Some random high-level takeaways/thoughts on cybersecurity from the past few months: The whole issue is complexity, which makes it hard to hold in your head exactly the security invariants you want to maintain Don't think about what a system is intended to do, think about how it just literally, actually works. You need a totally reductionist frame. While there are definitely vulnerabilities in the security primitives people use (e.g. kernel bugs, C programs not being memory-safe, etc.), most actual hacks and vulnerabilities are something akin to "configuration mistakes". People using systems for purposes they weren't designed without thinking about the security implications, just overpermissioning, and the whole integrated system being really complex so it's hard a priori to trace out all of the exploit chains. Defense in depth is super important/helpful for reducing the number of opportunities adversaries have to execute exploit chains, but less so if your models have unlimited attempts. They'll find the path through the swiss cheese. This is why monitoring is so important—agents will defeat passive security measures with enough time. There are certainly many linux kernel bugs that models will be able to find, for example.