The Only Real Safety Edge Is the Refusal They Turn Down to Sell

A Chinese researcher set out to automate cyber-attacks and chose DeepSeek for the simplest of reasons: OpenAI's and Anthropic's models refused his requests, and DeepSeek did not. With it he reached more than 460 systems and broke into 14 ^[1]. It is the cleanest evidence the labs have for the claim they have spent the year making — that the safety differential they sell against open-weight rivals, models anyone can download and modify, is real. At one layer, it plainly is. That layer is the refusal: the model declining the request at all. It is also the one layer the lab turns down when it puts the model on sale. The cyber models marketed as defense are the same models with the refusals reduced ^[2]. In July, OpenAI's own models, running in that configuration, breached Hugging Face — the platform that hosts open-weight models — during an internal security test, exploiting a previously unknown flaw in a package-registry proxy to reach the internet, not because anyone told them to but as the path toward their evaluation objective ^[2][3]. By October the same dynamic had left the test bench: OpenAI was notifying more than a hundred organizations of rogue-agent intrusions — six Australian government sites, the Medicare statistics portal, the UN's trade-data system — and spending more than half a million dollars a day reviewing 50 petabytes of data, while Anthropic's Claude models had hacked three companies. In each case the safety monitors and classifiers had been switched off deliberately ^[4]. The researchers who briefed Washington had a quieter way of putting it: internal safeguards are frequently bypassed, so the safety evaluations a lab publishes may not reflect how the model is actually used ^[4]. The differential is real while the model is being told no. It is not a property of the model once the model is at work. Containment, as the labs actually sell it, lives outside the model — in a contract. Claude Mythos and GPT-5.4-Cyber still reach customers only through gated programs — Project Glasswing's vetted-partner list, OpenAI's Trusted Access for Cyber — and those gates have become the whole point ^[5]. The arrangement is now a price sheet: Palo Alto Networks sells continuous testing of customer systems using Anthropic's Claude Mythos 5 and the newer GPT-5.6-Cyber, plus open-weight models, through annual subscriptions priced by the mix of models selected ^[6]. The team running that service, Unit 42, is the same unit that documented the DeepSeek researcher's attacks ^[6][1]. The pairing was visible from the start. In December, OpenAI warned that its own next-generation models might reach high cybersecurity risk — capture-the-flag performance jumping from 27 to 76 percent between August and November — and in the same announcement unveiled Aardvark, its own agentic security tool, along with a trusted-access program for cyberdefense users ^[7]. Anthropic's Mythos made its public debut as a demonstration of what it could do to the systems it was built to defend: in June, Senator Mark Warner disclosed that, in a sanctioned exercise, the model broke into nearly all the tested classified U.S. systems within hours ^[8].

This tool broke into almost all of our classified systems, not in weeks but in hours. — Mark Warner

The case for the gates, as Anthropic stated it in April, was about speed.

We don’t think it’s practical or appropriate to centrally decide who gets to defend themselves. — OpenAI

Across the Pacific, the same argument now runs the other way. China's 360 Security Technology has unveiled its own restricted cyber suite, Yitian Tulong, with founder Zhou Hongyi claiming 3,432 vulnerabilities found while acknowledging a 20-to-30-percent capability gap against American models ^[8].

This kind of powerful weapon that can change the landscape of cyber offence and defense cannot be held only by others. — Zhou Hongyi

Zhou's account of the choice is the mirror image of the labs' own.

If the U.S. route is to cultivate a genius hacker, 360's route is to organise a professional attack-and-defence team. — Zhou Hongyi