If you thought the big tech companies had AI security figured out, TechCrunch published something yesterday worth reading carefully: not even Google has it figured out. Nobody does. We're all — Fortune 500 companies, two-person startups in a WeWork, and DJs running bots in production — improvising in real time, making security decisions about systems whose full behavior we don't yet understand. That's not pessimism: it's the most honest diagnosis that's circulated in weeks about the industry's actual state.
The problem isn't the technology. It's the speed.
AI didn't arrive with a security manual attached. It arrived as an avalanche of new capabilities every three months, and organizations — including the manufacturers themselves — have had to build security frameworks while the train was already running at full speed. Google, which has more resources for security research than most countries have for defense, is still discovering new attack vectors in its own models. That doesn't mean Google is incompetent: it means the problem space is genuinely new.
What we're living through is a transition without direct historical precedent. When the internet arrived, security problems took years to manifest at scale. With generative AI, exploits appear weeks after a model launches. The attack-defense cycle has compressed so much that there's no longer a "preparation" phase — there's only reactive response dressed up as proactive strategy.
Prompt injection, jailbreaks, and the perimeter that doesn't exist
The most documented attacks today against AI systems aren't from science fiction imaginaries — it's not Skynet, not a rogue AGI. They're far more mundane things, and far more dangerous in enterprise contexts: prompt injection into automation pipelines, manipulation of agents with access to external APIs, data exfiltration through models that process internal documents. An AI agent with access to your corporate email and your CRM is a massive attack surface, and most companies that deployed those agents in 2025 did so without a formal threat model.
Google knows this because it lives it from the inside. Their Red Team has been publishing findings about their own models for months — a transparency that, to their credit, not every company practices. But even with that infrastructure, the TechCrunch article makes clear that institutional knowledge about how to secure these systems remains fragmented, dependent on key individuals, and difficult to scale.
What this means for anyone operating AI today
If your operation uses language models in production — for anything, from customer service to content generation to workflow automation — there are some uncomfortable truths worth accepting:
First: there's no "set it and forget it" secure configuration for an AI system. Models change, contexts change, and attack vectors evolve. Security maintenance is continuous.
Second: the fact that your provider is Google, OpenAI, or Anthropic doesn't transfer responsibility to them. They secure the infrastructure; you secure how you use it, what data you give it, and what permissions you grant it.
Third: most AI security incidents in enterprise environments won't make any headlines. They'll be silent leaks, misconfigured automations, agents doing things nobody explicitly asked for but that the prompt implicitly allowed.
Honesty as a starting point
The most valuable thing in the TechCrunch article isn't the technical analysis — it's the cultural diagnosis. There's enormous pressure in the industry to project confidence and certainty about AI security, because enterprise contracts depend on that confidence. But that projection of certainty is itself a risk: it leads organizations to skip critical steps because they assume "the big guys already solved it."
The reality is that we're in a genuine transition period. There are no experts with twenty years of experience in LLM security because LLMs in production at this scale don't have twenty years behind them. The people who know the most are those who've been making mistakes the longest and documenting them — and that includes Google.
For anyone operating technology today, the smartest posture isn't to wait for someone to resolve this definitively. It's to build resilience: systems that fail in controlled ways, frequent audits, and the humility to assume something will go wrong before you know exactly what.