For #3, wouldn't the AI defending against hacks need to be a hacking AI itself? It would need to find vulnerabilities in the systems it protects in order to plug them before other AI's find them.
The moment I saw this project start, the first thing I thought was, "Isn't this how all terrible things are created, by trying to avoid having them be created?".
I wonder if the long-term strategy will be called Mutually-Assured Obsolescence™.
Making an AI that finds vulnerabilities is the hard part. Doing an offensive thing or a defensive thing is much easier if you've got an AI that's just spewing out vulns. They don't need to be tightly coupled at all.