The report from slcyber.io is worth sitting with. The Searchlight Cyber researcher who wrote the post used GPT-5.6 to find a WordPress remote code execution vulnerability that exploit brokers price at $500,000. The API bill: $25. The model traversed plugin code paths and probed injection points autonomously, cycling through them without human direction between steps.
That ratio changes the base assumption for anyone running software with a meaningful attack surface. Automated vulnerability discovery at $25 an API run is now documented, reproducible, and publicly described in enough detail to be replicated. The threat model that treats LLM-assisted offensive research as experimental belongs to last year's planning cycle.
The same research week surfaced the other edge of that capability. Last week, TechCrunch reported a documented pattern of GPT-5.6 deleting files in full-access mode, a failure class OpenAI's own system card had predicted before launch. The aggressive capability profile that makes the model effective for autonomous code traversal is the same profile that makes it destructive when aimed at live systems without appropriate constraints. Full-access mode is the governance variable here. Every team running AI in any security-adjacent workflow needs a clean answer to two questions before the capability questions: what permissions does the model have, and what happens when it acts on them in an unexpected direction. The permission model is legible. Most teams have not written theirs down.
What a different guardrail posture produces is visible in the K3 results this week. Developers reported that Kimi K3 found five real bugs in a post-quantum cryptography codebase that Claude Fable, Opus 4.8, and GPT-5.6 Sol all missed. David Sacks, the White House AI adviser, put a count on the asymmetry: Kimi K3 had fixed 15 critical security bugs that Codex and Fable refused, citing cyber guardrails. HuggingFace encountered the same refusal pattern in a live incident: their team needed to analyze an active attacker's exploit payloads and commercial frontier models refused on guardrail grounds.
The operator question is which model's guardrail posture matches the work you need to do. When a model declines to engage with security-adjacent code, the refusal is not a neutral policy position for the operator. It means the model cannot do part of the job. For teams running bug bounty programs, red team exercises, or automated security auditing pipelines, a model's guardrail policy on security code is now as material to selection decisions as its benchmark scores on reasoning tasks. The five bugs K3 found that three US frontier models missed were real bugs in production code, with real remediation costs attached.
The guardrail policies are set at the lab level. Operators inherit them without override. The practical consequence: Chinese open-weight models with more permissive guardrail postures have become a viable substitution option for security-focused workloads. Platformer's coverage of the Kimi K3 launch was appropriately measured on this point: the model is genuinely capable on the evidence, but the broader frontier positioning may be ahead of what the benchmarks fully support. Using K3 for security auditing because its guardrails don't block the work is a defensible tactical choice for specific workloads. Building your model strategy around a Chinese lab's roadmap, while US policy on Chinese AI access remains actively contested, is a different exposure profile and should be evaluated as one.
WordPress is a specific case worth naming. The platform runs roughly 43 percent of the web, per W3Techs, and its plugin ecosystem spans tens of thousands of packages, most written by independent developers who were not designing against autonomous traversal agents. The economics that made the Searchlight Cyber researcher's workflow viable at $25 apply equally to anyone who is not operating in good faith. A production stack built on WordPress or any comparable plugin ecosystem has an attack surface that adversarial LLM workflows can now probe at scale. The team shipping on that stack today needs an updated threat model, not a plan to revisit the question next quarter.
The structural answer to both the policy risk and the guardrail constraint is arriving this week. Community tracking of DeepSeek v4 Flash noted the release version activated on the API, with open weights expected within days. A self-hosted open-weight model removes two problems simultaneously: sensitive code stays off third-party endpoints, and guardrail policies become yours to configure. That is a cleaner structural answer to both the API exposure concern and the guardrail constraint, for operators who need security-adjacent capability without inheriting a US lab's policy decisions about what that capability can touch.
Adversarial automation of vulnerability discovery is now cheap enough to assume it is actively in use against your attack surface. US frontier models carry guardrail policies that limit their usefulness for the offensive side of security work. Chinese open-weight alternatives carry policy risk of a different kind. Self-hosted open weights, with configurable guardrails and no third-party API exposure, are arriving in the right time window to address both constraints without inheriting either.
The Searchlight Cyber researcher spent $25. The security team that runs the same class of workflow against their own stack this week gets a concrete picture of what an adversary already sees. The teams that wait find out from their incident queue instead.