Imagine you are a senior application security engineer at a financial services firm. You feed a snippet of internally de

Imagine you are a senior application security engineer at a financial services firm. You feed a snippet of internally developed authentication code into a frontier AI model and ask it to identify logic flaws. Instead of analysis, you receive a lecture. The model refuses on the grounds that you might use the information to “exploit a system.” You are not a criminal. You are the person hired to stop criminals. Yet the guardrail treats both roles as indistinguishable.

This scenario is becoming routine. As large AI labs tighten safety protocols to prevent malicious misuse, they are colliding head-on with the workflows of legitimate cybersecurity professionals. The result is a growing paradox: the very tools promoted as force multipliers for software engineering are being withheld from the specialists who protect critical infrastructure.

The Friction Between Safety and Security

Major AI developers have not ignored the cybersecurity community entirely. OpenAI runs a program called Trusted Access for Cyber. Anthropic operates a Cyber Verification Program. Both are designed to let vetted users bypass certain refusal mechanisms so they can conduct legitimate research. In theory, these gates separate the good actors from the bad.

In practice, many offensive security researchers and network defenders experience them as bureaucratic speed bumps. The verification processes can be opaque. Approval timelines are unclear. Even after acceptance, researchers report that the elevated access does not always function reliably across different model versions or conversation threads. For teams racing to patch vulnerabilities under active exploitation, that friction matters.

The tension between Washington and Silicon Valley reached a notable flashpoint when the U.S. government imposed export controls on Anthropic’s Mythos and Fable models. The restrictions followed reports that individuals had circumvented the models’ safety guardrails to facilitate cyberattacks. Regulators moved quickly to treat these systems as uniquely dangerous export commodities. The controls have since been lifted or modified, but the episode sent a clear signal: high-capability AI models are increasingly viewed as potential doomsday devices rather than general-purpose technical instruments. For the defenders who rely on them, that perception translates into heavier scrutiny, slower access, and an underlying suspicion that security research is merely hacking by another name.

Why Defense and Offense Are Inseparable

The heart of the conflict is not administrative. It is technical. The same capabilities required to defend a network are nearly identical to those required to attack it.

Chris Anley, Chief Scientist at NCC Group, uses a simple analogy: AI is a hammer. You can use it to build a house or to break a window. The tool itself does not know the difference. In cybersecurity, this duality is unavoidable. When a practitioner asks a model to “fix this code,” the request triggers a defensive action. But the reasoning process that produces the fix—identifying insecure functions, tracing untrusted input, mapping execution flows—inevitably reveals how the vulnerability can be triggered. The explanation serves as a roadmap for exploitation.

Because AI safety teams often train models to refuse any prompt that smells of exploitation, the systems frequently overcorrect. A researcher asking how to sanitize user input gets an answer. A researcher asking how a