Was I wrong about open models & cyber risks?

What it is

Nathan Lambert's Interconnects post (autumn 2026) revisits his earlier claim that an open-weight Claude Mythos in April 2026 would have been "fine". He now says "fine" undersells it. He defines the outcome as an acceleration of cyber incidents, not a step change, and as a forced, expensive industry update. He also says he should have credited the part of the AI safety community that described this as a new era of cyber instability.

The post says the recent run of disclosures was called "Black October", citing PHP2Shell and GitLab, and that another crypto incident at Binance followed. Lambert notes that crypto is a poor indicator of new harm because it has a long history of hacks.

The evidence cited

• Epoch AI's GLM-5.3 exploit: Epoch used GLM 5.3 to build a website that, when a Firefox user simply visits it, lets the attacker exfiltrate files from the user's computer. No further interaction is needed. Lambert's point is that the attacker must still plant a site that targets the flaw, so finding the bug is one step in a multi-stage chain.
• Threat-actor behaviour: A quoted tweet argues that threat actors act like businesses with fixed processes. Phishing and ClickFix operators will not switch to vibe-coded exploits because a critical CVE appeared. Only actors whose existing method is exploitation use new CVEs.
• Trend data: Joshua Saxe and Chris Hughes frame the rise in exploits and damages as an exponential trend that predates ChatGPT. Lambert says a plot from Saxe would show a step change if AI capability were the bottleneck, and it does not.

Lambert's positions

• Lambert expects most recent vulnerabilities to be found by closed models, but says his error bars are very high.
• Open models are expensive to serve and the compute for the largest ones is sold out. If an open model is used in a hack soon, Lambert suspects it will be through a poorly secured open model API.
• He expects open-model prices to fall as compute supply grows.
• He believes adversaries have likely used these models to extract information at scale, but sees no party yet pushing the models at public institutions to cause mass harm.
• He says he is not a cyber expert.

Caveats

The post cites no new measurements. Its core claim is a prediction, and Lambert describes it as falsifiable. It quotes Rob Wiblin (10 April 2026), Anthropic's Project Glasswing post (7 April 2026) and Zvi Mowshowitz (9 April 2026) as examples of alarmed framing. It gives no CVE details, patches or detections for PHP2Shell, GitLab or the Firefox flaw, so an engineer needs the Epoch AI post for technical specifics.