Living outside of the US (and EU). I’m in the process of launching an agent assisted automated pentesting and authorized offensive security service. I’m using open weights models to execute the entire audit. So lets for a moment entertain the idea that the US somehow locks open weights. How are they going to stop such audits or actual attackers? A competing service in the US simple won’t be able to execute the same level of audits because many of the models refuse following penetration and offensive security testing instructions. An actual attacker is not going to limit itself to those models either. Why would anyone serious about security then limit itself too.

In the end, as a non-US entity; how would the US even stop me from providing services to US companies in private? Well I have a US LLC now, but the moment they become serious about this it takes me a few weeks to incorporate in HK or SG.