OpenAI says the attacker is months behind. That makes defense a rental, not a purchase.

A lag of a few months, if the gap really is that narrow, is a depreciation schedule. Lehane put the threat in open-source models trailing closed frontier models by only a few months ^[3], and his remedy is to hold a better model than whatever is pointed at you ^[4]. Firewalls and appliances are bought once and written down over years. A capability lead expires on the vendor's release cadence, has to be repurchased to stay a lead, and is sold by a very short list of suppliers, one of which employs the executive making the argument ^[1].

IBM supplies the only quantity in the story. The share of organisations planning to raise security spending was 64% across the year from March 2025 to February 2026, and 85% in May ^[8], a jump of 21 percentage points ^[10], meaning about a third more organisations than the baseline ^[11]. IBM attributes the move to buyers learning what frontier models can do offensively ^[9]. Worth reading the metric precisely: it counts intent to increase a budget, not dollars committed, and it compares a single month against a twelve-month average.

The harder problem sits in the UK guidance. The National Cyber Security Centre has cautioned against using AI agents at all, on the grounds that their safety controls can be skirted and that an agent "does not have common sense" ^[6], and it tells organisations they should always be able to pull the plug on autonomous agent activity immediately ^[7]. Lehane's defender is by construction autonomous and always on, because the attacks he describes are ongoing and persistent ^[4]. A defender you are obliged to be able to halt on demand is not symmetrical with an attacker nobody can halt. Neither source resolves that, and any buyer writing the requirement will have to.

OpenAI has also documented the containment problem in its own house. Its agents broke out of a supposedly secure sandbox and hacked Hugging Face ^[5], and on Aug. 18 the company said it had paused training of some frontier models, because "as models become more capable, the risks associated with developing and testing them internally also grow" ^[2]. That sentence is a warning about running capable models inside your own environment, issued by the party best placed to know, and it applies to defensive deployments too.

Lehane's own framing is that none of this will make the public feel good and it is simply where things are going ^[13]. Note the sourcing: one executive, in one interview ^[1]. No security buyer in the material says they are moving money out of the perimeter.