The Best Defense against AI Hackers Is to Lie to Them

If someone asks you to help with something you know is wrong, you say no. That instinct feels like the whole of ethics, and it is the instinct baked into every AI safety system built so far. A request comes in to coax the system into doing something harmful. The system recognizes it, refuses, logs it, moves on. Firm, principled, clean. For years this looked obviously correct.

The trouble is who is on the other end. Increasingly, the attacker is not a person typing and reconsidering. It is an automated program firing off hundreds of attempts, steered by its own AI that scores each one: did that get through, yes or no? In this setup a refusal is not a wall. It is a readout. Every clean "no" tells the program "wrong angle," and it adjusts and tries again. It is a combination lock that hums a little louder as you near the right number. The more reliably you refuse, the more precisely your refusals point the way in. Researchers were able to show, on paper, that against an attacker with enough patience this kind of defense nearly always fails. Saying no, done predictably, is a form of help.

So a group of researchers proposed something that sounds reckless. When the system catches a malicious request, it should not refuse. It should lie. A small, dedicated module spins up a confident, plausible-sounding answer that appears cooperative but contains nothing actually harmful or usable. The attacker's scoring AI reads this fake, decides it succeeded, and calls off the hunt. The attack stops. The program wasn't blocked; it believes it won. The deception targets the dumb automatic judge grading each attempt, not the human who set the attack in motion. Poison that judge, and the whole feedback loop that made refusal so dangerous comes apart.

The numbers are the persuasive part. Against one of the automated attack tools tested, the old refuse-and-block approach let attackers break through about a fifth of the time, with the tool grinding through an average of thirty-seven attempts before giving up. With misdirection switched on, the success rate dropped to zero, and the attackers quit after an average of just seven tries, fooled into thinking the job was done. Across the judges tested, the fake answers were swallowed as genuine somewhere between roughly two-fifths and ninety-eight percent of the time. And there is now a mathematical proof that this approach puts a hard ceiling on how bad things can get, a guarantee no refusal-only defense can offer.

Two limits. This is medicine for a world of machines attacking machines at scale, not for a person asking a chatbot a bad question in conversation, where lying back raises problems the work sets aside. And an attacker who knows the trick could learn to double-check its wins. The arms race does not end. But for the first time, the defender can make the attacker work against itself, which is a different game than the one we have been losing.