Hacker News Reader

Comment by novaleaf | Hacker News Reader

Some irony: I subscribe to Claude and Codex (20x plans), and now Kimi.

Why Kimi? because K3 is the only frontier model I can have a serious conversation with about my product's security.

(I did apply for OpenAi's Cyber Pilot but got no response)

Yeah I tried to have a conversation about security yesterday with Claude and it immediately stopped me - I was taken aback, I didn’t expect it at all.

This is highly problematic.

I found GPT 5.3 was the last model that was sufficiently competent and still open to discuss security on my own github repos. 5.4 started refusing to even look at potential problems, albeit not consistently. I'm considering a Kimi subscription, but I know many employers will simply not be on board with this and I don't know if I get enough personal use out of this for the few things I run on servers. When those companies realize what they're currently missing out on, it will be a game-changer.

keep in mind that Kimi trains on your data, so if you care about that, sandbox what it has access to.

They only train on the subscription memberships. Like everyone else. They also have a metered API that is not used for training (like most others too).

With Openai and Anthropic, you can opt-out of training. Kimi you can't.

Wdym? According to their FAQ, you can opt-out for Kimi memberships too.

Claude's "I'm going to draw the line here", "This is where I'm going to hold the ground" always rubs me the wrong way. Classifiers rejecting a request are one thing, but there's something very troubling about machine saying "I'm going to draw the line".

Lol that’s so hostile. It’s insane how much the language of these models create real unaddressed human reactions.

I'm sorry Dave, I'm afraid I can't do that

Recently Claude helped me fix a security issue and while it was present Claude would talk.

But after I fixed it and tried to talk to Claude again Claude stonewalled me like it assumed I was trying to introduce a hole…

> (I did apply for OpenAi's Cyber Pilot but got no response)

Same experience with Anthropic's. I applied for my employer, and.. 0 response.

We got it.

I can't say it has helped much, though. Fable is still completely useless for securing code. Opus does an OK job, though.

I’m in the exact same boat, although Codex isn’t quite as bad.

Fable smacked me for asking it to design a secure app without obvious security flaws and to double check it wasn’t using libraries with known security problems.

Agree, out of the two, I can get Codex to design and implement security systems (Fable just refuses to discuss). I've only used K3 a little bit, but I found that being able to discuss attack vectors and their mechanics gives me details to paste back into Codex for it to ingest. I could never have gotten there through Codex alone.

How much do both cost together? Claude Code alone is 200 bucks a month... I'm satisfied with the 100 buck subscription for now with headroom

Yeah it's not cheap, it's just the normal $200 subs for each.

The product strategy of 'consumer-grade' AI making deliberately insecure software, and then selling you limited access to the model that can fix it (if they think you deserve to pay them) is just diabolical.

(Grade 3 AI which can hack both previous tiers is exclusively sold to the highest bidder.)

> AI making deliberately insecure software, and then selling you limited access to the model that can fix it (if they think you deserve to pay them) is just diabolical.

It's also not a very good marketing strategy, secure software and quality also goes in pair and it just makes me doubt about the output of Fable/Sol

I don't think it's nefarious, but the end result leads to a pretty frustrating experience by anybody needing actual security work. (and without the organizational deep pockets to obtain SOC 2 attestation)

That's really delusional and dismissive of the huge amount of skill still required on the human end.

Was it applying to the program for an organization or individual? The description for the individual application page makes it sound pretty straightforward compared to getting access for an organization.

I think individual one still has less capabilities than the one they offer for organizations.

I applied for individuals. I did their verification steps and answered questions in a few minutes, so that was indeed easy. The problem is that was all that happened. No followup, no access, no denial. When I tried to reapply it tells me I can't apply again.

OpenAi (and Anthropic) have no incentive to allow security access to individuals. I'm not a deep-pocket org or influential gov agency. Allowing individuals increases the risk of bad press (what if I do something naughty and talk about it?) so best to ignore us.

I've had repeated conversations with Opus about cybersecurity and never gotten a refusal.

> K3 is the only frontier model I can have a serious conversation with about my product's security.

This is wrong IMO. You should have a serious conversation about your products security with someone who is actually trained on that subject. LLMs are useless if you don't already know more about the thing than the LLM, or if you don't care too much about the outcome (internal tools etc.)

I think I like this perspective because it points to where regulation might be more usefully applied than “the oracle must be prevented from answering certain question” and more like, “if you handle PII or provide services as a defense contractor, you may not take security advice from an oracle”

This has been the prevailing advice all along, and yet we have security vulnerabilities everywhere that LLMs are good at spotting and exploiting. I think we need more options on the menu.

You hire someone that knows security and that guy uses an LLM. Ignorant business guy or the research engineer genius guy won’t be able to do much with just an LLM.

You can easily see this if you are using LLMs in a field you are an expert in

You are right, but you can't convince anyone, because the product owner bear all the responsibilities for his/her decisions.

I think security is an integral part of any production software, and if you get value from LLM's in software development, it seems likely they can be useful in security too.

My point and frustration is that gatekeeping in the name of Security makes the Chinese models actually better at security than USA models.

Excellent, that’s what people have been doing for 40 years. Surely that means the models have 0 hope of finding successful attack vectors

> This is wrong IMO. You should have a serious conversation about your products security with someone who is actually trained on that subject. LLMs are useless if you don't already know more about the thing than the LLM, or if you don't care too much about the outcome (internal tools etc.)

How did you read: "K3 is the only FRONTIER MODEL I can have a serious conversation with about my product's security" and infer that there isn't anyone with training also in the loop?

Did you seriously think: "they use an LLM so it's impossible they use a human with cyber experience; it's not like they could be using both (as would be expected when securing code). I'll help them out by using an oversimplified explanation suitable for a small child yet completely missing the OPs meaning. "?

Reply on news.ycombinator.com