- Fotis Chantzis of OpenAI said a human in the loop on every core defensive action does not scale. He would keep people for actions with irreversible effects.
- Other panelists described AI doing a first pass while people validate, and put the human line later than he did. One speaker warned that cutting entry-level roles weakens the next generation of judges.
Fotis Chantzis, who leads agent security at OpenAI, argued that defenders cannot have a person approve every core defensive action. He made the case on the Black Hat USA 2026 panel on AI and the future of cyber defense. His view: people should judge the actions that cannot be undone, and AI should handle the rest.
What was said
Chantzis said AI does not rewrite the attacker's playbook. The steps are the same, but AI speeds them up. So defenders need AI woven into their own work. He said a human in the loop for every core defensive action is not sustainable. Teams should separate consequential actions, those with irreversible effects, and keep people there.
He pointed to a tool OpenAI recently deployed on Codex, its coding agent. A supervisory agent watches actions that escalate privileges across a sandbox boundary. It rates how risky the path looks and decides whether to allow it. The aim, he said, is to act "instead of pestering the human every time and leading to decision fatigue, where a human has to press confirm".
Other panelists described AI doing a first pass while people check the result, but they drew the human line later than Chantzis did. Morgan Adamski of PwC said clients use autonomy to map networks, triage tickets and spot anomalies, while people validate the findings. Katie Moussouris of Luta Security said AI can suggest a patch but may not know whether it breaks other code. She said Mozilla's security team, per a conversation with its head, still writes its patches manually because the AI suggestions were wrong. She said the field is not yet at trusting end-to-end automation. A speaker on the show added that humans should still be responsible for policy.
Why it matters
Our reading: the defender's job is shifting from doing the work to deciding where the lines sit. If every alert needs a click, approval turns into noise, as Chantzis described. Leaders may need to decide in advance which actions are irreversible, who signs off on them, and who owns the policy.
Training is the catch. A speaker on the show warned that replacing interns and entry-level staff with automation means missing the chance to "build your contextual bench". Judges learn by doing the work first.
The other side
The panel did not agree on where the human line belongs. Adamski and Moussouris kept people closer to the work than Chantzis did. Moussouris said she is optimistic that will change quickly. Chantzis also works for a company that builds such agents.
Judging needs knowledge of what is at stake. Sergey Konovalov of Anthropic, speaking about industrial control system operators, put the industry average at about two in ten with a firm understanding of their assets. He also expected a "tsunami" of patches headed their way. Linking that to judging irreversible actions is our inference, not something the panel said. The panel also did not say how a small team should tell which actions are irreversible.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- Black Hat: Black Hat USA 2026 | AI and the Future of Cyber Defense Panel (2026-11-13)
