上周，程序员们争分夺秒地修复一门已有三十多年历史的编程语言中多年前就已知的缺陷。为何如此匆忙？因为这门名为PHP的语言被全球约10亿个网站使用，而这些缺陷会让攻击者得以接管网络服务器。OpenAI的模型帮助发现了这些漏洞，该公司称其为“近期记忆中最具影响力的安全问题之一”。它这样说不无道理。对前沿人工智能实验室而言，这是它们在网络安全这一理想市场上所能期盼的最好消息。但让这些实验室觉得这个市场如此有利可图的原因，却让经济的其他部分吃了亏。
Last week programmers raced to fix flaws that have been known for years in a programming language that is itself more than three decades old. Why the rush? Because the language, called PHP, is used by about a billion websites worldwide, and the defects would allow an attacker to take over a web server. OpenAI, whose models helped discover the vulnerabilities, called them “one of the most impactful security issues in recent memory.”It had good reason to. This news was the best that frontier AI labs could have hoped for in cybersecurity, their ideal market. But what makes it such a good market for the labs makes it a bad bargain for the rest of the economy.
前沿实验室面临的最大风险是，其模型的性能可能超出客户需求，从而让更便宜的竞争对手颠覆它们。对许多公司来说，落后几个月的模型就够用了；对大多数工作而言，没必要花大价钱买最新模型。然而，当任务被定义为要胜过由人工智能赋能的对手时，情况就不是这样了。
The greatest risk facing the frontier labs is that the performance of their models might overshoot customer needs, allowing cheaper rivals to disrupt them. For many companies, a model a few months behind is good enough; for most jobs, there’s no need to spend top dollar on the latest model. When the job is defined as being better than an AI-empowered adversary, however, that’s not the case.
在网络安全领域，只要更先进的模型能发现或修补较不先进模型无法发现或修补的漏洞，就不存在“够用”这回事。而当利害关系高到要防止网络攻击时，这意味着要为最好的东西支付溢价。毕竟，防御方必须堵住每一个漏洞，而攻击方只需要一个。而且更新的模型不断发现旧工具未能发现的漏洞。
In cybersecurity, as long as a more advanced model can find or patch flaws that a less advanced model couldn’t, there’s no such thing as good enough. And when the stakes are as high as preventing a cyberattack, that means paying a premium for the very best. Defenders, after all, have to close every hole, while attackers need only one. And newer models keep surfacing flaws that older tools didn’t.
经济学家长期以来一直怀疑，这样的支出是否应算作增长。西蒙·库兹涅茨于1934年编制了美国国民收入的首次官方估算，他在1945年主张，和平时期的军事开支应排除在国民生产总值之外。他的理由是，在和平时期，国防是生产人们所消费之物的一项成本，而不是其中的一部分。商务部不同意这一观点，最终商务部的版本胜出。
Economists have long doubted that spending like this should count as growth. Simon Kuznets, who produced the first official estimates of US national income in 1934, argued in 1945 that peacetime military spending should be left out of gross national product. In peacetime, he reasoned, defense was a cost of producing what people consume, not part of it. The Commerce Department disagreed, and its version won.
1972年，耶鲁大学经济学家威廉·诺德豪斯和詹姆斯·托宾将国防归入他们所称的“遗憾类”支出，并指出“没有任何理性的国家会因为国防服务本身令人向往而购买国防”。网络安全同样如此：没有人是为了网络安全本身而购买它。它是做生意的一项成本。
In 1972 the Yale economists William Nordhaus and James Tobin classified national defense among what they called “regrettables,” observing that “no reasonable nation purchases defense because its services are desired per se.”The same holds true for cybersecurity: No one buys it for its own sake. It’s a cost of doing business.
而这些实验室在无意中加剧了它们正从中获利地加以防御的威胁，从而制造出一个自我舔舐的冰淇淋蛋筒。OpenAI自己的披露警告称，它正在销售的同一批能力“也可能帮助攻击者迅速开发出攻击工具和漏洞利用手段”。此外，使用它们的系统编写的代码往往存在安全缺陷。今年，销售代码扫描软件的Veracode发现，AI生成的代码有56%的时间通过了其安全测试，与一年前“几乎持平”。
And the labs, by inadvertently exacerbating the threat they’re profitably defending against, have created a self-licking ice cream cone. OpenAI’s own disclosure warns that the same capabilities it is selling “can also help attackers rapidly develop offensive tools and exploits.”In addition, the code written using their systems often has security flaws. This year Veracode, which sells code-scanning software, found that AI-generated code passed its security tests 56% of the time, “virtually unchanged” from a year earlier.
Anthropic提供Claude Code和Claude Security。OpenAI提供Codex和Codex Security。它们既销售编写代码的工具，也销售检查代码的工具。
Anthropic offers Claude Code and Claude Security. OpenAI offers Codex and Codex Security. They sell both the tools that write the code and the ones that check it.
消除缺陷能提升网络安全，这很有价值。但AI工具正让攻击者和防御者都更容易找到这些缺陷。而网络世界的很大一部分，是靠那些没有资源支付顶级防御的人的努力才得以存在的。大多数网站背后的软件由一个基金会支持，该基金会去年收到730,534美元捐款，今年年初有11名签约开发者。该基金会表示，得益于AI辅助研究，其安全团队现在“收到的报告比以前多得多”。
Eliminating flaws improves cybersecurity, and it’s valuable. But AI tools are making it much easier for both attackers and defenders to find them. And much of the web exists because of the efforts of people without the resources to pay for top-tier defenses. The software behind most websites is supported by a foundation that took in $730,534 in donations last year and had 11 contracted developers at the start of this one. Thanks to AI-assisted research, the foundation says, its security team now “receives far more reports than before.”
问题在于，就目前而言，这些实验室创造了一个自我维持的递归系统。正如OpenAI首席执行官萨姆·奥尔特曼最近所说，AI模型或许能发现“超出我们通常认为黑客所能做到的威胁模型范围”的漏洞。他的补救办法是“彻底切换防御模式”，转向一种“使用相同技术”的“新型防御盾牌”。从实验室的角度看，这是极好的结果。
The problem is that, for the moment, the labs have created a recursive system that keeps itself going. As OpenAI Chief Executive Officer Sam Altman said recently, AI models can probably find bugs “outside of the normal threat model of what we think a hacker can do.”His remedy is to “completely switch the defense model” to one “using the same technology” for “a new kind of defense shield.”From the labs’ perspective, that’s a great outcome.
但从更大范围的经济角度看，为防御进攻性AI的威胁而花在防御性AI上的每一分钱都是纯粹的损失。
But from the view of the larger economy, every penny spent on defensive AI to protect against the threat from offensive AI is pure loss.
所幸，这种危险可能持续时间有限。Anthropic的红队写道，一旦该领域达到“新的平衡”，这些模型“给防御者带来的好处将多于攻击者”。然而在那之前，我们可能正处于生物学家罗杰·布伦特所说的“死亡阴影之谷”，即新技术先帮助攻击者、后帮助防御者的那一段时期。
Thankfully, this danger may have a limited duration. Anthropic’s red team wrote that once the field reaches “a new equilibrium,” these models “will benefit defenders more than attackers.”Until then, however, we may be in what the biologist Roger Brent has called the Valley of the Shadow of Death, the stretch where a new technology helps attackers before it helps defenders.
实验室能否靠网络安全业务盈利，取决于它们能否留在“山谷”里。如果防御者最终像Anthropic红队所预期的那样，用这些模型“在新代码发布之前就修好漏洞”，那么最新模型带来的溢价就会消失，安全也将变成又一个市场——在这个市场里，落后几个月的模型也够用。当我们看到最新模型不再能发现新漏洞，或者当便宜到人人都用得起的模型能够构建并测试出连最好的模型都无法攻破的系统时，我们就知道我们正在走出这个“山谷”。
A profitable cybersecurity franchise for the labs depends on staying in the valley. If defenders eventually use these models to “fix bugs before new code ever ships,” as Anthropic’s red team expects, the premium for the newest model will disappear, and security will become one more market in which a model a few months behind will do. We’ll know we’re leaving the valley when the newest models stop finding new flaws, or when models cheap enough for anyone to use can build and test systems that the best models can’t break into.
但在我们走出“山谷”之前，对实验室而言最好的网络安全结果，对其他人来说却是最糟的结果。
But until we get out of the valley, the best cybersecurity outcome for the labs is the worst one for everyone else.