推文警告网络安全风险由攻防能力共同决定，系统无法做到"100% 安全"，持续防御成为必需。近期 Cloudflare 与 Microsoft 披露的恶意活动正凸显"防御者鸿沟"压力，缺乏先进防御工具的组织难以跟上。作者预计未来 24/7 安全智能体将承担防御，但担忧许多人无法获得或负担这类保护，并称这是网络安全防御方案的巨大机会。
You have been warned 💀
The internet isn't safe, and it never will be (and it never was)
Cybersecurity risks aren't only determined by the level of cyber defense you have, but by the capabilities available for a cyber offense (Check NIST’s risk framework).
It is not possible to make the system "100% secure", and that implies "continuous defense" will be required.
In the future, 24/7 security agents will likely offer such defense. My concern is that many won't be able to access or afford such protection.
Recent security vulnerability announcements are a direct consequence of the "Defenders Gap" (Cloudflare and Microsoft's reported malicious activity highlights the pressure on defenders).
In fact, it's even worse now, as these incidents have shown. Organizations without access to advanced defensive tools may struggle to keep up.
Cyber Defense is named "defense" for a reason, as these threats may pose a real monetary impact on the economy.
If we think of programs like Daybreak as a way for AI labs to pay a "security tax," it becomes clear we have a huge supply-and-demand gap in this area.
This is the gap between the protection governments need to provide to businesses and individuals and what they currently provide.
Cybersecurity risks affect companies worth billions. Soon, tons of rogue agents will be running across the internet, trying to breach whatever they can (speculation).
At some point, these incidents will be happening almost daily. This will affect normies' day-to-day lives, too. Yet, it is an unmatched opportunity to provide cyber defense solutions.
YOU ARE NOT PREPARED!
This is a "Defender's gap" chart that OpenAI published recently. It shows the gap between defenders' capabilities and attackers' capabilities from a cybersecurity POV. This also translates to a gap between proprietary and open AI models. What Dario is proposing is closely related: "Thus, a key part of pacing within democracies is to keep democracies’ AI lead over autocracies as large as possible, to give us the breathing room we need in order to pace effectively." In other words, Anthropic and OpenAI want to widen the "gap" between what their AI can do and what the rest of the world can do. This doesn't necessarily mean that they will stop AI development and training. What this leads to is: - Anthropic, OpenAI, and other frontier labs will need to work together to make sure that every lab maintains alignment standards. - These labs will continue using RSI to advance their internal models with "employee-like access". - These models WON'T be released to the public until the "gap" is sufficient and until alignment standards are met. What about China? > "Distillation of frontier models allows lagging companies to narrow the gap using a fraction of the cost it would take to develop their own AI independently." > "If we execute these measures well, I believe they would slow China’s progress enough to widen America’s lead significantly over the next 3–5 years — the window when AI becomes geopolitically most important." The assumption behind these measures is simple: without being able to distill frontier models, it will take China significantly longer to close the gap with top-tier models. All the above may fay fail. China may or may not take the lead in AI progress. Yet, it's not a surprise that AI can already be used as a cybersecurity weapon. Note that the top point on the "frontier" line describes defenders' capabilities available to companies with Daybreak access and similar. However, the top point on the "open-weight" line is accessible to everyone. Even with current levels of intelligence, we will start seeing more and more major security incidents around the globe. > “Everything that makes it successful is exactly what makes it dangerous.” Monitoring 👀👀👀在 X 查看被引用的帖子
来源：🚨 AI News | TestingCatalog · x.com