Blue AI and red AI in cyber don't cancel out—program analysis has theoretical limits, says Saxe
joshua_saxe · x · 2026-09-13
Security researcher Joshua Saxe argues that blue-team and red-team AI in cybersecurity don't simply cancel each other out like a simplified RTS game model.
- Theoretical limits of program analysis and distributed code (parts living on unanalyzable third-party SaaS) make it impossible to guarantee finding and fixing all bugs
- Even blocking vulnerability exploitation, attackers can get in via social engineering and implant just-in-time malware
- Detecting such malware and its C2 channels may require solving unsolved problems in program analysis or cryptanalysis
The thread discusses getting open-weights cyber policies (like Astra) right, with replies advocating a red-team + blue-team defense-in-depth mix.
Related event: Cybersecurity Experts Debate AI Offense-Defense and Inference-Layer Rules(4 posts)→
More from AGI Musings
- Bootstrapping competitive edge with frontier tokens — curious_vii · 2026-10-31
- Carbon chauvinism: 'You're software, and so is Claude' — LeviTurk · 2026-10-31
- Creator finishes cyberspace trilogy starring Claude: 'You're software, and so is Claude' — LeviTurk · 2026-10-31
- Walden Robotics CTO: general-purpose robot manipulation is having its 'GPT moment' — adnothing · 2026-10-30
- AI isn't eliminating developers, it's changing their roles, argues analyst — DavidLinthicum · 2026-10-30
- Goldman Sachs says AI will eliminate nearly 15 million jobs — saibharadwaj · 2026-10-30