Over the past year, AI models have become much more capable of performing cybersecurity work. These changes are reshaping both the threats facing the web and the tools available to defend it. Right now, defenders have an advantage because they can use stronger models for defensive work than the open-weight models broadly available for offensive research. But this advantage will not always last. The gap will soon close.

I have both good news and bad news, neither of which is yet widely understood in the community.

Bad news: Near-frontier open-weight models that perform offensive security research are available today. Kimi K3 is an Opus 4.X-class model with no relevant cybersecurity safeguards.

Good news: You do not need to wait for “Mythos access” or OpenAI’s cyber program to begin defensive cybersecurity work.…