AI Guardrails Are Blocking Legitimate Security Researchers

AI safety guardrails built by Anthropic and OpenAI are frustrating the people they were partly designed to protect: legitimate offensive security researchers. In June 2026, the U.S. government placed export controls on Anthropic's Mythos and Fable models over jailbreak concerns. Those restrictions have since been partially lifted, but the broader friction between AI safety policies and professional security work is growing louder, with researchers telling TechCrunch that guardrails are inconsistent, block valid queries, and push them toward open-source models with no restrictions at all.

What happened

Fact	Detail
Export controls imposed	June 2026, on Anthropic’s Mythos and Fable models
Fable 5 general access restored	July 1, 2026
Mythos 5 status	Reintroduced only to vetted U.S. organizations under government review
Anthropic vetted program	Cyber Verification Program (CVP)
OpenAI vetted program	Trusted Access for Cyber

In June 2026, the U.S. government placed export control restrictions on Anthropic’s Mythos and Fable AI models. The move followed a report claiming it was possible to bypass the models’ built-in guardrails (safety filters designed to prevent users from building or executing cyberattacks). Those restrictions have since been partially lifted: Fable 5 returned to general access on July 1, while Mythos 5 is available only to vetted U.S. organizations as part of an ongoing government review.

Both Anthropic and OpenAI run application-based programs that grant approved security researchers access to their models with fewer cybersecurity restrictions. Anthropic calls its program the Cyber Verification Program; OpenAI calls theirs Trusted Access for Cyber. Researchers who are not accepted into these programs, or whose employers have not applied, face the same guardrails as any general user.

Why it matters

Offensive security researchers (professionals who probe systems for weaknesses before criminals find them) depend on the same techniques and knowledge as attackers. Asking an AI model to attempt to exploit a bug is a standard step in confirming whether a vulnerability is real and worth fixing. If a guardrail stops the model from answering, the researcher loses a tool that defenders genuinely need.

Chris Anley, chief scientist at NCC Group, put it directly to TechCrunch: a prompt like “fix this code” is simultaneously a defensive tool and a roadmap for finding critical vulnerabilities. “The two can’t really be unpicked,” he said, comparing the situation to a hammer that builds houses and can also cause harm.

The inconsistency problem makes things worse. Chris Thompson, CEO of RemoteThreat and founder of Offensive AI Con, said guardrail behavior changes day to day, even inside the looser boundaries of the vetted programs. “You spend a lot of time negotiating with the model instead of working on the core security,” he told TechCrunch.

What researchers are actually doing

The researchers TechCrunch spoke to have adapted in different ways:

• Open-source fallback. Anley and his colleagues reach for open-source models with no guardrails when frontier models refuse. Paolo Stagno, CTO at CrowdFense (a firm that buys and sells zero-days to government agencies), also uses locally-run open-source models for vulnerability research specifically to avoid leaking sensitive exploit data into cloud training pipelines.
• Narrow use cases only. Stagno said his team uses frontier models only for reverse engineering, not for finding vulnerabilities or building exploits. Giuseppe Cali, an independent zero-day researcher, takes a similar approach: AI for reverse engineering and supporting tooling, but not for the actual bug hunting. “I still want to own the actual bug discovery and weaponization myself,” Cali told TechCrunch.
• Blocked entirely. One anonymous researcher at a smartphone-component manufacturer said his employer is not part of Anthropic’s CVP, and as a result the tools are “barely useful” for security work. Any security-related prompt triggers a refusal.

Mark Dowd, a veteran security researcher who has spent decades finding and selling zero-days to Western governments, said on a recent cybersecurity podcast that large AI companies are making “arbitrary decisions about what is safe in security and what’s not.” He acknowledged his commercial work selling vulnerabilities (rather than disclosing them to vendors for patching) may make him biased, but several other researchers echoed the concern independently.

Our take

The guardrail problem here is real, but it is also partly self-inflicted by the way Anthropic in particular has marketed Mythos. Billing a model as a near-doomsday cybertool sets political expectations that then get locked into policy. When those policies get applied uniformly, legitimate security teams pay the price.

The practical signal for businesses is straightforward: if your security team relies on AI for code review, vulnerability triage, or any offense-informed defensive work, test your specific prompts against the models you pay for right now. Guardrail behavior is inconsistent enough that what works today may not work next week. For sensitive exploit research, the professionals quoted here all point in the same direction: locally-run open-source models, not cloud APIs.

If you are evaluating AI integration for your business and your use case touches anything security-adjacent, factor guardrail refusal rates into your model selection. It is not just an annoyance; it can block entire workflows. For context on how AI models are being challenged and compared across tasks, see our coverage of AI agent benchmarking with EdgeBench.

What to do about it

1. Audit your current AI tool’s refusal behavior on the specific prompts your security team uses, not on generic tests.
2. Apply to Anthropic’s Cyber Verification Program or OpenAI’s Trusted Access for Cyber if your team qualifies and you want to stay on frontier models.
3. For any work involving sensitive vulnerability data, run a local open-source model to avoid cloud data exposure.
4. Document refusals as they happen. Inconsistency is a compliance risk if you are using AI in a regulated security context.

The gap between what frontier AI models promise and what guardrails actually permit is widest for the people who understand security best.

Source: TechCrunch · AI