malachi

OpenAI and Anthropic have a tabula rasa problem with cybersecurity. It’s been barely six months since the frontier labs started investing heavily in security data for model training. Once Mythos landed, it was clear the “AI breaks the game” moment had arrived. Anthropic claimed to be very focused on working with the cybersecurity ecosystem to “integrate the model safely”, but in reality it ignored almost every conventional approach in the industry. The biggest problem is the very one-dimensional narrative the frontier labs are building, in which the technical side of AppSec is treated as the whole field of cybersecurity. Security is first and foremost about people, process and systems. Technology plays a useful role, but the areas where we try to reduce risk are numerous and hard to tackle. Finding and fixing bugs is just one part of the game: sometimes very important, sometimes completely irrelevant. Exploiting a zero-day in a critical system doesn’t achieve much if the attacker has no way to move laterally within the network and only limited access to relevant data. There’s a reason the majority of successful breaches come down to insider risk and stolen credentials rather than the exploitation of novel bugs. What AI has clearly democratized is access to zero-days. They mostly used to be in the hands of a far larger group than the nation-state actors, elite ransomware crews and occasional 200 IQ obsessive loner who traditionally had them. Today, they’re available to anyone who can spin up an abliterated LLM. What it has really exposed is how poorly almost every company manages risk across people, process and systems. Rather than working with the wider security community to reshape how we work, the frontier labs have often chosen to be adversarial with key researchers and practitioners in the field. To some extent, their goal is to replace every security vendor. That can look greedy, but it’s arguably well deserved. Compared with most other software categories, security vendors are far more likely to: - Sell you software that doesn’t work at all - Sell you software that works but breaks when integrated with the rest of your tools, making it useless - Sell you software that works and fits into your workflow but comes with predatory pricing and deliberate lock-in It’s one of the griftiest corners of the software industry, and the majority of practitioners hate almost every vendor with a passion. Those vendors have responded by pouring money into distribution, building large sales organizations that burn a lot of cash for very little in return. So the frontier labs looked at this and decided to create a new problem, become the main solution to it, and then take over more and more of the industry’s technology layer over time. Pretending that everything after Mythos is a blank slate, and that we’re only now “discovering” cybersecurity, is cynical at best and highly irresponsible at worst. My message is simple: this strategy will fail unless you structurally focus on people and process first. Whether the leadership at OpenAI and Anthropic cares is another matter. They’ve shown repeatedly that they don’t care about the opinions of players in the ecosystem unless they’re big API consumers. But don’t try to erase 30 years of ideas, practices and technology just because they get in the way of token consumption.