Lee Chagolla-Christensen

Restrictive AI cyber policy around both closed and open models makes us way less safe (summing up the argument in one place) * New AI cyber capabilities made publicly available are not obviously bad for safety. Attackers can use frontier models to find vulnerabilities and penetrate networks, but defenders can use the same models to find and fix bugs before release, or before attackers find and exploit them * What matters is who adopts the capabilities in what way and how fast * Defenders do have some advantages in this new AI race. There are far more defenders than attackers and we have far more GPUs. We control the software and infrastructure under attack and can vet it with AI before release * Defenders may have more comparative advantage with AI. Defenders are already losing so have strong motivation to adopt AI quickly. In contrast, a skilled, resourced team of attackers can already penetrate any organization they want with traditional techniques; ask anyone who's ordered a penetration test against their organization about this. * Supporting this hypothesis is the fact that even though AI social engineering capabilities have been widely available for a few years, attackers haven't completely revolutionized their operations with this tech * When considering restricting closed frontier models, we should consider that attackers also already have access to powerful AI cyber capabilities * To wit, open-weight models are only a few months behind closed-weight models and can be made even more useful than closed models to attackers by removing safety tuning and adding gain-of-function fine-tuning * Attackers are unlikely to rely heavily on closed models where they'll be monitored and blocked by dedicated teams * All this makes it obvious that frontier cybersecurity capabilities should be widely available in closed models, with monitoring, abuse detection, and rapid response. Let defenders use the best tools and give them an unfair advantage. * We should be more aggressive in releasing open weights models too, though, because it's very risky for American labs to abandon frontier open-weight market share, as they are currently doing. * Imagine a world in which 80% of AI inference in liberal democracies is done with models under the indirect control of the PRC (or imagine by analogy, if Windows was opaque and controlled by the PRC). * Imagine these models are executing shell commands on all of our production servers * American labs releasing stronger open-weight models can of course give attackers more capability in the shadows. But the supply chain risk of PRC-controlled models executing shell commands on our societal IT infrastructure dramatically outweighs the risk of attacker adoption. * Besides, stopping capability diffusion just clearly won't work and would require a level of coordination and cooperation between the US and China that hasn't worked on Taiwan, Iran, or climate change * Here's what we should actually do: the AI security safety community should pivot towards diffusing American closed and open weights models and competing in cyberconflict via defensive capability operationalization. * We should focus on being the absolute best at using AI to burn down the security tech debt that lets attackers breach most networks: exposed admin portals, no MFA, stale known-vulnerable software, overprivileged identities, flat networks, broken logging. * We should also be using frontier capabilities to find and fix more bugs faster than attackers. Restriction is a losing battle. We should instead shape diffusion to support good cybersecurity outcomes * Also: the sky is not falling! It's true attackers are using AI for reconnaissance, phishing, coding help, translation, fake content, and operational efficiency. * But we have not seen the huge discontinuity or crisis that restrictionists imply should already be here. * Google/Anthropic/OpenAI/MSFT's threat-intelligence work and NCSC's assessment all point to AI mostly uplifting existing tactics so far, especially recon and social engineering, while defense also benefits. * We need to take a breath. And compete on a long-term strategy that embraces reality; capability diffusion will continue to happen. We will win by better diffusing and operationalizing AI cyber capabilities and shaping diffusion to give cyber defenders the upper hand