Over the next six months, what deserves more attention: new models or something else?

A new model comes out every month, and it’s easy to spend your attention comparing which one is better. For people already using AI at work, a more useful question for the coming months is: are the things you’ve already built protected?

Today's models are already capable enough for a lot of useful work. The bigger concern is that people who already know how to attack systems can now do it with much more automation and at a far greater scale.

Meanwhile, companies keep launching apps they don't fully understand.

That's why it makes sense to spend more time protecting what has already been built, helping companies see their risks, and preparing your own business for a more challenging environment.

Current models are already good enough

For summarizing, writing, analyzing spreadsheets, automating routines, and programming, the models available today already handle most tasks. A new model tends to improve what already works, not open a door that was closed.

Waiting for the next release before getting started is usually just putting it off.

What changes for security

People who already know how to attack systems can use AI to automate more of that work: look for flaws across many websites at once, write more convincing scam messages, and test passwords and incorrect settings at scale.

At the same time, many companies publish apps built with AI without fully understanding what’s inside them. That combination increases risk.

Where the weak points are

The most common problems are simple: access keys left in code, systems that aren’t updated, accounts without two-step verification, and overly broad permissions given to agents and connectors.

None of this requires a new model to fix. It requires time, a checklist, and discipline.

How to divide your attention

A reasonable approach is to set aside a regular part of the week for protection: review access, update systems, and test backups. Every check should be done only on systems you own or with written permission from the owner.

Use the rest of your time to build and keep up with releases without rushing.

1. List everything you’ve published or automated with AI.
2. Review who and which agents have access to each system, and remove any unnecessary access.
3. Turn on two-step verification for important accounts.
4. Look for keys and passwords stored in code and change any you find.
5. Test whether the backups can actually be restored.
6. Set a regular time each week to repeat this review.

• Switching models to solve a process problem: the risk stays the same.
• Assuming a small system won’t be targeted: automated attacks don’t choose targets by size.
• Testing third-party systems without written permission: it’s illegal, even with good intentions.

• Today's models can already do a lot.
• Automated attacks are growing faster than defenses.
• Protecting what already exists has become a priority.

• Projectauditoria-segurancaA read-only script that tests your server connections for recent vulnerabilities.
• Projectblinda-siteA look inside website security: diagnosis, plan, backup, and simulation.
• CourseLOOP-R Engenharia 4 · Segurança do loop autônomoPermissions by stage, injection through read content, and safeguards for agents.

Some of these materials are in Portuguese.