White House AI adviser attacks cyber guardrails after Kimi K3 bug test

Why it matters

Cyber guardrails are becoming a product constraint for incident responders, while open and foreign models let both defenders and attackers bypass provider controls.

David Sacks (@DavidSacks), the White House special adviser for AI and crypto, attacked cybersecurity restrictions on American AI models on July 19th after a developer said Kimi K3 fixed 15 security bugs that OpenAI's Codex and Anthropic's Claude Fable 5 refused to handle.

The comparison gives Sacks a new argument against controls that US labs introduced as their models became more capable at finding vulnerabilities and developing exploits. It also hands Moonshot AI founder Yang Zhilin a pointed distribution pitch for Kimi K3: a Chinese model that developers can turn to when American services decline work classified as high-risk.

"There's no reason to limit American models on tasks that Chinese models handle without issue," Sacks wrote in a two-post thread. "We're only making ourselves less competitive."

The 15-bug result remains a developer's claim rather than a documented benchmark. Sacks' thread did not identify the repository, list the vulnerabilities, show the refusals, or provide patches that independent researchers could validate. It also described the bugs as "critical" without specifying a severity framework or explaining whether all 15 fixes passed regression and security testing.

That limits what the comparison proves about the models' relative technical ability. A refusal can stop a more capable model before it attempts the task, while a compliant model can produce a patch regardless of whether the patch is correct. The test primarily demonstrates a difference in access policy.

Hugging Face documents the same failure mode

Sacks paired the Kimi claim with a stronger, independently documented example from Hugging Face's July 16th security incident report.

Hugging Face said an autonomous AI agent system exploited two code-execution paths in its dataset-processing infrastructure, gained node-level access, harvested credentials and moved across internal clusters. Hugging Face recorded more than 17,000 attacker events and used AI agents to reconstruct the campaign.

Hugging Face initially submitted attack commands, exploit payloads and command-and-control artifacts to commercial frontier-model APIs. The requests triggered provider safeguards, according to Hugging Face. Its security team instead ran Z.ai's open-weight GLM 5.2 on internal infrastructure, which allowed the analysis to proceed without sending credentials and incident data outside Hugging Face.

That case establishes the operational problem behind Sacks' criticism. Incident responders sometimes need models to process the same exploit code, malware behavior and infrastructure details that attackers use. Intent is difficult for an automated classifier to determine from the payload alone.

Hugging Face stopped short of arguing that providers should remove safety systems. It recommended that defenders keep a vetted model available for local deployment when hosted services block incident work.

The refusals are part of the product design

Anthropic has explicitly classified penetration testing, bug bounties, exploit development, privilege escalation and high-value vulnerability discovery as high-risk dual-use activities. Fable 5 is intended to block those requests until Anthropic has stronger ways to restrict access to approved researchers.

Anthropic has acknowledged the cost. When it redeployed Fable 5 on July 1st, Anthropic said its updated classifier would produce more false positives during benign coding and debugging. Flagged Fable requests can be routed to the less capable Opus 4.8 model, depending on the product and configuration.

OpenAI also applies additional automated checks to cybersecurity requests in Codex, ChatGPT and its API. OpenAI advises defenders whose requests are blocked to narrow the scope, emphasize remediation and omit exploit details that are unnecessary for the defensive result. OpenAI separately offers Codex Security for repository scanning, exploit validation in a sandbox and patch generation.

Sacks' argument presses on the gap between those controlled products and unrestricted or differently governed alternatives. US labs can reduce abuse on their own services, but they cannot remove equivalent capability from the market when developers can switch providers or run downloadable models themselves.

Kimi K3 sharpened that problem days after its July 16th release. Moonshot says K3 has 2.8 trillion total parameters, native visual input and a 1 million-token context window. Full weights are scheduled for release on July 27th, meaning the model at the center of the developer comparison was still primarily an API and hosted product when Sacks posted his thread.

That distinction matters. The Kimi test appears to show Moonshot permitting a task that US providers restricted. Hugging Face's GLM 5.2 case shows the harder policy limit: once capable model weights can run on infrastructure controlled by the user, a provider's classifier no longer determines which cyber tasks can be attempted.

Sacks has turned both cases into a competitiveness argument. The evidence supports a narrower conclusion: broad cyber classifiers are blocking some legitimate defensive work, while open and foreign models give practitioners an immediate route around those restrictions. The unresolved tradeoff is whether US providers can verify trusted defenders quickly enough to preserve useful access without giving the same capabilities to attackers.