The AI Safety Arms Race: A Business Lesson

On the Latent Space podcast, Eric Nguyen, CEO of Radical Numerics, analyzed the attack on Hugging Face infrastructure and the question it raised across the industry: what else in the AI stack can fail in the same way? Anthropic responded by expanding Claude’s filters to cover two risks—cybersecurity and biosecurity. Clément Delang, CEO of Hugging Face, put the point more forcefully: defensive cybersecurity capabilities must be open and updated no more slowly than the models used to attack.

The argument was reinforced by GLM 5.2—a model that China’s Zhipu AI released openly and for free, and that became part of thousands of developers’ infrastructure worldwide within months.

Companies that give LLM agents access to tools through MCP or build RAG over internal documents expose the same class of attack surface as model vendors—only without Anthropic’s classifier budget. Every MCP server an agent can call and every RAG source it can read is a point where the model may execute an unchecked instruction or leak data if no separate filtering and logging layer exists between the agent and the system.

At KT.Team, we call this layer LLM & Security Gateway: a proxy between the agent and its tools that checks calls, blocks anything that must not leave the system, and updates independently of the agent itself—the patch cycle is not tied to the product release cycle.

The TTU—time to use—rule applies to security as well: a solution’s value is measured by how quickly it delivers results. A guardrail patched months after the release of a new-generation attacking model is theater, creating a false sense of security until the first incident.

A business connecting AI agents to internal systems must measure the speed of security updates against the speed of its features—otherwise the gap now discussed between Anthropic and Hugging Face will emerge in its own environment through a single compromised MCP server.