Schneier on Security

Clive Robinson • August 11, 2026 2:25 PM

@ Bruce, ALL,

You make a couple of points with,

“If there is any vulnerability in anything, AIs are going to find and exploit them. Our cyber defensive game has to be dramatically improved…very fast.”

The first is as a result of being able to create “armies of agents” where as not long ago we were having trouble contending with just “armies of one” as attackers.

The “army of one” was possible because in action there was but a single set of instructions running on thousands of target / victim machines that were deficient, thus vulnerable. The attacker did not own or rent these target machines they belonged or were used by the victims.

Now we have “armies of agents” that are the flip side. Now we have AI agents by the tens if not hundreds of thousands attacking not by a single set of instructions but tens if not hundreds of thousands of variations of much more general almost inspecific or general instructions.

In effect we have moved from the age of detailed commands/orders to the “make it so” command nonsense of the 1980’s and 1990’s.

Whilst this will take some adjustment, there is good reason those in longer positions of command are mostly not daft enough to issue “make it so” commands.

We will unfortunately have to wait on the rest of the world to play “catch-up”.

Unless of course they get hooked on the “convenience factor”, if they do then we are all in effect doomed to the dire consequences that will result.

As for your second point,

We have to accept that we are but human, and have failings.

One such failing is whilst individuals might occasionally move fast, usually this is as a result of one of “The 5 F’s” of Flight, Fight, Faint, etc of the “autonomous system” not the conscious system that can be thousands of times slower, or incapable of coming to a rational, reasoned response at all.

The apparant “logical choice” will be to build “synthetic autonomous systems” by use of AI…

For reasons that will not fit in a single post to a thread this AI-v-AI situation will not end well. In fact it is almost guaranteed to be a disaster much as ECM, ECCM, ECCCM and nearly all other “arms races” have amply demonstrated in the past.

Heck even the alleged fate of the Sabertooth Tiger demonstrates what an “evolutionary cul-de-sac” and many similar overly specific evolutionary behaviours will destroy you.

The worst enemy of survival and security is loss of generality to specificity.

AI will give lots of specificity with limited close in fuzzing, what it won’t as easily give is broad generality.

It’s Current AI of LLM and ML Systems Achilles heel…

Thus highly trained and skilled humans are still very much required to make the intuitive leaps that LLM Fuzzing just does not make.