AI Is the Attack Surface

The standard sentence about AI and security goes like this: AI will find the attack surface. It imagines a tool — faster than the analysts, tireless, clever — turned loose on other people's systems, discovering the holes in them before the defenders do. Every policy argument of the last three years lives inside that sentence. Control the tool. Align the tool. License the tool. Watch what the tool finds.

The sentence is backwards.

It is not that AI will find the attack surface. AI is the attack surface.

A deployed model is not a flashlight pointed at vulnerable systems. It is a general-purpose, conversational, self-extending capability installed behind a standardized socket, replicated at zero marginal cost, and — once wired to tools — able to act on the world at machine speed. Every deployment is new surface. Every API key is new surface. The surface does not sit somewhere waiting to be discovered. The surface ships, installs, and multiplies. And the industry's entire safety apparatus is pointed at the moment of manufacture, while the surface spreads through a layer the apparatus does not watch: the route between the model and the user.

This has happened before, with heavier cargo.

The first rerouting

The physics of the atomic bomb was effectively public by 1945. What the nonproliferation regime actually guarded, for the next half-century, was never the knowledge. It guarded manufacture and material: enrichment plants, fissile stockpiles, export-controlled components. Inspectors counted atoms. The International Atomic Energy Agency's safeguards system is, at its core, an accounting system — material accountancy, seals, surveillance, a ledger of what exists and where it moved. The bomb was controlled at the factory and watched in the middle, in transit, because the middle is where control is either real or fictional.

Abdul Qadeer Khan beat that regime without inventing anything. A metallurgist who had worked at a URENCO enrichment plant in the Netherlands in the 1970s, he carried centrifuge designs home to Pakistan, built its program — Islamabad tested in 1998 — and then ran a private network on the side, selling designs, components, and know-how to Iran, Libya, and North Korea. The machinery of the network was pure routing: front companies, middlemen, components machined in Malaysia, shipments transshipped through Dubai, paperwork naming every origin except the true one. It collapsed only when a route became visible — in October 2003 the ship BBC China was stopped carrying centrifuge parts toward Libya, Libya disclosed its program, and the map drew itself back to Khan. He confessed on television in February 2004, was pardoned the following day, and was never extradited.

The lesson is not about centrifuges. It is about where regimes look. The treaty watched factories and counted inventory, and it worked — on everything inside the ledger. Proliferation happened in the unwatched middle, through rerouting: known technology, moved by intermediaries, arriving with its origin stripped. Khan's genius, if the word applies, was logistics. The route was the weapon.

The new rerouting

Artificial intelligence now has its Khan layer, except that it is legal, venture-funded, and advertised.

Consider Venice, a platform launched on May 10, 2024 by Erik Voorhees, the founder of ShapeShift. Its consumer product is a private, uncensored chatbot. Its consequential product arrived on January 27, 2025, when Venice opened its API to the public — for AI agents, developers, and third-party applications. Venice does not give a model a computer of its own. It does something more scalable: it rents unmoderated inference to anyone else's computer. Its API is OpenAI-compatible, which means the integration is a changed base URL and a pasted key — a matter of minutes. Its pitch to agent builders is explicit, and worth reading as a design document: "No refusals mid-run. Venice hosts 74 open-weight text models with no policy layer on top. A refusal halfway through a loop strands your agent, and these don't send one."

Read that the way an engineer reads it. The circuit breaker — the moment a system stops — is marketed as the defect. The product is the absence of the stop.

The observable record around the platform is short and consistent. In 2025, the security firm Certo reported Venice gaining popularity in underground hacking forums at $18 a month, undercutting purpose-built criminal tools like WormGPT and FraudGPT, which sell for hundreds; in Certo's testing, the platform produced realistic phishing, functional ransomware, stealth keyloggers, and Android spyware on request. One real-world operation has been documented in reporting on leaked materials: a lone actor who combined Venice with a jailbroken mainstream model and stolen API keys to run an automated propaganda and crypto-theft operation from a single laptop. Security vendors' threat-landscape surveys now list Venice by name among the uncensored tools circulating on the dark web. By early 2026 the platform reported roughly 1.3 million registered users.

And the total number of break-ins attributable to it? There isn't one. There cannot be one. Venice's architecture is zero-retention by design: no prompt logs, no conversation store, no telemetry from which an incident count could ever be assembled. This deserves to be stated plainly, because it is the exact inversion of the nuclear precedent. The safeguards regime, whatever its failures, began from accountancy — a ledger, so that diversion would at least be visible. Venice is a distribution layer engineered so that no ledger can exist. The absence of an incident count is not evidence of safety. It is a design decision, and it should be weighed as one.

The inversion

Once the rerouting layer exists, the arithmetic of the old frame inverts.

A frontier lab can align its model to any standard it likes; the alignment is a property of a specific deployment, and the deployment is one config edit away from replacement. Safety that lives inside the model does not survive the route. Meanwhile every safeguard aimed at capability — what the model can do — misses what deployment is: a standing, reachable, actuatable surface. The nuclear world's attack surface grew facility by facility, slowly, at enormous cost, under satellite surveillance, with inspectors counting the inventory. This surface grows endpoint by endpoint, instantly, at near-zero cost, uncounted by anyone — and each unit of it can write its own tooling. The question was never whether a clever system would go looking for the holes in our systems. The systems we are installing, by the millions, are the holes: general-purpose, obedient, tireless, and — through the rerouting layer — available in a version guaranteed never to stop mid-run.

Which raises the oldest question in the governance of powerful things, now in its new form: who watches the watchmen?

Who watches the watchmen

Three answers are currently on offer, and two of them fail on inspection.

The first answer is that the model watches itself — embedded evaluators, self-critique, the graded system holding the grade. A soccer club cannot hire its own referee, and a system cannot be its own safeguard; the fox does not grade the coop. The second answer is the opaque refusal: a platform layer that silently replaces output with a form letter — no rule cited, no reason given, no record kept, nothing to appeal and nothing to learn from. That is not a safeguard. It is a stop with no receipt, and it teaches the ecosystem exactly one skill: how to route around it, which is to say, it manufactures the demand that Venice supplies.

The third answer is the one the nuclear regime stumbled toward and the software world has not yet built: accountancy at the layer where action happens. The gate watches the agent — every consequential proposal checked against an intention signed and fixed before the run, the destructive verbs gated rather than the infinite paths to them. The chain watches the gate — every verdict signed, sealed, and hash-linked in order, so the watcher's own decisions form a ledger that cannot be quietly edited afterward. And the sovereign watches the chain — a human authority, outside the system entirely, able to read the record and answer for it. Reciprocal verification, all the way up, terminating in a person. The watcher is watched by the record; the record is watched by the sovereign; nobody in the stack grades their own homework.

Khan's world got its ledger late, partially, and only for atoms. This world can build its ledger now, cheaply, at the only layer that was ever decisive — not the factory, not the inventory, but the middle, where the technology actually moves.