Analysis: Why AI companies can postpone launches for cybersecurity risks

The dilemma between innovation and security in specialized AI models

The artificial intelligence sector faces a growing debate on how to deal with models that demonstrate advanced capabilities in sensitive areas such as cybersecurity. Experts and industry companies discuss scenarios where public launch of certain technologies could be delayed or restricted due to potential risks.

The issue gained relevance after several language models demonstrated increasingly sophisticated skills in code analysis and pattern identification in computer systems — capabilities that naturally extend to software vulnerabilities detection.

Emerging capabilities in security analysis concern sector

According to safety researchers consulted by the industry, state-of-the-art language models already demonstrate competence in tasks related to code analysis, including identification of patterns that may indicate vulnerabilities.

" We are observing that LLMs [large-scale language models] are able to detect specific classes of vulnerabilities with increasing efficiency," explains Daniel Kang, a security researcher in AI at the University of Illinois, in an interview with the MIT Technology Review published in March 2024. "This raises legitimate questions about access control to these capabilities."

The central concern is that as security professionals it takes years to develop expertise in finding and exploring vulnerabilities, an AI model could potentially democratize this knowledge immediately and on a large scale.

Companies consider gradual launches for sensitive technologies

Several AI companies have already adopted phased launch policies for models with capabilities considered sensitive. OpenAI, for example, implemented gradual access to GPT-4 in 2023, and Anthropic maintains security assessment systems before releasing new versions of Claude.

These practices include:

"The sector is maturing in the understanding that not all technical capabilities need to be made publicly available at the time it is developed," says Bruce Schneier, a cybersecurity specialist and berkman Klein Center for Internet & Society at Harvard, in an article published on his blog in February 2024.

European regulators discuss security AI frameworks

The European Union, through the AI Act approved in 2024, established risk categories for artificial intelligence systems, with specific requirements for applications that can impact cybersecurity.

Although the regulation does not prohibit the development of AI for vulnerability analysis, it requires:

Enisa (European Union Cybersecurity Agency) published preliminary AI guidelines on cybersecurity in January 2024, recognizing both the benefits and risks of these technologies.

Precedents and the way forward

The debate on responsible technology retention is not new. Security researchers for decades have followed practices of coordinated dissemination of vulnerabilities, sharing first discoveries with developers before making them public.

"What is emerging is an analogous model for AI capabilities," notes Helen Toner, former member of the OpenAI board and strategy director of Center for Security and Emerging Technology (CSET), in presentation at the NeuripS 2023 conference. "The question is not whether we should develop these technologies, but how to do it so that the benefits for cyber defense outweigh the risks."

Experts suggest that the future may include:

As technology advances rapidly, the sector seeks to balance innovation with responsibility, recognizing that some capabilities may require stricter controls before wide public availability.