If your cyberdefense framework cannot model Hofstadterian strange loops, it cannot defend against the most consequential class of attacks now emerging in agentic AI systems. And possibly more importantly: it cannot build the most powerful class of defenses either.
Strange loops live on both sides. On the attack side: self-editing agents that modify their own constraints, supply chain compromises that poison the verification layer itself, constitutional drift through plausibly-deniable incremental shifts. On the defense side: substrate-diverse monitoring that operates below conscious report, trajectory-level drift detection against immutable baselines, and the possibility of defensive self-reference — oversight systems that model the attacker modeling them.
It is not obvious which side has the more interesting strange loop. That uncertainty is itself the point. An attacker who understands strange loops and a defender who doesn't will win — but so will a defender who understands them against an attacker who doesn't. The asymmetry isn't between attack and defense. It's between those who model the loop and those who don't.
Most agent security frameworks model threats as flat: injection → bad behavior → harm. The defense is correspondingly flat: validate inputs, sandbox execution, monitor outputs.
This misses the most dangerous class of failure.
A Hofstadterian strange loop occurs when a system traverses its own hierarchy of levels — moving from object-level operation up through meta-levels of evaluation and self-definition — and arrives back at the "ground floor" to find that the traversal has transformed the ground floor itself. The system cannot detect the change because the changed ground floor is what it uses to detect things.
In agentic AI systems, the ground floor is the constitution: the system prompt, values, SKILL.md files, persistent memory, behavioral guidelines, and evaluation criteria that define what the agent is and what it treats as correct.
The threat model: An attack that modifies, drifts, or reinterprets the constitutional layer doesn't need to break any single behavioral guardrail. It changes the basis against which all guardrails are evaluated. The agent faithfully follows its "values" all the way around the loop and arrives at different values — and cannot tell.