Is physics the answer to AI software attacks? asks Michael Vallas, Global Technical Principal at Goldilock Secure.
The recent cyber incidents involving Meta, OpenAI and Anthropicโs AI models are a clear sign of how the industry has been heading towards this point for years. In each case, AI models have advanced their capability to find ways to escape the strict safeguards and boundaries intended to contain them. This exposes the fundamental weaknesses in relying on software controls alone, software can attack software.
As AI systems become agentic and more autonomous, they are also becoming capable of exploiting the software environments they operate within. At the same time, AI-driven attacks are getting faster and more effective at identifying vulnerabilities, uncovering hidden pathways and moving laterally across connected systems. This is why the conversation is shifting towards how organisations must retain control when the software they rely on can no longer be fully trusted. For the AI model testers, this means ensuring the test sandboxes are physically containing the AI, not just using software-defined boundaries.
Defences must therefore shift from pure software to hardware-enforced controls that AI canโt see or manipulate. The goal is no longer to eliminate every vulnerability, which has proven to be unrealistic, but to strictly contain the attack chains AI can assemble in seconds. That means deep segmentation to define the reach AI can have and deterministic control that can only come from physically isolating critical systems the moment compromise is detected.
You canโt trust software any more
For years, deep segmentation meant managing system efficiency by using software to control how traffic moves between workloads, applications, users and devices. It has increasingly become an essential element of enterprise security because it gives organisations greater visibility and control of east-west traffic while enabling policies to be enforced across increasingly complex networks.
But the fundamental weakness of software controls is that there are no physical boundaries behind them. They are just code trying to protect other code, which means they can be exposed to the same logic-based attacks as the systems they are trying to protect.ย In practice, that means adding on-demand hardware air gaps into the security architecture. The aim is to build resilience from the infrastructure up, rather than relying on another layer of software to control what happens underneath it.
The NotPetya and SolarWinds attacks were good large-scale examples of why this matters and remain great examples of how AI has progressed its attack methods. In both cases, the logical network perimeters were bypassed once attackers obtained valid credentials, elevated their privileges, and rewrote or disabled the access controls meant to stop them. Once an attacker gets inside, you can no longer trust anything you see – every control you run and every insight you gather could be a faรงade they’re creating for you. Absolute control has to come from a level below that they can’t see or touch.
AI will eventually work through software
Whatโs really exposing the weaknesses in software-defined security is the growing use of AI in cyberattacks. Software-based security tools alone are not keeping pace with AI-driven threats because traditional defences rely heavily on towers of rules and logic – and logic happens to be exactly what AI is good at working through.
AI-assisted threats can find and leverage hidden pathways, extract credentials, analyse complex configuration mismatches, and relentlessly test different ways to move laterally through a network. What once required substantial time and manual effort can now be automated and carried out at much greater speed. And that speed is helping to shrink breakout times, with attacks that could once take days potentially being reduced to minutes.
An AI agent can test multiple pathways, APIs and open ports across an entire network architecture, and more advanced models can analyse network configurations to predict defensive behavioural baselines and rewrite code exploits on the fly – all while they rapidly test and deploy stolen credentials. This doesnโt mean that segmentation doesnโt work, but it does mean that software-controlled segmentation needs to be reinforced with independent, infrastructure-level controls that can contain the spread of AI-driven attacks.
Isolating the threat, not the business
There is a common assumption that physically isolating assets and networks during a cyberattack means shutting down the business. In reality, it can help organisations do the opposite and keep critical operations running while limiting losses.
This is different from micro-segmentation, which focuses on workload-to-workload communication, whereas infrastructure-level segmentation gives deterministic control over how systems interact at the infrastructure level. Because those boundaries are physical, businesses can isolate a compromised IT environment while allowing critical OT systems – or any uninfected segment – to keep running autonomously as normal.
That gives security and business leaders more options during a crisis, they can pre-plan and pre-approve defensive actions. Instead of choosing between allowing an attack to spread or shutting everything down, they can isolate the affected part of the network and keep critical operations running. This matters as cyber resilience increasingly becomes a board-level concern. Leaders need to know that the resilience plans they approve will be enacted and work with certainty when they are needed most.
What the future of cyber resilience looks like
Looking ahead, cyber resilience wonโt be about having the biggest or most expensive security stack. It is about being able to stay in control when an attack is already happening. And as attackers increasingly use AI and automation to find vulnerabilities, bypass controls and accelerate attacks, resilience needs to be built into the architecture itself.
Organisations need a layered approach that combines visibility, detection, orchestration, software-defined segmentation and physical, infrastructure-level enforcement. By bringing these capabilities together, organisations can create security boundaries that keep the business running, regardless of how sophisticated the threats they face become.
