Cybersecurity Pros Say AI Safety Filters Are Driving Them Toward Chinese Open-Source Models

A growing tension is fracturing the relationship between AI companies and the cybersecurity professionals they're supposed to be helping. Researchers who probe systems for vulnerabilities — a practice known as offensive security — say the protective filters baked into major AI models are actively interfering with legitimate defensive work, pushing some toward foreign-developed, unrestricted tools instead. The irony isn't lost on anyone: measures meant to prevent cyberattacks may be inadvertently weakening the people best positioned to stop them.

The issue came into sharper focus earlier this year when the U.S. government imposed temporary export control restrictions on Anthropic's Mythos and Fable AI models, citing concerns that their guardrails could be bypassed to assist in cyberattacks. Anthropic had already positioned Mythos in particular as a high-risk, tightly controlled system — one that required strict vetting before access was granted. Although the controls on Fable 5 were lifted and general access resumed July 1, Mythos 5 remains restricted to vetted U.S. organizations undergoing government review, underscoring just how cautiously these tools are being managed.

Both Anthropic and OpenAI offer formal vetting programs — Anthropic's Cyber Verification Program and OpenAI's Trusted Access for Cyber program — that give approved researchers somewhat looser access to their models. But even within these programs, researchers say the experience is inconsistent and frustrating. Chris Thompson, CEO of RemoteThreat and founder of Offensive AI Con, described spending significant time negotiating with models rather than actually analyzing vulnerabilities. The guardrails, he said, shift unpredictably from day to day, causing over-sanitized outputs and blocking legitimate security queries without clear reason.

Chris Anley, chief scientist at NCC Group, illustrated the fundamental problem with a simple analogy: asking an AI to fix vulnerable code is simultaneously a defensive necessity and a potential roadmap for attackers. You cannot cleanly separate the two functions. When models refuse such queries outright, defenders lose a critical confirmation tool — the ability to verify whether a bug is exploitable enough to warrant a patch. Paolo Stagno, CTO at zero-day vendor Crowdfense, put it more bluntly, accusing AI companies of treating customers "like children who need babysitting."

The practical consequence is a drift toward open-source models with no guardrails whatsoever. Researchers at companies not enrolled in vetted programs report that frontier models become nearly useless the moment any security-related intent is detected. Thompson specifically noted that responsible researchers are being steered toward Chinese open-source models like GLM — tools with no usage restrictions, downloadable and runnable locally. That outcome, he argued, creates a geopolitical and security risk far greater than the one these guardrails were designed to prevent, leaving defenders ill-equipped as AI-enabled attacks grow faster and more sophisticated.