オープンモデルとサイバーリスクについて、私は間違っていたのか？

Was I wrong about open models and cyber risks was published on Friday, October 30th, 2026. Last week coined the term Black October after an onslaught of critical vulnerability disclosures, including PHP to Shell and a longstanding GitLab bug, signified the moment when the cyber risks of AI models started to materialize. It seemed like the news cycle had stalled a bit when I started writing this, but then there was the news about another major crypto security incident at Binance. The crypto industry has a very long history of hacks, so it's not the best industry to indicate vulnerabilities translating into news as idle harm. Still, we are very much living through the implications of this movement. The best guess for what is happening in the cybersecurity space is that the behind-the-scenes work has only accelerated, bringing more people and resources in to try to patch the internet. The Wall Street Journal reported the cyber first responders are strained, which seems like the system working. We're living through this plot of an exponential rise in vulnerabilities, which will take a long time to level off at the top of the sigmoid.

Click through to see the image of the critical vulnerabilities disclosure tracker. A few weeks ago, before the rapid acceleration in vulnerability disclosures and the uptick in reported hacks, I wrote the following take. It's been getting a pretty consistent barrage of feedback, some hopeless dunk attempts, and some reasonable discussion, so on to unpack where I stand. Quote, further. If Claude Mythos was accidentally released as open weight, it seems like the world would have been more or less fine. Yes, there would be a clear increase in cybersecurity incidents, and it would be bad for a society if the model leaked, but it would be a scenario that

looks more like an acceleration than a step change in risk. The leading proponents of this new wave of open weight fear-mongering have effectively been making a falsifiable prediction, that the current open weight models are going to cause substantial, not seen before AI harms by crippling our cyber infrastructure Based on all the evidence I have which I unpacked above they set up to be wrong At least now after so many years of debating open risks we will start to get some real answers, end quote. To start the reflection, I wanted to do more due diligence and track down some receipts on the claims I made that the AI safety community was reacting as if open-weight mythos would be an actual disaster, not just a painful headache. This was distinctly my impression, having lived through the online discourse. I've gotten criticism that the frontier AI community never said it would be a quote true disaster, but regardless of exactly what they said, it is always about how people hear and internalize your information. Here are some examples of the sort of language that I felt was too exaggerated and from prominent people, which spilled into the

public and more importantly the federal government perspective that this was a cyber weapon include rob wiblin host of the 80 000 hours podcast on his own podcast quote if it fell into the hands of criminals or hostile state cyber actors it would be an actual disaster anthropic themselves in the project glass wing announcement blog quote given the rate of ai progress it will not be long before such capabilities proliferate potentially beyond actors who are committed to pulling them safely. The fallout for economics, public safety, and national security could be severe, end quote. For one that is actually more reasonable, to illustrate the fine lines between correct and exaggerated, from Deux V, who I don't agree with on a ton of things, quote, Claude Mythos would give the attackers a cornucopia of zero-day exploits for essentially all the software on earth. It would be chaos, end quote. To date, this chaos has been confined to those running large-scale digital products, which is good, but could change. I largely still stand by

my above writing a few weeks ago, but I'm nervous about it. I'm not a cyber expert. I'm working hard to make the most educated predictions I can. It's a fine line between all of our tech companies need to work extra hard to keep us secure and public infrastructure is actually going down. It is very clear as of writing this that there are way more critical vulnerabilities which are being found in popular tools and fixes are being built. For example, Epoc.ai recently published a nice post on their internal work using GLM 5.3 to try and find vulnerabilities and chain them into what could be an attack. The actual exploit they found in Firefox is a good example of why cyber risk needs multiple things to align for harm to be done Quote we use GLM 5 to create a website that simply when visiting a Firefox user simply when visited by a Firefox user and without further interaction gave the attacker the ability to exfiltrate files from the user's computer. End quote. Here the exploit is in Firefox. A would-be hacker needs to plant a website that is looking for this exploit. This is doable and could have

serious consequences, but just finding the exploit is only one step in a multi-stage process. In the previous post, I should have been more specific on what FINE is for the future of cybersecurity. And in this case, it means giving more credit to some of the AI safety community that discussed this reasonably as a new era in cyber instability. Reflecting on it, I'm not sure that FINE is the right word to describe what is inevitably coming, a forced industry update to a new way of working with software, which will clearly be expensive and accompanied by some hard work. If you're already somber about the challenges coming from AI, I think fine is actually very suitable. If you don't price in a period of turbulence, fine undersells. I've written many times that I am in the former, difficulty will come, group, but I think humans are good at muddling through problems and patching immediate concerns. What my view was closer to is that open models are providing balance in the offense-defense equation, and that mythos coming sooner wouldn't have massively upended this. I suspect most of these companies would be faster to adopt open

weight models than attackers, as most attackers are lower resourced than these companies. A key needle we're watching is the balance on how willing attackers are to cause physical harm within the U.S. and its allies. For now, while our adversaries have likely used these models and exploits to extract information en masse in a clandestine way, it is not clear if there is a party who will cause mass harm by pushing the full force of these models at public institutions. I thought this tweet was a funny way to summarize some of the personnel motive gaps in hacking. Quote, life is a lot easier once you stop seeing threat actors as hackers who want to break into systems by any means possible and start seeing them as businesses with well-defined business processes. A bakery isn't going to start making dog food because there's a dog food shortage. ClickFix and phishing attack actors aren't going to drop everything to VibeCode exploits just because a critical CBE came out. The fact that the only actors exploiting this area are actors who MO is exploiting things isn a coincidence It entirely predictable if you understand threat actor behavior end quote Where I sit I expect

most of these vulnerabilities are being found by closed models, and I have very high error bars on this prediction. A lot hinges on how open models are actually being used in the near term. Today, open models are expensive to serve and the compute to serve the largest models is extremely sold out. In the long term, I am very confident that margins and prices on open models will be driven down, as computing supply grows abundant, but in the near term, the closed models are definitely more price effective. Many of my positions are making sure that we get to this future, as otherwise a few companies are building the tools that produce some of software with vulnerabilities, and also selling the tools to fix said software. For now, we're working through the backlog of cyber vulnerabilities as we transition from the human-focused Internet to closed silos of human activity mediated by agents. All of this, I think, is way more about AI's capabilities and diffusion generally than anything about open versus closed models. In fact, I feel like in reading more cybersecurity-oriented discourse that they focus much more on the ecosystem perspective, how the rate of exploits and overall damages from cyber has been growing since long before Chachiputi, and how these recent events are on trend.

It's just that trend line was exponential. An example plot of this trend is below from Joshua Sachs. These are the sort of ecosystem level plots which can be very clear if AI's capabilities in diffusion is the bottleneck on cyber attacks. Click through to see a plot which shows a steady increase in cyber damages over time with a small attribution to AI. When talking to people who are close to the AI community, especially AI safety, I find a lot of effort going into figuring out if open models are to blame, which we still have extremely low evidence for. Closed models have played a very heavy part in recent hacks, at least more than open models have. Cyber is a really societal problem, one which AI companies cannot solve alone. Effort needs to be spent at this higher level of abstraction. This is the first of many risks and transitions we'll need to manage with AI, none of which can be easily solved solely by the San Francisco-centric tech industry. Thanks to Seb Cryer for feedback on this post, and have a great day.

If you're interested in sharing interconnects with your team, I offer tiered discounts for group subscriptions. Please reach out and email me if you are interested.