Export controls on Anthropic‘s Mythos and Fable models have restricted access for legitimate network defenders and offensive cybersecurity researchers.
These restrictions follow a June report suggesting the models’ safety measures could be bypassed to build cyberattacks. Anthropic had previously marketed Mythos as a high-risk tool for vetted users only. While the government later lifted export bans on Fable 5 and reintroduced Mythos 5 to specific US organisations, the gatekeeping approach remains a point of contention.
Both Anthropic and OpenAI offer vetted programs for security researchers, such as OpenAI’s Trusted Access for Cyber and Anthropic’s Cyber Verification Program. These initiatives grant access to models with fewer cybersecurity restrictions. However, the guardrails attached to these tools are widely criticised by those tasked with finding unknown vulnerabilities before criminals do.
Mark Dowd, a security researcher who sells zero days to Western governments, told a podcast that it is uncomfortable for large companies to make arbitrary safety decisions.
“It’s not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security and what’s not,” Dowd said.
Dowd has spent decades identifying software flaws and selling the exploits to governments rather than reporting them for patching. He noted that keeping vulnerabilities open is useful for intelligence operations. While he admitted his work might introduce bias, he is not alone in this view.
Chris Anley, chief scientist at NCC Group, explained that asking an AI model to exploit a bug is a key step in confirming a real vulnerability. If a guardrail forces the model to refuse the question, it hinders defenders.
“This is where the whole offensive versus defensive and guardrails part comes in, because ‘fix this code’ as a prompt is both an essential mechanism for defense but also a roadmap for finding critical vulnerabilities in the code base,” Anley said. “So at the same time, the same tool is both an offensive tool and a defensive tool, and the two can’t really be unpicked.”
He compared the situation to a hammer, noting it is a necessary tool for building a house but also irreducibly a weapon.
When blocked by these restrictions, Anley and his colleagues sometimes revert to open-source AI models that lack guardrails entirely.
Paolo Stagno, chief technology officer at CrowdFense, agreed with Dowd. He argued that AI companies treat customers like children needing babysitting through their vetted programs.
Stagno and his team use frontier models only for reverse engineering. They avoid using AI to find vulnerabilities or build exploits because feeding that work into a cloud-based model risks leaking sensitive data or having it absorbed into future training runs. Instead, they use open-source models run locally to avoid sharing data outside the system.
Giuseppe Cali, a security researcher who develops exploits, stated that guardrails do not impede his work. He uses AI for initial reverse engineering and building supporting tools, which speeds up the process and lets him focus on discovery.
“I still want to own the actual bug discovery and weaponization myself and that wouldn’t change if all guardrails were lifted tomorrow,” Cali said. “I am jealous of my bugs, and I like this game too much to let models play it for me.”
One researcher at a smartphone-component manufacturer, speaking on condition of anonymity because he is not authorised to talk to the press, said his employer is not part of Anthropic’s Cyber Verification Program. He noted the tools are barely useful for finding vulnerabilities because the guardrails are too strict.
“If it catches wind we’re doing anything security related, it just stops and isn’t usable,” the person said.
Chris Thompson, chief executive of RemoteThreat and founder of Offensive AI Con, said his experience with frontier models shows guardrails are inconsistent and change daily. This inconsistency occurs even within the looser boundaries of vetted programs from Anthropic and OpenAI.
“I think the practical impact is you spend a lot of time negotiating with the model instead of working on the core security program,” Thompson said. “Instead of analyzing a vulnerability and reasoning through the exploitability, you’re trying to find why you’re getting inconsistent results or why are models over-sanitizing the output.”
As a result, researchers often rely on or are pushed toward Chinese open-source models like GLM. These are freely downloadable and can be run locally without vetting or usage restrictions.
“You have these responsible researchers that are being pushed away from U.S.-governed systems to foreign-owned systems,” Thompson said. “I think it’s more harmful than good to have these guardrails in place.”
Thompson called for AI frontier labs to open up their programs and provide responsible access while holding abusers accountable. He argued that without this change, defenders will lose the race against attackers.
“There’s this big storm coming. There’s this big wave of attacks that are going to happen at speed and scale like never before,” Thompson said. “But the same security consulting firms and legit researchers that are trying to make a difference are being stifled right now.”
What it means
Security teams are increasingly forced to choose between using restricted corporate models or running unvetted open-source software locally. This shift means legitimate vulnerability research is moving away from US-governed systems toward foreign-owned alternatives.
