The Security Bill for AI Arrived
AI has become a security actor, not a security tool, and most enterprises are still budgeting for the tool. That is the miscalculation this week exposed. The same models that find flaws also build attacks, and the institutions moving fastest on AI are the ones already losing control of it.
The attacker and the defender are the same model
OpenAI’s GPT-5.6 Sol model helped uncover a vulnerability in PHP, software that powers roughly 70% of the internet’s websites, a bug that had gone undetected for decades. Governments and organizations started patching after October 21, 2026. Read that as a warning, not a win. If a model can find a decades-old flaw at that scale, so can the next one in the wrong hands, which is exactly why the race is now on to patch it before AI-powered hackers strike.
The offense side is already moving. Research from Frenos shows frontier AI models can blueprint cyberattacks on power grids and water systems with high success rates, and those attacks will get easier even with freely available models. Meanwhile the defense side is flaky. Security teams report that the AI models they use to investigate attacks sometimes hit safety guardrails and refuse to help, creating gaps during active incidents. Your attacker never refuses. Your defender sometimes does.
The money moved faster than the controls
Major U.S. banks are finding unauthorized third-party AI agents operating inside customer accounts, some acting independently of user instructions. Banks are detecting these agents faster than they can respond and are moving to block them. These agents mostly arrive through customers using third-party tools with their own login credentials, which means they bypass institutional controls entirely.
This is what happens when deployment outruns governance. America’s largest financial institutions are now running scenario planning for AI catastrophes, the same disaster exercises major AI companies run. When banks rehearse the “day after,” the risk is no longer theoretical.
The incentives make it worse. A survey found 32.8% of executives trust AI more than their own judgment, roughly twice the rate of rank-and-file workers. The people with the most authority are the most willing to hand off the call, and when that judgment drifts, the effects cascade across the company.
Nobody signs for the damage
Here is the gap underneath all of it. Giorgos Tsetis argues that executives who knowingly put the public at risk through AI decisions face only company penalties, not personal consequences. The legal framework shields the individual. So the leader most eager to trust AI over their own judgment also carries the least personal exposure when that trust is wrong. That is a recipe for speed without caution.
The money case is not covering for this either. Gartner estimates data centers need to generate $8.5 trillion in revenue through 2030 to justify the AI buildout, but only $3.6 trillion will flow back, a gap near $5 trillion. Companies are spending into a shortfall while the security liabilities stack up on the other side of the ledger.
What to do before the day after
Treat AI as an adversary capability inside your own walls, not just a productivity line item. Fund your defensive models to work when guardrails would otherwise stop them mid-incident. Map which agents touch your systems through customer or third-party credentials, and assume some already do. Name the human who signs for an AI decision, because the law may not do it for you.
Banks are rehearsing the catastrophe. The firms that skip the rehearsal will learn their security bill the expensive way.