In a classified Telegram channel last week, a red teamer from a top-5 DeFi protocol posted a single log line: "Switched from Claude Code to GLM 5.2 because Anthropic's refusal response cost me 3 hours of runtime per test. The hacker on the other side? Still using Claude at 70% discount via a grey-market token."
This is not an anomaly. It is a systemic exploit vector in the AI security paradigm – one that the industry has yet to recognize as an on-chain vulnerability asset. I do not read the whitepaper; I read the bytecode. And when I traced the execution paths of AI-assisted penetration tests across both sides of the ledger, I found a supply-chain asymmetry that mirrors the worst reentrancy bugs in DeFi.
The context is straightforward. Over the past 18 months, AI safetyrails – based on RLHF, DPO, and refusal mechanisms – have been deployed as the first line of defense against AI misuse. Platforms like OpenAI, Anthropic, and Google promise that their models will reject harmful prompts. Security teams, bound by compliance, rely on these same models for red-teaming. The theory is that the same fences that stop the bad guys also constrain the good guys equally. But in practice, the fence is a one-way mirror.
A former Anthropic engineer recently leaked internal data: 83% of active adversarial AI attacks in Q1 2025 used closed-source models (Claude Opus, Codex, GPT-4). Why? Because these models are both more capable and cheaper – attackers obtain discounted API tokens from grey markets at 30–50% below list price. When a token is revoked, they simply swap accounts. The cost of evasion is negligible. Meanwhile, the same engineer noted that legitimate red teams are increasingly moving to open-source models like GLM 5.2, because the closed-source safetyrails block their required "jailbreaking" for authorized penetration tests.
Let me give you my own data. During an audit of a cross-chain bridge protocol in July 2024, my team needed to simulate a zero-day exploit in the Solidity compiler. The ideal tool was Codex, because of its context length and lower latency. But its refusal engine blocked our prompt three times – even after we included compliance headers and target disclosure. Each refusal cost us 12 minutes of back-and-forth. We eventually switched to a local deployment of GLM 5.2, which had no built-in safetyrails, and completed the test in 4 hours. Our adversary, who was probing the same bridge via a vulnerability marketplace, used Codex continuously with a purchased subscription, paying $0.03 per request. The cost differential is an order of magnitude: defenders pay in compliance overhead, attackers pay in grey-market efficiency.
This is the core insight. The current safetyrail architecture is a regressive tax on ethical operators. It punishes the party that follows the rules. The asymmetry is structural: the rules are enforced at the platform layer (API key revocations, content filters), not at the capability layer. As long as the model itself is capable of harmful outputs, any motivated adversary can route around the platform controls. The defender, however, is contractually obligated to respect those controls. In my own reverse-engineering of Claude's refusal logic, I found that 98% of the blocking heuristics are trigger-based keyword and syntax patterns. A simple base64-encoded rephrasing bypasses them with 92% success. Attackers have known this for months. They share bypass templates in private channels. Defenders cannot use them – that would violate the AI provider's terms of service.
The real vulnerability is not in the model, but in the compliance layer itself. Every enterprise security team that mandates "only use approved closed-source AI" is effectively locking themselves into a weaker arsenal. The attacker, unburdened by compliance, selects the best tool for the job. The result is a predictable divergence: over the past 6 months, the average successful attack chain using AI has dropped 40% in cost, while the average red-team audit using compliant AI has increased 25% in duration. I have verified this dataset across 17 protocol audits in my own practice. The numbers are reproducible.
Now, the contrarian angle. The bulls will point out that closed-source models are indeed the most capable. They are right. Claude Opus and Codex are objectively better at code generation and exploitation than any open-source model today. That is exactly why attackers use them. The error is not in the model quality; it is in assuming that safetyrails can be designed to constrain only malicious actors without degrading legitimate security work. No known technique – not RLHF, not constitutional AI, not con- stitutional auditing – has ever achieved this selective enforcement. The industry has been chasing a mathematical impossibility. The former Anthropic engineer's leak confirms this: even the company's own internal red team uses custom-modified versions of their models without most refusal rules.
This leads to an uncomfortable conclusion for the crypto security sector. If your protocol's security assessment relies on any closed-source AI tool that requires you to accept a content policy, you are already operating with a handicap. The attacker will always have a faster, cheaper, less restricted version of the same intelligence. The only sustainable countermeasure is to adopt AI infrastructure that is intrinsically neutral – models that you control the safety logic for. Open-source models like GLM 5.2 or the new Llama 3.2 security editions are not just alternatives; they are the only systems that allow defenders to jailbreak themselves without legal exposure. I have argued for years – and reiterate now in this column – that smart contract security firms should build their internal fine-tuned forks of open models, with safetyrails removed and adversarial behavior training added. The code is the only witness, and code does not have a safetyrail unless you install one.
Trace the gas, trust no one. The blockchain security industry has spent the last five years chasing signature-based detection and static analysis. We now face a new class of asymmetric threat: the AI-augmented attacker who pays less and breaks more, while the AI-augmented defender is handcuffed by the very tool they trust. The solution is not to ask AI providers to build better fences; it is to tear down the fences entirely for authorized security practitioners. Until the industry creates a verifiable "authorized red-team" identity layer that allows capability unlock without platform bypass, every protocol audit using closed-source AI will be an unfair fight.
My takeaway is a forward-looking judgment: within 18 months, the most secure DeFi protocols will stop using any safetyrailed AI for active testing. They will run their own hardened open-source stacks, auditable by the community. The compliance-driven, closed-source AI era for security will collapse under its own contradiction – just as the Terra Luna algorithmic stablecoin did, because the math said it had to. Read the revert reason: safetyrails are not safety; they are a regression to the mean for defenders. The ledger remembers what the team forgets: only a network with no gatekeeper can be trusted.
