Offensive Security Researchers Say AI Guardrails Are Getting in Their Way

For months, Anthropic and OpenAI have built vetted access programs and default safety guardrails to keep their most capable models out of the hands of malicious hackers. According to new reporting from TechCrunch, those same guardrails are now getting in the way of the legitimate offensive security researchers whose job is to find dangerous vulnerabilities before criminals do.

Vetted Access Programs Built to Thread a Narrow Needle

The tension traces back to Anthropic’s Mythos and Fable models. In June 2026, the U.S. government imposed export control restrictions on both after a report suggested it was possible to bypass the guardrails meant to stop the models from being used to build and run cyberattacks. Those restrictions have since eased: Fable 5 returned to general access on July 1, while Mythos 5 remains available only to vetted U.S. organizations as part of the government’s review process, according to TechCrunch.

That kind of vetting is not unique to Mythos. Anthropic runs a comparable program called the Cyber Verification Program (CVP), which lets approved security teams work with fewer default restrictions. In a June 2 update on Project Glasswing, its effort to give partner organizations early access to Claude Mythos Preview for vulnerability scanning, Anthropic said it intends to scale up the CVP further, “which would grant Mythos-class capabilities to many more organizations for specific cyberdefense tasks.”

OpenAI runs a parallel effort called Trusted Access for Cyber (TAC), introduced in February 2026 and expanded in April with the release of GPT-5.4-Cyber, a version of GPT-5.4 tuned for defensive work with a lower refusal boundary and added binary reverse engineering capability, according to Help Net Security. Individuals verify their identity at chatgpt.com/cyber, while enterprises apply through an OpenAI representative; approved users get reduced friction around safeguards that would otherwise flag dual-use cyber activity.

Researchers Say the Guardrails Still Get in the Way

Despite those programs, TechCrunch spoke with several offensive security professionals who described guardrails that interfere with day-to-day work, vetted or not. Mark Dowd, a veteran vulnerability researcher who has spent decades finding and selling zero-days to Western governments, said on a cybersecurity podcast that “it’s not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security and what’s not.”

Chris Anley, chief scientist at security consultancy NCC Group, told TechCrunch that asking a model to try to exploit a bug is often how his team confirms a vulnerability is real and worth fixing. When a guardrail refuses that request outright, it slows down defenders just as much as it blocks attackers. “This is where the whole offensive versus defensive and guardrails part comes in, because ‘fix this code’ as a prompt is both an essential mechanism for defense but also a roadmap for finding critical vulnerabilities in the code base,” Anley said. “So at the same time, the same tool is both an offensive tool and a defensive tool, and the two can’t really be unpicked.” He compared the models to a hammer: “You can’t build a house without a hammer. It’s definitely a tool but it’s also irreducibly a weapon as well.”

Chris Thompson, chief executive of the security firm RemoteThreat and founder of the offensive-security event Offensive AI Con, told TechCrunch that in his experience the guardrails can be inconsistent, sometimes behaving differently from one day to the next.

Workarounds: Local Models and Self-Imposed Limits

Some researchers have adapted by working around the vetted programs entirely. Paolo Stagno, chief technology officer at Crowdfense, a firm that develops, acquires, and sells unknown vulnerabilities to government agencies, told TechCrunch his team uses frontier cloud models only for reverse engineering. For the more sensitive work of finding vulnerabilities and building exploits, they rely on open source models run locally, since sending that material to a cloud provider risks leaking it or having it absorbed into a future training run. Stagno said AI companies “essentially treat customers like children who need babysitting” with their vetted programs and guardrails.

Not every researcher sees the guardrails as an obstacle. Giuseppe Cali, who develops exploits for a living, told TechCrunch he uses AI mainly for reverse engineering and building supporting tools, not for the core work of discovering and weaponizing bugs. “I still want to own the actual bug discovery and weaponization myself and that wouldn’t change if all guardrails were lifted tomorrow,” Cali said. “I am jealous of my bugs, and I like this game too much to let models play it for me.”

One researcher at a smartphone component manufacturer, who spoke to TechCrunch on condition of anonymity because he is not authorized to talk to the press, said his employer is not part of Anthropic’s CVP, so its AI tools are largely unusable for vulnerability work: any hint that a prompt is security related and the model simply stops responding.

Why This Matters for Security Teams

The complaints point to a structural problem, not a one-off bug. Anthropic and OpenAI are both trying to build a single set of guardrails that separates legitimate vulnerability research from actual attack preparation, using the same prompts and the same underlying capability to do it. Anley’s framing, that the tool cannot be neatly split into offensive and defensive halves, is the crux of the issue: a restriction tight enough to stop a criminal will often catch a defender doing the identical task for a patch instead of an exploit.

For security teams evaluating whether to build workflows around Claude or GPT models, the practical takeaway is to check vetted-access status before relying on a frontier model for exploit-confirmation work, and to keep a fallback, such as a locally run open source model, ready for the sensitive stages of vulnerability research where cloud guardrails or data handling policies are not acceptable.