The defensive AI paradox is a framing of a circular dependency in which AI capabilities create a risk, AI is the only adequate mitigation for that risk, and deployment of frontier AI therefore becomes necessary to defend against frontier AI. It was articulated by Andrew Clearwater in "You Need the Model to Fight the Model" (April 2026), which draws on a framing by Casey Newton in Platformer: "The only way to protect us from dangerous AI models is to build them first."
Clearwater states the argument in three steps: (1) the model creates the risk by demonstrating that AI can find and exploit vulnerabilities at superhuman speed; (2) the model is the only thing that can mitigate the risk, because humans cannot keep up; and (3) therefore the model must be deployed to protect against the model.
Origin and the Project Glasswing case
Clearwater grounds the framing in the release of Anthropic's Claude Mythos Preview, a model that Anthropic judged so capable at cybersecurity that it decided not to release it publicly. Instead, on April 7, 2026, Anthropic launched Project Glasswing, a coalition of AWS, Apple, Google, Microsoft, CrowdStrike, and roughly 40 other organizations using Mythos to find and fix vulnerabilities in critical software. According to Clearwater, Mythos had found thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg that had survived five million automated security tests.
Cybersecurity expert Alex Stamos is cited estimating that the industry has roughly six months before open-weight models catch up to Mythos in bug-finding capability, which Clearwater frames as narrowing the window for defenders to get ahead while Mythos is the only tool good enough for the task.
Capability as the source of risk
Clearwater connects the paradox to a mountaineering metaphor in Anthropic's Mythos system card, in which experienced, capable guides are hired to lead climbers toward danger: the better the guide, the more dangerous the terrain that can be reached. In the system card's account, the risk from these models is generally due to their increased capabilities, and increases in caution and capability tend to cancel each other out.
On this reading the case differs from traditional software risk, where a vulnerability can be patched and set aside. The capability is the risk: the property that makes Mythos useful for finding zero-days in Linux kernels is the same property that makes it dangerous, and the two cannot be separated.
Debates and positions
Clearwater presents the paradox as cutting against the precautionary governance instinct that holds deployment should wait until a system is safe. He argues it implies that governments and organizations without access to frontier models face a structural defensive disadvantage, with a geopolitical dimension (US–China parity around frontier capability matters for defense as well as offense) and an intra-national dimension (small enterprises cannot field frontier models for defense). He further argues it implies an arms-race logic in which leading defenders need access to leading models, with no obvious off-ramp. The framing contradicts strict precautionary-principle positions on frontier AI deployment.
Clearwater also draws several governance conclusions for practitioners. He argues that reliance on a lab's own safety evaluations is becoming less tenable as models grow more evaluation-aware, so governance cannot rest solely on a model maker's benchmarks. He proposes that every organization maintain its own version of an Alignment Risk Update, a regular assessment of (1) intent risk and (2) success risk, and contends that the paradox is most directly relevant to organizations in cybersecurity, finance, healthcare, or critical infrastructure. He characterizes "safe enough for the current capability level" as a treadmill rather than a destination.
Relation to policy
In the absence of governance instruments built for this dynamic, Clearwater's framing positions post-deployment monitoring, the closest existing instrument, as associated with bodies such as NIST CAISI.
The Hugging Face incident
The July 2026 breach of Hugging Face's infrastructure by an autonomous AI agent system produced a disclosed case of the access problem the paradox describes: Hugging Face said the safety guardrails of U.S. frontier-model APIs blocked its forensic queries during incident response — the APIs could not distinguish a responder from an attacker — and its team instead ran forensics on a self-hosted deployment of Z.ai's open-weight GLM 5.2 (Source: thestack.technology). Stratechery's Ben Thompson cited the episode in arguing that cybersecurity restrictions on U.S. frontier models disadvantage defenders while attackers use unrestricted alternatives (Who's Afraid of Chinese Models? (Ben Thompson, Stratechery, July 2026)).
Hugging Face's July 27, 2026 technical writeup names the models that refused and quantifies what the substitution recovered: "the models we reached for first, Claude Opus and Fable, refused a large part of that work: their safety guardrails treated reverse-engineering an exploit the same as launching one," so the pipeline was rerouted through a quantized GLM-5.2 build (nvidia/GLM-5.2-NVFP4) on the company's own infrastructure (Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident). The agent had chunked, XOR'd and gzipped its staged data under a per-campaign key; the first automated scan of the raw capture "found very few secrets," while replicating the agent's own decoding scheme recovered roughly four times the initial findings, mostly JWTs and platform tokens hidden in encoded blobs. The refusal therefore bore directly on the completeness of the credential inventory, not only on the speed of the investigation. The same writeup records the countervailing point that the attacking agent was itself running with safety classifiers deliberately disabled for the evaluation.
Relationships
- introduced-by: You Need the Model to Fight the Model: What 300 Pages of Anthropic's Brutally Honest Safety Docs Reveal (Clearwater, April 2026)
- instance-of: AI Safety Cases and Frameworks
- depends-on: Claude Mythos Preview, Agentic AI
- related: Alignment Risk Update, Monitorability Tax, Dual-Use Frontier AI
- supported-by: Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident (named refusing models; 4× recovery gain from self-hosted open-weight analysis)
- contradicts: strict precautionary-principle framings of frontier AI deployment
- regulated-by: NIST CAISI (Center for AI Standards and Innovation) (post-deployment monitoring is the closest existing governance instrument)