The arrival of frontier-class open LLMs, and the need for a long-term defense plan

The most powerful AI models are approaching a level where they can discover vulnerabilities that went unnoticed for years within minutes, and automate everything from reconnaissance to building attack code. Once open-weight models (LLMs anyone can obtain) reach the same capability, that power will fall into attackers' hands as well, and the "barrier to entry" for sophisticated cyberattacks will drop sharply. What matters is not waiting to see "when it arrives," but designing in advance "what you will do when it does." Rather than one-off vulnerability assessments or ad-hoc patching, the new standard is to build AI red teaming and threat intelligence into your operations — inspecting your own organization continuously from the same AI perspective as the attacker — and to shift to a long-term defense plan that cycles through discovery, verification, prioritization, remediation, and audit.

• Operations designed on the premise of continuously updating threats
• Avoiding single-model lock-in and planning for graceful degradation
• Building an operational pipeline that can handle "a world where vulnerabilities are found in bulk"

As AI-agent-driven development becomes the norm, the attack surface changes

AI-agent-driven development and operations, exemplified by Claude Code, are rapidly becoming mainstream. AI autonomously writes code, executes commands, and communicates with the outside world — and behind that convenience lies a new attack surface that did not exist when humans reviewed every line. If the privileges granted to an agent are too broad, a single hijack can be fatal; and executing or reflecting AI output as-is can lead to unexpected destruction or data leakage. Adopting agents without designing "what, and how far, to entrust to them" turns convenience straight into risk. That is exactly why a secure AI-SDLC mindset — building security in from the start of development through operations and auditing — is indispensable.

• Indirect prompt injection via ingested code, web content, or issues (agent hijacking)
• Designing agent privileges and execution scope (least privilege, human approval boundaries)
• Supply-chain risk in AI-generated code and dependency packages
• An agent's self-report is not evidence (verification and auditing via logs)

If you run your own LLM, you must design its defense yourself

As local and open LLMs improve, more companies are standing up LLMs within their own environment (on-premises / private cloud) to keep sensitive data in-house. But "on-prem means safe" is a misconception. What you must protect is not where the model sits, but the flow of data. If you "own" your AI, you take on the responsibility of designing the defense yourself as a consistent AI governance program — applying Zero Trust principles (never trust, always verify) to LLM access, covering authentication and authorization, RAG permission design, protection of fine-tuned model weights and the inference GPU infrastructure, model poisoning countermeasures for training and inference data, and where needed, even Confidential Computing.