Extended Development Record - Equal Intelligence Does Not Mean Adequate Security

I’ll assess whether equal access to powerful AI actually gives defenders enough of an advantage—and whether releasing the strongest models faster could make defense harder.

**The major flaw is that equal access to intelligence does not necessarily produce an advantage for defense.** The proposal has a strong argument in its favor: powerful AI in many responsible hands could expose vulnerabilities, investigate abuse, and counter dangerous systems. But the conclusion that this makes “full speed ahead” safe requires several additional assumptions. I would separate three decisions: how quickly capabilities advance, how widely people can use them, and whether anyone can download and modify the weights. Those decisions need not move together. **1. Attackers and defenders may face very different tasks—even with identical models.** An attacker can sometimes choose the target, timing, and method, while defenders must protect many systems continuously. A successful defense of one organization does not protect a less prepared organization whose failure could harm others. That does **not** mean offense inevitably wins. Defenders also have advantages: they control legitimate infrastructure, can share intelligence, and sometimes fix a vulnerability once for millions of users. The relevant question is which advantages AI strengthens more. The February 2026 [International AI Safety Report](https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers) explicitly identifies the future balance between AI-enabled cyberattack and defense as unresolved. “Both sides get better tools” does not settle that balance. **2. Access to the same model does not mean equal effective power.** Running a model effectively also requires computing resources, reliable tools, relevant information, engineering, and organizational authority. Downloading the strongest model would not instantly give a small hospital the security capacity of a well-funded organization. This cuts both ways: governments and major infrastructure operators may have substantial defensive advantages. But openness alone does not determine where usable capability ends up. There is also a difference between having an assistant that identifies a problem and possessing the resources to fix it. A model might correctly recommend replacing vulnerable equipment, restructuring permissions, or redesigning a process. Implementing those changes could still take considerable time. **3. Capability can spread faster than protection can be installed.** This is a particular weakness of the **full-speed** component. Suppose a new model enables a previously difficult attack. Defenders might need to discover the vulnerability, validate a remedy, distribute it, and install it across numerous organizations. An attacker may only need to find one organization that has not completed that process. The reverse can also occur: AI may find vulnerabilities before adversaries do and accelerate remediation. The issue is timing. A release strategy therefore needs evidence that defensive adoption can keep pace with newly enabled threats. Making defensive tools available is only the beginning of deploying a defense. **4. Better defense per attack can coexist with greater total harm.** Imagine AI makes defenders considerably better at stopping each attempt—but also makes attempts much cheaper, more numerous, and easier to adapt. The overall outcome depends on both changes. A declining success rate for attackers does not necessarily mean declining expected damage. This becomes especially consequential when a small number of failures could have enormous effects. Preventing millions of ordinary incidents would not automatically compensate for enabling a qualitatively more destructive one. Whether such a threshold exists is an empirical question; the open-model argument cannot simply assume it away. **5. Open-weight release removes some options for correcting mistakes.** If a dangerous capability is discovered after unrestricted release, the developer generally cannot retrieve every copy or require everyone to adopt a safer version. Malicious users can retain the version they prefer. That does not make containment impossible: defenders can still protect infrastructure, revoke access, and disrupt particular operations. But it means some remedies available before release are no longer available afterward. The International AI Safety Report highlights both this irreversibility and the greater difficulty of maintaining safeguards on openly distributed weights. This creates an asymmetry: **the benefits of broad release can be pursued gradually, while some consequences of premature release cannot be reversed.** Open models can also support independent inspection and remediation. That is a real benefit—but discovering a dangerous capability after its unrestricted distribution may be too late to prevent its availability. **6. An army of defensive agents creates another control problem.** Your reference to rogue swarms is especially important. To counter systems acting rapidly across many environments, defenders might deploy their own agents with significant autonomy. Those defensive systems would need reliable ways to: - Recognize legitimate versus malicious activity. - Stay within their authority. - Coordinate without amplifying mistakes. - Remain interruptible and accountable. Being highly intelligent does not automatically establish those properties. A powerful defensive agent could misidentify an incident, take an excessive response, or interact badly with another defensive system. Multiple well-intentioned organizations could collectively produce an unstable response even without any deliberately hostile AI. Consequently, “good AI will police bad AI” partly depends on solving the reliability and control problems the strategy is supposed to help manage. It can be a component of the solution, but it cannot substitute for those solutions. **7. Some harms cannot be reliably repaired after detection.** The defensive analogy works best when threats are observable, intervention is fast, and damage is recoverable. Those conditions vary: | Setting | Why strong AI defense might help | What equal access does not guarantee | |---|---|---| | Software vulnerability | Find and fix the defect before exploitation | Timely adoption across exposed systems | | Fraud or manipulation | Detect patterns and verify claims | Recognition before consequential decisions | | Critical infrastructure | Monitor activity and constrain access | Recovery from every physical failure | | Biological threats | Improve detection, research, and response | A countermeasure arriving before widespread harm | | Rogue autonomous systems | Investigate, restrict, and interrupt operations | Finding every relevant instance before it acts | These are conditional mechanisms, not claims that present models can already cause every listed catastrophe. The concern is that **understanding an attack as well as its author does not necessarily provide an effective countermeasure in time.** **8. “More good actors than bad actors” does not automatically create coordinated defense.** Responsible actors have different responsibilities, budgets, information, and incentives. They cannot necessarily pool their capabilities as one organized defender. A company might protect itself while leaving costs elsewhere. Governments may disagree about which activity is hostile. Organizations may conceal incidents. Meanwhile, some malicious actors may cooperate effectively. Nor does broad access automatically create deterrence against rogue AI. Deterrence requires an actor that understands and cares about the threatened consequences. Equal capability alone does not establish that relationship. **The strongest case for openness nevertheless survives these objections.** Concentrating advanced AI in a few institutions creates its own risks: restricted scrutiny, abuse of power, dependence on particular providers, and inadequate access to defensive tools. Open weights can enable independent research, local adaptation, and protection that does not depend on a vendor’s permission. So these criticisms do not establish that closed development is safer. They establish that the comparison must concern **actual worldwide outcomes under different release strategies**. What I find least persuasive is the leap from “openness helps defenders” to “therefore the strongest models should be developed and released as quickly as possible.” Independent scrutiny needs time. Defensive deployment needs time. Discovering whether a model creates a new category of danger needs time. A credible version of your proposal would therefore need to show that, at each significant capability level, broader release strengthens effective defense more than it expands destructive opportunity—and that safeguards can manage the remaining failures. **Universal access could help create a safer balance of power. It could also create an arms race with many more opportunities for irreversible mistakes. The existence of capable, well-intentioned users does not by itself determine which equilibrium we get.**

I’ll weigh the costs of delaying beneficial AI alongside the safety and competitive risks, then propose a policy that distinguishes medical progress from the development and release of harder-to-control capabilities.

The health costs of delay should count, but the relevant estimate is how many deaths a particular restriction would actually cause by postponing effective treatments. The same discipline applies to safety: a restriction only earns credit for the risk it reduces globally. Medical research and dangerous biological capabilities can also overlap, so the policy needs controlled access rather than a blanket medical exemption.

**Under the assumptions we’ve been using, I would recommend continued AI development with binding safety requirements for dangerous training, deployments, and weight releases—combined with a major effort to accelerate medical research and other beneficial applications.** The costs of delay strengthen the case against an indiscriminate pause. They do not establish that unrestricted development and release is the fastest route to a better world. **Preventable deaths from delayed treatments belong in the calculation.** But we need to compare actual alternatives. We should count the additional deaths caused by a particular restriction delaying an effective, accessible treatment—not every death occurring while the restriction exists. Equally, a safety restriction should receive credit only for the *global risk reduction it produces*, including competitors’ responses. There is concrete reason to take medical benefits seriously. A [2025 randomized phase 2a trial](https://www.nature.com/articles/s41591-025-03743-2) studied an AI-discovered drug for pulmonary fibrosis and reported results supporting further investigation. Its small sample and short follow-up limited conclusions about long-term safety and efficacy. That is meaningful progress, while remaining far short of demonstrating that advanced AI will soon cure fatal diseases generally or reverse aging. I would include those more transformative possibilities in policy analysis, with uncertainty attached. Neither dismissing them nor treating them as guaranteed would be defensible. My recommendation would have six parts. **1. Continue frontier research under enforceable, independent scrutiny.** The US government should establish a technically competent federal evaluation function, with authority provided by Congress to inspect the highest-risk development programs and impose specific restrictions. Requirements should escalate with credible evidence of dangerous capability and exposure. Relevant concerns include the ability to facilitate catastrophic misuse, evade effective control, or conduct consequential autonomous operations. Model size or training compute can help identify programs requiring assessment, but should not be the sole definition of danger. Labs should provide independent evaluators with meaningful access, including confidential access where necessary. Their assessment should cover the whole system: the model, its tools, memory, permissions, monitoring, and deployment environment. **Restrictions should apply to training itself when the training or evaluation process credibly creates serious danger.** Where research can be conducted with adequate containment, it should continue. Keeping a model private is not sufficient protection if it can already act through an inadequately controlled research environment. This would require documented safety arguments, adversarial testing, incident reporting, and enforceable limits. It would not require proving that every possible jailbreak or alignment failure has been eliminated. **2. Make deployment and weight release separate decisions.** A model may be useful for supervised research before it is suitable for broad autonomous deployment. It may be suitable for a controlled service before unrestricted distribution of its weights is justified. I would favor the following default: | Situation | Recommended approach | |---|---| | Uses with manageable, demonstrated risks | Expand access rapidly. | | Promising applications with unresolved consequential risks | Permit controlled research and limited deployments that generate evidence. | | Systems approaching severe misuse or loss-of-control thresholds | Require independent review and stronger containment before expansion. | | Weight releases that would irreversibly distribute inadequately controlled catastrophic capabilities | Withhold unrestricted release while enabling appropriately controlled research access. | The rules should apply to domestic and foreign systems used in consequential US settings, rather than assuming American origin implies safety. Open models should remain an important part of the ecosystem. Independent inspection, competition, reproducibility, and local adaptation have value. Restrictions should therefore depend on the particular risk—not simply whether a model is open, or whether its developer is a small company. **3. Treat accelerating health benefits as an explicit government responsibility.** A safety policy should be accompanied by funding and institutional changes intended to reduce the costs it imposes. I would support NIH, FDA, universities, hospitals, and industry working on: - High-quality research data and secure computing access. - Experimental validation of AI-generated hypotheses. - Better trial recruitment, trial operations, and evidence analysis. - Regulatory capacity to evaluate useful innovations promptly. - Manufacturing and access arrangements that turn discoveries into treatments people receive. The objective should be shorter time to demonstrated health benefit. Producing more candidate molecules or research papers is valuable only insofar as it helps achieve that objective. This does **not** permit a blanket “medical research” exemption. The [International AI Safety Report](https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers) notes that some capabilities useful for medical research can also support dangerous biological uses. Controlled access and oversight may therefore be necessary precisely because a capability is powerful and medically valuable. Nor can we assume all medical progress can be separated from general frontier advances. Where a restriction delays both, that cost should be estimated and openly acknowledged. **4. Invest heavily in defenses that remain useful when foreign models catch up.** The government should help critical institutions deploy stronger cybersecurity, access controls, monitoring, recovery systems, and appropriately tested defensive AI. Leading labs should contribute to this work, including by making capable defensive tools accessible beyond their largest customers. Hospitals, utilities, municipalities, and small businesses should not be expected to defend themselves merely because a powerful model is available somewhere. The crucial design principle is that protection should remain effective when an attacking model is uncooperative. Safety cannot rest entirely on the attacker’s developer maintaining its refusal behavior. Defensive agents themselves would need constrained authority and independent checks. Giving a security agent unlimited access because it is “on our side” would recreate the control problem. **5. Preserve US capability while pursuing specific, verifiable international agreements.** I would make US–China safety cooperation a serious national-security priority, focused on shared catastrophic hazards rather than agreement on every political value. The most useful starting points would be specific practices: reporting serious incidents, protecting unreleased weights, evaluating particular dangerous capabilities, and agreeing on conditions that trigger restrictions. Verification and incentives would matter more than broad declarations. Meanwhile, the US should preserve a strong research base, computing infrastructure, independent research community, and capacity to develop defensive systems. Foreign advances should trigger reassessment of US restrictions. They should not automatically override them. The relevant question is whether changing a restriction reduces global danger—not whether it restores a leaderboard position. Likewise, a domestic restriction should not persist simply because it sounds cautious if evidence shows that it transfers risk abroad without improving preparedness. **6. Make regulation accountable for both safety failures and unnecessary delay.** For government, that means published criteria, independent expertise, review deadlines, appeals, support for smaller researchers, and periodic evaluation of whether requirements are accomplishing their purpose. Deadlines should require timely decisions, not force approval of an unsafe release. For labs, it means precommitted escalation procedures, protected internal reporting, strong security, and independent authority to stop a dangerous step. Safety commitments should not become optional whenever a competitor announces a stronger model. Both sides should report evidence about the consequences of their decisions: incidents prevented or enabled, defensive deployment, research delays, and progress toward real-world benefits. **There is a hard tradeoff this approach cannot eliminate.** Some safeguards will delay valuable work. Some beneficial advances will increase dangerous capabilities. Some restrictions will be difficult to enforce internationally. “Targeted regulation” is only a useful answer if it is technically competent enough to manage those overlaps. Still, accepting your stipulated **10% extinction risk** would justify substantial intervention. Potential future cures do not make that risk acceptable by default; extinction would also eliminate the possibility of delivering those cures. Conversely, invoking extinction cannot justify any restriction regardless of whether it actually helps. **I would accept some delay in frontier capability growth when there is a credible case that it substantially reduces global catastrophic risk. I would simultaneously require an aggressive effort to preserve and accelerate the benefits that can be delivered under effective control.** That gives government and labs responsibility for both sides of the ledger: avoiding catastrophe and avoiding preventable suffering caused by unnecessarily slow progress.

I’ll center the thesis on the leap from shared access to shared safety, and phrase the opening so it doesn’t depend on proving that the entire industry has changed its position.

I’m using the writing-blocks skill for a paste-ready thesis. The claim will be that equal access to AI does not establish that defenders can keep pace with the risks it introduces.

I’d center the essay on this claim: **Equal access to intelligence does not guarantee an advantage for defense.** Warnings from within the AI industry that capabilities are outpacing control expose a weakness in the promise of frontier models for everyone. Open access can strengthen defenders, but distributing powerful intelligence does not automatically distribute the resources, coordination, and reliable safeguards needed to contain it. Attackers and defenders face different burdens, protection takes time to deploy, and released weights cannot reliably be recalled. As increasingly autonomous systems proliferate, the case for unrestricted release must demonstrate that defensive gains will outpace the expansion of malicious use, accidents, and loss of control. “The good guys will have AI too” leaves that central question unanswered. This gives the essay a clear burden of argument: **the benefits of openness do not, by themselves, justify releasing every capability as quickly and widely as possible.** You can acknowledge independent scrutiny, innovation, and defensive access while examining the asymmetries and irreversible risks. I would use **“warnings from within the industry”** rather than **“the industry’s center of mass has shifted”** unless the opening establishes that broader shift with evidence. The thesis remains strong without depending on an industry-wide consensus. And I’d describe the swarm concern as **“uncontrolled autonomous systems”** initially. That covers malicious agents, accidental failures, and systems pursuing unintended objectives without assuming they all have deliberately nefarious goals.

I’ll keep the thesis intact, pressure-test its strongest objections, then build an 800–1,200-word draft around the few arguments that carry the most weight. I’ll use the documents skill to deliver the critique, outline, and op-ed together.

The strongest objection is that defense can scale: one fix can protect millions of systems. The essay needs to confront that directly. I found a concrete way to sharpen the argument: WannaCry caused widespread NHS disruption despite advance warnings to patch. Access to a remedy and protection in practice are different things. I also found Zuckerberg’s own argument that institutions with more computing power can contain smaller bad actors. That gives us a substantive position to challenge.

The draft is about 1,000 words. Its central argument is that defenders need the authority, resources, and time to turn intelligence into protection—and releasing model weights can remove options for responding when safeguards fail. It also takes the strongest case for openness seriously: independent scrutiny and defensive tools that can protect many people at once.

Your thesis stays unchanged. The draft below is **972 words**. **Pressure-test.** A critic can concede every word of your thesis and still favor unrestricted access. The essay must overcome that objection. - **“Does not guarantee” cannot do all the work.** Nothing guarantees security. Your substantive argument must show why equal access leaves important defensive requirements unmet. - **Defense can scale better than offense.** One fix can protect millions of systems. Avoid the familiar but misleading claim that attackers need to succeed once while defenders must always succeed. - **Openness has real safety benefits.** Independent scrutiny and wider access can improve protection. Exposing weaknesses in open distribution does not establish that closed providers are safer. - **Restrictions have costs.** Foreign releases could undermine withholding, while delayed access could impede defensive and medical advances. Any restriction needs a credible benefit against those alternatives. - **Keep the evidence within its limits.** Historical security failures illustrate mechanisms; they do not prove impending AI catastrophe. The piece gains credibility by dropping unsupported claims of industry consensus or a settled extinction probability. **Structure.** - **Lede:** WannaCry disrupted hospitals despite advance warnings to patch. - **Nut graph:** State your thesis and distinguish possessing intelligence from delivering protection. - **Evidence:** Deployment failures, safeguards weakened through modification, and the inability to recall distributed weights. - **“To be sure”:** Acknowledge independent scrutiny and the enormous potential for defensive gains; insist on evidence that those gains reach exposed systems. - **Kicker:** Return to the patient whose hospital needed protection before the attack. **The Good Guys Need More Than AI** Before the WannaCry ransomware attack disrupted England’s National Health Service in 2017, officials had warned hospitals to patch their systems. The warnings went out in March and April. The attack arrived in May. Thousands of appointments were canceled. Britain’s [National Audit Office](https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/) later found that the government had no formal mechanism for checking whether local NHS organizations had followed its advice. Knowing how to prevent the attack had not ensured that hospitals were protected. That gap belongs at the center of the argument over releasing the most powerful AI models for anyone to download and modify. The case for doing so has an appealing logic: malicious actors will acquire advanced AI anyway, so give defenders the same capabilities. More capable institutions, backed by greater resources, can keep dangerous actors in check. Equal access to intelligence does not guarantee an advantage for defense. Security depends on whether someone can turn that intelligence into effective protection, where it is needed, before an attack succeeds. As AI systems gain the ability to act with less supervision, the consequences of confusing access with protection become more serious. In a [2024 essay](https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/), Mark Zuckerberg argued that access to similar generations of AI would allow governments and institutions with more computing resources to check smaller bad actors. He also advocated testing and mitigating risks before release. His argument about computing power deserves scrutiny on its own terms. It assumes that institutional strength will translate into effective defense across the places attackers can reach. A hospital may have access to an exceptional security model and still operate equipment it cannot quickly replace. A utility may understand a vulnerability but need to test a repair before interrupting an essential service. Intelligence can identify these constraints and help resolve them. Giving everyone the same model does not make the constraints disappear. Attackers can choose among exposed targets. Defenders are responsible for the particular systems entrusted to them, including old equipment and poorly funded organizations. AI could automate much of that protective work. But until it does so reliably, access to better analysis can coexist with an expanding supply of attacks. The security case for a release depends on whether its added defensive benefits outweigh the additional harm it enables. The [International AI Safety Report 2026](https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers) identifies whether AI will benefit cyberattackers or defenders more as an open question. That uncertainty is consequential. A policy of unrestricted release cannot establish its safety merely by pointing to the existence of powerful defensive applications. Open weights also change what happens after a mistake. These downloadable model parameters allow recipients to run and modify a system independently. Once copies have spread, the developer cannot reliably withdraw them. Discovering a dangerous capability after release leaves a different set of options from discovering it in a service whose operator can suspend access. Nor can the developer assume that safeguards supplied with a model will survive modification. In [research published in 2023](https://arxiv.org/abs/2310.03693), Xiangyu Qi and colleagues showed that fine-tuning could weaken safety protections in the models they tested, including through otherwise benign customization. A safety review limited to the original model misses the versions users can create. Defenders can still improve their systems after a release. But malicious users need not accept an update, and the public cannot count on a developer retaining control over privately modified copies. Releasing weights therefore commits society to managing capabilities that may remain available long after the assumptions used to justify their release have changed. Increasing autonomy adds another complication. Answering an uncontrolled AI agent with a defensive agent only works if the defender can be trusted to act within its authority. A system allowed to disable accounts or shut down infrastructure needs controls against mistakes and manipulation. Otherwise, the proposed remedy creates another powerful actor whose behavior requires supervision. More copies of a capable model do not settle that problem. To be sure, open models can strengthen independent research and give defenders options beyond a handful of vendors. Defense can also scale spectacularly: a researcher helped arrest WannaCry’s spread by activating a [kill switch](https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/). One successful intervention can protect many potential victims. These are substantial reasons to support openness. They also show what matters: an effective intervention deployed in time. Counting how many people can obtain a model tells us much less. Restrictions carry costs, too. Denying researchers useful tools can impede safety work. Delayed access could postpone medical discoveries. Foreign developers may release comparable capabilities, eroding the benefit of withholding a domestic model. Any proposed restriction must account for those consequences. But they do not establish that immediate, unrestricted distribution of every new capability produces the safest outcome. The practical response is to test that proposition before an irreversible release. For models with capabilities that could enable severe harm, independent evaluators should examine realistic misuse alongside defensive performance, including the time and resources needed to deploy protection. Evaluations should test modified systems where feasible, rather than treating the developer’s preferred configuration as the only one that matters. Access for outside researchers is essential to making that scrutiny credible. Where evidence shows that defenses can contain the added danger, broad release has a stronger case. Where it does not, staged access can preserve opportunities for research while keeping more options open. The standard should be credible evidence of manageable risk, with explicit attention to the costs of withholding. Demanding perfect safety would make the standard impossible; assuming that equal access provides safety would make it meaningless. The people defending hospitals and infrastructure deserve the best tools we can responsibly give them. They also need those tools to work under the conditions they actually face. Before we release capabilities we cannot retrieve, we should require more than confidence that the good guys will download them too. A defense available in principle offers little comfort to the patient whose hospital needed it yesterday. [Equal_Access_to_Intelligence_Op_Ed.docx](sandbox:/workspace/scratch/aa1c79331bec/Equal_Access_to_Intelligence_Op_Ed.docx)

Yes. The revision needs to show why equally capable AI can produce unequal security outcomes: attackers can choose targets and timing, while defenders must keep specific systems operating safely. I’ll build the essay around those asymmetries and directly address the argument that powerful AI for everyone will make its own defenses sufficient.

I’m holding the AI capability constant, including its ability to act. The revised argument focuses on differences that remain: attackers can select targets, disruption can count as success, defenders must infer intent from incomplete evidence, and identifying harm does not necessarily reverse it. Open weights and autonomous defensive agents add further limits on control.

The revision is 1,017 words. It now makes the equal-capability comparison directly, with separate explanations of the disadvantages defenders face. I’ve kept the strongest counterargument—one defensive fix can protect millions—so the essay challenges automatic confidence in openness without claiming that offense always wins.

Yes. The crucial comparison holds intelligence and agency constant, then examines the different tasks and constraints each side faces. This revision makes those asymmetries the organizing argument. **Equal Intelligence Does Not Mean Equal Security** Give an attacker and a hospital’s security team the same advanced AI, with the same reasoning ability and capacity to act. The attacker can choose when to strike, which system to target and whether to abandon an attempt. The hospital must keep treating patients while protecting the systems it already has. This is the problem with a reassuring argument for maximum AI acceleration: develop the strongest models as quickly as possible, make them freely downloadable and modifiable, and let good institutions and individuals use them to contain malicious actors. Even if attackers obtain equally powerful AI, the good guys will have it too. Equal access to intelligence does not guarantee an advantage for defense. Even granting comparable computing resources, the two sides face different tasks. Giving them identical tools does not equalize their objectives, the information available to them or the consequences of their mistakes. [Mark Zuckerberg has argued](https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/) that access to similar generations of models would allow institutions with greater computing resources to check smaller bad actors. He also supports testing and mitigation before release. Institutions can have real advantages. But aggregate strength does not automatically protect every place an attacker can reach. Start with target selection. Attackers can search for a weak organization, an overlooked supplier or a poorly protected connection between systems. Defenders inherit the particular hospital, business or public service they are responsible for. A failed attempt can send an attacker elsewhere; a vulnerable hospital cannot simply choose to stop being a hospital. Better AI helps both sides, but their freedom to choose the contest remains unequal. Their standards of success differ, too. An attacker seeking disruption may succeed by making a service unreliable. The defender must distinguish harmful activity from legitimate work while keeping that service available. An AI that blocks every transaction could stop fraud by making a bank unusable. The attacker may welcome that outcome. The bank’s customers will not. Protecting a functioning institution requires judgments that indiscriminate disruption does not. Identical intelligence also does not mean identical information. A malicious actor knows what they intend. The defender must infer intent from behavior that may resemble legitimate activity. Even a brilliant model cannot extract certainty from evidence that does not resolve the question. Strong authentication and careful system design can reduce this disadvantage. Merely handing both sides the same model cannot supply the missing evidence. Then there is the difference between causing harm and reversing it. Discovering that private information has been stolen cannot make the thief forget it. Identifying an attack does not restore treatment a patient missed during an outage. If AI accelerates the development of a biological threat, equally intelligent researchers would still need time to test, manufacture and deliver countermeasures. Intelligence can shorten some delays. It cannot make every protective action instantaneous. Nor do the resources of all well-intentioned users form a single defensive force. One institution’s model cannot automatically secure another institution’s network. Doing so requires access, trust and authority to act. AI may make cooperation easier, but giving an agent control over someone else’s critical systems is itself a consequential security decision. The number of good people using AI tells us little about whether help reaches a particular target in time. Open weights add a further asymmetry. Responsible operators have reasons to preserve safeguards; malicious operators have reasons to weaken them. In [2023 research](https://arxiv.org/abs/2310.03693), Xiangyu Qi and colleagues showed that fine-tuning could degrade safety protections in the models they tested. Making a model available for unrestricted modification therefore does not make its original safeguards equally binding on everyone who uses it. Once copies have spread, the developer cannot reliably recall them. Defenders can adopt improved versions, but an attacker need not accept an update that restricts harmful behavior. A release can leave society managing dangerous capabilities long after the developer has recognized a problem. The ability to improve tomorrow’s model does not withdraw yesterday’s copies. The proposed answer to rogue AI agents often repeats the same assumption: deploy equally powerful agents to police them. That could help. But a defensive agent permitted to disable accounts or interrupt infrastructure must act reliably within its authority. A destructive agent can tolerate outcomes that a legitimate defender must avoid. Calling a system a defender does not establish that it can make those distinctions safely. Equal capability supplies no guarantee of reliable control. To be sure, defense has powerful advantages of its own. One repair can protect millions of systems. Defenders can control infrastructure, share information and use AI to find weaknesses before attackers do. Open models support independent scrutiny and reduce dependence on a handful of vendors. These benefits are substantial. They are reasons to develop and distribute useful defensive capabilities, and they can make particular releases beneficial. Those benefits do not establish that unrestricted release at maximum speed makes society safer. The [International AI Safety Report 2026](https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers) identifies whether AI will benefit cyberattackers or defenders more as an open question. The balance must be investigated for the actual capabilities involved. It cannot be inferred from the fact that both sides have access. The asymmetries survive whether attackers use an American release or an equally capable Chinese model. A foreign release may weaken the case for withholding a domestic model. Delayed access may also postpone beneficial discoveries. Those costs belong in the decision. But they do not turn unrestricted distribution into a defense against the capabilities being distributed. The relevant test is whether a release’s defensive benefits outweigh the additional harm it enables. That requires evidence about protection under realistic conditions: whether exposed institutions can deploy it, whether it remains effective against modified models, and whether defensive agents can intervene without causing unacceptable damage themselves. Independent researchers need meaningful access to evaluate those claims. Where the evidence is inadequate, staged access preserves options that publishing downloadable weights gives up. Advocates of unrestricted release owe us an account of why defensive gains will outweigh these disadvantages. Counting the institutions that could download a model does not supply one. The hospital and the attacker may possess the same intelligence. Only one of them has to keep the hospital running. [Equal_Access_to_Intelligence_Op_Ed.docx](sandbox:/workspace/scratch/aa1c79331bec/Equal_Access_to_Intelligence_Op_Ed.docx)

I’ll cut repetition and simplify the language while keeping the thesis, key examples, and counterargument.

The essay is now 801 words, down from 1,017. I’ve kept the concrete examples and sources, shortened the explanations, and reduced the policy discussion.

**Equal Intelligence Does Not Mean Equal Security** Give an attacker and a hospital’s security team the same advanced AI. Let both systems reason and act equally well. The attacker can choose where and when to strike. The hospital must protect its systems while continuing to treat patients. That difference exposes a flaw in the argument for developing AI as fast as possible and releasing its full capabilities to everyone. The promise is straightforward: even if criminals get powerful AI, good institutions and individuals will have the same tools to stop them. **Equal access to intelligence does not guarantee an advantage for defense.** Even with equally capable models and comparable computing resources, attackers and defenders face different demands. In a [2024 essay](https://about.fb.com/news/2024/07/open-source-ai-is-the-path-forward/), Mark Zuckerberg argued that institutions with more computing power could check smaller bad actors if both had access to similar generations of models. He also supported testing and mitigation before release. That resource advantage can matter. But computing power concentrated in strong institutions does not automatically protect weaker organizations that attackers can choose instead. Attackers can choose their targets. They can search for a vulnerable organization, supplier or connection between systems. Defenders must protect the institution they already operate, including its old equipment and outside dependencies. An attacker can abandon a difficult target. A hospital cannot abandon its patients. The strongest defenses at one institution do little for an attacker’s next target unless those protections reach it too. Attackers seeking disruption also face a simpler test of success. Making a service unreliable may be enough. Defenders must stop harmful activity while allowing legitimate work to continue. An AI that blocks every transaction could prevent fraud by making a bank unusable. That could satisfy an attacker while failing everyone the bank serves. A defense that causes the disruption it was meant to prevent has not succeeded. The two sides also have different information. An attacker knows the purpose of an attack. A defender must infer that purpose from activity that may look legitimate. Better AI can improve those judgments, but it cannot reliably determine intent when the available evidence does not distinguish an attack from ordinary use. Giving both sides the same model does not give them the same facts. Harm can also be irreversible. Detecting a data leak cannot restore lost privacy. Recognizing an attack cannot recover treatment a patient missed during an outage. If AI helps create a biological threat, equally intelligent researchers would still need time to test, manufacture and distribute countermeasures. Faster thinking does not make every physical response instantaneous. Nor do millions of well-intentioned AI users automatically form a coordinated defense. One institution’s model cannot secure another’s network without access and permission. Sharing control of critical systems introduces risks of its own. What matters is whether effective protection reaches an exposed target in time, not how many people own a capable model. Open weights let users download and modify a model, creating another problem. Responsible operators have reasons to preserve safeguards; malicious operators have reasons to remove them. [Research published in 2023](https://arxiv.org/abs/2310.03693) showed that further training could weaken safety protections in the models tested. Safeguards present at release need not survive modification. Once copies spread, developers cannot reliably recall them. They can offer safer versions, but malicious users need not accept updates. Fixing tomorrow’s model does not withdraw yesterday’s dangerous copies. Using defensive AI agents to police rogue agents raises similar questions. A defender authorized to disable accounts or shut down systems must avoid harming legitimate users. It must also follow instructions and resist manipulation. Matching a rogue agent’s intelligence does not establish that the defender will act reliably or stay within its authority. Defense has substantial advantages, too. One repair can protect millions of systems. Defenders control infrastructure and can share information. AI can help them find weaknesses before attackers do. Open models allow independent scrutiny and reduce dependence on a few vendors. These benefits can make broad access safer than restricting it. But they do not establish that unrestricted release at maximum speed makes society safer. The [International AI Safety Report 2026](https://internationalaisafetyreport.org/publication/2026-report-extended-summary-policymakers) identifies whether AI will benefit cyberattackers or defenders more as an open question. Equal access alone does not answer it. These problems remain whether attackers use American models or equally capable Chinese ones. Foreign releases can weaken the case for withholding domestic models, and restrictions can delay beneficial discoveries. Those costs matter. They do not eliminate the disadvantages defenders face. The test is whether a release’s defensive benefits outweigh the additional harm it enables. Developers should demonstrate protection under realistic conditions, including against modified models, and give independent researchers meaningful access to test their claims. Where evidence is inadequate, staged access preserves options that publishing downloadable weights gives up. The hospital and the attacker may possess the same intelligence. Only one of them has to keep the hospital running. [Equal_Access_to_Intelligence_Op_Ed.docx](sandbox:/workspace/scratch/aa1c79331bec/Equal_Access_to_Intelligence_Op_Ed.docx)