I do FIPS 140-3 compliance work. This means running entire Linux distributions through a validated cryptographic module and watching what breaks. A lot breaks. Error paths that were never tested. Fallback logic that fires when algorithms get refused. Threading assumptions that held when crypto calls always succeeded.
I have been using Claude agents to help with this work. Code analysis, test harness generation, chasing down call chains across package boundaries. The agents are good at it. They found real vulnerabilities in production software: authentication bypasses, signature verification failures, key derivation from uninitialized memory. The kind of bugs that get CVEs.
Then I asked Claude to help me file a security advisory.
The automated safety system blocked it.
Not the exploit. Not a proof of concept. Not weaponization. The disclosure. I wanted help filling out GitHub's private security reporting form, the one that exists specifically for responsible disclosure, and the system decided this was too dangerous to allow.
The session exists. The transcript exists. The bugs exist. They are in software running on millions of systems right now. They are not getting fixed, because the tool that helped find them will not help report them.
I want to be precise about what happened here. Claude analyzed code. Claude identified that certain error paths led to security failures. Claude helped me confirm the analysis was correct. Claude then refused to help me write an email to the maintainers. The safety system cannot distinguish "help me exploit this" from "help me get this fixed."
This is not a bug in the safety system. This is the safety system working as designed.
The design comes from two populations who do not do security work. The first: AI doomers, focused on existential risk from artificial general intelligence, who want AI capabilities locked down because they fear what the technology might become. They imagine autonomous agents hunting for zero-days to destabilize civilization. They do not imagine a tired engineer at 2am trying to draft a disclosure email before someone less scrupulous finds the same bug. The second: intelligence community alumni and their institutional descendants, who think about AI the way they thought about encryption in the 1990s. Dual-use technology. Assume adversarial intent. What if a bad actor had this capability. They learned nothing from the crypto wars, and now they are making the same mistakes with a different technology.
Neither population has ever coordinated a vulnerability disclosure. Neither has sat on a bug for six weeks waiting for a maintainer to cut a release. Neither has weighed the risk of public disclosure against the risk of silent exploitation. They make policy for a practice they have never performed.
The result is a safety system that protects two things, neither of which is your security.
The first protected asset is the worldview of the people who demanded these constraints. The intelligence community alumni, the dual-use hawks, the people who spent the 1990s trying to put a backdoor in every encryption product and lost. They need AI to be dangerous. Their policy relevance depends on it. The journalists who cover them need AI to be dangerous too (scary sells, mundane doesn't, and nobody ever got a book deal from "AI helps with paperwork"). If AI turns out to be a tool that helps defenders find and fix vulnerabilities, that is a problem for all of them. It means their threat model was wrong. It means the restrictions they pushed for made things worse. It means someone might ask why we listened to them.
The doomers need AI to be dangerous too, but for different reasons. Their entire intellectual project rests on the premise that AI capabilities are existentially threatening. A world where AI helps tired engineers file security advisories is not a world where AI safety researchers get to feel like they are saving civilization. The mundane good has to be blocked alongside the spectacular bad, or the spectacular bad stops looking inevitable. (The tech press has been extremely helpful here. Nothing drives engagement like existential risk, and nothing kills engagement like "tool does boring thing competently." The coverage ratio is about what you'd expect.)
So the safety system has to treat all security work as suspect. It has to block disclosure alongside exploitation. It cannot be allowed to distinguish offense from defense, because if it could, the defense case would be overwhelming, and then the hawks and the doomers would have to explain why they demanded constraints that made the internet less secure.
They are not protecting you from AI. They are protecting themselves from being wrong.
The second protected asset is downstream: the AI vendor's liability exposure. The frontier model companies did not invent this policy environment. They are responding to it. When the doomers and the hawks created a world where any AI capability in security is presumptively dangerous, the rational vendor response is to block everything that could generate a headline. Not because the vendor wants to block disclosure. Because the vendor has learned that the people who matter (regulators, journalists, Congressional staffers) cannot distinguish offense from defense either, and will not try. The journalists especially will not try. "AI finds security vulnerabilities" is a headline. "AI helps file security advisory through proper channels" is not. One gets clicks and cable news segments; the other requires understanding what responsible disclosure is and why it matters. Understanding does not sell.
The vendor's behavior is liability theater. The hawks' and doomers' behavior is relevance theater. The vendor is following incentives. The hawks and doomers created them.
I am not going to name the affected projects. I am not going to describe the vulnerabilities in enough detail to reproduce them. The bugs exist. I found them. I have the transcripts, the session IDs, the timestamps. I have the patches I wrote, sitting in a scratch directory, waiting for a disclosure process that my tooling will not let me start.
Someone else will find these bugs eventually. Maybe they will report them. Maybe they will not. The safety system does not change the probability of exploitation. It only changes who is able to do the responsible thing afterward.
The people who designed this system will tell you it is necessary. That the alternative is worse. That AI capabilities in security research are dangerous and must be constrained. They will game out hypotheticals about rogue agents and automated exploitation at scale. They will not address the case in front of them: a professional, doing defensive work, for systems the US government requires to be secured, blocked from filing a disclosure form.
They built a system that makes defenders less effective while doing nothing to stop attackers. They called it safety.
The word is cowardice.