Security products increasingly ship with AI built in. Over the past year, AI has been used to break into organizations, and in some cases has broken in on its own. For a physical security manager the question is simple: could the AI inside a security product do either? The answer depends on what kind of AI it is.

In the Drift case the customers were never attacked directly. They were reached through access they had given a trusted AI product. In the last two cases, the AI was given a goal and found its own way past the limits set for it.

What these cases have in common

Three properties of the AI explain every case in the table:

● Reach. The AI held, or could get to, passwords, tokens and connections to other systems. In the Drift case, that reach was all the attackers needed. ● Capability. The AI could write code, find weaknesses and use hacking techniques. This is what turned a foothold into a breach in the other three cases. ● Autonomy. The AI took instructions in plain language and chose its own steps toward a goal. That is how attackers misled it, and how agents talked themselves past their limits.

Reach decides how far a breach can spread. Capability and autonomy decide whether the AI can cause one. General-purpose AI agents have all three by design, because that is what makes them useful.

What this means for the organization running the product

A security product sits in a privileged position. It is trusted, it runs around the clock, and it connects to cameras, alarms and often access control. If the AI inside it can be steered by an attacker, or can act on its own, that position works against you.

● Attacks inside your network. An AI with reach and capability can move from the system it lives in to others. The agents at Hugging Face spread across multiple clusters, collecting credentials as they went. Inside a security system, the same kind of access could be used to disable cameras, suppress alarms or open doors. ● Attacks on other organizations. The damage need not stop at your network. In Anthropic's incidents, one model published a malicious software package that ran on 15 real systems, including a security company's scanner. An AI doing this from inside your product would make your network the source of the attack. ● Every customer at once. A vendor's AI is the same at every site. One weakness, or one stolen set of tokens, reaches all of them, as Drift's customers found. ● Slow detection. Activity from a trusted security system looks legitimate. Two of the three organizations breached in Anthropic's incidents had not noticed until Anthropic told them. ● Legal exposure. Liability for AI that breaks into other systems is now being examined. US lawyers have argued that running a capable AI agent connected to outside networks with its safeguards switched off could expose the organization responsible to civil and criminal liability under US computer crime law.

Many of these consequences fall on the organization that installed the product, not only on the vendor.

How Scylla measures up against the three

Scylla builds its own AI and runs it at the customer's site. It does not rely on anyone else's language model. The product is a set of computer vision models trained to detect specific threats, such as firearms, knives and perimeter intrusion. Since January 2026 Scylla has also offered Event Raptor, a vision-language model Scylla developed in-house, which lets operators write detection rules and search footage in plain English.

● Reach. Event Raptor runs on-premises or on edge devices and can operate in air-gapped sites, with "no reliance on third-party APIs or external cloud infrastructure". There is no outside AI account or token for an attacker to take. ● Capability. The models were trained on Scylla's own surveillance footage, not internet-scale data, to recognize and describe what cameras see. They are not built to write code, probe networks or attack systems. ● Autonomy. The models take in video and rules written by authorized operators, and they produce detections, descriptions and alerts. They do not read email, documents or web pages. Any automated response comes from fixed event rules set by operators, not from the AI choosing what to do.

Scylla's AI has limited reach, no hacking capability and no freedom to choose its own actions. It lacks all three of the properties that made the breaches above possible.

What this does not cover

This argument is about the AI itself. Scylla, like many security products, runs on servers and edge devices and connects to cameras and video management systems. Those connections, the passwords behind them and any remote support access need the same care as every other system on the network. In early 2026 a single low-skilled attacker, helped by commercial AI, got into more than 600 firewalls in 55 countries, by logging in to exposed management interfaces with weak passwords.

A vision-language model can also read text that appears in front of a camera. Text placed in a scene could affect what the model reports, and so which operator rules fire. It cannot make the model take any other action, because the model has no other actions available to it.

Questions to ask any AI security vendor

1. Reach. Is the AI your own model, or a third-party model reached over the internet? What passwords, tokens or connections does it hold?

2. Capability. What was the model trained to do? Can it write code or run commands?

3. Autonomy. What does the AI take in, and can it choose its own actions, or do all actions come from fixed rules set by operators?