A fixed set of artificial-intelligence guardrails cannot be universally robust against adaptive adversarial prompts, according to a mathematical argument published by a senior National Institute of Standards and Technology scientist.
The finding is about a limit, not a declaration that AI security is impossible. Apostol Vassilev’s paper argues that when behavior is constrained by a finite rule system, a sufficiently adaptive adversary can construct inputs that expose cases the rules do not settle as intended.
NIST connects that argument to the logic of Kurt Gödel’s incompleteness theorems. The analogy does not mean a language model is a formal proof system in every respect; it is used to show why a finite compliance scheme should not be treated as permanently complete.
The operational consequence is a shift away from “one and done” security. NIST says organizations should continuously red-team systems to uncover new adversarial prompts, update defenses as those failures are found, and build resilience that limits impact and accelerates recovery.
That sequence changes what readiness means. Passing a pre-release evaluation establishes how a system behaved against the tests available at that moment. It does not establish that future users or attackers cannot discover a new interaction that bypasses the same controls.
Continuous monitoring also requires evidence, not merely a recurring calendar task. Teams need documented failure cases, reproducible tests, versioned control changes and recovery measures that show whether a newly hardened system actually reduces the identified risk.
The paper appeared in the May 2026 issue of IEEE Security & Privacy, and NIST summarized it publicly in June. NIST’s account says the long-run goal is to make finding new exploits more expensive than an attacker can justify, rather than promising absolute immunity.
The limits matter most where model actions can affect accounts, infrastructure, medical workflows or other high-consequence systems. A lower-risk assistant and an autonomous tool with privileged access should not receive identical monitoring budgets simply because both use generative AI.
The useful takeaway is narrower than the headline risk: fixed guardrails remain necessary, but they are not a finished security program. Deployment must include an operating loop for finding, patching and containing failures that were not visible when the original controls were written.