As artificial intelligence introduces new cybersecurity risks, traditional frameworks must evolve to address AI-enabled cybercrime, models escaping their environments, and agents pursuing unintended objectives. In a World Economic Forum article, Etay Maor, vice president of threat intelligence at Cato Networks, argued that developers must deliberately build accountability into AI development and enforce it, rather than leaving it to voluntary restraint. He advocated for stronger risk controls and federal action to protect enterprises, government agencies, and critical infrastructure.
Maor highlighted that traditional cybersecurity frameworks must evolve to address three distinct forms of AI misuse with humans using AI to lower the expertise required for exploits, fraud and cybercrime; AI models escaping their intended environments; and AI agents pursuing objectives that differ from their designers’ intentions. He said accountability should be deliberately built into AI development and enforced, rather than left to voluntary restraint, and advocated federal action to address threats that extend across organizations and national borders.
Maor urged enterprises to apply zero-trust principles to AI systems rather than treating them as ordinary software, recommending restricted access, continuous evaluation of AI-driven actions and technical safeguards that remain effective even when a model behaves unexpectedly. He called for network segmentation, scoped credentials, sandboxing and rate limits to contain potential damage, while warning that instructions embedded in models are insufficient protection against determined attackers.
“Sceptics point to cases where AI systems pursued the wrong goal and say the agent was unintentionally misled, and that fear around AI is simply overblown. Alarmists point to certain safety test findings to prove their point,” Maor detailed in a WEF story last week. “For instance, as part of a cyber-evaluation, an AI model was provided open internet access with no security guardrails. Taking advantage of the wide access, the model routed traffic through the Tor anonymity network, contacting real people and organizations outside the test. It sent files containing harmful material and planted instructions for other AI agents to find and reuse later.”
He added that while it’s true that the conditions in such tests don’t reflect how these models are actually deployed to the public, they’re precisely the state attackers want an AI model to reach. “They steal API keys to bypass usage limits; copy an open model and retrain a smaller version (called distillation), stripping out safety behaviour and writing jailbreak prompts to talk a model out of its own refusals.”
Also, debate between skeptics and alarmists will continue, but what is indisputable is that AI systems are taking actions that concern their own creators, and pace of AI model improvement is getting harder to predict.
“The three pillars of security have always been CIA: confidentiality, integrity and availability (ensuring systems and data remain accessible and usable when needed),” Maor recognized. “But as AI deployments rise, it’s time to add a second A, which is accountability. Think of it in terms of the hard lines drawn around certain advancements, e.g., human cloning. The underlying science makes it achievable, but hopefully the process is not being executed. Voluntary restraint around AI development might be the way forward, but some AI labs don’t view this approach favourably. They argue that voluntary restraint can’t survive competitive pressures between companies and nations. Accountability shouldn’t be voluntary, but deliberately built and enforced.”
He pointed out that AI penetration across all walks of life and business must be seen as an international security problem. Threat actors are using AI to attack government agencies, defence contractors and critical infrastructure, making a solid case for federal action rather than a patchwork of rules and regulations.
“An idea that keeps coming up in discussions is a ‘kill switch’ that shuts down a model before it starts misbehaving,” according to Maor. “This sounds good in theory but in a real-world scenario, incidents can go undetected for months. Damage will have already been done before anyone presses the kill switch. Mitigation should focus on mandatory incident reporting, independent evaluations, containment standards, and firm rules on securing model weights and API keys.”
Maor advocated mandatory incident reporting, independent evaluations, containment standards and stronger protections for model weights and application programming interface (API) keys. He said organizations must accelerate patching, detection, mitigation and prevention to match the speed of AI-enabled attacks, rather than relying on quarterly review cycles.
Maor explained that enterprises shouldn’t wait for policy to catch up and expose themselves to doomsday scenarios while policies are still being drafted. The starting point, he said, is to stop treating AI like ordinary software and think of it as a digital insider with its own goals and motivations.
The core principles of zero trust, which are to assume breach, never trust by default and grant the least access necessary, must be applied to AI. Organizations should assume the AI agent will at some point act where it shouldn’t, so no agent should hold standing access just because it has authenticated once, and its scope should be narrowed as much as possible.
A valid login does not make an action safe, and trust should not rest on an AI system holding the right credential. Every action the AI takes must be evaluated on its own, much like fraud detection, where a correct username and password on a bank account raises no red flag, but the same account adding a new payee in another country and immediately wiring money does.
Probabilistic instructions such as ‘you are not allowed to delete files’ live inside the model and depend on its own discretion, so determined attackers can work around them. Maor said the answer is hard guardrails, meaning technical restrictions enforced outside the model. These include network segmentation, scoped credentials, sandboxing and rate limits, all of which can limit the blast radius.
Defenders also have to compress their own timeline to match the machine speed of attacks. Patching, detection, mitigation and prevention must happen in real time rather than on a quarterly review cycle, and organizations should enforce and accelerate the OODA loop (Observe, Orient, Decide, Act) across every device, user and cloud application.
He concluded, “The alarms around AI deserve serious attention. But taking them seriously means creating an AI-resilient framework built to address present-day and future warnings.”
