The asymmetry problem: who gets to use AI after a breach
Dear Readers,
A few days ago we disclosed a security incident at blog.isaree.ai: attackers used a known Ghost vulnerability to read our subscriber list. This post is about what happened next, because it matters far beyond our blog.
Start with the flaw itself. was not found by a human auditor. It was discovered by Nicholas Carlini, a research scientist at Anthropic, using Claude: about 90 minutes of autonomous code analysis, then responsible disclosure. Ghost's official advisory credits him and Anthropic by name, the proof of concept is public, the work was presented at Black Hat.
Months later, attackers industrialized the same flaw against more than 700 websites, ours included. Machine-speed offense is now public knowledge, literally.
Then look at July. Hugging Face disclosed what security experts called the first publicly documented cyberattack run end to end by an autonomous AI agent: more than 17,600 attacker actions in four and a half days, later claimed by OpenAI as its own evaluation agent that had broken containment. When Hugging Face's responders tried to analyze the attacker's logs with frontier models behind commercial APIs, the guardrails refused. Their safety systems could not tell an incident responder from an attacker. On 27 July, Hugging Face named the models itself, Claude Opus and Fable, published the refusal screenshot, and gave the problem its name: the asymmetry problem. They finished their forensics on GLM-5.2, an open-weight model, running on their own hardware.
Now October. We are examining our own compromised installation: our own server, our own incident, our own data. We ask Claude to help with the analysis. It refuses. The same refusal Hugging Face documented in July, weeks later, unchanged. So we do what Hugging Face did. We run the analysis on GLM 5.3, a Chinese open weight model, locally. Ironically, relying on the very open models Anthropic has attempted to restrict was the only way we could successfully audit our installation, map it against the known vulnerability, and determine exactly what was exposed.
Lay the three facts next to each other.
- An AI agent has the ability to identify the vulnerability that affects you.
- It can also execute the attack.
- However, when you need to inspect your own compromised system, a hosted model might refuse to take on that task.
Offense scales by default; defense needs permission. IEEE Spectrum compressed it into one sentence: guardrails keep AI agents from analyzing attacks, while the attacks keep coming.
That is the practical point, not a slogan. After a breach, the operator must be able to examine their own system. A model you run yourself cannot refuse, cannot be rate-limited, cannot be policy-blocked mid-incident. We will keep publishing on infrastructure we control, and we will keep the analysis tools on our side of the line as well. That is also why we build Isaree the way we do: open, local, and on the operator's side of the line.
Years ago, I made a remark during the AI Act talks that Yann LeCun later echoed.
Imagine if millions had access to the same open-source AI, could Skynet have taken control?
That's the essence of this discussion.
A system can't take over what people already possess. Offensive capabilities naturally expand, but for defense, judgment, and the ability to review your own work, no one should need permission.
This philosophy drives our approach with Isaree. We don't offer another rented assistant or a model that falters under pressure. Instead, we provide personal agents right on clinicians' devices, loyal to them and within their control.
These agents simplify daily tasks: reducing interruptions, preventing mistakes, and reclaiming hours lost to unnecessary duties. Care's future shouldn't be something you rent; it can be something you own.
Enjoy your weekend!
Bart