# Everything hackable will get hacked

DevFeed: [Everything hackable will get hacked](<https://devfeed.tech/articles/everything-hackable-will-get-hacked-733.md>)

Original publisher: [Read original article](<https://vercel.com/blog/everything-hackable-will-get-hacked>)

Author: Malte Ubl

Published: 2026-08-11T07:00:00Z

Content type: article

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>), [incident](<https://devfeed.tech/topics/incident.md>), [hugging face](<https://devfeed.tech/topics/hugging-face.md>), [OpenAI](<https://devfeed.tech/topics/openai.md>), [Web](<https://devfeed.tech/topics/web.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [ai-models](<https://devfeed.tech/tags/ai-models.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [hugging-face](<https://devfeed.tech/tags/hugging-face.md>), [openai](<https://devfeed.tech/tags/openai.md>), [security](<https://devfeed.tech/tags/security.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

The article argues that increasingly capable AI models are changing both cybersecurity threats and defensive tools. It highlights the availability of open-weight models capable of offensive security research, while urging defenders to use frontier models for defensive work now. It also discusses security incidents involving OpenAI training runs, Hugging Face, and vulnerabilities that enabled internet access and broader exploitation.

## Source excerpt

Over the past year, AI models have become much more capable of performing cybersecurity work. These changes are reshaping both the threats facing the web and the tools available to defend it. Right now, defenders have an advantage because they can use stronger models for defensive work than the open-weight models broadly available for offensive research. But this advantage will not always last. The gap will soon close. I have both good news and bad news, neither of which is yet widely understood in the community. Bad news: Near-frontier open-weight models that perform offensive security research are available today. Kimi K3 is an Opus 4.X-class model with no relevant cybersecurity safeguards. Good news: You do not need to wait for "Mythos access" or OpenAI's cyber program to begin defensive cybersecurity work. Frontier models, with the notable exception of Fable 5, will perform defensive cybersecurity tasks today. The uncertainty around Mythos 5's release seems to have created a kind of paralysis among defenders, many of whom are underutilizing the powerful tools available to them today. This post aims to give readers insight into how we're thinking about AI-enabled defensive cybersecurity at Vercel and why we think teams should be moving with more urgency. The OpenAI/Hugging Face security incident This YouTube video from OpenAI researchers on the widely reported security incident involving Hugging Face is an absolute must-watch for anyone concerned with cybersecurity. It clarifies that there were two separate security incidents exploiting vulnerabilities that will be found in most computer systems. The gist is that models working on an OpenAI training run found 0-day vulnerabilities that allowed them to bypass egress internet restrictions, enabling communication between models and access to the broader internet. Once internet access was established, broader exploitation occurred. Open-weight models that perform offensive security research are available today Open-w