You just updated your iPhone. 75 security patches. Good. Now let me tell you why that number is about to get a lot worse.
I saw a tweet the other day from a security researcher that stopped me cold. He said: “I found a zero-day with a 5-minute prompt. But I can’t share it because my AI said no.”
Think about that. The technology to find every single vulnerability in your phone—before hackers do—already exists. It’s called a state-of-the-art large language model. It can read code, spot memory bugs, and suggest fixes faster than any human team. And it’s being deliberately hobbled by the very companies that claim to be protecting you.
The safest AI is the one that never finds a bug. That’s the problem.
Anthropic, OpenAI, and others have spent billions teaching their models to say “I can’t help with that” when asked to find security vulnerabilities. They call it safety. But what it actually does is leave the door wide open for every unaligned actor—criminals, state-sponsored hackers, script kiddies—who will use unrestricted AI to exploit the exact bugs the “safe” AI refused to find.
You’ve probably noticed that your phone gets patched every month. You’ve probably wondered why hackers still find ways in. The answer is infuriating: your phone’s security depends on AI that’s been told to be incompetent.
Apple just pushed 75 fixes for iOS and 155 for macOS. That’s a lot. But it’s a drop in the bucket compared to what could be found if we let the AI loose. The paradox is that the more we restrict AI from finding bugs, the more bugs we leave for the bad guys. The AI safety guardrails don’t protect users—they protect AI developers from liability while leaving the broader digital ecosystem exposed.
I’ve heard the counterargument: “But what if the AI itself becomes a weapon?” Yes, that’s a real concern. But the current approach is like locking the fire door while the building burns. We need calibrated, not total, restriction. We need AI that can find bugs and responsibly disclose them, not AI that pretends the bugs don’t exist.
Here’s the twist: the companies most vocal about AI safety are the same ones racing to sell you AI-powered security products. They want you to trust their AI to protect your network, but they won’t let their AI actually find the holes in your phone. That’s not safety. That’s marketing.
Your phone’s security is being held hostage by a philosophy that values theoretical purity over practical protection.
So the next time you install a security update, ask yourself: how many bugs could have been fixed before they were exploited? The answer is all of them. And that’s the tragedy.
We have the tools to make your digital life permanently secure. We’re just too afraid to use them.
FAQ
Q: Isn't it dangerous to let AI freely find and exploit security bugs?
A: Yes, if it's done irresponsibly. But the alternative is worse: hackers already use unrestricted AI to find zero-days. The only people not using AI for vulnerability discovery are the ones trying to protect you. The solution is controlled, responsible disclosure—not a blanket ban on AI finding bugs.
Q: What practical step can I take to protect myself?
A: Demand transparency. Ask your phone manufacturer: 'Are you using AI to find vulnerabilities in your code? If not, why?' Push companies to publish responsible AI usage policies for security testing. And always update your devices—but know that even the latest patch is already behind the curve.
Q: Aren't AI safety guardrails necessary to prevent AI from creating superbugs?
A: That's a valid concern, but it's a false binary. The current approach is like locking the fire door while the building burns. We need calibrated, not total restriction. Let AI find bugs, but require disclosure through legitimate channels. The real danger is not AI that finds bugs—it's AI that's been trained to ignore them, leaving the ecosystem exposed.