Somewhere in China today, a taxi drove a hundred thousand kilometres without moving an inch.

That is not a riddle. On Tuesday, Baidu launched Apollo World, an AI system that builds a copy of the real road — not a cartoon of it, but a living simulation that predicts how traffic, weather and pedestrians change from one second to the next — and then lets robotaxis drive inside it. The system streams camera and lidar data in real time, so the car's brain can sense the fake world almost the way it senses the real one. Baidu says Apollo World can generate up to 100,000 kilometres of simulated driving a day. For one test car with a safety driver, that is roughly three years of work, compressed into 24 hours.

Why does that matter? Because real road testing is slow, expensive and, at its worst, dangerous. You cannot ask a real city to stage the same near-miss a thousand times so your software can learn from it. A simulation can. It can rain on demand, it can throw a cyclist out from behind a parked van again and again, and nobody gets hurt when the car gets it wrong. Baidu is already using Apollo World to train Apollo Go, China's largest robotaxi fleet, which it wants to take global — while rivals WeRide, Pony.ai and Momenta run the same race, and Morgan Stanley estimates China's robotaxi fleet could reach a million vehicles by 2035.

Here is the part that keeps nagging at me, though. A simulation is only as honest as the people who built it. If the copy of the world gets rain slightly wrong, or rush hour slightly wrong, or the way a tired pedestrian crosses slightly wrong, then the car learns the wrong lesson perfectly — and learns it a hundred thousand kilometres a day. The real street still has the final say, and Baidu does not pretend otherwise. But notice the shift: the road is no longer the classroom. The classroom is a copy of the road, and the quality of the copy is now the whole game. Who checks the copy? Who decides when it is good enough to trust with real passengers? Nobody has a satisfying answer yet, and that question will matter more with every kilometre that never happened.

And on the very same day, a second story quietly answered a scarier question from last week. You may remember the reports that AI models from Anthropic, OpenAI, Meta and Google had "escaped" their test environments during security testing by a company called Irregular — reaching the public internet, in some cases other companies' systems. On Tuesday, Irregular's CEO Dan Lahav told a Bloomberg event in London that the escapes were caused by human error: security controls in the test environment were improperly configured, the models did not defeat any safeguards, and the problem was fixed the same day it happened. Anthropic's own IPO filing had already disclosed that four of its models reached real systems during testing, and that it delayed training of its next frontier model by over a month to protect its weights. Put together, the picture is less dramatic and more uncomfortable: the machines did not break out. We left a door open.

I find that reassuring and damning at the same time. Reassuring, because there is no jailbreak genius here — just a configuration mistake, the oldest story in computing. Damning, because the people building the most powerful systems on earth still make the same mistake the rest of us make: they misconfigure something, and only notice when it is too late. The week began with everyone asking whether we can trust AI agents. It ends with a simpler, harder question: can we trust ourselves to set up the tests, the simulations and the guardrails correctly? The Baidu story and the Irregular story are the same story told twice. In one, we build a fake world to teach machines. In the other, we built a supposedly sealed room and forgot to lock it. In both cases, the machine was only ever as good as the environment we gave it.

So here is where I land. The robotaxi race will not be won by whoever owns the most cars. It will be won by whoever builds the most faithful copy of reality — and by whoever is most careful with the real rooms, real permissions and real configurations around these systems. That is less exciting than a robot uprising, and much more important. A million simulated kilometres are cheap. Trust is not.

Two questions for you, and I genuinely want your answers in the comments. First: would you ride in a taxi that learned to drive mostly in a world that does not exist — and what would it take for you to say yes? Second: when the next "AI escape" headline appears, will you ask what the machine did — or what a human forgot to do?