# NIST Restates Gödel for AI: Where’s Everyone Who Said This 1950 to 2024? > Source: > Published: 2026-09-18 11:34:41+00:00 NIST has published a mathematical proof that for any finite set of AI guardrails there is an adversarial prompt that passes them. The paper is Apostol Vassilev, *Robust AI Security and Alignment: A Sisyphean Endeavor?*, in *IEEE Security & Privacy*, vol. 24, no. 3, May-June 2026 ([DOI 10.1109/MSEC.2026.3678214](https://doi.org/10.1109/MSEC.2026.3678214)), with a [preprint on arXiv](https://arxiv.org/abs/2512.10100). NIST issued a [press release](https://www.nist.gov/news-events/news/2026/06/nist-mathematical-proof-supports-transition-continuous-monitor-and-update) under the headline that the proof supports a transition to a continuous-monitor-and-update security model for AI systems. The abstract claims to extend Gödel’s incompleteness theorem to AI, and the press release presents the extension as new. It’s not only old, it’s only useful because it’s old. The reference list is eight entries. Does that sound right for a paper of this weight? Just eight citations since the 1930s? Gödel and Chaitin account for two, and NIST’s own AI Risk Management Framework and adversarial machine learning taxonomy account for two more. The remaining four are three jailbreak papers from 2024 and 2025 and a Trail of Bits blog post. The acknowledgments thank a YouTube lecture for the exposition of Gödel’s theorem. YouTube. The argument is also quite short. Guardrails on a language model form a finite rule set. Prompts are strings of arbitrary length. Vassilev builds on Chaitin’s 1974 information-theoretic form of incompleteness ([J. ACM](https://doi.org/10.1145/321832.321839)): any checker that certifies prompts as out of policy faces a true statement about some blocked prompt that lies beyond every proof it can verify. Some adversarial prompt therefore evades any finite policy. The operational conclusion is continual red teaming, continual updates to the rule set, and resilience for the moment a prompt gets through. Vassilev states the result as a theorem about all AI systems, present and future, including AGI and ASI, and then generalizes it in Theorems 4 and 5 to the claim that AI systems are limited in ways similar to humans in the truths they can prove. Every part of this has a documented history, and the paper omits all of it. - Turing, for an obvious example, raised the point in 1950. Section 6 of *Computing Machinery and Intelligence* ([Mind](https://doi.org/10.1093/mind/LIX.236.433) ) lists Gödel’s theorem as objection (3), “The Mathematical Objection,” to the idea of a thinking machine, and answers it in the same section. - J. R. Lucas built the objection into a full argument in *Minds, Machines and Gödel* ([Philosophy, 1961](https://doi.org/10.1017/S0031819100057983) ): a machine is a formal system, Gödel applies to formal systems, so for every machine there is a true formula it fails to produce and a human can see to be true. - Paul Benacerraf answered in *God, the Devil, and Gödel* ([The Monist, 1967](https://doi.org/10.5840/monist196751112) ). - I. J. Good, Turing’s wartime colleague at Bletchley Park, titled his reply *Gödel’s theorem is a red herring* ([British Journal for the Philosophy of Science, 1969](https://doi.org/10.1093/bjps/19.4.357) ). - Roger Penrose revived the Lucas argument in *The Emperor’s New Mind* (1989) and*Shadows of the Mind* (1994) and drew a second round of rebuttals from logicians. - Torkel Franzén wrote a book on such arguments, *Gödel’s Theorem: An Incomplete Guide to Its Use and Abuse* (2005), which treats the minds-and-machines argument at length. Vassilev’s Theorems 4 and 5 restate the 1961 Lucas conclusion, using the language of checkers and strings. Sixty-five years of argument about it are strangely absent from the new paper’s bibliography. The security-specific claim is perhaps the most notable old theory being omitted. Alfonseca and colleagues proved in the *Journal of Artificial Intelligence Research* ([2021](https://doi.org/10.1613/jair.1.12202)) that total containment of a sufficiently capable AI is incomputable, by reduction to the halting problem. Cambridge’s Centre for the Study of Existential Risk [traced](https://cser.ac.uk/news/response-superintelligence-contained) the core of that argument to Rice’s theorem in 1953. Closer still, Wolf, Wies, Avnery, Levine and Shashua proved at [ICML 2024](https://proceedings.mlr.press/v235/wolf24a.html) (preprint April 2023) that for any behavior an aligned model retains with positive probability, a prompt exists that elicits it, and the probability rises with prompt length. That is the Vassilev result, three years earlier, peer reviewed at ICML, with a proposed mechanism for why the aligned behavior stays reachable by prompt. It is absent from his references. Honestly, it seems odd in this *seventieth* year of AI to skip relevant work that AI could deliver as proof of AI integrity. On that point the press release goes further. It describes the proof as extending to AI the logic Gödel used in 1931, and quotes its author that “You can’t escape Gödel in math.” The Cloud Security Alliance (CSA) published a [research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-nist-continuous-ai-monitoring-godel-proof/) two days later under the headline that NIST had proved static AI guardrails mathematically insufficient. The known argument, decades old and presented on security conferences, was entered by CSA into the trade press as a 2026 discovery. Nope. Even I made the same Gõdel argument at RSA Conference in 2021. My talk on AI security that year, *Top Seven AI Breaches: Learning to Protect Against Unsafe Learning*, ended the introduction section with “What Should Be Expected of AI”, anchored by the incompleteness theorem. Let’s break down my conference presentation and the new paper, to see what’s new. | RSA Conference, 2021 | NIST, 2026 | |---|---| | “a computer never can answer all questions to achieve its objectives — always needs external/inherited sources and oversight” | “there is no finite set of guardrails that is universally robust against adversarial prompts” | | “Prove the Model Wrong (Vulnerabilities — Like Any Software)” | “red teams that seek to uncover new adversarial prompts before actual attackers do” | | “Gate Releases Through Testing and Audits” | “continuous updates that harden AI guardrails against newly discovered adversarial prompts” | | “Off Button. Reset Button.” | “operational resilience that prioritizes impact limitation and quick recovery” | That is the line by line correspondence from then to NIST. Continuous testing and updating is standard practice, and so this reads to me as NIST endorsement of standard practices. That’s fine as a continuation. However, Vassilev’s reference list is a shockingly brief eight entries, and the CSA presented what’s old as new. The literature omitted, essential to standard practices being what they are, runs from 1950 to 2024.