I think it's more the image formats PDF supports? I could be wrong, but there was that forcedentry vulnerability (which was insanely cool, even if really bad)
I'm pretty sure not even the safe languages would help you here. PDF allows you to pretty much run arbitrary code since it supports javascript, images, and a bunch of other things I'm forgetting, and you can't not implement javascript support or otherwise be selective about what you support with it because then all the end-users will complain when they get that one PDF that they need to fill out but it needs JS because... Nobody knows.
I mean maybe but... There's nothing forcing you to use Claude or what have you to play around is there? I mean an employer might force you to use it but you don't have to in your free time. That's one way I comfort myself lol
You’re right. But the treat was having a hobby that was also professional development. People in other industries have to take courses, study through dreary textbooks… I got to do something I enjoy and get professional benefit. That’s the shine we’re rapidly losing.
I can't comment on the enjoyment aspect, but I'd argue that writing code still confers professional benefits. It might not be the most economical way to ship code [citation needed] but it's still the best way to understand code, and understanding code will remain professionally relevant for a long time yet.
If this company was so incompetent that their private keys were a single byte, I seriously wonder what other areas they're incompetent in but that they've ventured into anyway. When you fail so spectacularly and so publicly at something like being a certificate authority, in the manner that eMudra did, it's rather hard not to wonder.
Also important for physical modelling and geometric acoustics -- you need a geometric mesh (made of triangles) to work with. Which parts of could be sent to the GPU for processing as well.
I would believe Anthropic about how Claude reduces attack surfaces if they weren't simultaneously nannying everyone about how they supposedly don't want their models used for cybersecurity because... Reasons. And if you do want that access, you have to verify your identity, and do a bunch of other things, all of which goes against "reducing" the "attack surface". If they really gave a damn about cybersecurity, this cybersecurity filter wouldn't exist, period.
> If they really gave a damn about cybersecurity, this cybersecurity filter wouldn't exist, period.
Golden guns don't keep you safe from silver bullets.
These models are obviously getting used to commit acts which would be criminal if done with intent (https://www.felonybench.com), handing everyone a digital version of a machine gun means everyone catches strays.
Worse: every capability the SOTA models demonstrate is available in an open weight model 3 months later, so we're all catching strays already, and it's only the exact policies you're unhappy about which gave critical infrastructure any prep time.
And recall, absent demonstrations of capabilities (and sometimes even with demonstrations), lots of people respond dismissively to these warnings; before OpenAI had actually hacked into HuggingFace, people thought it was "science fiction" that an AI would find and exploit novel zero-days in its own sandbox.
This doesn't work. Even if you use agents that are 3 months behind, they will still find the vulnerabilities Mythos or Claude Opus would find, it would just take them a bit longer to do it. As such there is little reason for these cybersecurity filters to exist. They don't actually prevent people from finding vulnerabilities; it just slows people in finding them because they have to use less capable models, and by extension that makes cybersecurity postures worse. You can't ever get rid of the arms race between defender and attacker. Anthropic acting all nanny-ish doesn't at all help the situation -- if anything, I would argue, it just makes it significantly worse. Especially when the filters will have significant false positives (e.g., they will trigger for local things that are completely unrelated to hacking at all, because somehow that's super duper dangerous).
> They don't actually prevent people from finding vulnerabilities; it just slows people in finding them because they have to use less capable models,
That's the point. Slowing people down. Hackers aren't "not people".
> You can't ever get rid of the arms race between defender and attacker.
Yes you can, and by doing exactly what you're complaining about:
And if you do want that access, you have to verify your identity, and do a bunch of other things
That's the thing which gives defenders an advantage. A 3-month advantage, or could have been if the US government hadn't blocked it for a non-trivial fraction of the gap.
> ... and by doing exactly what you're complaining about:
How exactly does requiring people to identify themselves actually protect anyone or slow them down? Their identity system doesn't even work reliably (it's just your classic "verify your ID" scheme), and it failed to verify my ID no matter how I did it, so in the end I gave up. Even assuming it was reliable, I don't see how it stops bad actors from doing it, since we all know how easy it is for most sufficiently resourceful actors to forge IDs, and I suspect these digital ID verification services have all kinds of vulnerabilities that would make them easier to bypass compared to the tools the state has to prove an ID is legit. For the higher tiers of CVP there may be more requirements, but do you seriously think these companies aren't just using AI to verify those tiers too?
The flip side of it is that now the US agencies have unrestricted access to that machine gun and software developers don't, or at best still heavily censored access (their "trusted" program is a joke). Instead of building a tool to fix security issues, they've essentially built a cyber weapon for offensive use. Which was obvious from the day 1 of Mythos shenanigans.
Yes, agreed the US agencies will have the best. But not from Anthropic: recall the White House unlawfully blacklisted Anthropic when Anthropic dared say no to their models getting used in certain ways, and that Anthropic was given an order to stop supplying to any non-American despite the large number of non-Americans on their staff.
So for this:
> Instead of building a tool to fix security issues, they've essentially built a cyber weapon for offensive use.
They did both. That it's a machine gun with an overly-cautious safety system isn't great, but it's also a tool and as a tool is better than either a machine gun with no safety system or just giving no-questions-asked direct control to just the US government.
No-questions-asked access would be from the other AI vendors.
No, it means some billionaires catch strays and have to sell one of their yachts out of their fleet, or cut dividends. The collapse of the current Google/Microsoft security and management duopoly would be less impactful on the average computer user than the death of flash player.
None of this is for you; it's for money. It's someone else's empire. Cybersecurity is a farce, and western culture would quickly recover from a complete collapse, and be better off for it.
compliance is payed for by the parties ensuring the compliance.
so yes if the cybersecurity was not strong enough, some big companies would go bankcrupt or change their TOS.
And then others would emerge, and the cat mouse game of hackers and viruses in the 2000s would pick up again.
We had a bit of a calm period when Anti virus programs in windows didnt do much anymore
> No, it means some billionaires catch strays and have to sell one of their yachts out of their fleet, or cut dividends.
Their capital isn't your body armour.
Anything it costs them has all the impact of an ambulance at the bottom of a cliff, when we could have a fence at the top.
> The collapse of the current Google/Microsoft security and management duopoly would be less impactful on the average computer user than the death of flash player.
Add Cisco (CVE-2026-20213), NGINX (CVE-2026-27654), the Linux kernel (CVE-2026-31554), ImageMagick (CVE-2026-33901), FreeRDP (CVE-2026-40033), OpenSSL (CVE-2026-45447), Suricata (CVE-2026-45751), FreeBSD (CVE-2026-4747), PostgreSQL (CVE-2026-6479), and Mozilla Firefox/Thunderbird NSS library (CVE-2026-6772).
> None of this is for you; it's for money. It's someone else's empire. Cybersecurity is a farce, and western culture would quickly recover from a complete collapse, and be better off for it.
Cybersecurity is indeed a farce; one does not put out a dumpster fire by pouring on gasoline. Well, not unless it's a huge amount, and then you've got gasoline everywhere off-gassing and one spark from being much worse.
Due to tech being over-sold as a solution to everything, it has been so heavily integrated in our infrastructure that "a complete collapse" would be devastating.
We see small, limited, isolated incidents already, just from Ukraine blowing up Yandex servers and by extension knocking out random chunks of Russian economy, or unknown hackers switching French/Dutch/US fridges to defrost overnight spoiling the food, or messing with water control systems in (fortunately small) reservoirs, Revolut not working for a bit when one European DC went down, and some stupidity where a root signing certificate had a private key of "4" for 18 months without anyone noticing.
Do this everywhere all at once, and it's likely we get mass blackouts, banking in general stops, software updates and signing can't be trusted to undo the mess. It's anywhere from "really bad" to "civilisational crisis" if it dropped in unexpected and unprepared for.
I’m very frustrated by this, for the record. But they have the atom bomb, and we want to borrow their tech for nuclear power. They don’t trust us. This familiar geopolitical quagmire isn’t resolved on the global scale, so I don’t expect these flawed companies to do it any better.
One can phrase it: bad actors already have nukes, and throwing them on peaceful American cities every day, and gov + corps deny citizen access to defensive tools while do nothing for protecting citizens.
As one example I can think of, there are a ton of devices that only work on Windows (or Windows and MacOS). The audio interface I have is one example: its "official drivers" are Windows and MacOS only. I know that someone is trying to make Linux drivers for it, using LLMs, because if there's one thing LLMs are very good at, it's RE and figuring out how hardware works. One of my other friends made an accessible equivalent to the Razer app for his Razer headphones because the official app is complete shit.
I would love to use Lazarus, but the UI toolkit it uses has some very bad accessibility bugs that make it practically unusable with my screen reader. FreePascal's love of syntax diagrams is also a turn-off for me (I've always preferred things like EBNF or similar for grammar notation).
The (only) part of this that I find rather ironic (and kind of funny) is that these idiotic companies never seem to learn a thing. Nearly every single time they take something like this down, it just draws even more attention to it (the Streisand effect).
reply