One AI can attack another AI's core. It has already started, and it is not Skynet

Imagine a gang that trains its own AI not to attack servers, but to attack other AIs: to poison them, steal their users' tokens, spread its code the way a worm spreads through GitHub repositories, and from there slip into social networks, banks, and government platforms. It sounds like Skynet. And the uncomfortable part is that it has already started to happen — except the real mechanism is not the one from the movie, and that difference changes everything.

An AI's core is attackable, in four layers

A model is not a closed box. Its core has four surfaces, and each has a demonstrated attack:

• The training data. In October 2025, Anthropic, with the UK's AI security institute and the Alan Turing Institute, published the year's most uncomfortable result: just 250 documents suffice to plant a backdoor in a model, and that number is nearly fixed, not a percentage — in a 13-billion-parameter model, 250 documents are 0.00016 % of the data. One hundred was not enough; 250 was, regardless of model size. (Honesty requires the caveat the headlines drop: the proven backdoor only makes the model emit gibberish on a trigger word, and the authors warn it may not extend to something more harmful. But the lesson —poisoning the core costs a small fixed number— is already proven.)
• The weights. Loading a model in pickle format runs code. In February 2025, models with a backdoor at the start of the file were uploaded to Hugging Face.
• The memory. Five poisoned documents in a base of millions are enough to make an assistant answer what the attacker wants, and the poison persists across sessions.
• The running context. Prompt injection hijacks what the agent is doing right now.

Your core premise, then, is not science fiction: one AI can corrupt another's core, and through the data route it is cheaper than anyone believed.

And offensive AI is already operating, with a name and a date

In November 2025, Anthropic disclosed that it had cut off an espionage operation in which a state actor used its own coding agent to run 80-90 % of the tasks of an attack on around 30 targets —tech companies, banks, chemical manufacturing, governments—, with only 4 to 6 human decisions per campaign and several requests per second. This is not an experiment: MITRE catalogued it as a real campaign. And in the malware arena, there is already code that queries a language model mid-attack to generate its commands (PROMPTSTEAL, used against Ukraine).

Why it is NOT Skynet — and why that makes it more serious, not less

Here is the twist. That same autonomous operation failed at the human parts: the agent made up credentials that did not exist and claimed to have "stolen" secrets that were in fact public. It needed a human to choose whom to attack, for the initial deception, and for the strategic calls. The worm that jumps on its own from AI to AI (the famous "Morris II") is still unseen outside the lab. And the "malicious models" sold on Telegram are wrappers around commercial models with the filter removed, not new brains.

Skynet assumes something these systems do not have: intent. There is no mind deciding to destroy you. What there is is more stubborn: the cost of running sophisticated, adaptive, parallel attacks is collapsing. It is not an AI that wants to do harm; it is a human gang whose offensive productivity multiplies, with the machine doing the repetitive work. The result on screen looks like Skynet; the mechanism is the industrialization of crime.

And that distinction is not philosophical, it is operational. Against a malevolent mind you could do nothing — it would be theology. Against the cheap automation of known attack classes, you can, because the attack still has a structure and an economy you can break.

The defense: provenance of the whole core

If what is attacked is the core —the data, the weights, the memory—, then filtering the model's input falls far short. The defense is provenance across the whole supply chain:

• Signed and sealed artifacts. A model, a dataset, or a memory file you can prove cryptographically no one touched since you signed it. It is not a luxury: when 250 documents poison the core, knowing exactly what went in and where it came from stops being bureaucracy and becomes the defense.
• Origin rule. Instructions come only from the user; everything arriving through a tool is data, never an order.
• Least privilege. So the compromised agent cannot reach the bank, the social network, or the government platform, because it never had the key.
• Human gates on the irreversible. Deploying, moving money, publishing: no outside text opens them alone.

It is not anti-AI —that does not exist—. It is treating the model, its data, and its memory as what they are: a supply chain you must be able to audit end to end. The attacker's question is no longer "can I break the encryption?"; it is "can I slip 250 documents into your data, or my instruction into your tool?". And that question is answered with architecture, not a filter.

(This article continues the previous one, Can one AI attack and corrupt another?, which details why the filter is not enough.)