The "Genie Coefficient": Schneier proposes a measure for what traditional security no longer achieves

Bruce Schneier proposes a "Genie Coefficient" - the gap between the latitude given to an AI agent and the traceability we keep on its actions. A conceptual gauge that names a problem that neither CVE nor jailbreak covers.

The fact

Bruce Schneier proposes a "Genie Coefficient": a measure of the gap between the latitude given to an agentic AI system and the traceability kept on its actions. The higher the coefficient, the more poorly the wish has been formulated. He draws a parallel with the Gini coefficient - not to measure inequality, but to make visible what remains buried today in system prompts, IAM roles, and integration chains.

Our reading

The idea is appealing because it names a problem that traditional security does not address: it's not a CVE, it's not a jailbreak, it's an architecture of delegation. An agent that can close a ticket, send an email, debit a card - without knowing what to report in case of failure - has a high Genie Coefficient even if no component is exploited. Recent frontier runtimes integrate fine telemetry consoles, but the gap with wild enterprise integrations is widening. The challenge is to build the score - which Schneier leaves open.

To watch

If the NIST, ENISA, or AISI take up the idea in an evaluation framework. And if frontier providers start publishing a "GC" by default on their enterprise agents rather than a vague stamp of "human oversight".