Offensive cybersecurity researchers report that safety guardrails from OpenAI and Anthropic are restricting their ability to find vulnerabilities and develop security tools. The limitations are creating friction for legitimate security work.
Cybersecurity researchers who hunt for unknown vulnerabilities face growing obstacles from AI safety measures designed to prevent misuse. OpenAI's and Anthropic's guardrails restrict access to code generation, exploit development, and other technical capabilities these professionals depend on.
The issue centers on distinguishing defensive research—identifying weaknesses to fix them—from malicious activity. Researchers say guardrails often block legitimate security work without clear appeal processes or exceptions for credentialed professionals.
This creates a broader tension: AI companies prioritize safety by default, but overly broad restrictions can hamper the security community's ability to protect systems. Researchers lack consistent ways to demonstrate their credentials or request temporary access for authorized work.
Both companies have implemented some researcher programs, but coverage remains limited. The cybersecurity community is calling for more nuanced policies that account for legitimate offensive security research without compromising safety.
Two Nigerian men have been extradited to the U.S. and charged in connection with sextortion schemes that led to the deaths of two minors in Mississippi and North Carolina.
Threat actors are exploiting a vulnerability chain in Microsoft SharePoint to execute arbitrary code on unpatched servers. Defused has confirmed attackers are leveraging proof-of-concept exploits in the wild.
Hackers have claimed to steal millions of patient records from McKesson, the major U.S. healthcare distributor. The company acknowledged the breach and warned of potential service disruptions.
Artificial intelligence is becoming adept at finding and patching software vulnerabilities, potentially undermining governments' ability to deploy spyware and hacking tools. The development could spark renewed pressure for backdoors in encrypted devices.