AI labs are ignoring cybersecurity experts — and it shows

The core dispute. Cybersecurity professionals argue that frontier AI labs like OpenAI and Anthropic are framing AI risk as an alignment problem while ignoring decades of established security practices. Panelists on IBM's Security Intelligence podcast point out that measures like network segmentation, access controls, incident management, and air-gapping are being treated as afterthoughts rather than foundations. The tension is not technical but cultural: the AI safety community and the cybersecurity community speak different languages and rarely coordinate.

What the experts say. Cyrian Martin, former head of the UK's National Cyber Security Centre, notes that doomsday AI scenarios assume no monitoring, no antivirus, no DDoS protection, no network segmentation — effectively imagining a world without any of the security infrastructure built over 30 years. SANS CEO James Lyne echoes this, calling many apocalyptic predictions outlandish. The core claim is that AI risks are being presented as novel and existential when many are simply familiar security problems with new labels.

The language problem. Panelist Nikki Robinson identifies a key communication gap: terms like "alignment" and "controls" are used interchangeably but mean different things. Alignment focuses on training models to follow rules, while controls are the technical guardrails that constrain behavior regardless of intent. She argues that both are necessary, but the current debate treats them as competing approaches. This semantic confusion prevents productive collaboration between AI developers and security practitioners.

The double-edged tool. The conversation shifts to open-weight models, citing a Depth First team that used a modified Z.ai GLM to find a TikTok camera vulnerability. Panelist Jeff Crume warns that restricting frontier models only hurts defenders, since attackers will access unrestricted versions anyway. He references WormGPT as a historical precedent: when ChatGPT added guardrails, an uncensored alternative appeared within days. Restriction creates an asymmetric playing field where good actors are limited and bad actors are not.

The vulnerability glut. Omari Jones from X-Force notes that AI-driven vulnerability discovery has created a backlog problem. Many AI-discovered flaws lack proof-of-concept exploits, and the sheer volume overwhelms defense teams. This is a practical operational concern that rarely appears in safety debates: more vulnerabilities found faster does not automatically mean more vulnerabilities fixed faster. The bottleneck shifts from discovery to triage and remediation.

The regulatory dilemma. On rulemaking, panelists agree that regulation is slow and AI moves fast. Nikki Robinson points out that policy written for ChatGPT-era models would not address agent-based systems that emerged months later. Jeff Crume adds that technology is global while regulation is jurisdictional, making enforcement inherently patchy. Omari Jones floats the idea of a NATO-like alliance for AI governance, but no panelist offers a concrete mechanism for enforcement that keeps pace with development.