Whether we’d admit it or not, most of us by now have offloaded some cognitive effort onto AI. Chatbots and agents have become so commonplace that it’s often tricky to avoid them. The stakes of this use are usually pretty low; we may compromise some of our own critical thinking skills and creativity in the process, but the harm stops there. In some cases, however, an over-reliance on automation can have major downstream consequences.
Cybersecurity is the most notable example. Thankfully, that’s a field that most of us almost never have to think about, because most of the time, the computer systems running critical infrastructure—from water treatment facilities to the stock market—function as they’re supposed to. But many of those systems haven’t been updated in decades. In July of last year, a report from the U.S. Government Accountability Office found that the Department of Defense’s in-house IT system has been in use since before the first Apollo moon landing. (The Department of the Treasury and the Environmental Protection Agency weren’t far behind.) “These agencies’ missions are essential to government operations such as health care, critical infrastructure, tax processing, and national security, and these legacy systems provide vital support to the agencies’ missions,” the GAO wrote in its report. COBOL, a computer programming language invented in 1959, is still widely used on IBM mainframe computers across the U.S. government, so much so that during the pandemic the governor of New Jersey was forced to put out a call for “cobalt” (his word) programmers to help maintain the state’s decrepit, aged, and overwhelmed unemployment system.
Unfortunately for the cybersecurity of the United States, much has changed since those “legacy” cybersecurity systems were first installed. Programmers today—perhaps more than any other profession—rely on AI in their day-to-day work. And while that may have led to some efficiency gains, it’s also turned much of modern programming itself into a black box. In a recent study with over 50 (mostly junior) software engineers, Anthropic found that using AI for coding “led to a statistically significant decrease in mastery.” And in a May survey of more than 850 cybersecurity professionals, two-thirds of them said they were now spending more of their time on the job reviewing AI outputs and trying to decide whether to trust them or not. Much of modern cybersecurity, in other words, revolves around just trying to interpret AI.
Meanwhile, leading AI companies have been competing to build what are effectively autonomous cybersecurity locksmiths. Anthropic’s Mythos, which the company first announced in April, was deemed to be so frighteningly good at finding and exploiting cyber vulnerabilities in software that the company said it would not initially release it to the public, choosing instead to roll it out gradually to a group of handpicked partners. The wide-eyed, almost reverent secrecy with which Anthropic teased the model quickly turned it into a cybersecurity bogeyman. In its own tests, the NSA—widely considered to be the Fort Knox of cybersecurity—reportedly used Mythos to discover flaws in its own system within a matter of hours. Other labs, like OpenAI and Google, soon followed up with their own models, which were described as being potentially dangerous hacking tools if they were allowed to fall into the wrong hands. (And in many cases, most notably the July Hugging Face hack, AI models from frontier companies didn’t even need human operators to commit cybercrimes.)
While there were those who brushed fears of an AI-triggered cybercatastrophe aside as doomerism or marketing hype, plenty of experts were genuinely worried. In June, the Five Eyes—an alliance comprising the government intelligence agencies in the U.S., Canada, U.K., Australia, and New Zealand—warned that the new fleet of AI models arriving on the market “are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years; it is months.”
Indeed, the cybersecurity threat posed by buzzy new models like Mythos and OpenAI’s Astra has dominated the public spotlight so much that it’s arguably blinded us to some much more subtle—but no less consequential—events unfolding in the wings. While the IT systems running critical U.S. government infrastructure have grown a bit long in the tooth, there’s been a simultaneous exodus of the very seasoned professionals who know how to operate and manage those legacy systems. Factor in an incoming generation of engineering talent that’s become largely dependent on AI assistance and you have a potentially explosive situation, experts say.
“There is a brain drain from the federal government at the very time when the cybersecurity challenges are a mess,” Darrell West, a senior fellow at the Center for Technology Innovation at the Brookings Institute, told Gizmodo.
Take the U.S. Cybersecurity and Information Security Agency (CISA), for example. Folded within the Department of Homeland Security, Trump inaugurated the agency during his first term to “lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure,” according to its website. Alas, part of that infrastructure includes the U.S. voting system, which meant Trump had some qualms with the agency after losing the 2020 election to Joe Biden, a loss he has yet to publicly concede; Trump fired Christopher Krebs, then director of CISA, before leaving office in January 2021. After Trump regained the presidency in 2024, his new administration—guided by Elon Musk’s short-lived Department of Government Efficiency (DOGE)—began slashing CISA’s budget, producing a surge of layoffs.
Many of the agency’s outgoing officials had spent long stretches of their careers updating and fortifying the federal government’s cybersecurity systems during a period of profound technological change, marked first by the rise of the internet and followed by social media. According to Josephine Wolff, a professor of cybersecurity policy at the Fletcher School of Law and Diplomacy at Tufts University, the result was a sudden and dramatic loss of hard-won expertise. “It’s a little heartbreaking when you think back over the past twenty or so years how much time, energy, and effort went into trying to build up cybersecurity expertise on the civilian side,” says Wolff. “I don’t know how long it will take to restore [that].”
It could be a long time, considering the difficulties that government agencies already have trying to attract and retain new cybersecurity talent, competing with high-paying private sector roles on the one hand and navigating federal budget cuts on the other. According to one survey conducted earlier this year, more than half of all government agencies across the country—not just federal but also state and municipal—have been struggling with cybersecurity recruitment and churn. The drying up of an incoming domestic pipeline coupled with a federal immigration crackdown on foreign talent “is a catastrophic combination” for U.S. cybersecurity, says West.
Without a steady flow of incoming cybersecurity engineers and experienced professionals to train them on the intricacies of the government’s antiquated system, that system could become more and more opaque, leading to greater and greater vulnerability for critical infrastructure. AI may be able to serve as a makeshift middleman between federal employees and their IT systems, but that’s not going to fix the underlying problems. This is one of those problems where just ignoring it is only going to make it worse, especially with an administration that’s ratcheting up its belligerence overseas; while CISA’s coffers have been depleted, the Pentagon’s have swelled.
“You’re not safer by going out into the world and punching everyone else in the face—actually that’ll make you significantly less safe, unless you’re willing to actually defend yourself at the same time,” says Safa Shahwan Edwards, director of the Cyber Statecraft Initiative at the Atlantic Council, a think tank based in Washington D.C. “So having all those investments in offense and not making the requisite investments in defense, and not giving CISA the resources that they need to do their jobs well… I don’t know what’s going to happen. It’s not going to be good.”
