DeepMind's Hassabis warns on AI security risks

Hassabis, speaking at an AI conference in Dublin, said recent incidents were “early warning shots” that showed current systems are still not robust enough. He argued that new models should be tested first in isolated “sandbox” environments without internet access and said the sector needs an international standards body, modelled loosely on nuclear governance, to set safety norms without choking innovation.

The comments land at a moment when the AI boom is already colliding with a security reality check. Microsoft’s chief executive Brad Smith has separately called for tougher standards and mandatory incident reporting, while recent breaches involving OpenAI and Anthropic have underlined how quickly AI tools can be turned against corporate systems. The European Commission has also been urging greater investment in AI testing and safety, suggesting the next phase of AI regulation will focus less on disclosure and more on operational controls.

For investors, the message is that the AI trade is no longer just about compute demand and model performance. Security spending could become a larger line item across the ecosystem, benefiting cybersecurity vendors while adding friction to AI rollouts at hyperscalers and model developers. Microsoft, Google and Nvidia all face that tension: each is deeply exposed to AI growth, but each also has warned in filings that autonomous or semi-autonomous systems can create new attack surfaces and regulatory risk.

That is part of why the market has become more sensitive to execution risk in AI. Microsoft shares have held above their long-term trend, with the stock recently around $539, while Nvidia has been more volatile after a sharp run-up, reflecting investor concern that margin-rich AI growth will eventually come with heavier security, infrastructure and compliance costs. CrowdStrike, a beneficiary of that concern, has surged this year, even after recent pullbacks, as buyers look for companies positioned to profit from AI-related defense spending.

There are two competing investment views. The bullish case is that stronger standards will professionalize the market, widen adoption and increase demand for cybersecurity software, testing tools and identity controls. The bearish case is that more incidents, and the regulations that follow, could slow enterprise AI adoption, raise operating costs and compress returns on capital for firms racing to ship new models.

The next catalysts are likely to be regulatory proposals in the EU and the US, along with any fresh disclosure of AI-related incidents at major platforms. If Hassabis is right, the industry’s defining test will be whether it can build governance fast enough to preserve trust before a serious breach forces the issue.