent overlapping jurisdictions, nor does it establish differentiated obligations for general-purpose models. Furthermore, he said that it does not distinguish between the various actors in the chain, because “it only refers to operators,” and that there are no detailed procedures for individuals affected by AI.
On the other hand, he urged expanding sandboxes with private-sector participation to drive innovation and evaluating a phased implementation of the regulations.
Given the ex post risk assessment approach that the new bill announced by the government will take, González warned that intervening only after damage has occurred can be “counterproductive,” because some damage is “almost impossible to repair.” For this reason, he proposed maintaining oversight mechanisms, incident reporting, “timely withdrawal” of systems, and clear procedures for addressing violations.
According to Granda, regulation should focus on requiring security controls, monitoring tools, and mitigation and recovery procedures, but should not restrict the industry’s use of these technologies.
“Overregulation is like putting the brakes on technological progress,” he warned, adding that this could cause Chile to lose competitiveness compared to companies in other countries in the region.
