To demonstrate that a protection is insufficient, you have to bypass it. For the demonstration to be credible, you have to explain how. And that explanation is, word for word, a how-to guide. This is not a matter of personal ethics: it is a structural property of security research, and it has no clean solution.
We reported this morning that a testing method had turned into an attack template. Let's take the time to consider the question it raises.
Why silence doesn't work
The intuitive answer would be to publish nothing. It has been tried, and it fails for three established reasons.
The flaw exists whether you disclose it or not. Not publishing protects no one: it simply leaves users unaware of a risk that others, perhaps, already know about.
Without public pressure, nothing gets fixed. The history of computer security is one of vendors ignoring private disclosures for years, until publication became a credible threat. That is what produced coordinated disclosure and its ninety-day window.
Secrecy favours those already looking. A motivated attacker finds things. The defender who doesn't know doesn't even look.
That is why fifty years of practice have led to a counter-intuitive conclusion: making flaws public protects better than hiding them.
What makes AI different
Three differences prevent this model from being transposed directly, and they need naming.
There is no patch. A software flaw gets fixed: you change the code, ship an update, the problem goes away. A guardrail bypass cannot be fixed the same way. You can reduce its frequency with additional training, but you don't close a door, because there is no door — only a statistical tendency.
The barrier to entry is zero. Exploiting a software flaw generally requires skill. Reusing a bypass template requires knowing how to copy text. The population able to use the publication is incomparably larger.
The testing tool is the attack tool. In computer security, a distinction is drawn between describing a flaw and exploiting it. Here, the testing method is the attack method. There is nothing to hold back in the publication that would render it harmless.
Biology encountered this problem earlier and produced an imperfect but real answer: dual-use research of concern goes through review committees, some publications are stripped of their methodological details, and an international framework defines what is shared and what stays in a restricted circle. This apparatus is criticised, bypassed, and it exists. AI has no equivalent: each researcher decides alone, according to their conscience and their employer.
What seems to hold up
No simple rule works, but two distinctions help with the decision.
The severity of what is unlocked. Publishing a method that makes a model produce embarrassing content does not carry the same weight as publishing a method that unlocks dangerous capabilities. The same gesture does not have the same consequence.
The ratio between what it teaches and what it gives. A publication that explains why a class of attacks works serves the defence. A publication that provides a ready-to-use template serves the attack above all. Both can describe the same discovery, with different editorial choices.
That is where the researcher's real room for manoeuvre lies: not in whether to publish, but in exactly what they publish.
What is missing
What we call for in other articles applies here too, and it is the same gap.
There is no reporting channel for model security: no shared identifier, no standardised timeline, no protection for whoever reports. We wrote this regarding the inventory requested by Congress: without protection, transparency dries up.
Nor is there any body where a researcher can submit a sensitive finding for advice. They decide alone, and bear alone the responsibility for what follows.
What to take away
Our position, and it is an uncomfortable one: publication remains preferable to silence, and that preference is not free.
It is preferable because the alternative — security built on general ignorance — has never worked anywhere. It is not free because every publication arms someone, and claiming otherwise would be dishonest.
What would make this choice bearable is what other disciplines took decades to build: places where decisions about what gets published are made collectively, rather than leaving each researcher to arbitrate alone between their career, their conscience and the risk. This is not a question of individual goodwill. It is a question of institutions, and they do not exist.