The friction is gone

Ethan Mollick points out that governments and companies are increasingly flooded with AI agents making inquiries — agents that get past the frictions that used to gate access to their services. The graphs in the paper he cites show it has already started. His question: will they make those services worse or better as a result?

In security discussions, after the Hugging Face attack, frontier labs have encouraged software companies to stop thinking about vulnerabilities in terms of their severity: critical, major, minor… The only thing that matters is whether a vulnerability is open or closed. That sounds like a separate point, but it is exactly the same one. A critical vulnerability might have offered less friction to exploit than a minor one, but the friction is gone.

If it’s open, it will be used. Government services, intended APIs, “unintended” APIs — bugs and vulnerabilities — all of them.