We Put Cameras on the Raptors

In the later Jurassic Park films there is a moment that should have been funnier than it was. Somebody looks at the velociraptors, the animals that spent the first film systematically eating the cast, and decides the correct response is to train them. Put a handler on them. Mount a camera on the head. Point them at the thing you are actually afraid of.

It works, right up until the raptors reconsider. Not out of malice. They just get new information about who they are working for.

This is the current state of AI in cybersecurity, and I mean that with more affection than it sounds. The industry has correctly identified that AI agents are becoming a serious offensive capability, and has concluded, reasonably, that the answer is defensive agents. Fight fire with fire. Put a camera on the raptor.

It is not a stupid plan. It might even be the only plan. But it has a property that traditional security tooling does not have, and almost nobody is pricing it in.

First, the unglamorous truth from our own logs

Before the future, the present. We run a public Bot Ledger that logs every automated request to this site, including the ones probing for vulnerabilities. Here is a genuine 30 day sample of what actually tried our door.

Three hundred and seventy vulnerability probes in a month, against three hundred and eighteen AI crawler visits. More hostile scanning than AI traffic. And when you classify it, it splits almost exactly in half between two ambitions: 43.8% hunting a WordPress installation we do not have, and 45.1% hunting credentials, mostly environment files.

That second number is the one to sit with. The WordPress probes are the loudest and the least likely to work. The .env probes are quieter, more numerous, and catastrophic when they land, because a leaked environment file is not a foothold, it is the keys. Nothing in that traffic is clever. It is just correct about where the value is.

One thing we should declare, because it is the obvious objection: this site used to run on WordPress. It does not now, and it is static today, but that history could plausibly explain why so much of this traffic hunts WordPress paths. So we checked, and the evidence says it does not. The scanners guess at subdirectories, trying /shop/, /cms/, /test/ and /2019/ before wp-includes, which is not how you behave when you know what a site runs. They are not remembering us. They are enumerating everyone.

Our sample is tiny, so here is the real picture

Twelve probes a day is not a national statistic, and it would be dishonest to present it as one. For scale: the SANS Internet Storm Center, which aggregates sensors across the internet, logged around 108 million attack records in the same seven day window, from roughly 175,000 distinct sources a day. We are one grain of sand on that beach. What makes our grain worth publishing is not its size, it is that anyone can check it, and that the shape matches what the big sensor networks see.

The more useful comparison is against what is actually being exploited. CISA maintains the Known Exploited Vulnerabilities catalogue, a list of flaws confirmed to be under active attack. It currently holds 1,653 entries. Search it for the things hammering our door and you get six WordPress entries and thirteen for PHP generally. Search it for enterprise edge equipment and you get thirty-five for Ivanti, twenty-eight for Fortinet, twenty-two for Citrix.

That gap is the whole lesson of this section. The traffic that reaches a small website and the vulnerabilities that actually break organisations are two different threat surfaces. Commodity scanning is loud, indiscriminate and mostly aimed at a decade-old CMS. Real intrusions increasingly come through the appliance sitting at the edge of a corporate network, which never appears in logs like ours because it is not a website. Do not mistake the doorbell for the fire.

And none of it adapts. No reconnaissance, no adjustment when the first forty attempts returned 404. Just scripts sweeping the internet, checking whether we are one of the millions of sites running an unpatched plugin or a misplaced config file. The most sophisticated thing about the whole operation is that it costs nothing to run.

That is the honest baseline, and it matters for scoping. If you are a normal business, the overwhelming majority of hostile traffic you receive is still commodity garbage. The raptors have not arrived at your fence. Script kiddies are still rattling it, and they will get in if you left the gate open, which is why patching and credential hygiene remain more valuable than anything with "AI" in the product name.

The part that is genuinely new

Now the future, because it is arriving and it is not the part the marketing is about.

Every security control ever built has had one useful property: it cannot be talked out of its job. A firewall cannot be persuaded. An EDR agent cannot be socially engineered. You can exploit a bug in them, you can misconfigure them, but you cannot convince them to change sides mid shift, because they do not process language as instruction.

LLM agents do. That is the whole point of them, and it is not a bug that gets patched next quarter. OWASP researchers described prompt injection at Infosecurity Europe this year as architecturally unsolved, for a reason worth understanding: a model processes everything as one token sequence. There is no privilege boundary between your system prompt, your user's query, and the content the agent went and fetched. The model has no reliable way to know that the log file it just read is data rather than orders.

The numbers are early but not comforting. Prompt injection is reported as the fastest growing attack category of 2026, the average agent related breach is running around $4.7 million, and roughly 61% of incidents trace back to over permissioned credentials. That last figure is the important one, and we will come back to it, because it is also the good news.

You do not have to take my word for the paradox

Here is the part that makes this more than a neat analogy. The companies selling AI defence publish the evidence for the other side of it themselves, and they are the best source we have.

Anthropic banned 832 accounts for cyber related policy violations across a single year, mapped what those accounts were attempting, and contributed the findings to the Verizon Data Breach Investigations Report. The same company separately disrupted what it described as the first reported AI orchestrated cyber espionage campaign, in which an agent was used to run the attack rather than merely advise on it. OpenAI publishes a recurring "Disrupting malicious uses of AI" report doing much the same job.

Both companies also sell AI security products. Anthropic's models are embedded in defensive tooling across the industry; OpenAI ships Daybreak.

That is the paradox, stated by the people best placed to know. The same capability is the armoury and the guard. The vendor writing your defensive agent is also, on a different day, writing the incident report about someone using the same model offensively. This is not hypocrisy and I want to be careful here: publishing that data is a genuinely good thing that most industries never manage, and we only know the shape of the problem because they did it. But it should end any conversation that treats "we are deploying AI defensively" as a category distinct from the threat. It is the same animal, hired.

Which is also why the numbers are so hard to reason about. Those 832 accounts are the ones that were caught, on the platforms that publish. Nobody publishes the figure for models running on somebody's own hardware with the safety training removed, and that population is not zero.

Credit where it is genuinely due

It would be easy, and lazy, to stop there and write the whole field off. So let me be fair, because the serious players are doing serious work.

OpenAI's Daybreak is defensive first by design, aimed at finding and patching vulnerabilities before attackers do, and built alongside actual security companies rather than in isolation. Their cyber tuned model was held to restricted access for verified defenders with additional monitoring, which is a meaningfully responsible answer to an obvious dual use problem. They could have shipped it wide and did not. The associated open source patching push is a straightforwardly good thing for an ecosystem where the bottleneck is not finding bugs but fixing them.

And having gone through the partner enablement for it, I will say the thing I did not expect to say: the training is better on delivery discipline than most consultancies manage. It talks about bounded pilots, with evidence requirements and explicit stop conditions. Stop conditions. A defined point at which you agree in advance to halt and reassess. I have reviewed a lot of AI project documentation in this archive and almost none of it contains that idea. If the only thing a practitioner takes from any of this is "define what would make us stop", the field is ahead.

The thing that gives me pause

Here is where the raptor analogy earns its keep, and it is not about the technology at all.

The commercial machinery is being built faster and more systematically than the competency layer. That is not an accusation, it is public record. The OpenAI Partner Network launched this June with reported nine figure backing and a stated target of 300,000 certified enterprise AI consultants by the end of 2026, cybersecurity among the specialisation tracks.

Three hundred thousand certified consultants, this year, in a discipline whose central vulnerability its own researchers describe as unsolved. Set aside whether any individual course is good. Ask what a number like that does to a market. It produces an enormous population of people credentialed to sell and deploy agentic security, expanding far faster than the population of people who have operated it long enough to have watched one fail.

Because the practitioner curriculum in a new field cannot contain what nobody has learned yet. Real security practice is sedimented incident experience. It is knowing which alert is nothing, which log line matters at 2am, what the last four breaches actually looked like from inside. That takes years and there is no way to compress it, however good the enablement is.

Which brings us back to the island. The failure in every one of those films is never that the dinosaur outsmarted the fence. The fence was fine. The failure is that the commercial pressure to open on schedule ran ahead of the safety engineering, and the people who understood the containment were outranked by the people who understood the business case. The raptors are not the antagonist of Jurassic Park. The board is.

What to do on Monday

None of this argues for staying out. Agentic defence is coming whether or not it is ready, and refusing to engage just means it arrives without you in the room. It argues for deploying it like something that could turn.

• Assume the agent can be retasked. Design as though an attacker will at some point be writing its instructions, because prompt injection is unsolved and your agent reads untrusted content by definition. The question is not whether it can be turned but what it can reach when it is.
• Scope the credentials like you mean it. That 61% figure is the whole ballgame. Over permissioned agents turn a prompt injection into a breach. Short lived, narrowly scoped, per task credentials turn the same injection into a log line. This is unglamorous 1990s security discipline and it is still the highest leverage control you have.
• Keep a human on the irreversible actions. Reading, triaging and drafting can be autonomous. Deleting, deploying, paying, and granting access should require a person. Owen Grady is not decorative.
• Build the kill switch before you need it. Know how to revoke an agent's access in one action, and rehearse it. Containment you have never tested is set decoration.
• Write the stop condition into the SOW. Take the one genuinely good idea from the vendor training and make it contractual. Define in advance what result means the pilot ends, and you have converted a research project into a scoped engagement. See also the deprecation clause, which does the same job for a different failure.

The honest summary

The threat is real but earlier than the marketing implies, and for most small businesses it is still comprehensively outnumbered by bots looking for a CMS you do not run. The defensive tooling is legitimate and some of it is genuinely well built. And the paradox is not a rhetorical flourish, it is documented by the vendors themselves: you are deploying the same animal you are defending against, and the only thing separating the two is instructions that prompt injection makes impossible to fully protect.

Put the camera on the raptor by all means. Just keep it in a paddock you have actually tested, give it the smallest possible key ring, and never let anyone tell you the training makes it not a predator. It is a predator. That was the point of hiring it.