For years, most web security has been designed around two broad kinds of adversary: humans probing systems manually, and automation executing relatively rigid attacks at scale.
Large language models blur that line.
An AI-assisted attacker can inspect an application, reason about what it sees, adapt when a route fails, correlate small clues and keep exploring. It does not need a single perfect exploit if the application exposes enough surface area to assemble a path through several mediocre weaknesses.
That changes what I think good defensive architecture should optimise for.
Reduce the amount of system an attacker can negotiate with
The normal answer to security is often more: more middleware, more detection, more rules, more dashboards. Those things have value, but they sit behind a more fundamental question.
How much capability does an unauthenticated or weakly trusted caller get to see in the first place?
I expect good modern systems to move toward deliberately narrow entry points: smaller public contracts, aggressively scoped identities, short-lived capabilities, explicit transitions between trust zones and far less ambient authority.
The best endpoint to defend is still the endpoint you never exposed.
Assume reconnaissance can reason
Rate limiting remains useful. WAFs remain useful. Signatures remain useful. But they become less reassuring when reconnaissance is adaptive rather than repetitive.
A reasoning system can change vocabulary, request order, pacing and technique. It can learn from error messages. It can test whether two individually harmless pieces of information become useful when combined.
That pushes architecture toward behavioural controls and strong invariants rather than hoping malicious traffic looks sufficiently unlike normal traffic.
Make privileges disposable
One pattern I expect to become increasingly important is capability-based access: grant a caller exactly the ability required for a specific action, for a small period of time, and nothing else.
That is a very different mental model from handing a session broad access to an application and relying on every downstream component to behave perfectly.
AI raises the cost of accidental complexity because complexity gives an adaptive adversary more things to test.
Security architecture becomes product architecture
This is the important bit. I do not think the answer is an “AI firewall” bolted onto the same sprawling systems.
The stronger response is architectural: slimmer attack surfaces, clearer boundaries, better isolation, less privilege, less information leakage and systems that remain safe even when a caller is extremely patient and surprisingly inventive.
AI does not invalidate the old security principles. It makes the bill for ignoring them arrive faster.