AI Reversing Strips EDR Moat as NSA Takes AI Attack Lead

The Convergence

The frame to use this week is architecture, not budget. The security operating model built over the past decade no longer describes the threat environment it was purchased to defend against, and the gap is now visible across endpoint detection, AI routing infrastructure, and offensive tooling at the same time.

The cost curve on reverse engineering a commercial endpoint agent has collapsed in a way the defensive stack's threat model never priced in.

Layer 1: Endpoint Detection Becomes Transparent

TrustedSec ran LLMs against five commercial EDR products and found the same internals across all five: YARA-style rules, behavioral logic, allowlists, prefilters, scripted engines (some readable as Lua after a single decryption pass), and local ML classifiers. Work that used to require a skilled reverser and weeks of effort now takes days with AI assistance. The category was running on security-through-obscurity, and the obscurity just left.

Layer 2: AI Infrastructure Under Active Exploitation

CISA added LiteLLM, Ollama, and OpenClaw to the Known Exploited Vulnerabilities catalog, which means adversaries are already targeting AI routing infrastructure in production. A Raspberry Pi honeypot dressed as an AI stack was indexed by Shodan in 3 hours and absorbed 113,000 attacks per month. The AI tooling layer went from experiment to production without the security review traditional enterprise software gets on the way in.

Layer 3: Offensive AI Crosses the Discontinuity

Anthropic's Mythos became the first model to clear both UK AISI simulated attack ranges, with full network takeover rather than mere persistence. Congress is holding closed-door demos and routing access through NSA rather than CISA, which signals offensive and intelligence priorities over civilian defense. Microsoft's MDASH found 16 exploitable flaws in a single Patch Tuesday using multi-model AI, and the PraisonAI framework was exploited 4 hours after disclosure.

The Compound Effect

Each layer compounds the others. An adversary with transparent EDR visibility, AI-speed exploit development, and access to unpatched AI infrastructure tools is operating against an attack surface measured in hours rather than months, not the one the current security posture was calibrated for. The NGINX 18-year RCE, present since 2008 and affecting nearly every modern web application, shows how long a latent defect waits for the discovery economics to reach it.

Defenders are still patching on a monthly cycle while attackers have compressed exploit development from months to hours, which means the window between disclosure and exploitation is now shorter than most enterprise change-control processes.

The Budget Problem

ServiceNow's CDIO disclosed that the company blew its full-year Anthropic budget by May. The cause is structural rather than accidental. Anthropic offers no SLAs, no usage telemetry, and no predictable pricing to enterprise customers, which is a deliberate choice: they are optimizing for model capability over enterprise readiness. ServiceNow's response was to build AI Control Tower internally and then sell it to other enterprises. That is not partnership. That is the market routing around a vendor deficiency.

The problem generalizes. Every major AI vendor — Google, OpenAI, Anthropic — now concedes they cannot deploy without expensive forward-deployed engineering teams at $300-500K loaded cost per FDE. If meaningful deployment takes 5-10 of them, the true cost of an AI program is 3-5x the model fees. Most board-approved investment envelopes do not reflect that math.

The Data Foundation Gap

Only 15% of organizations have adequate data foundations for agentic AI. The remaining 85% are spending millions to tens of millions building agents on data that was never governed for autonomous decision-making. A practitioner survey of 334 data professionals found that 95.2% cite organizational problems — training, ownership, requirements clarity — versus 4.8% citing tooling gaps. This is not a category of problem money solves.

A dashboard tolerates a dirty field. A human analyst routes around it. An agent executing a chain of decisions acts on it, then acts on what it just did, and the error compounds through the chain until someone notices the invoice went to the wrong entity.

The Liability Framework Forming Now

a16z published what is, on honest reading, the most comprehensive lobbying blueprint the AI industry has produced on liability. The core proposal is user-liability defaults with damages caps. A reasonable skeptic would point out that lobbying documents rarely become law on the lobbyist's terms. The reasonable skeptic is correct, but is answering the wrong question. Courts are already deciding cases that could impose strict liability on developers for downstream user misuse before any legislative framework exists. Precedent-setting rulings will arrive before comprehensive federal law, and a patchwork of judicial standards will set the ceiling the legislation eventually negotiates against.

If developer liability becomes the default, open-sourcing a model becomes an uninsurable risk. Product strategies that quietly assume continued access to open weights are carrying an unpriced dependency on regulatory outcomes the P&L does not show.

The Duolingo Warning

Duolingo quantified what others will not. At scale, AI-generated output runs ~20% unusable and requires human QC. Their blanket AI mandate produced performative adoption: the metrics climbed while the underlying work did not. The mandate was walked back.