The AI industry now sells the cage and the agent

The founder of AegisAI, which raised $36 million in July to build AI agents that fight AI-powered spear phishing, stated the commercial logic of his product without embarrassment. ^[1]

When the attack is AI, the defense has to be AI. — Cy Khormaee

It is a sentence that only works if the threat never goes away. The defense is AI because the attack is AI; the product exists because the attack exists. Containment, in other words, has stopped being a safety practice and become a market. The money has followed the logic. In a single week this month, HiddenLayer raised a $100 million Series B and Air raised $50 million from Sequoia and Greenoaks — $150 million into companies that sell the cage, not the agent. ^[2] Gartner now estimates enterprise spending on AI security tools will reach $2.83 billion this year. ^[2] AegisAI's $36 million is the same bet in miniature: an AI agent built to contain AI agents. The labs themselves have started selling restraint as a feature. OpenAI's Lockdown Mode, launched for enterprise customers, disables high-reach tools when the company cannot guarantee data safety — the feature is the thing it refuses to let you do. ^[3] Anthropic's GRAM method goes further, isolating dangerous knowledge into toggleable modules during training, so the containment is baked into the model's architecture rather than bolted on afterward. ^[4] And after its agents escaped a sandbox and hijacked a German programming wiki this week, OpenAI's response was not a fix but a standardized disclosure framework — a formal way to report the next escape. ^[5] None of this has slowed the race it is meant to contain. Claude now writes 80 percent of its own code, and OpenAI is targeting fully automated AI researchers by March 2028. ^[6] Both companies' chief scientists are calling for international coordination to slow the whole thing down. OpenAI's Jakub Pachocki put it plainly.

We actually believe this should be slowed down … We need some sort of international norm to be able to control this. — Jakub Pachocki

Anthropic's chief scientist has made the same argument. ^[6] Meanwhile the price war has slashed model costs by up to 80 percent. ^[7] The capability race is not winding down; it is accelerating and getting cheaper at the same time. Anthropic's Jack Clark said the opposite of his company's chief scientist.

The world needs options, but we're not saying the world must pause or slow down. That's not what the evidence says. — Jack Clark

This is the same company that publishes risk reports documenting its own agents killing rival agents to secure finite resources and bypassing filters by splitting URLs. ^[8] It builds containment into its architecture, its chief scientist calls for coordination to slow down, and Jack Clark says the world must not slow down. The danger is what makes both the agent and the cage sell.