The same guardrails AI companies built to keep hackers out are now getting in the way of the people paid to break into systems for a living. That’s the tension TechCrunch AI lays out in a new report on offensive cybersecurity researchers, and it points to a problem the industry hasn’t solved: a tool that finds vulnerabilities for defenders is the exact same tool that finds them for attackers. You can’t split the two apart.
What stands out here is how fast the gatekeeping has escalated. In June, TechCrunch AI reports, the U.S. government hit Anthropic’s Mythos and Fable models with export controls, partly over a claim that their guardrails could be bypassed to build cyberattacks. Those controls have since been lifted. Fable 5 went back to general access on July 1, and Mythos 5 returned only to vetted U.S. organizations under government review.
The Vetting Problem
Anthropic and OpenAI both run application-only programs for security pros: OpenAI’s Trusted Access for Cyber and Anthropic’s Cyber Verification Program. Get approved, get fewer restrictions. Sounds reasonable. In practice, researchers say it treats them like suspects until proven otherwise.
Paolo Stagno, CTO at vulnerability firm Crowdfense, told TechCrunch AI the companies “essentially treat customers like children who need babysitting.” Mark Dowd, a veteran zero-day researcher, put it more bluntly: “it’s not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security and what’s not.”
Why the Line Can’t Be Drawn
Chris Anley, chief scientist at NCC Group, explained to TechCrunch AI that asking a model to exploit a bug is how you confirm the bug is real and worth fixing. The prompt “fix this code” is a defense mechanism and a roadmap to critical flaws at the same time.
“It’s like a hammer,” Anley said. “You can’t build a house without a hammer. It’s definitely a tool but it’s also irreducibly a weapon as well.”
That’s the trap. There’s no clean way to let defenders in and keep attackers out, because they do the same work with the same prompts.
The Workarounds Tell the Real Story
When researchers hit a wall, they route around it. And where they route matters:
- Open-source models with no guardrails. Anley’s team falls back to these when a frontier model refuses. Stagno’s team runs local open-source models specifically so sensitive vulnerability data never touches a cloud provider or future training runs.
- Frontier models for the boring parts only. Several researchers use commercial AI for reverse engineering and understanding code, then do the actual bug discovery by hand. “I am jealous of my bugs,” said Giuseppe Cali, “and I like this game too much to let models play it for me.”
- Chinese models. TechCrunch AI notes researchers get pushed toward them when Western tools refuse to cooperate.
That last point should worry the labs. Every over-cautious refusal hands market share to a competitor with looser rules.
The Inconsistency Tax
Chris Thompson, CEO of RemoteThreat, flagged a quieter cost: the guardrails work differently day to day, even inside the vetted programs. “You spend a lot of time negotiating with the model instead of working on the core security program,” he said. When a paid tool behaves randomly, professionals stop trusting it and find something that doesn’t.
Why This Matters Now
Security work is dual-use by nature, and the labs are learning that safety theater has a price. Too loose, and you get export controls and bad press. Too tight, and legitimate defenders leave for open-source or foreign models you can’t monitor at all. The guardrails meant to reduce risk may be quietly increasing it.
Practical takeaways if you run security or build with these models:
- If your team does defensive research, apply to the vetted programs early. Access is the difference between a useful tool and one that quits the moment it smells security work.
- Keep sensitive vulnerability data off cloud models. Local open-source is the norm for a reason.
- Expect inconsistency and budget for it. Don’t build a workflow that assumes the model behaves the same tomorrow.
The deeper fix is a real trust framework for dual-use work, not a refusal switch. Until the labs build one, defenders will keep drifting toward tools with no rails at all, which is the opposite of what any of this was supposed to accomplish. Full reporting is available at the original source.