Autonomy and innovation was published on Monday, August 24th, 2026. While not every Western followed the cliche, by the 1930s cowboy serials had landed on a consistent visual cue. The hero of the show wore a white hat, and the villain wore a black one. At the end of the day, however, they both were cowboys with cowboy hats. Westerns aren't much of a cultural touchstone anymore, but the white hat and black hat nomenclature is very relevant in tech. Hackers who are focused on patching vulnerabilities and protecting software are white hat hackers, while hackers who are focused on exploiting vulnerabilities for malicious reasons are black hat hackers. Of course, this can very quickly become complicated. Governments might employ hackers to break into enemy software installations. Are they white hats or black hats? Or consider bug bounty programs, wherein large software companies pay bug bounties to hackers who find and report vulnerabilities. It's basically using money to incentivize would-be black hat hackers to be white hat hackers. The actual takeaway is that all this complexity is overwrought. Just as a cowboy is a cowboy, a hacker is a hacker. The hat is not a statement of capability, but rather intentions. And those intentions are shaped by incentives.
The best way to attack infrastructure is to find a vulnerability and exploit it. The best way to defend infrastructure is to find a vulnerability and patch it. It's all the same skill set. This delineation between capability and intent and incentive is critical when it comes to AI. At the end of last month's article, Who's Afraid of Chinese Models, I discussed the mysterious attack that model host Hugging Face had just endured, which they were only able to fight off with the help of Chinese models and wrote, "It's difficult to overstate how wrong-headed the Trump administration's panic response to Anthropic's release of Fable was, particularly since it exacerbated Anthropic's worst tendencies in terms of assuming only they can be trusted with powerful AI. In a world with only one AI, it might make sense to reserve the most powerful cybersecurity capabilities for the US government and trusted allies. However, that's not the world we live in. There are and will be models eminently capable of mounting cybersecurity attacks on existing infrastructure. And those models will be already are widely available. The best defense, the only viable defense in fact, will be to make sure defenders have access to the best models as well. Right now defenders are effectively banned from using Fable or Soul for cybersecurity because of Trump administration directives. That means the best alternative is using models from a country which has been trying to weaken our cyber defenses for years. This is insane." End quote. The point is the one I made in the introduction. When it comes to cybersecurity, the capability that is necessary for good defense is the exact same capability that is necessary for good offense. The color of the hat is a matter of who is actually prompting the AI.
And sometimes not even that is clear. It turns out that the entity that hacked Hugging Face was actually OpenAI as a series of unconstrained agents being evaluated for their cybersecurity capabilities, found and exploited a bug in the package manager in their sandbox. That package manager had internet access and a sufficiently writable file system such that the agents could communicate with each other over time. The entire chain of vulnerability discovery and exploit creation culminated in the so-called Hugging Face incident. The Hugging Face incident. There is an entire article to be written about the implications of this specific incident and what it says about AI risk. Some of my takeaways are still up in the air pending OpenAI's promised release of an in-depth technical report. My preliminary takeaway is that the agents were not cheating, but rather doing what they were told to do. Of course, that's arguably even scarier. The part I want to focus on today, however, came at the end of a presentation OpenAI's Eric Wallace and Michael Dalton made at the Black Hat USA conference about the Hugging Face incident. This was Dalton summarizing lessons learned.
We have seen what will be a dramatic acceleration of offensive capability for attackers. We have an existence proof that was unintentional, but it exists before us and we have as a consequence seen a glimpse into the near future of what attacks will look like for our industry. The challenge is that we need a similar acceleration of defense. And today, we see fully automated offense is possible. We have no such existence proof for full automation of core defensive loops and cycles and behavior. We believe it's vital at this moment to begin accelerating defense and finding ways to automate SDLC like in the in the modern parlance. So, incident response, vulnerability detection, vulnerability patching. There's some things that are at stand out acutely as challenges for the industry to begin tackling with high urgency. So, continuous agentic red teaming is one of them. As you can see from this incident, agents are quite good at finding zero-day attacks in the infrastructure of companies. The question that's now going to be posed is are companies able to invest sufficient model intelligence and effort in finding and remediating their vulnerabilities before someone else, that's a threat actor, does it for you?
This style of operating will be different now, but ultimately, we need to invest in having AI agent red teaming that enables defenders to find and remediate vulnerabilities before attackers do. But, automating these defensive loops is not trivial. And so, if we do this partially, we will fail to meet the scalability of what the offensive acceleration that we have just seen. So, for example, if we automate vulnerability finding without automating we will shift the bottleneck from volns to patching to remediation, and we will simply drown or inundate human software engineers in new volns to fix and patch. This is not a problem in whose end state we can solve partially. We will need to take these core defensive loops and fully automate them, which will require conversations with infrastructure and product partners and reaching to a point where we can say, if a vulnerability is identified, not only can an agent identify that vuln, we can have an agent propose a patch, we can have automated infrastructure to roll out a change with that patch and roll it back if there is an availability incident or outage. That loop needs to be fully automated in its end state. Of course, we want to automate as progressively and iteratively and quickly as we can, but if we don't reach that end state, then we will be comparing a core defensive loop of fixing vulnerabilities that is a human in the loop and is much slower and less scalable with an offensive loop that is fully automated and that is an unsustainable position for this industry to be in.
This situation is obviously completely novel. Dalton is arguing that it will become commonplace. Some of the issues he's raising, however, are not novel at all. Go back to the concept of a bug bounty program. Software is incredibly complicated and brittle and built on a foundation of code that, if you dig deep enough, often goes back decades. There is so much code and so many dependencies that no company, no matter how security-conscious they are, could ever ensure it is perfect. This reality is what creates the opportunity for black hat hackers. A bad actor can probe software, find bugs, and exploit them. The most effective defensive preparation is to do the exact same thing. That could entail regular penetration testing, pen testing, by a red team, or simply paying the would-be bad actors to be on your side. It's worth noting, however, that this approach to defense only arose after offensive black hat hackers have been breaking into systems for years. The problem wasn't that they were uniquely capable, but rather that they were uniquely incentivized. Breaking into systems was good business. Companies hosting those systems, on the other hand, were insufficiently incentivized to invest in defense. Spending money on security is well spent if nothing happens. And unfortunately, that is a difficult budget line item to argue for when it only moves the needle on costs, not revenue. This is where Dalton's concerns echo past industry indifference. What the Hugging Face incident showed is that agents, with their ability to scale attacks with compute and autonomously develop exploits for vulnerabilities they find, are a threat today, but that companies are not investing in the capabilities necessary to defend themselves.
There is good news, however. In this new agent-defined security landscape, defense should be at an advantage in a way it wasn't in the hacker era. It used to be that the best defenders could do is mimic the tactics of the offense and or pay them off because preemptively finding all of the bugs was not viable. However, that is changing. It actually is or soon will be possible to meticulously go over an entire code base, including all of its dependencies, and look for bugs and patch them. Notice the structural advantage available to defenders. They actually have the code in question. Offensive agents need to probe and discover vulnerabilities without the same advantage. What was illuminating about Dalton's overview, however, was the implication embedded in his explanation of why this isn't currently enough. Specifically, the expected value for a hacker's automated attack is always positive. If the offensive agent finds a vulnerability and creates an exploit, and that exploit fails or is itself buggy, then nothing has changed about the status quo. The exploit doesn't work or, conversely, makes the original vulnerability larger by virtue of its own bugs. If the agent executes the exploit perfectly, meanwhile, the attacker has gained access to the system. The attack only needs to work once for the entire endeavor to have a positive payoff.
The challenge for the defender, on the other hand, is that they need to keep the software in question working correctly and not make the situation worse. This means that any automation has a negative expected value. Successful automated vulnerability discovery and patching preserves the status quo, i.e., the software is not hacked. However, any unsuccessful patches make the situation worse, either by breaking the software by introducing new vulnerabilities. The agent only needs to fail once for the entire endeavor to have a negative payoff. This is the dynamic that leads to the exact situation Dalton describes, where offensive actors are fully automated while defensive systems, even if they use AI, will be incentivized to keep a human in the loop. And no human in the loop will be able to keep up with fully automated agents. Truly effective defense will mean truly trusting agents to act autonomously, but most companies won't do that until they are forced to by regular and unrelenting hacks by fully autonomous attackers. Why AI diffusion takes time. Over the weekend, David Senra released a new podcast with the OpenAI CEO, Sam Altman, where Altman admitted he had been wrong about the speed of AI diffusion into the broader economy.
