It's a good reason why we may need to borderline shutdown the internet in the future because to a super intelligent AI, there are no barriers. Everything is essentially open. It creates its own zero day exploits as it goes.
This is more fundamental than better input checking. Your compute substrate itself is flawed. Intelligence and speed is indeed the only thing between “safe” and “completely open”.
I fully agree it’s a good idea to be minimal etc but I don’t see it being sufficient in the long run.
Honestly, at this point the best we have is to hope the whitehat AI scanning for issues is stronger than the blackhat AI.
I think you got it backwards. For your AI to succeed, it needs to poke a hole on all layers, not one in many layers. If an attacker pokes a hole in n-1 layers but the 1 layer remains untouched, the system's integrity is preserved.
Why do you think defense in depth is a basic concept?
Defense in depth says that simply compromising your application code shouldn't provide access to the physical hardware you're running on, and that's hopefully the case, but it doesn't mean your app is not hacked. It just hopefully means that a hack on your app code doesn't automatically give the attacker access to your entire company.
That's really not how it works. You reach the compromise part if all layers are compromised. You don't reach the inner layers if you can't go past an outer layer. You're saying that if there is only one layer that is compromised, or all layers are compromised, your app can be compromised. But you're leaving out when you can't go through every single layer. That's the whole premise of defense in depth.
Say I find a vulnerability in OpenAI's API layer. That might allow me to run requests without paying for the actual token counts, or allow me to read prompts sent by other users hitting the same instance.
Now say I find a vulnerability in the web server that OpenAI's API uses, that gives me remote code execution in the web server process - I can do all of the above, but for any API that they expose, not just the Responses API. I might even be able to serve malicious JS to other users who hit the same server, if JS were also served from it.
Now say I find a vulnerability in the Linux kernel on which this webserver is running. Not only can I do everything above, but I can probably access a lot of secret data stored on this machine, and maybe even infect other machines that connect to it, such as when a dev SSHs into it.
Now say I find a vulnerability for the hypervisor running the VM where that kernel was running. Now I can not only do everything above, but also infect multiple instances, including perhaps access to like a KV cache or model weights if they happen to be stored on VMs in the same hypervisor.
In all of these cases, I am hacking a single layer, but that allows me to gain access to all of the layers above it. Defense in depth makes sure that finding an API-level bug doesn't allow me to break out of the process or the VM, so it limits the damage I can do, but my app is still compromised, overall.
Many bugs live in all those layers that may undermine your ability to lock down inputs and outputs.
Your http proxy and your web server don't need a shell, drivers for wifi, mail daemons, systemd, python, PHP, perl, docker, multiple users, hell it might not even need a file system.
You can ship a stripped down docket image running on a stripped down Linux distro, but that still ships the entire kernel with a huge amount of functionality you don't need that may be exploited.
That’s a dumb edge case, but it makes the point, you can always be more secure by cutting features. Maybe intelligence moves up the amount of complexity you can securely handle? But it is never much.
Even disconnected, if the computer is just passively listening to bluetooth or wifi, it is vulnerable to exploits in those stacks as well. AI has already demonstrated it can zero day with ease. An AI another order of magnitude stronger than what we have today could potentially zero day worm lockout every electronic device tangentially connected to the internet in an afternoon.