Former Anthropic Employee Claims Black Hat Hackers Use Claude and Codex

Employees from OpenAI and Anthropic discussed on X, expressing concerns that once open models catch up with closed-source models, the capabilities for automated attacks will become uncontrollable. Former Anthropic employee Noah Lebovic stated that black hat hackers are currently primarily using Claude Code and Codex. He mentioned that some attackers purchase discounted subscription tokens from the gray and black markets, continuing to switch accounts after being banned. Closed-source models are more powerful, with lower subscription prices, and the security restrictions are merely hurdles to be bypassed. Legitimate security teams, on the other hand, rely more on open models because they cannot violate rules by jailbreaking or frequently changing accounts, making it easier for real vulnerabilities and attack commands to trigger the interceptions of closed-source models. Lebovic noted that three legitimate penetration testing teams have already adopted GLM 5.2 as their primary model. He previously used Opus 4.6 to take over bank accounts and read medical records during authorized testing, believing that existing safeguards are more likely to stop rule-abiding defenders, while those intent on malicious actions can still circumvent these barriers.