Issue 28 · September 13, 2026

Equal Intelligence Does Not Mean Adequate Security

Equal access to intelligence does not guarantee an advantage for defense.

Give an attacker and a hospital’s security team the same advanced AI. Let both systems reason and act equally well. The attacker can choose where and when to strike. The hospital must protect its systems while continuing to treat patients.

That difference exposes a flaw in the argument for developing AI as fast as possible and releasing its full capabilities to everyone. The promise is straightforward: even if criminals get powerful AI, good institutions and individuals will have the same tools to stop them.

Equal access to intelligence does not guarantee an advantage for defense. Even with equally capable models and comparable computing resources, attackers and defenders face different demands.

In a 2024 essay, Mark Zuckerberg argued that institutions with more computing power could check smaller bad actors if both had access to similar generations of models. He also supported testing and mitigation before release. That resource advantage can matter. But computing power concentrated in strong institutions does not automatically protect weaker organizations that attackers can choose instead. [1]

Attackers can choose their targets. They can search for a vulnerable organization, supplier or connection between systems. Defenders must protect the institution they already operate, including its old equipment and outside dependencies. An attacker can abandon a difficult target. A hospital cannot abandon its patients. The strongest defenses at one institution do little for an attacker’s next target unless those protections reach it too.

Attackers seeking disruption also face a simpler test of success. Making a service unreliable may be enough. Defenders must stop harmful activity while allowing legitimate work to continue. An AI that blocks every transaction could prevent fraud by making a bank unusable. That could satisfy an attacker while failing everyone the bank serves. A defense that causes the disruption it was meant to prevent has not succeeded.

The two sides also have different information. An attacker knows the purpose of an attack. A defender must infer that purpose from activity that may look legitimate. Better AI can improve those judgments, but it cannot reliably determine intent when the available evidence does not distinguish an attack from ordinary use. Giving both sides the same model does not give them the same facts.

Harm can also be irreversible. Detecting a data leak cannot restore lost privacy. Recognizing an attack cannot recover treatment a patient missed during an outage. If AI helps create a biological threat, equally intelligent researchers would still need time to test, manufacture and distribute countermeasures. Faster thinking does not make every physical response instantaneous.

Nor do millions of well-intentioned AI users automatically form a coordinated defense. One institution’s model cannot secure another’s network without access and permission. Sharing control of critical systems introduces risks of its own. What matters is whether effective protection reaches an exposed target in time, not how many people own a capable model.

Open weights let users download and modify a model, creating another problem. Responsible operators have reasons to preserve safeguards; malicious operators have reasons to remove them. Research published in 2023 showed that further training could weaken safety protections in the models tested. Safeguards present at release need not survive modification. [2]

Once copies spread, developers cannot reliably recall them. They can offer safer versions, but malicious users need not accept updates. Fixing tomorrow’s model does not withdraw yesterday’s dangerous copies.

Using defensive AI agents to police rogue agents raises similar questions. A defender authorized to disable accounts or shut down systems must avoid harming legitimate users. It must also follow instructions and resist manipulation. Matching a rogue agent’s intelligence does not establish that the defender will act reliably or stay within its authority.

Defense has substantial advantages, too. One repair can protect millions of systems. Defenders control infrastructure and can share information. AI can help them find weaknesses before attackers do. Open models allow independent scrutiny and reduce dependence on a few vendors. These benefits can make broad access safer than restricting it.

But they do not establish that unrestricted release at maximum speed makes society safer. The International AI Safety Report 2026 identifies whether AI will benefit cyberattackers or defenders more as an open question. Equal access alone does not answer it. [3]

These problems remain whether attackers use American models or equally capable Chinese ones. Foreign releases can weaken the case for withholding domestic models, and restrictions can delay beneficial discoveries. Those costs matter. They do not eliminate the disadvantages defenders face.

The test is whether a release’s defensive benefits outweigh the additional harm it enables. Developers should demonstrate protection under realistic conditions, including against modified models, and give independent researchers meaningful access to test their claims. Where evidence is inadequate, staged access preserves options that publishing downloadable weights gives up.

The hospital and the attacker may possess the same intelligence. Only one of them has to keep the hospital running.

Sources

[1] Mark Zuckerberg, Open Source AI Is the Path Forward, Meta, July 23, 2024. https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/.

[2] Xiangyu Qi et al., Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!, arXiv:2310.03693 (2023). https://arxiv.org/abs/2310.03693.

[3] International AI Safety Report 2026, executive summary. Whether attackers or defenders will benefit more from AI assistance remains uncertain. https://internationalaisafetyreport.org/publication/2026-report-executive-summary.