Why blocking AI models won’t stop the cyber threats they create

Jessica Ji and Andrew Lohn, both researchers at Georgetown's Center for Security and Emerging Technology, used a CyberScoop op-ed to push back on a policy instinct that's become almost reflexive in Washington: when an AI model looks dangerous, block it. Their argument is blunt. That approach treats a symptom while ignoring the disease.

The pair points out that cyber capabilities don't disappear just because one model gets restricted. Open-source alternatives proliferate, other countries keep building, and the underlying vulnerabilities in American networks stay exactly where they were before anyone typed a prompt. Ji and Lohn frame model-blocking as a quick fix that feels like action but doesn't actually shrink the attack surface hackers exploit.

Instead, they call for something less flashy and much harder to execute: a genuine national cybersecurity strategy, one that treats AI-enabled threats as an extension of existing defense gaps rather than a brand-new category requiring brand-new bans. That means federal leadership setting priorities and standards, paired with AI companies actually building in safeguards rather than reacting to headlines. The line they use, and it's the crux of the whole piece, is that what's needed is real long-term strategy, not quick-fixes like blocking individual model releases.

Underneath the policy talk is a more uncomfortable point. Banning a model is easy to announce and easy to photograph. Rewiring how federal agencies, critical infrastructure operators, and private companies actually defend their systems is slow, expensive, and politically unrewarding. Ji and Lohn are essentially betting that the harder path is the only one that works.