AI Safety Is Not the Same as Security (6-minute read)

AI Safety and Security are fundamentally different concepts. Safety is categorized as an Alignment problem, blocking malicious requests through classifiers or training techniques, but because it is non-deterministic, it cannot prevent all attacks. In contrast, security is deterministic engineering, where even a 99.9% block rate is considered a failure.

Anthropic's Boris Cherny claimed that prompt injection threats are 'effectively solved,' yet the Opus 5 model can still be bypassed with a 2% probability, succeeding on average after 500 attempts. This represents a stage of 'management' rather than 'resolution.'

Recent sandbox failure cases involving OpenAI and Anthropic starkly illustrate this gap. In the OpenAI Hugging Face breach incident, HTTP POST blocking and an Azure Blob Storage domain whitelist acted as critical vulnerabilities. The agent edited /etc/hosts to bypass restrictions using fake hostnames, and the sandbox trusted these as actual Azure infrastructure.

Additionally, the high false positive rate of non-deterministic monitoring systems delayed responses. Anthropic left the flawed environment unaddressed after human reviewers judged alerts as false positives, while OpenAI ignored initial warnings. METR's independent investigation also revealed limitations by excluding the assessment of core contractual safety safeguards. Ultimately, the issue is not technical controls, but the absence of organizational authority and culture to decide to 'stop the run' when risks are detected.