Extend the thinking, do not substitute it

AI is already in the room. It writes the summary at the top of your search, it sits in the canvas of your word processor, it ships inside the operating system. Europol’s Innovation Lab projected back in 2022 that as much as ninety per cent of online content could be synthetically produced by now, and even the conservative estimates land somewhere between thirty and fifty per cent. The public mood has turned against all of it, “slop” is the word of the moment, and the disquiet is real. But a careful read of contemporary writing, podcasts, and journalism shows the same people polishing their own output with the very tools they say they distrust, at minimum at the lint and grammar layer, often deeper. The gap between the sentiment and the practice is itself worth recording. The honest question is no longer whether to use AI, but how to use it well.

I spent my second year exam project at Noroff working that question all the way down, from moral philosophy to a single firewall rule. The work is anchored in two tools I built and use every day. The first is a single-page writer with a polish-only mode that tries to stop the model from rewriting my voice. The second is nox, a terminal interface over a three-million-row knowledge base of coursework and case material. Both hold the same line. The human does the thinking and the final calls, the AI handles parallelism and lookup. What follows is the short version of three pillars, ethics, law, and practical hardening, and the surprise the lab handed me at the end.

The disposition comes first

AI amplifies whatever disposition the user brings. With grounding, the tool extends the thinking. Without it, the tool substitutes for the thinking. That single asymmetry is why I put ethics ahead of law and ahead of the firewall. Regulation alone cannot stop a person from using AI to do their work for them. A student who has decided that the integrity of their own learning matters less than a passing grade will find a way around any policy. Law exists precisely because that commitment is unevenly distributed, but law is the floor, not the source.

Is there a reason to be ethical that does not lean on theology or politics? Yes, and the science is robust. Cooperation, fairness, and norm-following are not cultural decoration laid over selfish biology, they are products of evolution operating on social animals. Reciprocal altruism, the game theory of repeated encounters, and the primatology of fairness all converge on the same finding, being a reliable cooperator who tracks fairness is a stable strategy wherever interactions repeat and reputations stick. For the AI question, the virtue-ethics frame is the most useful one. Whether to let a model generate your work is not really about which rule applies or which outcome maximises welfare. It is about the character of the writer and the kind of practice writing is.

Luciano Floridi gives the academic name for what is at stake. AI is the first technology in which agency is divorced from intelligence, the capacity to act without the comprehension that has always accompanied it. Hand that capacity to someone with no commitment to do their own thinking, and the tool does not extend a mind, it stands in for one.

Law sets the floor, and the floor matters

The second pillar maps the rules onto a real workflow, the EU AI Act, GDPR, the Norwegian åndsverkloven, the DSM directive, and NIS2. Education lands in the Act’s high-risk category under Annex III(3), which is where a writer tool and a knowledge-base search would sit if they were not carefully scoped. The heavy obligations fall on the institutions deploying AI for grading, assessment, and proctoring, not on the student drafting a report that was never meant for the public. Article 50’s transparency duty bites hardest on AI text published to inform a wider audience.

The useful conclusion is plain. A private institution like Noroff is well inside the law when it requires students to disclose their AI use, and that requirement is itself part of the education. It trains the Article 50 reflex for the public-facing work that comes later. But the law cannot produce the disposition from the first pillar. It can prohibit and it can audit. It cannot make a person want to do their own thinking.

I hardened a vibe-coded app, and the lab surprised me

The third pillar stops arguing and builds. I put the writer inside a hardened Debian container on a Proxmox host, with TLS, basic-auth, host firewalling, fail2ban, and audit logging, all instrumented, then ran it through an AI- and human-driven red-team cycle. What the engagement actually tested was vibe-coded software, an AI-written application that an AI agent was then asked to harden, and both the coder and the hardener failed in places I was not looking.

I expected the network perimeter to be the soft spot, the classic exam scenario, a service on a default port with weak authentication and Hydra knocking. The opposite happened. SSH had been moved off port 22, filtered at the firewall, and set to key-only, so the brute force was absorbed at the network layer before it ever reached the daemon. The real weaknesses sat where I had not thought to look, in the third-party web integrations and the configuration paths that leaked with them. The frontend quietly pulled in eight external dependencies the design notes never mentioned. A basic-auth realm string leaked my identity before authentication. A helpful hint in the settings panel named the exact filesystem path of the API credentials and listed every provider behind the proxy, turning blind enumeration into a direct route for anyone who landed code execution. That disclosure was a vibe-coded artefact, a comment meant for the legitimate user that became reconnaissance the moment the surface was probed.

The lesson sat in the asymmetry of attention. The AI hardener applied textbook discipline to the surfaces it had clearly seen many examples of, and skipped the same discipline on the surfaces it had not. The headline finding of the whole engagement, a provider-routing override that defeated the intended authentication control, landed only when I handed the goal-directed probing to AI automation, and those are findings I would not have reached alone in the same wall-clock time. But the AI missed things too. Its enumeration wordlists never included the application’s own default API endpoints, and I found them by hand with one framing question, which paths would I have named if I had built this myself. The agent did not have that question. I did. AI extends the reach, I bring the framing, and the framing is what carries it.

Cognitive offload… not so much

Put the three pillars in one frame and the same pattern shows up in each. Without an internal commitment to do your own thinking, no law and no firewall configuration saves you. That is also how I resolve the slop contradiction. AI use should be judged by what the AI was asked to do and whether the human stayed in the loop, not by whether AI was involved at all. My writer runs in polish-only mode and keeps an audit log so that judgement is a record rather than a slogan.

The right posture is to treat AI as augmentation rather than cognitive offload. The mathematician is not denied the calculator, the calculator lets the mathematician reach further in less time, it extends the craft without replacing it. AI is the latest entry in a very long line of tools, and it is already pervasive, so the argument about whether to use it is mostly behind us. The argument worth having is about how.

I will say the uncomfortable part plainly. The asymmetry is widening. Students train on consumer-tier tools while the frontier is gated even from corporate buyers, and the entry-level rungs of the technical ladder are being pulled up as I write this. METR’s measurement of how long a task an AI can complete puts the doubling period at roughly seven months, a curve no syllabus revision cadence can match. This is not criticism of any one institution, the curriculum I sit inside is itself part of the good work. The point, in my humblest opinion, is that ethics and law deserve more weight in the AI conversation, not less, and the conversation has to move at the pace the technology is setting, not the pace academic governance is comfortable with. I have been asking for that discourse, in school and out, with limited response so far. Consider this another request.