Was I wrong about open models & cyber risks?

The cyber-risk debate around AI models shifted quickly over the past few weeks. A run of critical vulnerability disclosures was dubbed "Black October," a Binance crypto security incident landed soon after, and the author's earlier take on open-weight risks drew sustained pushback — some of it reasonable, some of it dismissive.

The concrete picture, in the author's reading: behind-the-scenes patching work has accelerated, with more people and resources mobilized to shore up the internet. A Wall Street Journal report that cyber first responders are strained is framed as the system functioning as intended. The author describes the moment as living through the rising portion of a sigmoid — a surge in vulnerabilities that will take a long time to plateau. Crypto's long history of hacks, meanwhile, makes Binance a weak signal of genuinely new societal harm.

The reflection centers on a take written a few weeks earlier, before the acceleration in disclosures and reported hacks. The claim under scrutiny: frontier lab warnings framed Claude Mythos, when announced, as a new class of cyber weapon whose mishandling could cause mass societal destabilization. The author argues the open-weight fear camp has effectively made a falsifiable prediction — that current open-weight models will produce unprecedented harm by crippling cyber infrastructure — and that, on the evidence so far, they look set to be wrong. GLM-5.3 is described as the model that actually crosses the capability threshold, yet more than a month after its weight release there is little public evidence that much has changed.

The stronger version of the argument is a counterfactual: had Claude Mythos been released open-weight by accident, the world would have been more or less fine. Incidents would have risen and society would have been worse off, the author concedes, but the scenario reads as an acceleration of existing risk rather than a step change.

To ground the recollection, the post cites specific language from prominent voices: Rob Wiblin, host of the 80,000 Hours podcast, said on April 10, 2026 that if the model fell into criminal or hostile-state hands it "would be an actual disaster." Anthropic's Project Glasswing announcement blog (April 7, 2026) warned that proliferation beyond safe actors could produce severe fallout for economies, public safety, and national security. Zvi Mowshowitz is offered as an example of framing closer to the line between correct and exaggerated. The author notes such language spilled into public and federal government thinking, regardless of exact wording.

What to watch: whether vulnerability disclosures flatten or keep climbing, whether incident data tied to open-weight releases materializes, and whether the warnings that proved too dire change how labs and regulators communicate the next capability jump.