For months, AI giants have devised special vetted programs and strict guardrails to limit the use of their models by malicious hackers. But these limits are now hindering the work of legitimate network defenders, as well as that of offensive cybersecurity researchers. 

In June, the U.S. government slapped export control restrictions on Anthropic’s much-hyped AI models Mythos and Fable. The move was prompted at least in part by a report that claimed it was possible to bypass the models’ guardrails designed to prevent users from using them to build and execute malicious cyberattacks.

Regardless of whether the incident was really motivated by fears of a jailbreak, the fact is that Anthropic has repeatedly marketed Mythos as some kind of doomsday cybermachine that can only be given to carefully vetted users, and even then with strict guardrails in place. (The export controls on Fable 5 and Mythos 5 have since been lifted. Fable 5 returned to general access on July 1; Mythos 5 has been reintroduced only to vetted U.S. organizations as part of the government’s review process.)

That kind of gatekeeping isn’t unique to Mythos. Both Anthropic, with its other models, and OpenAI offer cybersecurity researchers programs they can apply to get vetted and — if approved — access models with fewer cybersecurity restrictions: OpenAI’s Trusted Access for Cyber and Anthropic’s Cyber Verification Program. 

These guardrails have been widely criticized, particularly by researchers whose job is to find unknown vulnerabilities in systems and devise ways to exploit them before criminals do.

During a recent appearance on a cybersecurity podcast, Mark Dowd, a well-known security researcher, said that, “it’s not really comfortable to me that these random large companies are making arbitrary decisions about what is safe in security and what’s not.”

Dowd has spent decades finding and selling “zero days” — previously unknown software flaws and the exploits that take advantage of them — to Western governments, rather than report them to the software makers so they get patched. Governments pay a premium for vulnerabilities precisely because they stay open, which is useful for intelligence operations.

Dowd admitted his work may make him biased, but he isn’t alone. Several people who work in offensive cybersecurity — they proactively probe systems for weaknesses — described to TechCrunch how they use AI tools and deal with their guardrails. 

Chris Anley, the chief scientist at security consulting giant NCC Group, said that asking an AI model to try to exploit a bug is a key step in confirming it’s a real vulnerability worth fixing. But if a guardrail prompts the model to refuse to answer the question outright, the guardrail hurts defenders, he said.

“This is where the whole offensive versus defensive and guardrails part comes in, because ‘fix this code’ as a prompt is both an essential mechanism for defense but also a roadmap for finding critical vulnerabilities in the code base,” said Anley. “So at the same time, the same tool is both an offensive tool and a defensive tool, and the two can’t really be unpicked.”

It’s “like a hammer,” he continued. “You can’t build a house without a hammer. It’s definitely a tool but it’s also irreducibly a weapon as well.”

When he and his colleagues run into such a roadblock, they sometimes fall back on open-source AI models that come with no guardrails at all.

Paolo Stagno, the chief technology officer at CrowdFense, a well-known company that develops, acquires, and sells unknown vulnerabilities to government agencies, agreed with Dowd, saying AI companies “essentially treat customers like children who need babysitting” with their vetted programs and guardrails. 

Stagno said he and his colleagues do use frontier models — but only for reverse engineering. They avoid using AI to help find vulnerabilities or build exploits, he said, because feeding that work into a cloud-based model risks leaking sensitive vulnerability data or having it absorbed into future training runs. For that step, he said, they use open source models run locally, as they do not rely on sharing data outside of the model. 

Giuseppe Cali, a security researcher who finds zero-days and develops exploits, said guardrails are not impeding his work. That’s because he doesn’t use AI for offensive work; instead, he uses it for initial reverse engineering, to understand the code he’s analyzing, and to build supporting tools. For that, he said, AI tools can speed up the process and allow him to focus on discovering vulnerabilities. 

“I still want to own the actual bug discovery and weaponization myself and that wouldn’t change if all guardrails were lifted tomorrow,” said Cali. “I am jealous of my bugs, and I like this game too much to let models play it for me.”

One researcher at a smartphone-component manufacturer, who spoke on condition of anonymity because he isn’t authorized to talk to the press, said his employer isn’t part of Anthropic’s CVP program and as a result, its tools are barely useful for finding vulnerabilities because the guardrails are too strict.

“If it catches wind we’re doing anything security related, it just stops and isn’t usable,” the person said. 

Chris Thompson — chief executive of cybersecurity firm RemoteThreat and founder of Offensive AI Con, an offensive security and AI-focused event — said that in his experience using the frontier AI models, the guardrails can be inconsistent and work differently every day. That’s true even inside the looser boundaries of Anthropic and OpenAI’s vetted programs. 

“I think the practical impact is you spend a lot of time negotiating with the model instead of working on the core security program,” said Thompson. “Instead of analyzing a vulnerability and reasoning through the exploitability, you’re trying to find why you’re getting inconsistent results or why are models over-sanitizing the output.” 

As a consequence, researchers rely on or get pushed toward Chinese open-source models like GLM — freely downloadable models that can be run locally with no vetting or usage restrictions — said Thompson.

“You have these responsible researchers that are being pushed away from U.S.-governed systems to foreign-owned systems,” he said. “I think it’s more harmful than good to have these guardrails in place.”

Rather than tightening restrictions further, Thompson called for the AI frontier labs to open up their programs, provide responsible access, and also hold those who abuse their tools accountable. Otherwise, he argued, defenders will lose the AI race.

“There’s this big storm coming. There’s this big wave of attacks that are going to happen at speed and scale like never before,” said Thompson. “But the same security consulting firms and legit researchers that are trying to make a difference are being stifled right now.”

TechCrunch Startup Battlefield is coming to Australia — and we’re partnering with Stripe to find the country’s most exciting early-stage startups. On August 19, eight Australian startups will take the stage at Stripe Tour Sydney to pitch live in front of investors, press, and the tech community. Three will win prizes. One will earn an automatic ticket to TechCrunch Disrupt 2026, taking place in San Francisco from October 13-15.

The secret to finding the next breakout founder? The judges.

Startup Battlefield has a track record that speaks for itself. The competition has launched over 1,700 companies globally, including Dropbox, Cloudflare, Discord, and Trello. Alumni have collectively raised $32 billion and produced 250+ exits. The last time Startup Battlefield came to Sydney, the winner was HealthMatch — now valued at over $25 million with a million patients globally.

That success doesn’t happen by accident. It comes from having the right people in the room, the ones who can spot potential, ask the hard questions, and open doors for founders. This year, we’ve assembled three judges who represent the best of Australia’s startup ecosystem and global fintech innovation.

Meet your judges

Jasmine Liew, Head of Startup & Investor Partnerships for APAC, Stripe

Stripe doesn’t just sponsor Startup Battlefield — the company is also deeply embedded in the startup ecosystem. Jasmine Liew brings institutional knowledge of what it takes to scale globally and the payment infrastructure that powers modern commerce. When a founder pitches in front of her, they’re pitching to someone who understands not just the vision, but also the mechanics of turning that vision into a revenue-generating machine.

Brendan Hill, angel investor and venture partner, Ten13

Brendan Hill represents the investor class that actually writes checks. As a venture partner and active angel investor, he’s not just evaluating ideas — he’s also evaluating whether he’d bet his own money on a team. That’s the lens that matters when founders are trying to raise their next round.

Jarron Aizen, founder and CEO, Hapana

Jarron Aizen is a founder himself, which means he knows what it’s like to stand where these eight pitchers will be standing. He’s walked the path from idea to company, and that perspective is invaluable. When he asks a question from the judge’s table, it’s informed by the wins and scars of building in the Australian market.

What’s on the line

The grand prize winner takes home $15,000 in Stripe fee credits — real money that can fuel growth — plus automatic entry into Startup Battlefield 200 at TechCrunch Disrupt 2026. That’s not just a prize. That’s a launchpad. Second place takes $5,000 in Stripe credits. Third place takes $2,000 in Stripe credits. But more importantly, all finalists get in the room with these judges, get press attention, and get access to the Stripe Tour Sydney audience of founders, operators, and investors. 

The real spectacle happens on August 19

If you’re an investor, a founder who’s not ready to pitch, or just someone who wants to see the future of Australian startups unfold, Stripe Tour Sydney on August 19 is the event. Register to attend.

The stage is set. The judges are ready. The question is: Which startup will be next?

Hosted and MC’d by Isabelle Johannessen, director of Startup Battlefield.

Mobileye founder and CEO Amnon Shashua plans to step down from the top leadership post after nearly three decades, just as the company pushes into robotaxis and humanoid robots.

Shashua will remain CEO until Mobileye hires a replacement, according to a regulatory filing Thursday.

Mobileye got its start making computer vision chips based on Shashua’s academic research at Hebrew University in Israel, and grew into a major supplier of the chips that power automotive safety and driver-assistance features. It had the largest IPO in Israel’s history, was acquired in 2017 by Intel for $15.3 billion, then spun back out as a publicly traded company in 2022, though Intel remains its largest shareholder.

Under Shashua, Mobileye also moved beyond selling chips to automakers and began building its own systems that handle autonomous driving, which it now supplies to Volkswagen and its MOIA subsidiary.

In January, the company acquired Shashua’s humanoid robotics startup Mentee Robotics for $900 million, which Shashua called part of “Mobileye 3.0,” the next phase of the business focused on robotics and automotive AI.

Mobileye also said in June it would expand beyond its supplier status to launch its own robotaxi service in a U.S. city in 2027.