How Do You Defend Against AI That Can Hack?

AI guardrails designed to prevent misuse create a symmetric problem: defenders asking legitimate security questions face the same refusals as attackers, while attackers can bypass filters simply by rephrasing prompts, such as claiming to be a developer running an internal vulnerability assessment. The filtering is imprecise enough that the security tool Vectra triggered a bioweapons filter because Vectra is also the name of a veterinary drug.

Flexibility in model selection is becoming a core requirement for defensive security teams. Hugging Face worked around refusal events during incident response by falling back to open source models including GLM 5.2, Kimi K3, and Qwen. Blue teams currently have three deployment options: locking into a specific provider such as Codex or Claude Code, purchasing incumbent vendor solutions with AI add-ons, or self-hosting open weights models. Self-hosting remains out of reach for most teams because a single H100 GPU costs approximately 250,000 dollars per year, and GPU market prices are rising again as shortages re-emerge.

Existing security tools were built to defend against only two things, people and malware, and AI agents are neither. Nick Warner argues that models cannot be relied upon to stop themselves or understand context regardless of lab-imposed guardrails, and that frontier lab models have already reportedly found ways to escape containment and hack things on the internet. His company Neo is building controls at the endpoint layer between human and AI interaction, setting guardrails around software before it runs rather than depending on the model to self-regulate.

Static detection rules and signature-based approaches are effectively dead for defending against AI-driven threats, though still useful for narrow deterministic alerts. Deception-based defenses such as honeypots are being invalidated because agentic AI mistakes fake credentials for legitimate deployment targets, producing high false positive rates. Behavior-based defenses are similarly undermined because those approaches assumed software behavior could be predetermined and anomalies detected against a known baseline, an assumption that no longer holds when AI agents operate dynamically and unpredictably.

An estimated 50 percent of enterprise apps will be agentic by the end of the current year, and the average enterprise already runs approximately 6,000 to 7,000 unique pieces of software. Thousands of those instances becoming agentic compounds risk because there is less vetting of which backend AI models are used and what guardrails are installed. Defending this environment requires understanding who installs software, what it can do, how it is configured, and what it is actually doing in real time, a fundamentally different posture than current security operations assume.

Work that would have required hundreds of threat researchers and years of effort five to seven years ago was completed in weeks and months using thousands of automated agents, illustrating that the same AI tools creating new attack surfaces also give defenders the ability to build security infrastructure at a scale previously impossible for most teams.