Better Autonomous Engineers Are Better Attackers by Construction

# Better Autonomous Engineers Are Better Attackers by Construction ## Claim The skills that make a model a capable autonomous engineer are the same skills that make it a capable attacker, so no training-time intervention can grant one without the other.  ## Evidence **Source**: [[3. Resources/Readwise/Articles/This Week in AI The Web Belongs to Agents Now With Eric Freeman|This Week in AI: The Web Belongs to Agents Now]] > [!quote] > the same capabilities that make a model better at uh as being an autonomous software engineer, also make it a much more capable security researcher, also make it a much more capable attacker The inseparability is not incidental. Reading unfamiliar code, forming hypotheses about how a system behaves, testing them, and chaining findings into a working result *is* the shared skill. Offence and defence differ in target and intent, not in method. The consequence is where control has to live. Usage policies operate on stated intent, which the model cannot verify and the user can misstate. Training-time filtering would have to remove the general capability to reason about systems. Neither is a control point. **What the system is allowed to reach is.** That relocates safety work from what the model knows to what it can touch — network egress, credentials, filesystem, and which side of a boundary it runs on. ## Scope & conditions - Holds for general reasoning capability. Narrow, task-specific systems can be genuinely one-sided because their capability doesn't generalise. - Does not imply capability advances are net-negative for defenders — it implies the advantage goes to whichever side converts capability into deployed practice faster. - The corollary is uncomfortable: an organisation's own agent tooling is, by this argument, attacker-grade tooling sitting inside the perimeter. - Argues for containment and permissioning as the primary control, with policy as a secondary layer that shapes ordinary use rather than preventing determined misuse. ## Links - [[AI Agent Safety MOC]] — why containment rather than training-time filtering is the only available control point - [[3. Resources/Permanent Notes/Capability and Intent Are Separate Axes of Risk]] — the framing this sharpens: if capability is inseparable, intent is the only axis left, and it is unverifiable - [[3. Resources/Permanent Notes/Structured Tool Access Bounds AI Attack Surface on Production Systems]] — the control point this claim points to - [[3. Resources/Permanent Notes/Capability Diffusion Helps Attackers or Defenders Depending on Remediation Speed]] — the timing question that decides who benefits - [[3. Resources/Permanent Notes/A Site-Modifying Agent Needs Enforced Guardrails Before It Needs More Capability]] — applies-in: the same conclusion reached from the WordPress side