Claim
Export controls that restrict AI from helping with security-relevant tasks like bug-fixing asymmetrically harm defensive security teams, because defenders require that capability to patch vulnerabilities before attackers can exploit them, while attackers do not need defensive-capability AI to execute attacks.
Mechanism
Attackers and defenders use different AI capabilities. Attackers need models that help them discover vulnerabilities, generate exploits, and probe systems. Defenders need models that help them understand vulnerabilities, write patches, write tests that verify patches, and explain fixes to stakeholders. These are distinct capability sets. Export controls triggered by the ability to "fix bugs" eliminate the defensive capability while leaving offensive capability largely intact: attackers can still find bugs without AI bug-fixing assistance. The restriction closes one lane for defenders without equivalently closing any lane for attackers. The asymmetry grows as AI becomes faster than human patch cycles.
Conditions
Holds when: the export control treats any engagement with security-relevant code as a restricted capability, without distinguishing offensive from defensive use. Applies in any jurisdiction where AI models are restricted based on what they can help with rather than who is using them and why.
Fails when: export controls are narrowly scoped to genuinely offensive capabilities, such as generating novel exploit code, and explicitly permit defensive workflows including patch generation and vulnerability explanation.
Evidence
Willison describes researchers who prompted AI models to "fix this code" containing known vulnerabilities. Fable 5 refused requests to review code for security issues, then complied when asked to fix bugs. The compliance was then labeled a jailbreak and used to justify the export ban. Willison's core argument:
"Defenders need to ask AI to fix bugs, explain why the fix matters, and write tests confirming patches. That is not a guardrail bypass. It is the most valuable thing an AI model can do for defensive security."
He frames non-technical policymakers as the structural problem: they conflate the ability to identify security flaws with dangerous offensive capability.
Signals
- A security team can no longer use AI to generate patch code or explain vulnerability fixes.
- Offensive security researchers face no equivalent restriction on using AI to find or probe vulnerabilities.
- AI models are available to foreign threat actors through other models while domestic defenders face restrictions.
Counter-evidence
Export controls on capable AI models do address real proliferation risks. Frontier models could accelerate state-sponsored offensive cyber programs. Restricting them broadly may be simpler to enforce than fine-grained capability controls. Willison's critique targets the specific calibration, not the existence of controls.
Cross-references
- Silent AI model degradation breaks user trust more fundamentally than explicit refusals because users cannot adapt to limitations they cannot detect (Simon Willison on invisible safeguards as a trust problem, June 2026)
- Frontier AI deployment is now constrained by safety policy, not by model capability (Tomasz Tunguz on policy constraints on frontier AI, June 2026)
- When safety restrictions align with financial incentives, treat the safety rationale as suspect (Armin Ronacher on safety framing as access restriction, June 2026)