Essay argues open-weight models have not caused a cyber step change
Original title: Was I wrong about open models & cyber risks?
The author says a leaked Claude Mythos would have accelerated incidents, not collapsed infrastructure, and cites GLM-5.3 a month after release.
An Interconnects essay revisits claims that open-weight frontier models would cripple cyber infrastructure. The author argues that, more than a month after GLM-5.3 weights were released, public evidence does not show a step change, and that an accidental open release of Claude Mythos would have looked like faster incidents rather than societal collapse. The piece quotes April 2026 warnings from Rob Wiblin, Anthropic’s Project Glasswing post, and Zvi Mowshowitz, and notes Epoch AI used GLM-5.3 to chain a Firefox bug into file exfiltration via a visited website. The author says more critical flaws are being found and fixed, calls the coming software-practice shift expensive, and says he is not a cyber expert and remains nervous.
Unconfirmed: The “no step change” conclusion is the author’s reading; he says he is not a cyber expert and remains nervous.
- The author treats “Black October” disclosures, including PHP2Shell and GitLab, as background, not proof of collapse.
- Epoch AI reportedly used GLM-5.3 to build a site that could exfiltrate files from a visiting Firefox user.
- Wiblin called criminal or state access to such a model “an actual disaster” on April 10, 2026.
- Anthropic’s April 7 Project Glasswing post said proliferation fallout “could be severe.”
- Products
- Firefox
- AI models
- GLM-5.3Claude Mythos
From the original article
8 min read at interconnects.ai
Last week coined the term “Black October“ after an onslaught of critical vulnerability disclosures, including PHP2Shell and GitLab, signified the moment when the cyber risks of AI models started to materialize.
By Nathan Lambert · interconnects.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.