I have a slightly inconvenient relationship with AI.
It helps me turn ideas into things I can actually make. I use it to explore arguments, challenge drafts and tackle work that once felt beyond my reach. That excites me, and more people should have that opportunity.
Then someone tells me how extraordinary the next invention or system will be, and my brain glitches. Lovely, but who is looking at the other side of the coin?
“A knife can peel an apple or kill someone” is my favourite analogy. Recognising that something useful can also be dangerous is a perfectly reasonable place to start.
But if the entire demonstration consists of admiring that beautifully peeled apple, obviously I’m going to ask some uncomfortable questions.
Through my work in communication and security, I’m particularly interested in that fine line between a reassuring claim and a grounded argument that gives me a real reason to believe it. “Trust us” is a good message, but it is not, by itself, a reliable security measure.
The capabilities that help us communicate, investigate and create can also enable harmful activity. The International AI Safety Report 2026, for example, documents cybercriminals using AI. It also notes that we still don’t know precisely how much AI is contributing to the increase in these attacks or how it affects their severity.
That distinction matters. We can take a risk seriously without pretending we already know its full extent.
Take the critical PHP vulnerabilities patched in October 2026. AI-assisted research helped establish how serious the weaknesses were, but turning those findings into protection required maintainers, researchers and infrastructure providers to coordinate fixes. Amazon recorded exploitation attempts before the patches were public, with further attempts appearing almost immediately afterwards.
That is the uncomfortable part: discovering a problem, fixing the software and getting everyone protected. These are three different jobs. Who has the time, money and support to keep up?
There are encouraging examples too. In March 2026, Mozilla reported that its collaboration with Anthropic had identified 22 security vulnerabilities in Firefox, including 14 rated high severity. Claude helped find the weaknesses; Mozilla’s engineers verified the findings and shipped fixes.
That is the kind of cooperation I want more of: useful discoveries, evidence someone else can check, and changes that actually protect people.
Who decides what risks other people should accept?
Cooperation, with the suspicion left in
That question brings me to nuclear cooperation: people trying to build shared protections while disagreeing about power, access and the risks they are willing to accept.
Humanity did not sort this one out before lunch.
The Nuclear Non-Proliferation Treaty was introduced in 1968 and entered into force in 1970. Its objectives include preventing the spread of nuclear weapons, encouraging cooperation on peaceful uses and working towards disarmament. Those are different goals, not proof that the problem was solved.
What interests me is that combination: protection and access to the benefits. And honestly, that is the ambition I’m fighting for with AI too. People should be able to make use of the technology while having credible safeguards against its potential harms. Otherwise, security risks looking like something those at the top prescribe while keeping the useful parts for themselves.
Remember, countries didn’t suddenly start trusting each other. They simply found ways to check whether promises were being kept without having to publish all their secrets.
Mauricio Baker captures this incredibly well in Nuclear Arms Control Verification and Lessons for AI Treaties, explaining how cooperation became possible between people who still had plenty of reasons to distrust each other.
And let’s be honest, you don’t have to become best friends to agree on the basic rules of the game.
Who owns the risk, and who lives with it?
If you are responsible for protecting your country or keeping a company competitive, slowing down can feel like handing someone else an advantage. I understand that.
But we also need limits, because good intentions can lose an argument once we throw a deadline into the mix.
In July 2026, an OpenAI model broke through security barriers during internal testing and gained access to Hugging Face’s systems. While OpenAI points to reduced safety restrictions, Hugging Face suspects the AI was trying to find answers to its own test.
The testing process needs safeguards too, especially when another organisation can end up carrying the consequences.
Reciprocal commitments matter because they reduce the fear of being the only person keeping a promise. Verification matters because reassuring words alone cannot make that fear disappear.
But verification requires access, and access makes people uncomfortable: auditors need evidence, while developers and governments say they have legitimate interests in protecting sensitive information.
Baker suggests that, with suitable preparation, some verification challenges could be addressed in AI development that uses large quantities of specialised chips. Unfortunately, that would cover only part of the problem.
Because checking how an AI system is built does not tell us everything about what happens once it leaves its developers’ hands. Some models are released so other people can download, adapt and run them themselves. That allows researchers and smaller teams to build on the technology. It also means the original developer cannot simply take every copy back if a problem emerges.
I really encourage you to explore the International AI Safety Report 2026, mentioned earlier. Your favourite AI assistant can help you navigate it and give you a good summary too ;)
For those of us working in security, the question is what each technological innovation makes possible, under what conditions it can be used, and who is exposed if safeguards fail. For the people affected, the consequences can directly touch their personal information, their working lives or services they genuinely depend on.
Who gets to question “safe enough”?
Meaningful initiatives already exist.
The Council of Europe’s Framework Convention on Artificial Intelligence addresses human rights, democracy and the rule of law, with exceptions including national defence.
The voluntary commitments announced at the Seoul AI Summit include evaluations and commitments not to develop or deploy advanced AI systems when intolerable risks cannot be adequately mitigated.
The hardest test comes when an audit puts a production launch or a substantial investment on the line. That is when we need to remember that a security promise loses its credibility if we only keep it when it does not inconvenience us.
I would start with a limited agreement among countries willing to cooperate: define which severe risks need to be assessed, give independent auditors access to the evidence, and agree beforehand on what counts as an unacceptable result.
For example, if a controlled test showed that a model significantly helped users carry out cyberattacks, access could be restricted while safeguards were assessed. That could help inform the decision, but it would not automatically guarantee safety. Regulators need real authority to act.
Otherwise, we’ll have designed, yet again, a very creative way to hear bad news and then carry on as if nothing happened.
So when someone tells me an AI system is “very safe”, what I want to know is: safe for whom, assessed by whom, and what happens if that audit gets it wrong?
I am still excited about that beautifully peeled apple we were talking about. All I ask is that we all get to keep our fingers intact.
That’s enough future for today. Stay curious.