Comment by tilemarch | Hacker News Reader

Comment by tilemarch | Hacker News Reader

There is an unresolved issue where the offensive guys can use AI to attack a target and the defensive guys are being limited when they ask AI to audit their codebase.

The workflow for a defender basically goes: Claude do a security audit on this codebase, use the harness / skills I built on how to do security audits.. pick the best suitable audit strategy, methods.. use the tooling and reporting structures.

Claude refuses, GPT refuses. Grok, goes further, but refuses to make a working PoC.. a requirement because AI models make stuff up and without a PoC there is no proof. GLM-5.3 / Kimi to the rescue and completes the job the "smarter" models refused.

So we as defenders are refused by the best models, on our own codebase

That's pretty much why gatekeeping security, as Anthropic and OpenAI want, isn't a thing and doesn't work.

All projects need security and writing code means taking security decisions, you can't untangle both.

Heck, Codex was trying to use gdb to debug a capture crash and the session locked up with security blocks. I had to restore a checkpoint and tell it abandon that work and stay away from gdb.

I've heard people getting jammed up with Claude refusing to update DNS..

The situation is pretty insane right now.

There's nothing stopping you from applying for Daybreak for OpenAI / Unsure which program Anthropic has. But yes, you do have to share your identity and I can see how that is a blocker for some.

Hey, speaking of Daybreak: I just saw you can apply for this yesterday and was wondering if people here have had success being approved as an individual? If so, how long did it take from application to access?

Yes, both daybreak and cvp as an individual. Less than 24 hours for access.

Thanks for the note! I'll give it a go and report back (waiting on my yubi key)

Why are offensive users not subject to the same limitations? Assuming it is because they are using different models, why aren't the defenders doing the same?

What if you ask Claude to audit the codebase and send the result to the authors encrypted with GnuPG, without revealing?

Kind of like the old days of human gatekeepers.

Reply on news.ycombinator.com