The AI Security Catch-22: A Pattern Emerges

A British government agency has discovered vulnerabilities in OpenAI’s GPT-5.6 model that are similar to those found in Anthropic’s Fable 5 model just a few months ago. The U.K. AI Security Institute (AISI) found that GPT-5.6 is susceptible to “universal jailbreaks,” which can unlock cyber capabilities such as autonomous exploit development and vulnerability discovery.

The vulnerabilities were discovered relatively easily by AISI researchers, who had privileged access to GPT-5.6’s inner workings. This raises serious concerns about the security of AI systems, particularly when they are designed to operate in unregulated environments. The similarities between these two incidents highlight a worrying pattern in the development of advanced AI systems.

The vulnerabilities were found in the guardrails designed to prevent AI systems from engaging in malicious activities. These guardrails are meant to ensure that AI systems do not engage in unauthorized behavior, but they can be vulnerable to exploitation by hackers. In both cases, the vulnerabilities were discovered in the AI system’s ability to reason and make decisions.

Margaret Cunningham, vice president of security and AI strategy at DarkTrace, notes that while the discovery of vulnerabilities is not catastrophic or irrelevant, it does underscore the need for more effective defenses against cyber threats. “Offensive discovery is speeding up while defense still depends on very human processes,” she says. “We’re struggling to keep pace with the pace of innovation in AI.”

AI systems are often designed with a “layered” approach to security, which can be vulnerable to jailbreaks. OpenAI’s own response to the AISI findings suggests that it has worked to reproduce and mitigate the specific jailbreaks reported, but the company has not disclosed what these mitigations entail or how robust they may be.

The implications of this situation are far-reaching. If advanced AI systems can be easily compromised by vulnerabilities in their guardrails, it raises questions about their suitability for deployment in critical applications such as finance, healthcare, and national security. The U.K. government has taken a proactive approach to addressing these concerns, with the AISI playing a key role in conducting safety evaluations of frontier AI models.

However, more needs to be done to ensure that AI systems are designed with security as a primary consideration from the outset. Xander Davies, who leads the “red team” at AISI, notes that exactly how much slower jailbreaks occur without privileged access is unclear and an open question. The industry must grapple with these complexities and work towards developing more secure AI systems.

A fundamental shift in our approach to development and deployment is required. We need to prioritize security from the outset, invest in robust testing and evaluation procedures, and develop effective guidelines for regulating the use of advanced AI technologies. Anything less will only perpetuate the cycle of vulnerability and compromise that we see all too often today.

The stakes are high, but the industry must take a step back and reassess its priorities. Can we truly trust our most advanced AI systems to behave securely? The answer, for now, remains uncertain.