Anthropic and OpenAI are selling models for cybersecurity to commercial entities with increased pricing. This alone shows that the whole "ban models on account of cyber risks" and putting in model guardrails is a huge grift. Take Hugging Face’s example where they got hacked by an OpenAI model but were unable to defend against it due to guardrails, so they had to resort to a locally deployed GLM-5.2. Meanwhile Anthropic is doom posting about a cyber capable GLM 5.3 model, while that model is the only one capable enough to defend against frontier Anthropic and OpenAI models. It’s a risk to the margins of their cybersecurity extortion racket.
Looking at cybersecurity through isolated user-model interactions and pretending that is somehow safe AI is wrong in its own right. A more useful framework for looking at safety on cybersecurity level is by looking at the whole ecosystem of actors: models, hackers (white, black, etc…), defenders, software and hardware; over time. Each of these parts of the ecosystem acts in unison and the end result, historically was that defense has gotten better. But it is not only through defensive efforts that this happens. Malicious hacking is a necessary part of making the whole ecosystem safer over the long term.
In cybersecurity it its widely understood that resilience builds up through exposure to failures and mitigating vulnerabilities. One of the main strengths of software in general is the openness of the ecosystem. Your own software doesn’t have to be exposed to a failure or under an attack to benefit from vulnerability mitigation. Even if guardrails increased the safety of the model interactions, which is questionable on its own and not without tradeoffs, they definitely don’t enhance the overall safety or the resilience of the whole cyber space.
In the context of resilience, suppressing volatility of a system, artificially suppressing failures for a limited amount of time is seen as counterproductive. It allows latent risks to build up. Without superficial suppression of volatility, software and hardware systems would be exposed to smaller isolated and uncorrelated failures. Only in that case we have an accurate evaluation of the true resilience of a system, which allows us to setup defenses that are proportional to the risks present in the cyberspace.
Without such volatility and failures we can not measure, or have confidence in the resilience of our cyber defenses.
Selective suppression of volatility through guardrails leaves systems unprepared in times of expanded offensive capabilities shock. Without guardrails defensive capabilities can track offensive capabilities and mount appropriate defenses. Systems hardened with guardrails are not able to track offensive capabilities, so at the times of a capabilities shock or expanse in access to advanced offensive capabilities, this leaves a preparedness gaps between the two scenarios. Both systems are vulnerable to failures but of different magnitudes and exposure surfaces.
The preparedness gap
Common counter argument might be that the access to advanced offensive cyber capabilities is given to chosen actors who can share the knowledge across the ecosystem. In cybersecurity it is the case that the vulnerabilities discovered by actors with different levels of access (internal, external) are complementary. For example, in browser hardening, internal teams are more likely to uncover problems deep inside the browser’s core code, such as memory handling or the JS engine, while external researchers find bugs in parts of the browser that are easier to interact with from the outside, such as the DOM. External researchers are able to find more vulnerabilities that are already present in stable releases, whereas internal teams catch more issues in development.
The biggest argument for looking at safety through the lens of resilience of the whole system, is that with increasing AI capabilities, potential for discovering novel attack vectors increases. Systems can’t be hardened against unknown threats. However, they can be made resilient, so that novel attacks can have smaller and localized impact, and so that we can build out systems that let us efficiently deal with novel threats.
Visible incidents and latent risk
