How AI Guardrails Are Blocking Legitimate Security Research
U.S. export controls on Anthropic's Mythos and Fable models exposed a growing problem: guardrails designed to stop malicious hackers are also stopping the researchers who find and fix vulnerabilities. Practitioners from NCC Group, Crowdfense, and independent zero-day hunters describe wasted time, inconsistent refusals, and a shift toward Chinese open-source models.
When the U.S. government slapped export controls on Anthropic's Mythos and Fable models in June 2026, it signaled a growing tension: the guardrails meant to stop malicious hackers are also stopping the researchers who defend networks. As one veteran put it, you can't build a house without a hammer — even if that hammer can also break windows.
The Gatekeeping Problem
Both Anthropic and OpenAI now run vetted-access programs for cybersecurity professionals. Anthropic's Cyber Verification Program (CVP) and OpenAI's Trusted Access for Cyber promise fewer restrictions for approved users. But the approval process itself has become a bottleneck. In June, the Commerce Department restricted exports of Mythos 5 and Fable 5 after reports that their guardrails could be bypassed — a move Anthropic had arguably invited by marketing Mythos as a "doomsday cybermachine" requiring strict controls. The restrictions have since eased: Fable 5 returned to general access on July 1, while Mythos 5 remains limited to vetted U.S. organizations under government review.
Researchers Caught in the Middle
The friction isn't theoretical. Six practitioners described how these controls affect their daily work:
| Researcher | Role | Stance on Guardrails | Workaround |
|---|---|---|---|
| Mark Dowd | Zero-day researcher selling to Western governments | Companies make "arbitrary decisions about what is safe" | Not specified |
| Chris Anley | Chief Scientist, NCC Group | "Fix this code" is both defense and offense; guardrails hurt defenders | Falls back to open-source models with no guardrails |
| Paolo Stagno | CTO, Crowdfense (vulnerability broker) | Treats customers "like children who need babysitting" | Frontier models for reverse engineering only; local open-source for vuln finding/exploits |
| Giuseppe Cali | Independent zero-day researcher | Not impeding his work | Uses AI only for reverse engineering and tooling; keeps bug discovery manual |
| Anonymous | Researcher at smartphone-component manufacturer | Tools "barely useful" — guardrails trigger on any security-related prompt | Not specified (employer not in CVP) |
| Chris Thompson | CEO, RemoteThreat; Founder, Offensive AI Con | Inconsistent, over-sanitizing; pushes researchers to foreign models | Chinese open-source models like GLM run locally |
The Hammer Analogy
Anley's comparison stuck with me: "It's like a hammer. You can't build a house without a hammer. It's definitely a tool but it's also irreducibly a weapon as well." Asking a model to exploit a bug is how you confirm it's real — and that same prompt looks identical whether you're patching the hole or preparing an attack. The guardrails can't tell the difference, so they block both.
Data Leakage Fears Drive Local-First Workflows
Stagno's team avoids cloud models for vulnerability discovery entirely. Feeding sensitive exploit data into a frontier model risks leaking it into future training runs — a non-starter for a company that sells undisclosed vulnerabilities to governments. They use local, open-source models for that phase. Cali takes a similar approach by choice: "I am jealous of my bugs, and I like this game too much to let models play it for me."
Inconsistent Guardrails Waste Researcher Time
Thompson, who runs the Offensive AI Con conference, says the practical toll is negotiation, not security. "You spend a lot of time negotiating with the model instead of working on the core security program," he told me. Guardrails behave differently day to day, even inside the vetted programs. Researchers get "inconsistent results" and "over-sanitized output" — turning a vulnerability analysis session into a prompt-engineering struggle.
The Unintended Consequence: Researchers Moving Offshore
This is where the policy backfires. When U.S.-governed models become unreliable, responsible researchers don't stop — they switch to freely downloadable Chinese models like GLM that run locally with no vetting. Thompson calls it "more harmful than good": the very people trying to defend systems are pushed toward foreign-controlled tools. His warning is blunt: "There's this big storm coming. There's this big wave of attacks that are going to happen at speed and scale like never before. But the same security consulting firms and legit researchers that are trying to make a difference are being stifled right now."
Key Takeaways
- Export controls on Mythos/Fable (June 2026) revealed how guardrail marketing invites regulatory scrutiny
- Vetted programs (CVP, Trusted Access) create bottlenecks; many legitimate researchers lack access
- "Fix this code" is dual-use — guardrails blocking exploit prompts also block defensive validation
- Data leakage fears drive serious researchers to local open-source models for sensitive work
- Inconsistent guardrails waste researcher time on prompt negotiation rather than security analysis
- Researchers are migrating to Chinese models (e.g., GLM) — a strategic own-goal for U.S. AI leadership
What Comes Next
Thompson's prescription is straightforward: open the vetted programs wider, grant responsible access, and pursue abusers after the fact. The alternative is a widening gap — attackers will use whatever tools work, while defenders waste cycles arguing with safety filters. As of July 26, 2026, Mythos 5 remains restricted to vetted U.S. entities, Fable 5 is back in general release, and the offensive security community is increasingly running its own models locally. The guardrails aren't stopping the work. They're just moving it somewhere U.S. labs can't see.
Frequently Asked Questions