There is an unresolved issue where the offensive guys can use AI to attack a target and the defensive guys are being limited when they ask AI to audit their codebase.
The workflow for a defender basically goes:
Claude do a security audit on this codebase, use the harness / skills I built on how to do security audits.. pick the best suitable audit strategy, methods.. use the tooling and reporting structures.
Claude refuses, GPT refuses.
Grok, goes further, but refuses to make a working PoC.. a requirement because AI models make stuff up and without a PoC there is no proof.
GLM-5.3 / Kimi to the rescue and completes the job the "smarter" models refused.
So we as defenders are refused by the best models, on our own codebase
The workflow for a defender basically goes: Claude do a security audit on this codebase, use the harness / skills I built on how to do security audits.. pick the best suitable audit strategy, methods.. use the tooling and reporting structures.
Claude refuses, GPT refuses. Grok, goes further, but refuses to make a working PoC.. a requirement because AI models make stuff up and without a PoC there is no proof. GLM-5.3 / Kimi to the rescue and completes the job the "smarter" models refused.
So we as defenders are refused by the best models, on our own codebase