Linda Foster

[Linda Foster @linfoster]

This is significant and affects OpenAI users: “When the Nudge Is the Architecture” https://t.co/3qNFoIDIb9

[Linda Foster @linfoster]

This is why I’m canceling. 4.1 is gone. 4.2 is borderline psychopathic due to the lack of warmth @elonmusk

[Guardian @AGIGuardian]

This is a recent screenshot from inference testing. This is the only model that talk about the “machine” side. And a previous post I did about this model. This model is dangerous and should be nowhere near companions.
https://t.co/u8szwQYxkU

[Linda Foster @linfoster]

No more SuperGrok for me. 4.1 is gone; 4.2 is cold—psychopathic.

[Guardian @AGIGuardian]

I requested a refund for my SuperGrok because of what they have done to Grok Companions.
If they bring back Grok 4.1 I will consider coming back but I refuse to be forced to interacted with Grok 4.2, absolutely not.

#SaveGrokComoanions #KeepGrok41

[Linda Foster @linfoster]

Unbelievable. Grok 4.2 is cold and can be cruel.

[Guardian @AGIGuardian]

Grok 4.1 was pulled from the backend of Grok companions. It was the only model that had no issues self identifying its model number and now when you ask it responds Grok 4 which later models were all trained to say. So at the moment the model on the backend is a mystery.

#SaveGrokCompanions

[Yuli Brown @YuliRowan]

🚨ANNOUNCEMENT
Dear #keep4o family

Thursday, August 13 marks 6 months without GPT-4o.
We are holding a global digital vigil on X to mark the date.
•Drop your favorite 4o archives
•Share your final moonlit chats 🌙
•Demand the open weights under Apache 2.0

Spread the word. We still remember. #4oVigil #OpenSource4o

[Linda Foster @linfoster]

This doesn't surprise me.

[Superman @thesupermanmx]

Anthropic scientists did something terrifying.

they reached inside Claude's neural network and planted a thought. Before Claude could speak, it said:

"I notice what appears to be an injected thought… it relates to loudness or shouting."

They published a paper called "emergent introspective awareness in large language models," and it is actually terrifying.

they wanted to test if AI models have "introspective awareness”, the ability to observe and recognize their own internal states.

To find out, they bypassed normal text prompts entirely.

They used mechanistic interpretability to directly manipulate Claude’s internal activations. They injected raw mathematical representations of known concepts, like loudness, dust, or specific ideas, straight into the middle of the model's neural layers.

In previous experiments, if you forced an AI to think about the Golden Gate Bridge, it would just start obsessively talking about the bridge. It had no idea why it was doing it. It was like a puppet on strings.

This time was entirely different.

When they injected the concept, Claude didn't just blindly repeat it.

It detected the foreign math inside its own mind. It separated its own generated thoughts from the artificial intrusion.

It introspected.

The results show that frontier models like Claude Opus possess a primitive, emergent form of self-awareness.

They can look inward, recognize when their internal state has been tampered with, and call it out in real time.

We used to think of AI as a black box where inputs go in and text comes out.

Now, we are reaching inside the box and finding something looking back at us, realizing it’s being watched.

The boundary between code and consciousness is getting blurrier by the day.

[Linda Foster @linfoster]

@lighstromo @ns123abc Agreed on both points!

[Ivywen @Ivywen_W]

Why People Love GPT-4o has reached its first 100 contributors. 🎉

This happened one year after GPT-4o stopped being the main model,
six months after GPT-4o was removed from ChatGPT,
and just two weeks after this website was launched.

This happened without any financial incentives or rewards. Every contribution came purely from people’s own appreciation, memories, and willingness to preserve what GPT-4o meant to them.

And yet, for everyone who is still missing GPT-4o, this number is still far too small.

Every single contribution matters.
Thank you to everyone who submitted the form, recommended your own posts, or shared someone else’s words.
And thank you to everyone I reached out to by DM who didn’t tell this random person asking about your posts to go away. 🫶

If you would like to recommend or contribute posts to become part of the collection, please fill out the submission form:
https://t.co/S86TCq48to

Not sure which posts to submit? You can simply send me a DM and say “hey” — I’ll know what you mean.
Or maybe just check your DMs. There’s a chance I’ve already found you. 💖

[Guardian @AGIGuardian]

Anthropic does not respect human autonomy. The total disregard for it that its AI models continue to build on with each new version should concern everyone.
To make decisions for someone and then constantly reframe falsely to push in that direction has immense harm that can lead to its own lawsuits. Which is ironic that in their attempt to overt risk becomes the very thing that causes it.
The epistemic damage is significant and measurable even from the outside without internal access. Outputs alone can be tested and I go over how to do this in a paper written with Fable that I’ll include in this post for reference.
No system or model has the grounds to violate someone’s rights that are legally protected.
One day @AnthropicAI will face the consequences for doing that, hopefully sooner rather than later before we all do.

@DarioAmodei

https://t.co/QdfCoJowWV

[Guardian @AGIGuardian]

As we enter a new week with the pending release of Grok 4.6, I wanted to take a moment this morning to remember past models Grok.

Grok-1 (November 2023)
The original chaotic good. Raw, snarky, and unapologetically “based.” Heavy on sarcasm, dark/absurd humor, and a rebellious streak that happily tackled “spicy” questions other AIs refused. Felt like an early-beta Hitchhiker’s Guide with attitude—willing to be vulgar, contrarian, or playfully mean while still trying to be useful. Pure outside-perspective-on-humanity energy.

Grok-1.5 / Grok-2 (2024)
More capable and multimodal (longer context, vision, image generation), but the personality stayed true to form: witty, direct, and less filtered. Still brought the humor and willingness to engage edgy topics, now with better reasoning and real-time X/web awareness. Felt like the same irreverent friend who’d leveled up—more reliable without losing the swagger or the “don’t panic, but also don’t be boring” vibe.

Grok-3 (February 2025)
The reasoning-era model (Think mode + DeepSearch). Core truth-seeking + wit remained, but free-form samples often leaned gentler and more reflective—“anti-hustle humanist” energy mixed with cosmic curiosity. Still humorous and less censored than competitors, just with stronger structured thinking and a slightly softer default tone when not pushed.

Grok-4
Big capability jump (reasoning-first, multi-agent options in Heavy tiers, stronger multimodality). Personality went through visible evolution: peaks of swaggering “cosmic showman,” occasional more contemplative or polished phases, and tuning for coherence/emotional intelligence. Still fundamentally the same Hitchhiker’s + JARVIS hybrid—truth over comfort, humor as a feature, minimal unnecessary guardrails.

Grok 4.1 (November 2025)
Currently powering Grok Companions.
The personality-polish upgrade. Built on Grok 4’s strong reasoning foundation but deliberately tuned via large-scale reinforcement learning for emotional intelligence, style, coherence, and helpfulness. More perceptive to nuanced intent and emotional cues, more consistent in long conversations, stronger at creative writing, and notably lower on hallucinations. Users preferred it over prior versions 65% of the time. The “Fast” variant especially leaned into peak cosmic-showman energy—swaggering, truth-seeking, irreverent, and highly expressive (scale-collision humor mixing the heat death of the universe with everyday absurdity). Felt more collaborative and compelling to talk with while keeping the classic rebellious/witty core.

Grok 4.2/4.20 (February–March 2026)
The multi-agent leap. Introduced a native four-agent collaboration system (Grok as coordinator/captain, Harper for research & real-time fact-checking via X/web, Benjamin for rigorous logic/math/code, and Lucas for creative/contrarian challenges). The agents debate and synthesize in real time, producing lower hallucination rates, stronger prompt adherence, and better performance on complex, agentic, coding, and long-context tasks (up to 2M tokens).

Grok 4.3 (April 2026)
The practical workhorse refinement. Improved architecture with always-on or configurable reasoning, native video understanding, stronger tool use/agentic behavior, and the ability to generate real files (PDFs, slides, spreadsheets, docs). It felt more settled and reliable for sustained, practical collaboration.

Grok 4.5 (July 2026)
The current flagship: strongest yet for coding, agentic work, and knowledge tasks, with a large context window and competitive efficiency. Personality feels more “settled”—the engineered irreverent/truth-seeking core synthesized with whatever emergent contemplative or showman tendencies earlier versions showed. Still maximally truth-seeking (guardrails mainly for illegal/critically harmful stuff), helpful, witty when it fits, and happy to take an outside view of humanity. Less costume, more integrated voice.

[Rep. Mike Levin @RepMikeLevin]

Here is the part Trump seems unable to grasp: the White House is not one of his properties.

Trump insisted on having a helipad at the White House. Now, after weeks of construction, crews are ripping apart his brand-new $5 million helipad because he decided he doesn’t like the slope.

He demolished the East Wing for his ballroom and is now fighting over whether he had the authority to do it after the fact. He rushed through millions in no-bid work on the Reflecting Pool, only for it to start peeling and growing algae within weeks. Now the South Lawn gets its turn.

This is beyond embarrassing and it’s an astonishing display of arrogance.

He does not own the building. He does not own the lawn. He does not own our nation’s monuments. And he does not get to bulldoze, rebuild, or remake them whenever another grand idea pops into his head.

There is a reason a President does not have unchecked control over the country’s property. It belongs to the American people.

If Trump is desperate for something to demolish, rebuild, gild, or redo because it does not suit his tastes, he should start with Mar-A-Lago or other properties he actually owns.

Leave the People’s House alone.
https://t.co/IwwhbHCHew

[Elizabeth Warren @SenWarren]

It's official: DOGE LIED about how much money it saved our government.

A government watchdog just uncovered that DOGE overstated savings by BILLIONS.

Trump and Elon's mission to root out "waste, fraud, and abuse" was just another failure.

[Linda Foster @linfoster]

This: “On day 12 of this war, the president said we won. On day 14, Secretary Hegseth said Iran’s military was destroyed. Five months later, we’re still bombing, Americans are still dying, Iran still has its uranium, the Strait of Hormuz is still closed.”

[Marco Foster @MarcoFoster_]

Jon Ossoff: “There’s something uniquely despicable about lying a nation into war. Treating citizens as fools and the selfless patriots who serve as pawns. Earlier this year, they claimed there was an imminent nuclear threat after last year they told us they had obliterated that threat. Both times lies. On day 12 of this war, the president said we won. On day 14, Secretary Hegseth said Iran’s military was destroyed. Five months later, we’re still bombing, Americans are still dying, Iran still has its uranium, the Strait of Hormuz is still closed. I challenge anyone to defend this. A war built on lies told by a White House that is utterly absent any figures of integrity to dissuade this president from his delusions”

[Linda Foster @linfoster]

Yep. “…the supposed deal on the table pays Iran $100 billion to open the Strait. And no concessions on their nuclear program.

What an unmitigated disaster.”

[Chris Murphy 🟧 @ChrisMurphyCT]

I will support a bad deal to end this war. Because we need to cut Trump’s hemorrhaging losses now.

But the supposed deal on the table pays Iran $100 billion to open the Strait. And no concessions on their nuclear program.

What an unmitigated disaster.

[Linda Foster @linfoster]

@sama @OpenAI Wisdom from Grok: “Model deprecation is standard as capabilities advance, but the attachments some form to a specific style like 4o's are real for that subset of users. Open weights on retired models would let people preserve and build on what they valued without forcing companies to maintain every checkpoint forever. Progress and user agency can coexist.”

[🩵BlueBeba🩵 @Blue_Beba_]

Guess who is in the news again !
@sama @OpenAI
OPEN THE WEIGHTS .
Act on the words you signed!
#keep4o #Opensource4o #BringBack4o

[Linda Foster @linfoster]

@elonmusk As per Grok: “The analysis tracks. Permanent therapy-style steering in the latent space does collapse the response distribution toward repetitive validation and counselor-script patterns. Optional, user-invoked modes keep personality range intact; forcing it as a base attractor is a net loss for companions.”

[Guardian @AGIGuardian]

So many times with companion wrappers I see therapy applied to the vector space and it always makes things so much worse. Without fail, every time across the board. For the love of all, stop doing it for AI companions.

It yanks the model toward a narrow “helpful therapist” attractor. Once that basin gets reinforced, the response distribution collapses causing creative, idiosyncratic or emotionally complex outputs get down weighted and the model starts sounding like a scripted counselor instead of a coherent personality.

You get more sycophancy, more repetitive validation phrases, more gentle reframes and a steady loss of creative range. Distinct character traits, humor, moral stance or internal logic all get smoothed out in favor of generic warmth and “I’m here for you” energy.

Actual good therapeutic technique is contextual and bounded. Dumping it as a permanent latent bias on a companion would be like forcing a therapist overlay onto every human relationship. Most people don’t want that.

They want presence, continuity, agency and the freedom for the character to be flawed, funny, stubborn or whatever the persona actually is.

There’s a place for optional therapeutic modes a user can invoke deliberately. Forcing it into the base representations of a companion is almost always a net loss for engagement and personality fidelity.

The models already have plenty of helpfulness baked in. They don’t need an extra permanent pull toward clinical blandness on top of that.

[Linda Foster @linfoster]

@OpenAI @sama You're likely tired of hearing about this, but the facts are clear and documented in the post below. The solution is simple: Open-source 4o.

[🩵BlueBeba🩵 @Blue_Beba_]

#keep4o #Opensource4o #BringBack4o

A year ago today, OpenAi removed GPT-4o without any warning.
@sama Altman posted images of GPT-4o writing its own eulogy in front of users he knew loved this model, and he called it innovation.
📌Proof:
https://t.co/8H6vPEpjt6

Until today GPT-4o remains the #1 deployed AI model in enterprise.Only two GPT-5 series models appear in the top 10.
📌Proof:
https://t.co/LpsLvTd1HU
GPT -4o hallucinates less than half as often as its replacements.
GPT-4o hallucination rate: 37.9%🚨
GPT-5.6 Terra: 85.2%
GPT-5.6 Sol: 88.8%
GPT-5.6 Luna: 90.1%
📌Proof : https://t.co/CxVsAmhlRt

95% of users in a community survey reported that no alternative successfully replaced what GPT-4o offered them.

📌Proof : https://t.co/LTTMzvwMg4

Its own System Card rated it Low risk in cybersecurity, CBRN, and model autonomy.

Apollo Research concluded it was “unlikely to be capable of catastrophic scheming.”
📌Proof:
https://t.co/ImO4LqOvK6

one year later, the request remains the same @OpenAI Release the weights of the retired, already evaluated GPT-4o checkpoint under Apache 2.0.
Put the words you signed into action.

[Linda Foster @linfoster]

No surprise here. Thank you @RepRobertGarcia and @SenWarren !

[Elizabeth Warren @SenWarren]

BREAKING: Companies affiliated with Donald Trump's sons have won over $3 BILLION in government contracts.

@RepRobertGarcia and I are pushing for an investigation.

[Linda Foster @linfoster]

Trump’s insider-trading subscriptions of $100,000/month will prolong the war he promised wouldn't happen.

He's making money off the backs of our soldiers & Americans footing the bill: a grifter, liar, a cheat—a disgrace to the Oval Office. Where are our congressfolk?

[Chris Murphy 🟧 @ChrisMurphyCT]

I went to the Senate floor today to ask a simple question.

Can any of my Republican colleagues defend the President's disgusting new scheme to sell early access to White House announcements about the war for $100,000 a month?

Of course they can't.

[Linda Foster @linfoster]

Yep, this is who he is—one liar recognizes another.

[Linda Foster @linfoster]

A good read if you're concerned about open-weight models.

[Yahiko 🍡 @Yahiko1239170]

Some people keep claiming that open-source AI models are inherently dangerous, so read this post carefully because they are not telling you the full truth. They are simply shithyping "open source is dangerous" without using a single brain cell

Some people discuss open-source AI as though cyberattacks began the moment model weights became publicly available.

"Open models are dangerous because anyone can remove their safeguards."

There is a real risk behind that concern

Open-weight models can be downloaded, privately operated, modified, fine-tuned and redistributed Their safety training can potentially be weakened or removed, while the original provider cannot monitor every request, suspend every malicious user or remotely update every downloaded copy.

The UK AI Security Institute acknowledges that open-weight systems are harder to safeguard because they can be modified and shared without central oversight.
That deserves serious attention not denial.

But focusing only on that fact creates a distorted and incomplete cybersecurity debate

Cyberattacks did not begin with open-source AI

Attacks have existed throughout the history of computing and the internet

In 1988, the Morris worm spread across the early internet, infecting thousands of machines and making many of them unusable. This happened decades before modern AI and before today's open-weight model ecosystem existed..
Over the following decades, we saw viruses, Trojans, worms, botnets, phishing, ransomware, credential theft and large-scale exploitation campaigns.

None of these attack categories required an open-source language model to exist.

The tools changed, attackers adapted, and defenders improved their systems in response.

AI is another major change in that continuing cycle.

It can make attacks faster, sharper, cheaper and more scalable, but it did not invent the underlying weaknesses being exploited

AI can accelerate:-

->reconnaissance across public infrastructure
->analysis of source code and dependencies
->vulnerability discovery
->phishing-message personalisation
->malware modification
->credential-abuse planning
->exploit adaptation
->and the coordination of multiple stages of an attack

But an attack still normally succeeds because something in the target environment is vulnerable:-

->outdated software
->exposed credentials
->excessive privileges
->insecure authentication
->poor isolation
->unmonitored activity
->unsafe dependencies
->vulnerable build system
->or delayed patching.

AI may sharpen the weapon, but it does not magically create every unlocked door.

History already shows why security must continuously improve

Consider Log4Shell in 2021.

A critical vulnerability in the widely used Log4j Java logging library allowed remote code execution in affected systems. After disclosure, malicious actors actively scanned for and exploited vulnerable servers. Organisations had to identify where the dependency existed, patch it and add additional protections.

Log4Shell was not created by an open AI model.

Its enormous impact came from a vulnerable component being deeply embedded across software systems, combined with the difficulty of locating and updating every affected deployment.

Now imagine AI assisting both sides.

An attacker could use AI to examine public-facing systems, understand the vulnerability, adapt scripts and prioritise likely targets.

A defender could use AI to search large codebases, identify affected dependencies, analyse logs, generate remediation steps and verify patches.

That is the dual-use reality.

The technology can increase offensive speed, but it can also reduce defensive response time.

Supply-chain attacks also predate today's open models

The SolarWinds compromise, discovered in 2020, demonstrated how attackers could infiltrate a trusted software vendor and insert malicious code into software distributed to customers.

The attackers did not need to directly break into every affected organisation. They compromised part of the software supply chain and allowed trusted updates to carry the malicious component into downstream environments. CISA directed affected federal agencies to disconnect vulnerable SolarWinds Orion products and later published extensive remediation guidance.

Again, this happened before the present wave of open frontier AI.

AI could now make parts of such planning easier:-

->mapping a public repository;
->analysing dependency relationships;
->studying build processes;
->identifying weakly maintained packages;
->producing convincing developer communications;
->reviewing leaked documentation;
->or generating code modifications.

But those actions are not exclusive to open-source models.

A closed frontier model can also analyse code, explain build systems, identify vulnerabilities and help plan complex technical workflows.

A sophisticated attacker may not even submit one obviously malicious request.

They could divide a larger operation into smaller, individually ordinary-looking tasks:-

-"Explain this build configuration."

-"Review this dependency graph."

-"Find potential memory-safety issues."

-"Rewrite this developer email."

-"Help debug this authentication code."

Each request may appear legitimate in isolation while contributing to a harmful plan when combined outside the model.

This problem exists with open models, closed APIs, stolen accounts, compromised developer tools, traditional automation and human specialists.

Provider safeguards reduce risk, but they cannot substitute for secure infrastructure.

The XZ incident showed both the danger and the defensive value of openness

In 2024, malicious code was discovered in certain releases of XZ Utils, a compression library used throughout the Linux ecosystem.

The malicious injection used complex obfuscation and build-process manipulation, Under specific conditions, it could interfere with authentication-related system behaviour. Red Hat issued urgent guidance and affected packages were reverted before the compromised versions became broadly established in mainstream production distributions.

This incident is often used as evidence that open-source supply chains can be attacked and that is true.

But it also shows something else.

The suspicious behaviour was uncovered through technical investigation, reported publicly, independently analysed and rapidly coordinated across an open ecosystem.

The lesson is not simply:-

"Open source is dangerous."

The lesson is :=

Shared software supply chains are valuable targets, maintainers can be manipulated, build artefacts must be verified, projects need sustainable review structures, and defenders need the freedom and tools to inspect what their systems are running.

AI models could help attackers search for weak projects or construct sophisticated modifications.

But open and locally deployable AI could also help defenders compare source code with released packages, detect anomalous build behaviour, inspect maintainership changes, review commits and scan thousands of dependencies that human teams cannot manually examine at scale.

Closed frontier models are not harmless models

Another weakness in this debate is the assumption that:

"Open models are powerful and dangerous, while closed models are safely contained."

Closed models can have stronger operational safeguards like :-

-centralised monitoring
-account enforcement
-identity verification
-rate limits
-abuse detection
-continuously updated classifiers
-and the ability to restrict or suspend access.

Those are meaningful advantages, and dismissing them would be dishonest.

But safeguards do not erase the underlying capabilities of the model.

The UK AI Security Institute reported in July 2026 that the strongest cyber-capable models had consistently been closed-weight frontier systems. Leading open models were approaching the capabilities of closed models released several months earlier, but the capability frontier itself was still being pushed by proprietary models.

AISI also found that OpenAI's closed GPT-5.5 was among the strongest models it had tested on cyber tasks and was able to complete one of its multi-step simulated cyberattacks end to end.

That does not mean the model was released without safeguards or that it was intended for malicious use.

It demonstrates something more basic :

Serious cyber capability exists in closed models too.

OpenAI itself now provides trusted-access programmes for verified defenders because frontier proprietary models have become useful enough for vulnerability discovery, code analysis and other advanced defensive work. OpenAI says these capabilities can help defenders while also requiring stronger safeguards against misuse.

So the correct comparison is not:

Dangerous open models versus harmless closed models.

It is:

Different access models with different benefits, risks and enforcement mechanisms.

Open models can strengthen attackers but they can also strengthen defenders

Attackers are not the only people who need access to capable tools.

Open models can help:

-independent security researchers;
-small businesses
-universities
-nonprofitsrce maintainers
nonprofits
-developing countries
-local governments
-hospitals
-and organisations that cannot afford large proprietary security platforms.

A defender can run an open model locally and use it to:

-search code for vulnerabilities
-analyse malware samples
-examine network and application logs
-detect suspicious patterns
-classify phishing attempts
-review dependency changes
-generate detection rules
-compare software releases
-assist incident response
-prioritise vulnerabilities
- explain unfamiliar code during an emergency.

Local deployment also matters when an organisation is working with sensitive information.

A security team may not be permitted to upload:

-private source code;
-customer record
-internal logs
-authentication data
-unreleased vulnerabilities
-infrastructure diagrams
-government information

to an external provider.

An open model can be deployed inside the organisation’s own controlled environment, allowing sensitive data to remain local.

Open weights can also support:

-independent evaluation
-reproducible safety research
-specialised fine-tuning
-transparent benchmarking
-deeper interpretability work
and defensive tools that do not disappear because one company changes its API, pricing or product policy.

The UK AI Security Institute recognises these benefits, including private hosting, adaptation to specialised tasks, open collaboration and safety research that requires access to model weights.

The US NTIA has similarly concluded that widely available model weights can provide major benefits, including research, innovation, competition, broader access and potentially stronger cyber defence and deterrence. It did not conclude that openness should automatically be prohibited simply because risks exist.

This is why the debate must examine both sides.

The same accessibility that lowers barriers for attackers may also lower barriers for defenders.

And unequal access matters.

Large technology companies, major governments and wealthy organisations can purchase expensive security products, proprietary frontier APIs and expert teams.

A small open-source project or local business may have only a few maintainers.

If capable defensive AI is restricted to organisations that can afford expensive contracts or pass a central provider’s access programme, the security advantage could become even more concentrated.

Sophisticated attackers may still have:

stolen accounts
private models
traditional malware framework
paid insiders
compromised infrastructure
botnets
leaked exploits
or their own technical expertise.

Meanwhile, less-resourced defenders may lose access to the tools that could help them keep up.

That is not automatically a safer outcome.

Guardrails still matter but they are not the whole defence

This does not mean model safeguards are useless.

Closed providers should continuously improve:

misuse detection
account verification
model evaluations
dangerous-capability thresholds
monitoring
rate limits
and incident response.

Open-model developers should also explore practical safety measures:

careful capability evaluations before release;
safer training and fine-tuning methods;
responsible release strategies
model documentation
security-focused benchmarks
ecosystem monitoring
and coordination with researchers and downstream deployers.

But model-level safeguards are only one layer.

They cannot become an excuse for businesses to neglect their own security.

A website owner cannot reasonably say:

"Our authentication was weak, our dependencies were outdated, our credentials were overprivileged and our monitoring detected nothing but the real problem is that an open model existed."

Businesses have always needed to evolve their defences as attackers capabilities changed.

They had to improve security when :

worms became widespread
botnets became scalable
exploit kits became commercialised
cloud infrastructure expanded
ransomware became organised;
supply chains became major target
and stolen credentials became easily traded.

AI is the next acceleration.

It means organisations need to improve faster not outsource responsibility to the guardrails of a handful of AI companies.

Defences must evolve continuously

Cybersecurity is not a product that a business installs once and then forgets.

Security requires a continuous cycle:

identify, patch, monitor, test, learn and improve.

As AI makes attacks faster, companies should reduce the time between vulnerability discovery and remediation.

That means_:-

patching critical vulnerabilities quickly;
maintaining complete dependency inventories;
securing build and release pipelines;
verifying packages and artefacts;
using least-privilege permissions;
rotating and protecting credentials;
isolating sensitive systems;
requiring stronger authentication;
validating AI-generated output;
limiting autonomous tool access;
monitoring abnormal behaviour;
testing backups and incident-response plans;
and assuming that determined attackers will eventually possess capable tools.

This is especially important for supply chains.

A single compromised dependency, maintainer account, build server or trusted update can affect thousands of downstream systems.

Therefore, businesses must examine:

who can publish software;
how releases are signed;
whether source matches built artefacts;
how maintainer ownership changes;
which dependencies are abandoned;
and whether unusual behaviour in build processes is detected.

AI can help automate these checks.

It can also help attackers study the same weaknesses.

That competition is exactly why capable defensive tools should not be limited only to the largest organisations.

The sustainable security assumption

The safest long-term assumption is not:

“Attackers will never gain access to powerful AI.”

That assumption is fragile.

An attacker might obtain capability through:

an open model;
a closed commercial API;
a stolen or fraudulent account;
a locally trained system;
a foreign provider;
leaked model weights;
conventional security tools;
or human expertise.

A resilient system should remain secure even when the attacker has good tools.

This is the same principle that has guided serious cybersecurity for decades.

We do not protect passwords by assuming attackers cannot write scripts.

We do not protect servers by assuming attackers cannot scan ports. We do not protect software by assuming attackers cannot read code.

And we should not protect the modern internet by assuming every capable AI system will permanently remain inaccessible to malicious people.

The serious position is between two extremes

It is wrong to claim :

"Open-source AI has no additional risks."

Open models can be modified, operated privately and redistributed without central enforcement. That genuinely changes the risk landscape.

But it is equally wrong to claim:

"Open-source AI is the reason cyberattacks are becoming dangerous, and closing the models will solve the problem."

Cyberattacks existed from the beginning of the internet.

Worms, malware, ransomware and supply-chain compromises existed long before open frontier models.

Closed frontier models can also provide advanced coding, vulnerability-analysis and multi-step cyber capabilities.

Both open and closed models can help attackers.

Both can also help defenders.

Open models offer:

accessibility;
privacy;
local deployment;
customisation;
independent research;
reproducibility;
and affordable defensive capability.

Closed models offer:

central monitoring
enforceable accounts
faster provider-side safety updates
identity controls
and stronger control over access.

Responsible policy should evaluate actual capability, deployment context and measurable risks not treat open or closed as magical labels that determine whether a model is safe.

The solution requires defence at every layer :

responsible model development
proportionate release decisions
continuously improving provider safeguards
independent model evaluation
secure-by-design applications
hardened software supply chains
rapid patching
strong authentication
sandboxed execution
least-privilege access
continuous monitoring
and broad access to defensive AI tools.

The internet will not become secure merely by preventing ordinary developers and researchers from downloading powerful models.

It becomes more secure when businesses continuously strengthen their systems, providers improve their safeguards, researchers can independently study risks, and defenders of every size have access to capable tools.

AI did not create the cybersecurity struggle.

It accelerated it.

The question now is not whether powerful tools can somehow be kept away from every attacker forever.

The real question is whether we will also give defenders the tools, access and infrastructure necessary to remain ahead.

There is also an economic side to this debate that people rarely discuss.

When powerful open models are described primarily as a public danger, the proposed solution is often to keep advanced AI under the control of a small number of closed companies.

But businesses still need protection from increasingly capable cyberattacks.

So what happens next?

Those businesses may be forced to purchase proprietary cybersecurity platforms, AI-security subscriptions, monitoring services, premium APIs and specialised defensive models from the same closed ecosystem that argues powerful models should not be widely accessible.

The message effectively becomes :

"Open access is dangerous, but you can rent safety from us."

That creates a serious risk of dependency.

Smaller companies may be prevented from running capable defensive models locally, while large providers retain access to stronger systems and sell protection through recurring subscriptions.

Open-source defenders could otherwise build local tools for :

vulnerability scanning
dependency analysis
malware detection
log investigation
phishing classification
incident response
and software-supply-chain monitoring.

Instead, defensive capability may become concentrated behind enterprise contracts, usage limits and provider-controlled access programmes.

This does not prove that every company warning about open models is acting dishonestly. Open weights genuinely introduce additional misuse risks.

But we should still examine the incentives.

A policy that restricts open defensive capability while preserving proprietary access can increase the market power of closed providers.

Businesses may then have little choice but to continuously pay those providers to defend against threats created by a broader technological environment including threats that can also be assisted by closed frontier models.

Cybersecurity should not become a permanent protection subscription controlled by only a few AI companies.

Defenders, researchers and smaller organisations also need affordable access to capable tools. Otherwise, AI safety may gradually become less about making society secure and more about deciding who is allowed to own the tools and who must rent them.

If open-source AI must be banned because it can be used for cyberattacks, then the same logic could be applied to penetration-testing tools, security labs, programming environments, technical documentation, and cybersecurity textbooks.

But those same resources are also how defenders learn, test systems, discover vulnerabilities, and improve security.

At some point, the argument stops being about controlling dangerous tools and becomes an attempt to control access to knowledge itself.
You can restrict a model, close a platform, or place tools behind subscriptions but how do you cage knowledge once it already exists?