NIST has published a mathematical proof that for any finite set of AI guardrails there is an adversarial prompt that passes them. The paper is Apostol Vassilev, Robust AI Security and Alignment: A Sisyphean Endeavor?, in IEEE Security & Privacy, vol. 24, no. 3, May-June 2026 (DOI 10.1109/MSEC.2026.3678214), with a preprint on arXiv. NIST issued a press release under the headline that the proof supports a transition to a continuous-monitor-and-update security model for AI systems.
The abstract claims to extend Gödel’s incompleteness theorem to AI, and the press release presents the extension as new. It’s not only old, it’s only useful because it’s old.
The reference list is eight entries. Does that sound right for a paper of this weight? Just eight citations since the 1930s? Gödel and Chaitin account for two, and NIST’s own AI Risk Management Framework and adversarial machine learning taxonomy account for two more. The remaining four are three jailbreak papers from 2024 and 2025 and a Trail of Bits blog post. The acknowledgments thank a YouTube lecture for the exposition of Gödel’s theorem. YouTube.
The argument is also quite short. Guardrails on a language model form a finite rule set. Prompts are strings of arbitrary length.
Vassilev builds on Chaitin’s 1974 information-theoretic form of incompleteness (J. ACM): any checker that certifies prompts as out of policy faces a true statement about some blocked prompt that lies beyond every proof it can verify. Some adversarial prompt therefore evades any finite policy. The operational conclusion is continual red teaming, continual updates to the rule set, and resilience for the moment a prompt gets through. Vassilev states the result as a theorem about all AI systems, present and future, including AGI and ASI, and then generalizes it in Theorems 4 and 5 to the claim that AI systems are limited in ways similar to humans in the truths they can prove.
Every part of this has a documented history, and the paper omits all of it.
- Turing, for an obvious example, raised the point in 1950. Section 6 of Computing Machinery and Intelligence (Mind) lists Gödel’s theorem as objection (3), “The Mathematical Objection,” to the idea of a thinking machine, and answers it in the same section.
- J. R. Lucas built the objection into a full argument in Minds, Machines and Gödel (Philosophy, 1961): a machine is a formal system, Gödel applies to formal systems, so for every machine there is a true formula it fails to produce and a human can see to be true.
- Paul Benacerraf answered in God, the Devil, and Gödel (The Monist, 1967).
- I. J. Good, Turing’s wartime colleague at Bletchley Park, titled his reply Gödel’s theorem is a red herring (British Journal for the Philosophy of Science, 1969).
- Roger Penrose revived the Lucas argument in The Emperor’s New Mind (1989) and Shadows of the Mind (1994) and drew a second round of rebuttals from logicians.
- Torkel Franzén wrote a book on such arguments, Gödel’s Theorem: An Incomplete Guide to Its Use and Abuse (2005), which treats the minds-and-machines argument at length.
Vassilev’s Theorems 4 and 5 restate the 1961 Lucas conclusion, using the language of checkers and strings. Sixty-five years of argument about it are strangely absent from the new paper’s bibliography.
The security-specific claim is perhaps the most notable old theory being omitted.
Alfonseca and colleagues proved in the Journal of Artificial Intelligence Research (2021) that total containment of a sufficiently capable AI is incomputable, by reduction to the halting problem.
Cambridge’s Centre for the Study of Existential Risk traced the core of that argument to Rice’s theorem in 1953. Closer still, Wolf, Wies, Avnery, Levine and Shashua proved at ICML 2024 (preprint April 2023) that for any behavior an aligned model retains with positive probability, a prompt exists that elicits it, and the probability rises with prompt length.
That is the Vassilev result, three years earlier, peer reviewed at ICML, with a proposed mechanism for why the aligned behavior stays reachable by prompt.
It is absent from his references. Honestly, it seems odd in this seventieth year of AI to skip relevant work that AI could deliver as proof of AI integrity.
On that point the press release goes further. It describes the proof as extending to AI the logic Gödel used in 1931, and quotes its author that “You can’t escape Gödel in math.”
The Cloud Security Alliance (CSA) published a research note two days later under the headline that NIST had proved static AI guardrails mathematically insufficient. The known argument, decades old and presented on security conferences, was entered by CSA into the trade press as a 2026 discovery.
Nope.
Even I made the same Gõdel argument at RSA Conference in 2021. My talk on AI security that year, Top Seven AI Breaches: Learning to Protect Against Unsafe Learning, ended the introduction section with “What Should Be Expected of AI”, anchored by the incompleteness theorem.
Let’s break down my conference presentation and the new paper, to see what’s new. Download PDF –> 
| RSA Conference, 2021 | NIST, 2026 |
|---|---|
| “a computer never can answer all questions to achieve its objectives — always needs external/inherited sources and oversight” | “there is no finite set of guardrails that is universally robust against adversarial prompts” |
| “Prove the Model Wrong (Vulnerabilities — Like Any Software)” | “red teams that seek to uncover new adversarial prompts before actual attackers do” |
| “Gate Releases Through Testing and Audits” | “continuous updates that harden AI guardrails against newly discovered adversarial prompts” |
| “Off Button. Reset Button.” | “operational resilience that prioritizes impact limitation and quick recovery” |
That is the line by line correspondence from then to NIST.
Continuous testing and updating is standard practice, and so this reads to me as NIST endorsement of standard practices. That’s fine as a continuation. However, Vassilev’s reference list is a shockingly brief eight entries, and the CSA presented what’s old as new.
The literature omitted, essential to standard practices being what they are, runs from 1950 to 2024.
And if you want to know what I am speaking about now? Practice and operation. You can deploy today what the NIST paper prescribes as a process. I released Wirken in February 2026, three months before the paper appeared in print and four months before the press release, as a gateway built on the assumption that the model is already jailbroken and that enforcement has to live outside it.
This is a hell of a place wherein to reveal my ignorance about software security. It’s hard to guess how it is done. But it’s easy to tell how it must not be done.
Surely “guardrails” are not specific words or combinations of words that are forbidden. That would be laughable. A security system that defends only against already-known threats is inherently deficient. Security software must be able to recognize characteristics of the composition or the behavior of malware, so that it can neutralize new iterations without having to positively identify a known problem.
To base security on updating a database of known threats would be a fool’s game: It would create an ever-growing burden on the potential victim and it would be ineffective against an innovative enemy. Distributors of malware could render such a defense impractical by flooding the environment with cheaply produced unique threats.
Natural language is infinitely mutable. A defense based on a static forbidden word set could never be effective. (Maybe that is part of the point ultimately made by the theories mentioned in this blog post? I have not tackled those theories because I assume that to comprehend those ideas requires education and experience that are beyond my ken.) Besides this, what basis would one use for the static set of forbidden words? To arrive at a satisfactory set of words would require the participation of a council of expert legal analysts, lawyers, judges, psychologists, linguists, philosophers, and other specialists who have overlapping expertise. No lone computer programmer, or group of computer programmers, would have the knowledge or the authority to determine the rules to which end users would be subjected. I doubt that any would have the hubris to even embark upon such a task. A self-awareness of insufficiency would check anyone from engaging in such a dubious endeavor. (Imagine a gaggle of coders at Google brainstorming for what search parameters to exclude from public use! The end result would be a contradiction of the end goal, as it would reflect the petty biases and the limitations of each individual involved. The customers want Safety Soup but the cooks can concoct only Skewed Stew. So they desist.)
There must be a way to create, in the mind of the machine, an abstract notion of what it must defend itself against. And then have it apply that notion to its interpretation of practical events. A light, general, flexible layer of security.