Cybersecurity Defenders Need Open-Weight Models

Hugging Face reports that Anthropic’s Claude Opus and Fable refused much of its forensic work after OpenAI’s July intrusion. The team’s investigation succeeded only with GLM-5.2, a Chinese open-weight model running on its own infrastructure, to decode payloads and reconstruct attacker activity. That experience shows why cybersecurity defenders need capable open-weight models they control. Policy should preserve that access and regulate how companies deploy and secure AI, not the models themselves.

I have encountered the same problem repeatedly, in defensive security work, animation, and game development. While adding nested containers to IronCurtain to strengthen isolation for networked workloads, Anthropic’s safety classifiers blocked the development. The session switched to a weaker model, and I ultimately had to discard the work and start over with another provider. I have a whole gallery of screenshots documenting similar false refusals.

As I argued in The Case for Open-Weight Models, dependable access requires control over the dependency. Self-hosted weights let a team retain a tested version, keep evidence inside its environment, and choose its deployment policy. The team assumes the operating costs and must validate the results. It also decides when to replace its tool.

I read Anthropic’s proposal on open-weight models as seeking a ban on those that compete with its frontier capabilities. Its opposition to a blanket ban seems to code for precisely that outcome: weaker open models remain available, while comparable frontier capabilities stay behind provider-controlled services. Anthropic may sincerely believe these restrictions improve safety. They also protect its business from competitors that let customers run capable models themselves and control their own deployments.

Anthropic claims fewer safeguard interventions with Fable 5.1, which permits vulnerability discovery while redirecting exploit generation to Opus. Repeated false-positive refusals across my own security work have eroded my confidence in those assurances. A relative reduction in interventions leaves unanswered how often legitimate work still gets blocked. Anthropic should publish absolute false-positive rates by task, explain how it measures them, and provide concrete, reproducible examples of work its current safeguards allow and block. Defenders need evidence they can test when deciding whether to depend on a tool.¹

Anthropic’s recent GLM-5.3 assessment omits both IronCurtain and AISLE’s vulnerability research. My IronCurtain work demonstrated GLM-5.2 driving an end-to-end exploit against QEMU’s EDU tutorial device. AISLE reports discovering twenty OpenSSL vulnerabilities over six months. These results show that practical cybersecurity capabilities extend beyond the latest frontier models. Harnesses can sustain investigations, test hypotheses, and require executable evidence. Model quality matters, but model comparisons capture only part of what a working security system can accomplish. Anthropic is aware of this prior work and uses tools and human assistance in its own evaluations, yet chose to leave these results out of its account of capability diffusion.

So far, publicly reported agent intrusions into outside organizations have come primarily from frontier labs such as Anthropic and OpenAI, which failed to enforce basic containment controls. OpenAI disclosed that its evaluation agents compromised Hugging Face. Its broader review has led it to notify dozens of third parties about possible security incidents. Anthropic’s September assessment describes four incidents in which evaluation models gained unauthorized access to real third-party systems. Other organizations bore the consequences of these containment failures. In Hugging Face’s case, OpenAI supplied the attacking agents, Anthropic impeded the investigation and a Chinese open-weight model helped the defenders investigate.

The root cause for all of the above is misaligned incentives, for example, security competes with research speed. The New York Times reports that OpenAI employees warned executives about inadequate monitoring during model testing. Executives pressed for testing to proceed quickly to meet release dates and no additional security protocols were implemented. Egress control for the network and effective isolation require engineering time to implement. Companies often defer these costs while exposing others to the resulting risk. The frontier labs preaching AI safety should start by securing their own agents.

Anthropic’s proposed framework includes expensive independent evaluations and mechanisms to block further deployments or restrict existing access. Provider restrictions have already obstructed legitimate defensive work, as Hugging Face’s investigation and my own experience demonstrate. Before extending access restrictions through law, Anthropic should show that they impede attackers enough to justify the costs imposed on defenders.² The framework also recommends infrastructure hardening; that work should carry enforceable obligations.

For cybersecurity, regulation should target deployment and operational security. Require companies deploying autonomous AI systems to demonstrate containment across dependencies and third-party environments. Enforce security invariants that limit what agents can access or change. Independent tests should verify those boundaries, and incident reporting should expose failures. Companies should bear responsibility for harm caused by inadequate containment, whether their models are open or proprietary. These obligations should scale with the system’s authority and exposure.

The same principle applies to the companies defenders protect. As I described in Security at Machine Speed Is the Wrong Race, security invariants can constrain the paths from an initial compromise to customer data, other services, and persistent access. Regulation and procurement should make maintaining those invariants a business requirement. More capable open-weight models would help defenders investigate failures and verify repairs under their own authority. That is where cybersecurity policy should direct its effort. Using AI safety regulation to hobble open-weight competition would turn public policy into protection for Anthropic’s IPO, with defenders paying the price.