diff --git a/plans/meta-prompts/loop_engineering.md b/plans/meta-prompts/loop_engineering.md
index 5dd70f5..b1d675a 100644
--- a/plans/meta-prompts/loop_engineering.md
+++ b/plans/meta-prompts/loop_engineering.md
@@ -143,6 +143,8 @@ Do not trust an agent because it is helpful, local, or model-authored. Trust onl
 
 Reference: Security Fest 2026, Dan Tentler, "Claude is your insider threat now" (YouTube `yvJYw2gR0cU`).
 
+**Antirez corollary: model export controls are futile against the insider-threat model.** Model weights (few TB files) will inevitably leak; internet proxies render geographical blocks meaningless; enforcement would require dismantling encryption and global connectivity. The real question is not nationality-based restrictions but whether to distribute a powerful model to any general public at all — every large country has internal threats that could misuse leaked copies (antirez, July 2026). This strengthens the case for agent-level safeguards: if you cannot control which model an adversary runs, you must sandbox the agent, policy-gate every action with business impact, and assume any model could be running on any hardware. OpenShell's approach (secure agent runtime, secrets management outside sandbox, policy-based egress) is the correct architecture for this world.
+
 ## External research anchors
 
 Ground agent plans against external production guidance, not just video notes: