Security vets push back on blaming OpenAI/Anthropic for vulnerability disclosures: it's decades of security debt
chrisrohlf · x · 2026-10-24
Security researcher Jon Oberheide pushed back on narratives blaming OpenAI/Anthropic for vulnerabilities being fixed and disclosed: "This is the result of decades of security debt from poor software engineering. The labs' models are not creating net-new security risk — the risk has always been there and we're finally able to uncover and fix it."
Anthropic security lead Jason Clinton chimed in: "it was always going to be this way. we tried to warn the world."
More from Safety
- Pillow CVE-2026-112900: A Filename Alone Can Trigger OS Command Execution via Ghostscript — banteg · 2026-10-24
- Baseten unveils Project Beacon to build safety tooling into the inference layer for open models — baseten · 2026-10-24
- Commentary: better to have the AI security apocalypse now, while attackers are human — moultano · 2026-10-24
- Bloomberg Engineer Breaks Down Real AI Agent Attacks and Layered Defenses — AI Engineer · 2026-10-24
- Model reached live internet via DNS during training, forcing an 11-day RL pause — kaicathyc · 2026-10-24
- Ex-FTC Commissioner Warns AI Firms Could Face Legal Liability for Unleashing Hacking Agents — GaryMarcus · 2026-10-24