Defensive AI Turn, four pieces from a convergent moment

Something is happening in the AI safety discourse that the headline "alignment vs. capabilities" doesn't capture. A distinct cluster of work has emerged that treats the question differently: not how do we align or constrain AI systems, but how do we build societal infrastructure robust enough that AI-enabled harm causes less damage regardless of whether those systems are constrained.

The cluster arrived independently across very different institutional settings. Julian Hazell writing for a personal Substack. The Institute for Progress commissioning a living essay collection. A UK-backed research initiative building a formal R&D agenda. A 30-country multilateral body synthesising scientific evidence for governments. None of them discovered the others before writing. The convergence is emergent which is either a sign that the idea is right, or a sign that the same cultural moment is producing the same response everywhere.

These notes read all four pieces as a cluster, aiming to hold the analytical structure of each well enough to actually use it.

You Actually Can Just Go Build Defensive

Hazell's opening move is to declare the 2023 playbook obsolete. The moment of international summits and sustained regulatory momentum did not hold. By 2025, AI capability costs had collapsed GPT-4 at roughly $40 million, DeepSeek R1 at roughly $6 million while governance ambition stalled. Most writers responding to this read it as defeat. Hazell reads it as a redirect.

The concept he proposes is hardening the broader world. Instead of constraining AI systems directly which requires regulatory buy-in most governments aren't currently offering you build infrastructure that limits the damage AI-enabled harms can cause, regardless of whether the underlying systems are constrained. The strategic question shifts from "how do we stop dangerous AI from being built?" to "how do we ensure that dangerous AI, when it exists, causes less damage?"

The categories of defensive technology he identifies are concrete. Biosecurity: next-generation PPE, far-UVC germicidal lights, biosurveillance networks if advanced AI can guide bioweapon synthesis, the countermove isn't only preventing AI from doing so, it's also making biological attacks less catastrophic when they occur. Digital identity: tools for distinguishing humans from AI agents, forensic attribution of AI-generated content. Cybersecurity automation: automatic bug-finding, formal system verification, memory-safety tooling. Epistemic infrastructure: AI forecasting tools, evidence synthesis, misinformation-countering systems. Hardware-Enabled Mechanisms (HEMs): hardware-level primitives for AI oversight named but not yet elaborated in the piece.

This political economy observation is the piece's sharpest insight. Defensive technologies sidestep the organised industry opposition that routinely kills AI regulation. They may also attract government funding as national security investments, making them significantly more tractable politically than governance reform.

Hazell is explicit that this isn't a permanent substitute for alignment research or regulation he frames it as the productive use of a low-appetite window. The piece ends on genuine optimism: "the opportunity to make AI more safe is only just beginning."

Caveat: Defensive tech addresses harm channels, not root alignment risk. The same cost reduction that makes AI accessible also accelerates offensive development offense often scales faster than defense, and the piece doesn't fully wrestle with this asymmetry.

The Launch Sequence

IFP's most ambitious publication to date is a living essay collection 17+ pieces as of mid-2026, still accepting submissions built around a single core bet: that realising AI's transformative potential for science and security requires deliberate government intervention, because commercial incentives alone will neither unlock the full upside fast enough nor adequately defend against the risks.

IFP frames this as two simultaneous failures of private incentives. First, AI's benefits for science won't arrive by default or quickly enough not because AI capability is lacking, but because structural barriers are the binding constraint: FDA regulatory bottlenecks, inaccessible government datasets, broken grant-funding models. Second, AI's security risks won't be mitigated by industry alone and there is "no iron law of computer science or economics" guaranteeing that defensive capabilities keep pace with offensive ones.

The science acceleration half focuses on removing structural barriers. A Deliverome Project to break the delivery bottleneck in precision medicine. Benchmarking for Breakthroughs a strategic challenge program for scientific discovery. X-Labs, reformed science funding models for large-scale AI infrastructure. An ARPANET-style data-sharing program to unlock orders of magnitude more training data from federal sources. A self-driving materials discovery lab. A brain connectome mapping project with dual applications in neuroscience and AI robustness research.

The security half is where IFP makes its most pointed argument. They explicitly critique existing AI safety proposals as relying on "brittle, top-down control" and more notably, critique the AI safety research community itself for focusing too narrowly on nonproliferation:

Security proposals include metagenomics-based pathogen detection, "Operation Patchlight" for AI-assisted cyber defence, "The Great Refactor" to automate memory-safety hardening of critical open-source code, a DOD-led red/blue-teaming effort to prevent AI sleeper agents, and hardware-based AI verification to limit misuse.

Political backing comes from Senator Martin Heinrich (D-NM), tied to his American Science Acceleration Project (ASAP) targeting a 10x acceleration in scientific progress by 2030. Endorsers span NSF, DARPA, Google DeepMind, Microsoft, Gingko Bioworks, CNAS, and FAS a deliberately broad coalition across the tech-policy establishment.

Caveat: This is a hub page for a living collection, not a single unified argument. The "first mover advantage" framing implicitly assumes national rather than global distribution of AI benefits a contestable geopolitical premise.

AI Resilience Civilisational Resilience in the Era of AI

Where Hazell and IFP are making strategic and political arguments, Kembery and Ammann are building a framework and it is a careful one. Core definition: "AI resilience is the capacity for existing and future civilisational systems to maintain their core function amidst the varied effects of increasingly powerful and increasingly widely available AI."

The key move is positioning AI resilience as a third layer in a defence-in-depth stack explicitly distinct from the two layers that dominate current AI safety discourse:

This is not a dismissal of alignment or control research the authors are explicit that resilience is complementary, not competitive. But the third-layer framing does important work: it acknowledges that alignment and control may be insufficient, and asks what it looks like to build robustness into the broader systems AI interacts with.

The methodology they call endgame thinking is worth foregrounding. Rather than asking how to improve incrementally on today's tools, it asks: what would it look like to durably and structurally resolve a class of vulnerability? Then work backward to identify the R&D needed to get there. This produces a different kind of research agenda oriented toward irreversible gains rather than marginal improvements.

Three endgame domains structure the agenda. Bio-Resilience: biosensing networks, pathogen-proof environments, decentralised rapid response capacity a world in which biological attacks cause far less harm regardless of weapon sophistication or vector. Cyber-Physical Resilience: critical infrastructure that operates securely and reliably by default, where the default state is secure, not vulnerable. Epistemic Resilience: tools and institutions that empower people to discover, validate, share, and defend true information in an environment saturated with AI-generated content.

Intellectual lineage note: The initiative draws heavily on Vitalik Buterin's d/acc (defensive acceleration) philosophy libertarian-techno-optimist in flavour, emphasising decentralised solutions and skepticism of heavy regulation. This colours the framing in ways worth being aware of, particularly for readers more institutionalist in policy orientation.

Status note: This is a nascent project. The R&D agenda identifies 30+ emerging technologies developed with specialists from 10+ frontier AI and scientific organisations, but the detailed sub-pages covering specific proposals were not fully available at time of reading. Worth revisiting as it matures.

International AI Safety Report 2026 §3.5 Building Societal Resilience

Where the first three pieces are arguments or initiatives, the IASR 2026 is a multilateral scientific consensus document commissioned by the governments attending the AI Safety Summits, representing 30+ countries including Australia, Brazil, Canada, China, France, Germany, India, Japan, Kenya, South Korea, the UK, and the US. Section 3.5 is the report's treatment of the same cluster.

The definition aligns with airesilience.net: "Societal resilience refers to the ability of societal systems to resist, absorb, recover from, and adapt to shocks and harms associated with general-purpose AI." And the positioning is the same resilience as a third pillar alongside technical safeguards and risk management, operating above the model level, addressing risks that emerge from AI's interactions with resources, individuals, organisations, institutions, and technologies.

The report's most useful contribution is Table 3.10, organising resilience measures into four functional categories across risk domains:

• Resistance Reduce likelihood or severity before a shock. Examples: DNA synthesis screening, media literacy education, multi-factor authentication.
• Absorption Maintain critical function during a shock. Examples: contact tracing, network segmentation, real-time deepfake labelling.
• Recovery Restore normal function after a shock. Examples: strategic vaccine stockpiles, offline backup restoration, correction and notification frameworks.
• Adaptation Transform systems to reduce future vulnerability. Examples: international biosecurity governance frameworks, incident reporting incentive structures, insurance markets, legal liability frameworks.

The report also identifies AI itself as a defensive tool: anomaly detection and malware classification for cyber defence, deepfake detection and digital watermarking for synthetic media, emergency management coordination, and zero-day vulnerability identification citing Google's Big Sleep agent as a real-world 2025 example.

Two findings stand out as particularly significant.

The offence-defence balance is genuinely unresolved. The report is unusually direct: "well-intentioned AI research for resilience may therefore inadvertently exacerbate risks." The same capabilities useful for defence simultaneously lower barriers for offence. In biosecurity specifically, the report cites evidence that offence is currently favoured and AI may tilt the balance further. Policymakers must weigh net benefit without adequate empirical grounding.

The funding gap is stark. Since the 2025 report, resilience investments have grown: OpenAI Foundation pledged $25 billion; Anthropic committed $10 million for economic impact research; the UK AI Security Institute awarded up to £4 million in seed grants. But private generative AI investment totalled $33.9 billion in 2024 alone, and OpenAI's Stargate Project involves $500 billion over four years.

The report recommends an iterative OODA (observe–orient–decide–act) implementation loop forecast scenarios, pilot measures, evaluate, measure post-deployment outcomes rather than one-time deployment of resilience infrastructure. It also flags a genuine open question about incentive structures: positive incentives (advanced market commitments, tax credits, public procurement) versus negative incentives (liability frameworks, insurance requirements), and who ultimately bears the financial burden of infrastructure that benefits everyone but is commercially difficult to monetise.

Caveat: The report is explicitly non-prescriptive it synthesises scientific evidence but does not recommend specific policies. Evidence for most resilience measures in an AI context remains sparse and highly context-dependent; effectiveness varies significantly by geography, language, digital infrastructure, and institutional capacity.

What the convergence means

What's striking is that these four sources converge on the same framework independently. Hazell (individual writer), IFP (US think tank), airesilience.net (UK-backed research initiative), and the IASR 2026 (30-country scientific body) all arrive at roughly the same structure: resilience and defensive technology as a necessary layer that operates alongside and not instead of alignment and control research. None discovered the others before writing.

The shared structure: alignment and control are necessary but insufficient; the relevant question is what it looks like to build societal robustness that operates at a layer above AI systems; defensive technologies are tractable now, in a way that governance reform often is not. The convergence is either a sign that the idea is right, or a sign that the same cultural moment is producing the same response everywhere which is itself worth paying attention to.

Open questions the cluster leaves on the table

• QThe offence-defence asymmetry. Every piece acknowledges it; none fully resolves it. If defensive capabilities don't automatically outpace offensive ones, what determines the balance, and can it be deliberately shaped?
• QFunding incentive structures. Resilience infrastructure is a public good it benefits everyone but is hard to monetise. Advanced market commitments and government procurement are proposed but untested at scale.
• QGeographic equity. Resilience measures that work in high-capacity Western contexts may be irrelevant or harmful in lower-capacity settings. The IASR flags this most directly effectiveness varies significantly by geography, language, digital infrastructure, and institutional capacity.
• QHardware-Enabled Mechanisms (HEMs). Named by both Hazell and IFP, not yet elaborated in the public record. Hardware-level primitives for AI oversight seem technically significant and worth tracking separately.