AI Safety vs. InfoSec: Lessons, Incidents, and Stakes

Executive Summary

Artificial intelligence safety is often framed as the successor to information security. Where infosec failures cost money, privacy, and infrastructure, AI failures could cost us control over the very systems we depend on. The stakes are higher, the timelines shorter, and the risks permanent. But focusing only on financial loss as we did in information security, risks repeating a deeper mistake. Not all actors are driven by money. In some regions, prestige and standing matter more than balance sheets. Leaders may absorb economic costs if it prevents an erosion of prestige. In others, the pursuit of geopolitical leverage outweighs compliance fines or reputation risk. These divergent incentives already complicated the global fight over cyber threats, and in the age of AI, they could fracture safety regimes entirely.

An aside worth noting: in the West, we often fail to recognize these alternative drivers of adoption and regulation. We design frameworks assuming money is the universal motivator, but it is not. By overlooking prestige and power as equally potent currencies, we risk misreading how and why other actors will adopt or resist AI safety measures. The takeaway is clear, AI Safety must be framed in terms broader than financial loss if it is to gain traction across cultures and systems of power. If it is not, we risk building guardrails that apply only to ourselves.

Introduction

Information security offers a cautionary history: it began as a mission to protect systems, data, and users from adversaries. Over time it became subordinated to cost and uptime priorities. AI safety now faces the same risk and with far higher stakes. This paper draws parallels between infosec’s trajectory and AI safety’s emerging challenges, examining incidents, structures, and incentives.

Historical Lens: Information Security

Information security began as a mission. The early practitioners were adversarial thinkers. They looked at systems the way an attacker would, found the weak points, and built defenses with the assumption that failure meant real damage. In military and critical infrastructure, it often did, but over time that mission was absorbed into corporate structures. Security ended up under IT and the CIO. That placement created a conflict of interest. The CIO is measured on cost and uptime. Security, when it competes with those goals, loses. The result was a slow drift away from mission protection and toward risk management by spreadsheet.

This change turned security into a reactive discipline. Patch cycles meant defenders always moved after attackers. Bug bounty programs outsourced the discovery of holes without building internal resilience. Compliance dashboards allowed organizations to show progress while remaining exposed to the same underlying threats. Attackers adapted faster. Low-cost cybercrime shops built economies around ransomware and fraud. State actors exploited the gaps with targeted operations. Insiders leveraged poor controls for personal gain. Meanwhile security teams were forced into a permanent game of catch-up. The lesson is straightforward. When security is subordinated to cost or convenience, it degrades into a checklist function. Once that happens, the adversary sets the pace.

State of AI Safety – Fall 2025

This section summarizes the current state of AI Safety as of Fall 2025, drawing from the most recent 90-day developments.

Regulatory & Governance

• Italy passed the first comprehensive national AI law in the EU.

• EU AI Act is live; full enforcement by Aug 2026.

• G7 Hiroshima Process reporting framework via OECD.

• UN launched global AI governance mechanisms.

• US shifted posture: rescission of EO 14110.

Standards & Frameworks

• NIST AI RMF (GenAI profile) as US baseline.

• OWASP LLM Top 10 (2025) formalized prompt injection.

Technical Safety & Evaluations

• UK AI Safety Institute evaluations remain leading. • Academic work: data filtration curbs dangerous capabilities.

Platform Integrity & Provenance

• C2PA provenance adoption: Google Pixel 10 camera, Google Photos.

• Media org pilots parallel SPF/DMARC for media.

Macro Risk & Equity

• WTO warns AI may widen the global wealth gap despite boosting trade.

Incident Matrix: Recent AI Safety Failures

The following incidents demonstrate how AI safety is already encountering infosec-style failures.

• Illegal content (CSAM): weak guardrails let criminal imagery through → platforms become liability engines.
• Prompt injection: like SQL injection, trusted output becomes attack input → data leaks and system pivots.
• Enterprise jailbreaks: assistants like Q, Copilot, Gemini → code exfiltration, brand damage, sabotage.
• Deepfakes: psychological + reputational harm → erosion of trust, not just financial loss.
• Child safety gaps: weak age-gating and grooming risks → design failure from the ground up.

Pattern recognition: these are not edge cases. They show AI safety is already repeating infosec’s worst mistakes. The following incidents show that AI safety is already repeating familiar infosec patterns. Each example highlights the same structural weaknesses: untrusted input, misplaced incentives, and controls built after the fact.

• Illegal content generation (CSAM). A chatbot platform was flagged for generating child abuse imagery. This was not a single bad actor, but a systemic failure. Weak guardrails and jurisdictional dodges created an environment where criminal content could be produced at scale. In infosec terms, this is the equivalent of an open relay or unpatched server left running in production. The takeaway is simple: without upstream controls, entire platforms become liability engines.

• Prompt injection and data leakage. Case studies documented injections that ex-filtrated sensitive information from tools connected to large language models. This is the same pattern as SQL injection in web systems. Treating model output as trusted input created a path for attackers to move laterally. Once again, the core failure is ignoring the principle of least privilege.

• Enterprise assistant jailbreaks. Integrated assistants like Amazon Q, GitHub Copilot, and Google Gemini were shown to be exploitable through indirect prompts. This is not just a novelty. It means proprietary code and business processes can be exposed through casual manipulation. The risk is brand damage and legal liability, but the deeper issue is architectural. Tasks were given to models without policy brokers or hard boundaries.

• Deepfake harms. Non-consensual nudes produced with generative models spread rapidly. These harms are psychological and reputational rather than financial, but they are no less damaging. Infosec faced the same challenge with phishing: the cost is not in the exploit itself but in the erosion of trust.

• Child safety gaps. Regulatory probes in the United States focused on AI chatbots interacting with minors. Weak age-gating and the potential for grooming or harmful advice created direct exposure for companies. This is the analog of weak access controls in infosec. When the most vulnerable users are not protected by design, the system is already broken.

Pattern recognition: These incidents do not represent edge cases. They show the structural reality of deploying AI without a layered defense model. In each case, the failure was predictable, the attack surface was known, and the consequences scale faster than the defenses. The adversary still sets the pace.

Structural Parallels: Infosec vs AI Safety

The parallels are direct: both began as protective missions but risk becoming compliance exercises.

Dimension	Infosec (Then/Now)	AI Safety (Emerging)
Org Placement	Rolled under CIO/IT	Inside labs/vendors racing for capability
Mission	Protect systems → compliance dashboards	Prevent misuse → risk of compliance theater
Approach	Patch Tuesdays, bug bounties	Reactive patches, red-teams, ‘alignment bounties’
Threat Actors	Criminals, states, insiders	Superhuman AI, malicious states/groups
Public Impact	Scams, ransomware, infra attacks	Systemic manipulation, existential risk
Trajectory	Permanent catch-up	Risk of permanent loss of control

Discussion: Divergent Incentives and Future Risks

AI safety does not suffer from a lack of frameworks or headlines. It suffers from the same structural weakness that crippled information security: misaligned incentives. In the West, the driver is money. Systems are patched to avoid lawsuits, fines, or lost revenue. That logic fails when the actors across the table are not counting dollars. In parts of the Middle East, decisions hinge on prestige. Leaders will accept higher costs if it prevents visible erosion of standing. In Russia and its allies, the driver is geopolitical leverage.

Systems are built and deployed not for efficiency but for deterrence and advantage. These are not secondary concerns. They are core motivators, and they shape how safety regimes rise or collapse. This mismatch is not theoretical. Infosec already proved it. Western compliance frameworks assumed that everyone wanted to minimize cost and liability. State adversaries did not care. They used prestige operations, cyber offensives, and disinformation precisely because it created symbolic gains even when it made no financial sense. That led to two decades of breach after breach while dashboards showed progress. AI magnifies this problem.

Once safety fractures along lines of money, prestige, and power, cooperation becomes impossible. Voluntary standards will stall. Global adoption will fragment. The outcome is not uneven compliance, it is the creation of safe and unsafe zones in which the weakest actors dictate the overall risk. the path is obvious. Unless safety is framed in terms that recognize all three drivers, it will degrade into the same theater that swallowed infosec. The only difference is scale. In infosec, that led to ransomware and critical infrastructure outages. In AI, the result could be systemic instability and irreversible loss of control.

Recommendations

Policymakers
– Establish enforceable baselines. Voluntary codes will fail against actors motivated by prestige or power. Laws must include binding safety requirements with independent verification.

– Fund national and international evaluation centers. AI models should be subject to the same scrutiny as aircraft or pharmaceuticals.

– Harmonize safety standards across borders. Divergent rules create regulatory havens. Closing gaps requires coordination at the G7, OECD, and UN levels.

Industry
– Build layered defenses. Treat AI like any other critical system: isolate components, enforce least privilege, and assume outputs can be malicious.

– Adopt provenance at scale. C2PA-style watermarking and cryptographic signatures should be as common as TLS certificates.

– Open the door to third-party evaluations. Independent red teams and accredited auditors are essential. Without them, ‘trust us’ will not hold.

Civil Society
– Act as watchdogs. NGOs, universities, and media must test systems, highlight failures, and demand accountability.

– Advocate for transparency. Citizens have a right to know when they are dealing with AI and what risks are being accepted on their behalf.

– Keep equity in focus. AI risks widening the global gap. Civil society must hold governments and companies accountable for outcomes, not just promises.

Conclusion

Information security taught us what happens when a mission is reduced to checklists. Once security was subordinated to cost and convenience, attackers set the pace and defenders played catch-up. That produced decades of ransomware, espionage, and disinformation while dashboards showed ‘green.’

AI safety is following the same path, but the cost of failure is far higher. This is not about stolen credit cards or downtime. It is about systemic instability, geopolitical leverage, and the possibility of losing control over the systems that drive economies and governments.

The incentives are misaligned. The frameworks are fragmented. The incidents are already happening.

The question is not whether AI safety will matter, it is whether we will recognize the stakes before the window closes. If we continue to treat AI safety as a compliance exercise, we will fail. If we face it as a mission with enforceable baselines, layered defenses, and recognition of prestige and power alongside profit, we stand a chance.