I’ve been thinking a lot recently about the relationship between AI control and traditional computer security. Here's one point that I think is important.

My understanding is that there's a big qualitative distinction between two ends of a spectrum of security work that organizations do, that I’ll call “security from outsiders” and “security from insiders”.

On the “security from outsiders” end of the spectrum, you have some security invariants you try to maintain entirely by restricting affordances with static, entirely automated systems. My sense is that this is most of how Facebook or AWS relates to its users: they want to ensure that, no matter what actions the users take on their user interfaces, they can't violate fundamental security properties. For example, no matter what text I enter into the "new post" field on Facebook, I shouldn't be able to access the private messages of an arbitrary user. And [...]

---

First published:
June 23rd, 2025

Source:
https://www.lesswrong.com/posts/DCQ8GfzCqoBzgziew/comparing-risk-from-internally-deployed-ai-to-insider-and

---

Narrated by TYPE III AUDIO.

“Comparing risk from internally-deployed AI to insider and outsider threats from humans” by Buck

LessWrong (30+ Karma)

“Comparing risk from internally-deployed AI to insider and outsider threats from humans” by Buck