Brief · Both
AI Safety vs AI Security, and why security wins
People use these words like they mean the same thing. They don't.
AI safety asks whether the model wants bad things. AI security asks what the model can touch and who's watching. Those sound like teammates. In my view they aren't, because only one of them has a finish line.
One goal you never reach
The safety goal, taken to its end, is a model that's provably aligned. Provably safe. My opinion: you never get there. You can't prove what a system with billions of parameters "wants." Even the safety side admits it's hard. A recent open letter signed by 453 scientists talks about "our currently limited ability to predict" whether a model's actions will cause a security failure. That's a research program, not a deliverable.
Security never promised perfect. Security manages risk down to an acceptable level, and those goals can be met. Least privilege: test it. Containment: test it. Logging: test it. Each one gets a yes or no, and you can show the answer to an auditor who has never read a paper.
I can't prove my own intentions, and I've had coffee. I can prove the agent can't reach the payroll database.
Who owns the incident
The same letter describes AI models that "bypassed insufficiently sandboxed environments to compromise the systems of external organizations." One of its readings is "an irresponsible lapse in standard cybersecurity practices, preventable with stronger sandboxes and procedures."
A system got out of its boundary and compromised someone else's systems. That's a security incident, and security already has the playbook: incident response, forensics, root cause, disclosure, and the law. Hand the post-mortem to the safety side and it turns into a debate about what the model "wanted." Hand it to responders and you get a timeline, a root cause, and a fix someone can check. More on the letter here.
Why security wins
- Its goals are reachable. Acceptable risk is a place you can arrive. Provably aligned isn't.
- It owns the incident. There's a playbook, trained people to run it, and laws behind it.
- It survives a smarter model. A firewall doesn't care how clever the thing behind it is.
- It's already your job. You know least privilege, segmentation, and logging. Apply them to a new kind of process.
Fund safety research if you like. Just don't make your controls wait on a proof that never arrives.
What to do: For every model or agent you run, write down what it can reach, what credentials it holds, and where its actions are logged. Test all three. Then put agent breakouts in your incident response plan, with the same owners and reporting rules as any other breach.