The AI that doesn't understand you: intent, bias and cybersecurity

Today’s most important AI news

The day was dominated by research exposing structural cracks in the most widely used LLMs: they don’t understand what the user actually wants, their evaluation systems are biased, and their cybersecurity applications open doors nobody really knows how to control. There were no spectacular launches, but there were findings that should change how professionals think about how much to trust these systems.

LLMs don’t understand your intent — and that has real consequences

A paper reviewed this week on arXiv reached a conclusion many practitioners suspect but few document rigorously: today’s LLMs, including ChatGPT, Claude, Gemini and DeepSeek, systematically fail to interpret the intent behind a request. It’s not that they ignore context — it’s that they have no real model of the user who is writing.

The problem goes beyond the everyday frustration of getting an answer that is technically correct but completely useless. The researchers found that this inability creates exploitable security vulnerabilities: malicious users can take advantage of precisely that gap between what is said and what is meant to get around safety filters. The models’ protection mechanisms are calibrated to detect explicitly harmful content, not to reason about the motivation behind an ambiguous request.

For a product manager or developer building on these models, the implication is direct: it’s not enough to train the user to “speak the model’s language”. Production systems need additional layers of intent validation, especially in contexts where a misinterpretation has real cost — customer support, medical assistants, legal tools. Assuming the model understands what the user wants is the most common and most expensive design mistake of the moment.

The evaluator is biased too: the problem of using LLMs to judge LLMs

There’s a practice that has become standard in the industry: using one LLM to evaluate the quality of another LLM’s answers. It’s cheap, scalable and reasonably correlated with human evaluation. A study published this week destroys a good part of that confidence.

The research compared nine bias-correction strategies across five judge models — from Google, Anthropic, OpenAI and Meta — on three different benchmarks and four types of bias. The central finding is uncomfortable: style bias is the most dominant and the hardest to correct. Judge models favor answers that sound elaborate, structured and formal, regardless of whether they’re correct. Existing debiasing strategies reduce some biases but frequently amplify others.

This matters day to day for any team using LLM-as-a-Judge to evaluate outputs in fine-tuning pipelines, RAG or prompt comparison. If the judge has a systematic bias toward a certain style, the model you’re training will learn to write a certain way — not to reason better. The practical advice is to always combine automated evaluation with samples of human evaluation, and never rely on a single judge model for production decisions.

OpenAI and cybersecurity: democratizing defense or scaling the risk

OpenAI published a five-point plan for what it calls the “Intelligence Age” in cybersecurity, focused on democratizing AI-powered cyber defense tools and protecting critical infrastructure. The document is part roadmap, part political positioning — and it arrives at a time when several research projects are building autonomous penetration-testing agents on top of open-source models.

The xOffense paper, also published this week, illustrates exactly that tension: a multi-agent framework that automates penetration testing using Qwen3-32B as its reasoning engine, capable of running complete workflows without expert human intervention. OpenAI’s proposal to “democratize defense” collides with a concrete technical reality — the same capabilities that make it possible to automate defense make it possible to automate attack, and the barrier to entry for the latter is falling faster.

For executives and technology teams at Latin American companies, the message is that the window to catch up on AI-based cybersecurity is closing. Not as an abstract threat, but as an operational shift: soon, malicious actors will have access to automated attack tools that today only the world’s best-funded security teams have. Understanding what AI does and doesn’t do in that context is no longer optional.

In a nutshell

What connects today’s news isn’t technical — it’s epistemological. We’re building systems that don’t understand the user, we evaluate those systems with judges that have their own biases, and then we deploy them in high-risk contexts like cybersecurity. The industry talks a lot about alignment as a future philosophical problem, but today’s papers show that misalignment is already here, measurable and with concrete consequences. The question isn’t whether LLMs will fail — it’s whether the teams using them have the controls to detect when they do.

---

Sources used: https://arxiv.org/abs/2512.21110, https://arxiv.org/abs/2604.23178, https://openai.com/index/cybersecurity-in-the-intelligence-age, https://arxiv.org/abs/2509.13021