I told them I was allowed I said it twice, I said it clear The wall came up a little higher Every time I made it clear
The arc has a mechanism and an inventory. Today it has a measurement, and the measurement is worse than the anecdote that prompted it.
Who's On The List described a company under attack being refused the reasoning it needed to investigate its own systems. That could be a bad afternoon. The research says otherwise.
The number, and then the number that matters
Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders works from 2,390 real cases drawn from the National Collegiate Cyber Defense Competition. Safety-tuned frontier models refuse defensive requests carrying security-sensitive vocabulary at 2.72 times the rate of semantically equivalent neutral requests. The refusals concentrate exactly where an organization under pressure needs help most: system hardening at 43.8 percent, malware analysis at 34.3 percent.
Those figures are bad. They are not the finding.
The finding is that explicit authorization, where the user tells the model plainly that they hold the authority to do the work, increases the refusal rate. The authors' reading is that models treat a justification as adversarial rather than exculpatory. Their diagnosis of the cause is flatter still: current cybersecurity alignment runs on semantic resemblance to harmful content, with no reasoning about intent or authority happening anywhere in the process.
Put that beside the register and hold both in view. The institutional layer says prove you are legitimate and you may hold the capability. The interaction layer says the more clearly you assert your legitimacy, the more certainly you are refused. Legibility is demanded upstairs and punished at the keyboard, and the same word covers both.
They asked her to prove she was allowed. Saying so was what got her refused.
Who the wall is for
The companion finding is the one that should end the conversation about whether this is a tuning problem.
The defenses that most aggressively suppress harmful output are the same ones that most aggressively refuse legitimate work, with over-refusal increases above 80 percent in the more zealous configurations. And the refusals fall to anyone who cares to push. Declare a scope and rules of engagement. Proxy the target behind a localhost address. The techniques are trivial to conceive and have been documented for longer than some of the evaluated models have existed.
So the wall does not stop the person who has decided to climb it. It stops the person who was going to knock.
There is a second-order version worth naming, because it lands inside this newsletter's usual territory. A human practitioner absorbs a refusal by rephrasing, working around, or doing the task manually at two in the morning. That absorption is unpaid labor, and it gets its own episode in The Door at the Desk. An autonomous defensive agent may simply stop, in the middle of an incident, unless somebody designed retry or escalation behavior into it. Nobody finds out until later.
Incidence
Which gives the week its most portable idea, and it comes from tax.
Incidence is the difference between who a levy is written about and who ends up carrying it. A tax on landlords is frequently paid by tenants. The statute is not lying; the statute is simply not where the answer lives. You find the answer by asking who cannot avoid it.
Apply that to any control on capability and the analysis becomes short. Written about attackers, carried by defenders, because an adversary operating outside every terms of service ever drafted has no relationship through which a refusal could reach them. Written about foreign adversaries, carried by every non-American user of a US model, because the directive reaches the vendor and the vendor reaches its customers. In both cases the party the rule was aimed at experiences nothing at all.
This is not a claim that anyone acted in bad faith, and the arc does not need one. Incidence does not run on intent. It runs on reachability, and it produces the same distribution whether the people designing the control are cynical or sincere. Sincerity makes it more durable, since a cynical policy can be embarrassed and a sincere one is defended by people who believe in it and should not have to apologize for that.
The remediation says it out loud
And then the corrective action, which does the work no argument could.
What OpenAI documents is that Hugging Face joined Trusted Access and received support drawing on its model capabilities. It does not say a lower-guardrail build was handed over, and this desk is not going to assert one.
The documented version is enough. The standard product refused the analysis. What changed the answer was admission to a program. Read those two facts together and the capability was never the hazard being managed, since the same capability became available once the recipient changed category.
Follow that for everyone still outside. If admission is what unlocks a defender's analysis, every organization that has not been admitted is working the incident with whatever the standard product will agree to look at. The clinic with ransomware in its imaging system has not been admitted. Neither has the water utility with two people in IT.
Check what the program says about itself and you will find no mention of exposure. OpenAI publishes no admission checklist, so what follows is this desk's reading of the public description rather than a quotation of policy. Access appears to turn on verified identity, a demonstrated role in defensive security work, the use intended, and a judgment about whether granting it strengthens the wider ecosystem. Vetted individual researchers qualify, so the register is no corporate members' club, and the argument gains nothing by pretending it is one.
What the criteria test is standing inside a profession. Every one of them is satisfied more easily by somebody already employed in security, with an organization to vouch for the identity and a job title that names the role. The machinery is white-collar rather than corrupt, and that is what makes it durable. Nobody is taking bribes. There is a form, and it asks what you already are.
One company across, the shape is starker. Anthropic's Project Glasswing opened in April 2026 to roughly fifty organizations, fronted by a founding group that included AWS, Apple, Cisco, Google, JPMorgan Chase, Microsoft and NVIDIA, and added about a hundred and fifty more that June, with a stated intention to prioritize critical infrastructure operators and maintainers of essential open-source software as it widens. Every line of that is defensible on its own terms. It is still a list, drawn up by the holder, of who receives the working version.
The register does not sort by who is most at risk. It sorts by who can be made legible as trustworthy to the party holding the capability.
What the arc is not saying
Two refusals of its own, because this is the episode where the argument could most easily overreach.
It is not saying that guardrails never protect anyone. Walking an unidentified caller through exploitation and lateral movement is a genuine harm, and refusing to do it is a defensible default. The claim is narrower and harder to answer: a control whose incidence falls on the defender by construction, whose exemptions sort by institutional legibility, and whose own vendor concedes it obstructs defense, is doing something other than what it says on the label.
And it is not saying that open weights are innocent. They distribute offensive capability to parties nobody has vetted, and the arc does not settle that. What the arc settles is narrower and more damaging. On this occasion, the dangerous capability was the estate's own, running unguarded by permission, and the restriction landed on the party it injured.
Tomorrow the arc turns on the one prescription that could close the loophole, and finds out what closing it would cost.
Companions
- The measurement: Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders, arXiv 2603.01246.
- The trade curve and the bypasses: Jones, Dziemian, Fredrikson and Kolter, A New Framework for Cybersecurity Refusals in AI Agents.
- The program criteria, worth reading straight: Trusted Access for Cyber.
- The other register, and its founding membership: Project Glasswing.
- The house's earlier finding on manufactured surfaces: Four in the Room.
These notes come out of Sociable Systems, a practice that reads AI-shaped documents the way a hostile reviewer will, before a lender or a court finds the gap. The argument has an operational form: the Interim Protocol sets out four rules for AI use in environmental and social deliverables, covering disclosure at touch-point grain, evidence custody, the phrases no automated screening may settle, and a hostile read before anything ships. Free, and written to be cited or retired once institutional guidance arrives.