If you do application security, you have probably watched a coding model decline something routine: writing a proof of concept for a bug in your own staging app, or explaining how a flaw in your own handler would be exploited so you can fix it. That leaves the defender with less help than an attacker would have.

I work on free-pi, a free terminal coding agent. We are adding an opt-in Defense section to the /model picker for signed-in GitHub users. The first model is Defense Flash : a reasoning model with tool use and a 1M-token context, chosen for lawful security work that general models often refuse. It is billed from normal credits like any other model.…