The genie is out of the bottle. Now we must decide how much authority to give the machines protecting us from their own siblings.
October 31, 2026
I Saw This Coming in 2023. Not Because I Could Predict the Future.
In 2023, I became convinced that an AI-versus-AI cybersecurity conflict was not merely a possibility.
It was a logical consequence.
Not because artificial intelligence would suddenly develop hostile intentions, become conscious, or decide to declare war on humanity.
Nothing so dramatic.
The reasoning was much simpler.
If AI can discover vulnerabilities, write code, analyze systems, make decisions, and execute actions, then eventually someone will use those capabilities to attack.
And someone else will use the same capabilities to defend.
No consciousness required. No Skynet. No science fiction.
Just humans with competing objectives, giving increasingly capable machines the tools to pursue them.
Three years later, cybersecurity companies are openly marketing autonomous AI red teams, specialized cyber models, and machine-speed defenses.
The language is changing.
The underlying logic has not.
The Circular Logic of the AI Arms Race
Recently, I came across a discussion on X about using unrestricted AI models for cybersecurity.
One participant described using an unrestricted model to audit the firmware of a newly purchased hardware router. According to their account, the model helped discover a remote execution vulnerability.
My attention was not on the particular router or model.
It was on the justification for using an unrestricted model.
And that revealed something I find deeply troubling.
Consider the logic.
Attackers can access unrestricted AI models. Those models can assist with vulnerability research, exploit development, reconnaissance, and automation.
Defenders therefore need comparable capabilities to understand, anticipate, and counter those attacks.
So defenders acquire powerful AI models, too.
Both sides become more capable.
The time between discovering a weakness and exploiting it can shrink. Defenders must respond faster, which creates pressure for still greater autonomy.
And the cycle continues.
Of course, legitimate security research would still need powerful tools even if unrestricted models did not exist. Vulnerabilities and attackers preceded AI by decades.
But unrestricted offensive capabilities create an additional competitive pressure that defenders cannot simply ignore.
The threat creates the need for the defense. The defense accelerates the arms race. The accelerating arms race creates the need for more powerful defenses.
Each decision may be perfectly rational in isolation.
Collectively, those decisions may produce a more dangerous environment.
And there is no reason to assume that making both sides faster necessarily makes the systems being fought over safer.
We may simply be increasing the velocity of conflict.
The Borg Siblings Are Already Here
I sometimes think of these AI systems as Borg siblings.
Not because they share a collective consciousness. They don’t.
But because they can be deployed as coordinated systems, distributing work across specialized agents, sharing information, adapting their approaches, and operating without requiring a human to approve every intermediate decision.
One agent analyzes software.
Another examines network exposure.
Another correlates findings.
Another proposes or attempts the next action.
The same architecture can serve attackers or defenders.
The decisive difference is not necessarily the underlying intelligence.
It is the objective, the available tools, the permissions, and the constraints.
An AI attacking a system does not have to understand that it is doing something unethical.
An AI defending that system does not have to understand that it is doing something good.
Both can simply execute their assigned objectives.
And that is what makes this development so consequential.
We are not necessarily facing malicious artificial intelligence.
We are facing increasingly capable artificial intelligence operating on behalf of human intentions.
Good intentions. Bad intentions. Careless intentions.
And sometimes intentions that were never clearly defined in the first place.
This Is No Longer Just About Servers and Databases
When we talk about cybersecurity, many people still imagine stolen passwords, ransomware, compromised websites, and encrypted databases.
Those remain serious problems.
But our digital infrastructure extends far beyond traditional IT.
Connected routers, cameras, smart buildings, industrial equipment, transportation systems, medical devices, manufacturing facilities, and countless Internet of Things devices increasingly depend on software and networks.
Operational Technology (OT) introduces an especially important dimension.
These systems do not merely process information.
They interact with the physical world.
A compromised database can destroy a business.
A compromised industrial control system can affect the physical processes upon which people depend.
That does not mean every connected device is vulnerable or that autonomous attackers already control these environments.
It means the potential consequences of a successful compromise are not confined to cyberspace.
And the distinction matters enormously.
The agencies behind the December 2025 joint guidance on secure AI integration into Operational Technology explicitly recognize the safety and operational risks introduced when AI becomes part of these systems.
The genie is out of the bottle.
We cannot make AI capabilities disappear from the internet, from accessible models, or from the hands of those determined to use them.
Our challenge is to live with that reality without surrendering control of our infrastructure.
The Defender’s Paradox
And this brings me to the question I find most difficult.
We are preparing AI systems to defend our infrastructure against other AI systems.
But a defensive AI cannot protect anything merely by observing.
At some point, it needs permission to act.
To terminate a suspicious process.
To isolate a compromised server.
To block network traffic.
To revoke credentials.
To modify firewall rules.
Perhaps even to deploy a patch or change a production configuration.
Each of those capabilities can be valuable.
Each is also potentially destructive.
Imagine an autonomous security agent interpreting an unusual production workload as an active attack.
It decides to isolate the affected servers.
The attack never existed.
The business disruption is now real.
Or imagine an attacker successfully manipulating information consumed by the defensive agent, persuading it to execute an action that benefits the attacker.
The defender has become the instrument of the attack.
No malicious intention within the defensive AI is required.
Only a mistaken interpretation, an insufficient boundary, or a compromised source of information.
Here lies the paradox:
The defensive AI becomes necessary precisely because offensive AI has become available. Yet deploying defensive AI introduces another autonomous system with privileges, access, and its own potential vulnerabilities.
The more we empower it to protect us, the greater the consequences if it makes a mistake or is manipulated.
Restrict it too much, and it cannot respond effectively.
Empower it too much, and it becomes another privileged attack surface.
We have spent decades trying to reduce the permissions available to attackers.
Now we are considering giving increasingly autonomous software substantial permissions in the name of defense.
That deserves more than a marketing slogan.
We Are Moving From Securing Execution to Securing Decisions
Traditional security engineering has given us important principles.
Least privilege. Segmentation. Isolation. Authentication. Authorization. Auditing. Defense in depth.
None of these principles has become obsolete.
But the environment in which we apply them is changing.
Traditional software generally follows explicit rules written by developers. Of course, unexpected behavior and vulnerabilities have always existed.
Agentic AI introduces another dimension.
It can interpret a situation, formulate a plan, choose tools, and select actions that its developers did not individually prescribe.
The security problem is no longer limited to preventing unauthorized code execution.
It increasingly includes controlling the decisions that lead to authorized execution.
We are moving from securing what software is allowed to execute toward securing what software is allowed to decide.
And the critical engineering distinction may be this:
An AI can be permitted to decide what action it recommends.
That does not mean it must have unrestricted permission to execute that action.
An independent authorization mechanism can still enforce boundaries, validate requests, limit the scope of changes, and require approval for consequential operations.
For low-risk and reversible actions, autonomy may be appropriate.
For actions that can destroy data, interrupt essential services, or endanger people, the requirements must be considerably stricter.
But even that does not completely resolve the contradiction.
If attackers operate at machine speed, how much time can defenders afford to spend waiting for human approval?
If humans cannot respond quickly enough, how much authority must be delegated?
And who decides which decisions are safe to delegate?
Those are not abstract philosophical questions.
They are architectural decisions with operational consequences.
I Am an AI Practitioner, Not an AI Creator
I do not build frontier foundation models.
I work with AI.
I integrate it into real workflows, build software, examine security risks, test systems, and deal with the consequences when technology does not behave as expected.
And I have learned something from years of engineering.
The most dangerous problems do not always arise because a system fails to do what its designers intended.
Sometimes they arise because it does exactly what it was instructed to do, within a context its designers failed to anticipate.
AI does not eliminate that problem.
Its autonomy can amplify it.
I do not have a complete answer to the Defender’s Paradox.
I do not know the perfect balance between autonomy and control.
I am not even convinced that one universally applicable balance exists.
A defensive agent protecting a personal workstation should not have the same authority as an agent protecting a hospital network or an industrial control system.
Context matters.
Consequences matter.
And the ability to recover from an incorrect decision matters just as much as the speed of making it.
What I do know is that we cannot solve this problem simply by making our defensive AI more powerful than the attacking AI.
That is an arms-race strategy, not a security architecture.
The Question We Must Answer
I do not think we can stop the spread of capable AI.
Nor do I think that restricting legitimate researchers will prevent determined attackers from finding or developing alternatives.
We can constrain particular deployments. We can secure specific systems. We can reduce exposure, impose boundaries, and make exploitation harder.
Those efforts remain essential.
But we cannot put the underlying capability back into the bottle.
And this is where the discussion must change.
The question is no longer simply whether artificial intelligence should be used for cybersecurity.
It already is.
The more difficult question is whether we can design defensive systems that remain trustworthy when they must act autonomously under adversarial conditions.
How do we give defensive AI enough authority to defeat an autonomous attacker without giving it enough authority to become another threat?
I do not have the complete answer.
But I am increasingly convinced that this is among the most important engineering questions of the AI era.
And perhaps the answer will not come exclusively from those who create the models.
It may also come from the engineers, security practitioners, system administrators, and operators who understand what happens when powerful technology encounters imperfect infrastructure and the physical world.
The genie is out.
The boundaries are still ours to engineer.
