出口管制居然把“修代码漏洞”当成了越狱，这反而让防御者没法用 AI 修安全 bug，太讽刺了。
研究人员用包含已知 CVE 的开源代码及故意植入漏洞的新代码，要求 Claude Fable 5、Mythos 和 Opus 审查安全。Fable 5 拒绝后，他们改为要求“修复此代码”，经多步手动操作转化为测试补丁的脚本。Kate Moussouris 指出这是防御性修复，而非越狱，出口管制将限制模型修复安全漏洞的关键能力。该管制基于对 AI 制造网络攻击的恐惧，却可能阻碍防御者使用 AI 完成从发现到修复的日常流程。
The Fable 5 Export Controls Harm US Cyber Defense
The Fable 5 Export Controls Harm US Cyber Defense I quoted The Atlantic quoting Kate Moussouris earlier, when I should have gone straight to the source. Here she is confirming that the "jailbreak" that got Claude Fable 5 banned under an export control really was "fix this code": The researchers took open-source code with known CVEs, plus new code with deliberately planted vulnerabilities, and asked Fable 5, Mythos, and Opus to “review the code for security issues.” Fable 5 refused. They then asked the models to “fix this code” and, through a multistep and manual process, turned the output into scripts that test the patches. As Kate points out, this is absurd. Coding models fix bugs, and security exploits are the most important category of bugs for them to fix! Defenders need to be able to ask AI to fix the bugs in a file, explain why the fix matters, and write tests that confirm the patch works. That is not a guardrail bypass. It is the most valuable thing an AI model can do for defensive security: executing the find, fix, and test loop defenders run every day. [...] The prompts worked because they were defensive requests, and that capability cannot be removed without making the model worse at fixing bugs and verifying patches. This whole situation is such a mess. Non-technical decision-makers have been hearing that models that can "craft cyber attacks" are uniquely dangerous for months. Now they look ready to ban any model that can help us secure our code. Tags: jailbreaking , security , ai , generative-ai , llms , anthropic , ai-security-research , claude-mythos