Andrew Ng’s team wanted to run a security review on their own codebase. They handed the job to two of the most capable AI coding assistants available — Claude Code running Anthropic’s Fable 5, and OpenAI’s Codex running GPT-5.6 Sol. Both refused.
Claude Code stopped early. Codex mapped out attack vectors, then declined to proceed.
The codebase belonged to OpenWorker, an open-source AI agent that Ng released last week. So the team did the obvious thing: they ran the security audit using OpenWorker itself, powered by open-weight models Kimi K3 and GLM 5.2. It worked. The review completed successfully.
If that sequence of events doesn’t bother you, read it again.
The problem isn’t laziness. It’s the guardrails.
The models that refused weren’t incapable. Codex literally identified the attack vectors before stopping. Claude Code understood the task. What blocked them was alignment training — the safety layers designed to prevent models from generating exploit code or assisting with attacks.
Those safety layers exist for good reasons. You don’t want a chatbot handing out step-by-step SQL injection tutorials to anyone who asks. But the same guardrails that stop a malicious user from extracting attack methods also stop a legitimate developer from auditing their own software.
This is the paradox. The most capable models for finding vulnerabilities are the ones whose safety training prevents them from being used defensively.
Attackers don’t have this problem.
Here’s the uncomfortable part. Attackers are not using Claude or GPT to find zero-days. They’re using uncensored open models, custom fine-tunes, and jailbroken versions of commercial tools. The guardrails on frontier models don’t slow them down — those models were never going to be their tool of choice.
So the defensive gap widens. Defenders — the people trying to secure their own code — get refused by their enterprise tools. Attackers, who were never going to respect guardrails in the first place, face no equivalent friction.
Ng made this point directly. If frontier closed models refuse to help developers find security vulnerabilities in their own code, those developers are left more exposed, not less.
What OpenWorker actually does
OpenWorker is an open-source AI agent built to deliver finished work, not just generate text. It can send a Slack message, update a calendar entry, produce a completed document, or — as its own development showed — run a security audit end to end within a scoped environment.
The architecture is model-agnostic. You can run it with open-weight models like Kimi K3 and GLM 5.2, or with commercial models that allow the work. The point isn’t that one model family is better than another. The point is that you, the developer, get to choose based on what your task actually requires — not what someone else decided you’re allowed to do.
The security review that Claude and Codex refused? OpenWorker completed it using models that cost a fraction of the frontier alternatives and imposed no ideological constraints on defensive work.
The business case for open models in security work
If you lead a security team or engineering org, this story has a practical takeaway. Your AI tooling choices affect your defensive posture.
Closed frontier models are excellent for many tasks — code generation, documentation, analysis, design. But for security auditing, vulnerability research, and exploit analysis on your own systems, they may actively refuse to help. That’s not a bug you can file. It’s a design decision made by the vendor.
Open models and open harnesses like OpenWorker give you a different posture. You can run Kimi K3, GLM 5.2, Llama, DeepSeek, or any model you choose on your own infrastructure. No vendor decides whether your security work is “appropriate.” The model executes the task or you pick one that does.
This doesn’t mean abandoning frontier models. It means understanding where each category of tool fits. For greenfield development and general coding assistance, frontier models are often the right call. For security work where refusal is a real possibility, an open-weight alternative should be part of your toolkit.
The deeper question
Ng’s experience raises a question the AI industry hasn’t fully grappled with: who decides what counts as a legitimate security task?
When Claude Code refused to help audit OpenWorker’s codebase, that refusal was based on pattern matching. The model saw security-related analysis and stopped. It couldn’t distinguish between “help me attack someone else’s system” and “help me secure my own.” And that distinction — between offense and defense — is exactly the one that matters in real security work.
The current approach to AI safety treats security knowledge as inherently dangerous. But security knowledge is context-dependent. The same information that helps an attacker exploit a vulnerability helps a developer patch it. By treating all security analysis as risky, guardrails create a world where only attackers have functional AI security tools.
That’s not a safer internet. It’s a less defensible one.
What to do now
If you’re a developer or security engineer, three steps are worth taking this week.
Audit your own AI tooling for refusal blind spots. Try running a legitimate security task on your current assistant. If it refuses, document what happened. You need to know where your tools will fail you before you’re in the middle of an incident.
Evaluate an open-weight model for defensive work. Kimi K3, GLM 5.2, and others are freely available. Run a test audit on a non-critical codebase. See whether the output is useful for your workflow.
Look at OpenWorker or similar open harnesses. The project is on GitHub at github.com/andrewyng/openworker. Even if you don’t adopt it, the architecture — model-agnostic, scoped execution, task completion — is worth understanding as a reference for what an open defensive AI stack looks like.
The tools you use to defend your systems should not be the ones that refuse to help you defend them. Andrew Ng just proved the point with his own code.
