Be a good AI ancestor: Cybersecurity already gave us the playbook

AI has brought us to a familiar inflection point in the story of privacy, cybersecurity, and online safety. We have an opportunity to apply decades of cybersecurity experience before the next generation of technology creates consequences we cannot easily reverse.

I learned the importance of that responsibility through a three-year-old child I’ll call Adia. Her name is a protective pseudonym.

Adia appeared in an image of child sexual exploitation uploaded to the internet. Investigators needed to determine where she was, identify the appropriate jurisdiction, and get actionable intelligence to the law-enforcement officer authorized to intervene. The technology enabling exploitation operated globally and almost instantaneously, while the systems responsible for protecting children remained constrained by fragmented information, legal boundaries, and legacy processes.

At the time, parts of that process could take approximately 30 days. For a three-year-old child, that was an unacceptable delay. It was 30 more nights before rescue.

Through Intel Inside, Safer Children Outside, I helped lead a public-private collaboration that brought technology companies, nonprofits, and law enforcement together to accelerate the delivery of actionable intelligence. Our work helped reduce a process that had taken roughly 30 days to approximately 24 hours.

That experience reinforced one of the most important lessons of my career: When digital crimes threaten human safety, competitors can become collaborators.

Companies that compete aggressively in the marketplace can share expertise, align technical capabilities, and work alongside government when the mission is bigger than any individual organization’s commercial interests.

We didn’t need one company to own the solution. We needed the right experts working together with an objective, appropriate legal authority, and measurable outcomes.

After nearly 30 years in technology, including my career at Intel, I believe AI safety requires the same approach.

AI systems can generate software, interact with enterprise applications, access sensitive information, and execute complex workflows with limited human intervention. These capabilities create significant economic and societal opportunities, but they also introduce new attack surfaces and operational risks.

For cybersecurity professionals, many of the underlying concerns are familiar. Identity and access management, least privilege, data protection, supply-chain security, vulnerability management, and incident response remain essential.

However, increasingly autonomous systems introduce additional complexity. Organizations must evaluate whether an AI system’s intended capabilities could produce unacceptable outcomes.

An autonomous agent with excessive permissions may execute unauthorized actions. Prompt-injection attacks can manipulate legitimate workflows. Compromised integrations can expose sensitive information or create cascading failures across connected systems.

These risks become particularly consequential when AI is deployed in healthcare, financial services, government, and critical infrastructure. The technology is evolving faster than many organizations can adapt their security architectures, procurement processes, and governance structures.

We have seen this pattern before. The question is whether we will apply what we learned.

Today, I serve as a Commissioner with the Global Council for Responsible AI (GCRAI), leading its International AI Safety Commission and work on International AI Safety Red Lines.

Our objective is to help establish boundaries for autonomous AI systems and advance those boundaries toward practical implementation. I believe the next phase of AI safety requires a shift in leadership and execution.

We have spent years discussing responsible AI principles, ethical considerations, and potential future risks . These conversations have been valuable, but principles alone cannot secure infrastructure, enforce access controls, or establish legal accountability.

It is time to put the people who understand how complex systems are built, secured, regulated, and operated at the center of the work. Let the engineers engineer. Let cybersecurity experts test the systems. Let legal experts establish enforceable accountability. Let infrastructure operators determine what is operationally feasible.

AI researchers must help define and evaluate dangerous capabilities. Data architects must address information integrity, access, and provenance. Security professionals must identify vulnerabilities and develop effective controls. Legal and regulatory experts must evaluate jurisdiction, liability, and enforceability.

Policymakers, civil society, and affected communities also have essential roles in defining acceptable risk and protecting public interests. Technical leadership must be informed by the people who will experience the consequences of these systems.

This is not a challenge that any single discipline, institution, or company can solve independently.

The same principle that helped us confront digital crimes applies here: competitors can collaborate on safety without surrendering their ability to compete on innovation.

The International AI Safety Red Lines initiative is focused on a fundamental question: What capabilities and behaviors should increasingly autonomous AI systems never be permitted to exhibit?

Responsible AI principles establish important expectations involving transparency, fairness, accountability, privacy, and human oversight. Red Lines are intended to define boundaries where risk becomes unacceptable.

For example, organizations need to determine how to prevent autonomous systems from exceeding authorized permissions, circumventing human oversight, facilitating serious cyberattacks, or compromising critical infrastructure.

These boundaries must eventually translate into technical requirements that can be implemented, tested, and independently evaluated.

A commitment to human oversight is not equivalent to demonstrating that an autonomous system can be interrupted or contained. A statement about protecting sensitive data is not equivalent to proving that an AI agent cannot access information outside its authorized scope.

Cybersecurity has taught us the importance of this distinction.

Responsible AI is a commitment. Demonstrable AI safety is an engineering and governance discipline.

During the 2026 United Nations General Assembly week in New York, we brought our International AI Safety Red Lines findings into discussions with leaders across technology, government, healthcare, financial services, and international governance.

The international dimension matters because AI systems operate across corporate and national boundaries. Models may be developed in one country, hosted in another, and integrated into critical services around the world.

Effective safety measures will require technical interoperability, accountability, and collaboration across jurisdictions.

Our next priority is to advance the Red Lines through open technical scrutiny. Cybersecurity professionals, AI researchers, infrastructure operators, legal experts, and other stakeholders should be able to challenge assumptions, identify weaknesses, and imp do rove the work. Credibility is earned by demonstrating that the framework can withstand scrutiny and produce meaningful results.

When I began my technology career, cybersecurity was frequently treated as an IT function rather than an enterprise-wide business responsibility.

Over time, the scale and consequences of cyber incidents changed that perspective. Security became a board-level concern, supported by technical standards, governance frameworks, regulatory requirements, independent assessments, and procurement expectations.

Privacy followed a similar trajectory as organizations faced more explicit obligations for protecting personal information.

The critical transition was from voluntary commitments to demonstrable accountability.

Organizations could no longer rely exclusively on assurances that they valued security. Customers, regulators, and business partners increasingly expected evidence of effective controls.

AI safety is approaching the same transition.

We already have valuable foundations, including the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 27001, and established cybersecurity assurance practices.

These frameworks address different dimensions of risk, and none independently guarantees that an autonomous AI system is safe. However, they provide an important foundation for developing consistent expectations and measurable safeguards.

The next stage should follow a recognizable progression: establish principles, define unacceptable boundaries, translate those boundaries into measurable controls, align with appropriate standards, independently assess effectiveness, and continuously monitor compliance.

Over time, sufficiently rigorous and testable requirements could support credible certification or other independent assurance mechanisms. The objective should be defensible evidence that AI systems operate within established safety boundaries.

Consider a chief information security officer evaluating an autonomous AI agent for deployment inside a hospital, financial institution, or energy company.

Traditional vendor-risk assessments already address infrastructure security, encryption, identity management, vulnerabilities, incident response, and regulatory compliance.

Can the system exceed its authorized privileges? Can malicious instructions manipulate its behavior? How are connected tools and sensitive data protected? Can dangerous actions be detected and interrupted? What happens when the underlying model changes? What independent evidence demonstrates that safeguards remain effective?

These questions require technical answers.

Organizations need control objectives, repeatable testing methodologies, logging, monitoring, documented response procedures, and mechanisms for reassessment when systems materially change.

Procurement can accelerate this transition. Governments and enterprises can establish risk-based requirements for vendors deploying AI in sensitive or high-impact environments.

Hospitals can require evidence that clinical AI systems operate within approved decision-making boundaries. Financial institutions can demand safeguards against unauthorized transactions. Critical-infrastructure operators can establish requirements for containment, human intervention, and operational recovery.

This is how cybersecurity evolved from a nice-to-have into a need-to-have. AI safety can follow a similar path.

There is another important opportunity in this transition.

Much of the public discussion about AI and employment focuses on displacement. Those concerns deserve serious attention, but the expansion of AI also creates demand for specialized human expertise.

Cybersecurity offers a useful historical comparison. As digital infrastructure expanded, organizations developed new professions in security architecture, penetration testing, threat intelligence, incident response, privacy engineering, and risk management.

AI safety will require comparable specialization.

We will need AI safety engineers, red-team specialists, model-risk assessors, control designers, independent auditors, incident investigators, infrastructure security experts, and professionals who can translate technical risks into business and regulatory requirements.

Experienced engineers and technologists already possess many of the foundational skills required for this work.

Rather than focusing exclusively on which jobs AI may eliminate, we should also consider which new responsibilities and professions are becoming essential because AI exists.

Human expertise is not simply a temporary safeguard until technology becomes more capable. Human judgment, legal accountability, independent oversight, and technical expertise are foundational to trustworthy technology governance.