What When AI Agents Outnumber Us? Rethinking Digital Sovereignty with Dr. David Bray

Cyberattacks are on the rise as AI gives hackers new ways to find and exploit security flaws. This month alone, large-scale attacks in Japan were linked to an AI-powered tool; hackers in France took over refrigeration systems at hundreds of supermarkets; and researchers exposed PHP2Shell, a pair of critical flaws that could let attackers run code on vulnerable servers without logging in.

“An attacker using these tools doesn't care about breaking things,” says Singularity AI expert David Bray. “Whereas defenders, they have to push back the attacker but also keep things running.”

Bray worries the situation will get harder before it gets better. As AI gains the ability to take actions on our behalf, securing interconnected systems—and maintaining control over them—is becoming even more crucial.

In this episode of Singularity Discussions, Bray explores the intersection of cybersecurity and AI sovereignty. Drawing on his experience with the U.S. National Intelligence service and the Federal Communications Commission, he speaks about how AI is changing the balance between attackers and defenders, why technological independence matters, and how we can maintain meaningful control over autonomous systems.

What Does AI Sovereignty Really Mean?

For Bray, AI sovereignty goes beyond who owns a given model; it’s a question of how countries can preserve their autonomy while relying on technologies they don’t build themselves. “No country wants to have so much dependency on a foreign company or country that they cannot enforce their own laws,” he says. “AI is not like cloud, where it's just storage of your information. This is actually getting into your decision loops, your intellectual property.”

Bray believes countries shouldn’t try to replicate the American or Chinese approach to AI development, but instead should identify strategic partners and build on their own strengths. That means addressing dependencies at three different levels.

• Hardware and energy are fundamental: countries need to reduce their dependence on external energy sources and be able to verify that imported chips haven’t been compromised.
• Models come next: instead of trying to compete with the big AI developers on their own terms, countries can develop open-weight models that understand their languages, cultures, and local context better than leading foreign models.
• Data is the third layer of control. Bray points to data trusts and federated learning as alternatives to handing over data to AI companies. With federated learning, an algorithm comes to the data rather than the data being transferred elsewhere. People could share their data for AI training in exchange for compensation or other benefits.

Giving People Control Over AI Agents

Sovereignty isn’t just a question for governments. As AI agents start acting on our behalf, we’ll also need ways to decide what they’re allowed to do and who’s accountable when something goes wrong.

Bray suggests three basic safeguards: we should be able to specify which agents we authorize, restrict the systems and data they can access, and stop agents that overstep their scope.

For example, someone might authorize an agent to manage their calendar or help plan retirement without allowing it to access family photos or bank accounts. If the agent tries to cross that boundary, its access should be blocked. Bray draws a parallel with radio operators who identify themselves using a call sign and hold a license; AI agents could similarly identify themselves and show that a person authorized them to act. “The big challenge we're going to face is that we don't really have a good way to identify you consistently online that isn't also eroding privacy,” Bray says, adding, “I know there are solutions out there.”

Accountability is equally important. Bray suggests that a trusted independent service could record which permissions people have granted, creating verifiable evidence if an agent acts without authorization. That record could help establish legal liability. Since AI is advancing faster than laws can adapt, these safeguards shouldn’t depend on AI companies policing themselves.

Why Existing Playbooks Won’t Work

AI has pushed the pace of technological change into overdrive, and our laws and institutions can’t keep up. While it may seem logical to reach for tech solutions to tech problems, that’s going to cut it. “We know from history it's got to be a broader systemic, whole-of-society solution, not just a technology fix,” Bray says.

He points to historical examples for perspective. Cars made it easier for criminals to cross state lines, forcing law enforcement to find new ways to share information and identify suspects. Radio raised fears about its potential misuse, helping spur licensing and rules for identifying operators. In both cases, society adapted rather than banning the technology.

Cybersecurity presents a similar challenge. AI tools can help attackers find vulnerabilities at machine speed, but they can also help defenders patch them more quickly. On a recent visit to Eastern Europe, Bray saw a six-person programming team using an open-weight model to rebuild and customize its software environment every week, continually changing its attack surface. This kind of rapid iteration could make it harder for attackers to exploit known vulnerabilities—and might eventually change our understanding of software from a fixed product into something that continually evolves. “It might be you're not buying individual products or services,” Bray says, but “getting a custom digital fabric unique to yourself.”

Building Better Systems

The complexity of these challenges means we can’t retreat from AI nor leave decisions to AI companies. Preserving autonomy at the national and personal level will require collaboration across sectors and a willingness to adapt as the technology evolves.

“It's going to be messier before it gets better,” Bray says. “But this is an opportunity for Singularity and others to step forward and say, it's not just about the tech, it's about everything else that goes around it in terms of companies, countries, and societies.”