The Cybersecurity AI Promise Meets the Firewall
For security researchers working in the trenches, AI was supposed to be the ultimate force multiplier. The premise felt simple: use large language models to map attack surfaces, dissect complex blocks of code, and trace exploitation paths at a speed no human could match. But a year into standardizing these tools, the reality is far more frustrating. The white-hat offensive research community is hitting a wall. Instead of finding bugs, they're arguing with safety guardrails.
The core tension is easy to spot. The same LLM that helps a defender spot and patch a critical vulnerability can easily be instructed to weaponize that same flaw. By trying to lock out the bad guys, the AI labs have ended up cutting off the very people building our defenses. It's a classic case of collateral damage.
Locked Out: The Irony of Export Controls
The friction reached a boiling point in June 2026. The U.S. government placed export control restrictions on Anthropic's flagship models, Mythos and Fable. Why? Because reports surfaced that users could bypass safety guardrails to generate cyberattack scripts. While the restrictions were eventually lifted—Fable 5 returned to general access in July, and Mythos 5 went back to vetted organizations—the incident showed how quickly political panic can throttle development.
Ironically, Anthropic had spent months marketing Mythos as a highly restricted cyber-superweapon. They built programs like the Cyber Verification Program to give select groups controlled access, while OpenAI launched its own Trusted Access for Cyber. But these programs are not keeping pace with the needs of the industry. When a researcher's access is constantly toggled by administrative changes and shifting policy baselines, the tool becomes useless for daily operational workflows. Check our previous reporting on Anthropic's Fable 5 Overzealous Guardrails to see how paranoid these systems can get in practice. You can also read about the initial launch in our coverage of Anthropic's Mythos Model. For a deeper look at how the security community responded to Fable's restrictive filters, see our analysis of The Fable of Safety: Cybersecurity Researchers Clash with Anthropic's Guardrails.
The Dual-Use Paradox: The Hammer Analogy
Why is it so hard to draw a line between offense and defense in code? Because the actions are structurally identical. Chris Anley, chief scientist at the security firm NCC Group, points out that a request to "fix this code" requires the AI to understand exactly how the code breaks. In a recent TechCrunch article, Anley noted that an AI tool is like a hammer. You cannot build a house without one, but it is also irreducibly a weapon.
Forcing an AI model to analyze a snippet of software for bugs inevitably triggers the system's safety filters. The model sees the vulnerability map and suspects an exploit is being built. If the program flags the query as malicious, the ethical researcher is blocked. The labs wanted to create a sandbox, but instead, they designed a cage that doesn't distinguish between a burglar and a locksmith. This makes the tools highly unreliable for professionals who need standard, repeatable results.
Babysitters and Backdoors: The Trust Deficit
The professional response to these filters has been a mix of irritation and deep skepticism. Mark Dowd, a veteran researcher who has spent decades finding zero-day exploits, expressed discomfort with how these safety decisions are made. A handful of corporate safety boards are unilaterally deciding what is safe for the entire security industry to study.
Other experts are even more blunt. Paolo Stagno, the chief technology officer at Crowdfense, says that AI vendors essentially treat customers like children who need babysitting. Beyond the annoyance, security firms face a real data privacy hazard. Uploading high-value, unpatched zero-days to a cloud-hosted frontier model is a massive risk. The data could leak, or worse, get eaten by the model's next training cycle.
Because of this, firms like Crowdfense are refusing to use cloud-based LLMs for bug hunting. Researchers like Giuseppe Cali still rely on models for initial reverse engineering and code translation, but they keep the actual vulnerability discovery offline. Cali admits he is jealous of his bugs and wouldn't let an AI play that game for him anyway. But for developers who aren't zero-day brokers, the lack of local, air-gapped access to top-tier models is a major obstacle.
The Slippage: Swapping Vet Tech for Local Models
What happens when you lock out the experts? They don't stop working. They just change toolsets. Faced with unpredictable guardrail rejections on U.S.-hosted platforms, researchers are bypassing them entirely. They are opting for open-source AI models that can run locally on their own hardware.
This pivot has national security officials worried. Chris Thompson, CEO of RemoteThreat, points out that researchers are increasingly turning to open-source models developed overseas, such as the Chinese GLM models. These models can be downloaded, run locally, and queried without any corporate oversight or usage logging.
It is the classic backfire effect. By making U.S.-aligned platforms like Claude and GPT too difficult to use, the guardrails are pushing legitimate security talent toward foreign-owned systems. The result is a double loss. The U.S. loses visibility into how these tools are used, and the researchers are forced to rely on models that may not have the same level of capability as the vetted frontier systems.
Reconciling the Fault Lines in AI Security
The current model of automated safety gatekeeping is hitting a wall. Even Anthropic's own official policies note the immense power of these systems: in 2026, their Claude Mythos Preview successfully discovered thousands of zero-day vulnerabilities in operating systems and browsers. The capability is there. The defensive payoff of letting AI find these flaws before the adversary does is massive. But right now, we are holding back the white hats while our adversaries build their own unfiltered toolsets.
AI developers need to treat security researchers as partners rather than risks. That means creating predictable, transparent, and legally protected access policies. We need true local-deployment options for vetted firms and a clear path to bypass safety filters when analyzing exploits. Thompson warns that a big storm of automated, high-speed cyber attacks is coming. If we keep treating our defenders like children, they'll face that storm completely unarmed.
