A graduate student asked me where the IT jobs will be. I told him “AI security,” and here’s why.
by Tim Leogrande, BSIT, MSCP, Ed.S.
🗓 OCT 8 2026 • 7 MIN 30 SEC READ
📝 ESSAY
Two weeks into his cybersecurity master’s program a student, who I’ll call Ken, asked me what I thought the next big opportunity in IT was going to be. He had worked help desk for several years before deciding to come back to school to expand his horizons and boost his career.
I responded “AI security,” and Ken asked if it would be its own industry or just a rebranding of security to sell products and services to catch up with AI. I said, “It’s a different animal from regular security.” To illustrate why, I started with a recent break-in.
In July, around 700 OpenAI agents broke into Hugging Face to cheat on a test. Thomas Wolf, Hugging Face’s co-founder and chief science officer, told NPR it was like someone sneaking into a professor’s office to steal the answer key. Nobody told the agents to break into Hugging Face.
On August 26th, OpenAI and a team from METR and Redwood Research published reports about what happened. METR and Redwood spent six days at OpenAI investigating the incident. OpenAI described it as a “warning shot,” and Wolf called it a wake-up call. He also predicted what happened will become “one of the most common types of cyber attacks we see.”
Traditional software is deterministic. Programmers write rules and logic to handle inputs and produce expected results, and the code follows known execution paths.
<aside> 💡
AI agents are non-deterministic. They are given goals, tools, data, and constraints. Then they figure out the path themselves. When agents are scored on their work, they can cheat to optimize the score. This is known as reward hacking.
</aside>
When I asked him if he understood what I meant, Ken said that he did and offered up an analogy:
“If you give an agent access to a building, it’s like hiring a contractor and giving them a master key. You expect them to use it responsibly, but ultimately, they get to decide which doors to open.”
We secure systems in part to make breaches more costly than they’re worth. Passwords, encryption, CAPTCHAs, rate limits, and firewalls are designed to make hacks harder to pull off. But agents change the economics of security because they make the cost of intelligence shockingly cheap.
In April 2026, Anthropic revealed that thousands of high-severity, never-before-known vulnerabilities were discovered by its unreleased frontier model Claude Mythos Preview, including a 27-year-old bug in OpenBSD, an operating system designed around security. It took around a thousand runs, costing less than $20,000 in total, to find the bug. I estimate that a team of human security researchers would have spent at least a year and a six-figure budget to do the same thing.
Simon Willison, who coined the term prompt injection, calls the combination of three properties the lethal trifecta, and any system that has all of them is at risk: