Incident response shouldn't rely on commercial APIs; Astra left out of trusted access
A security practitioner argues for open-model fallbacks, says OpenAI and Anthropic refusals remain annoying, and notes trusted access still excludes newer models like Astra.
- obviously IR has worked without AI for decades. your response process shouldn't completely rely on praying a commercial api won't refuse you mid-incident. you also have options… at least keep open models in your fallback stack. - dumping raw malicious code and logs into an agent asking “we got hacked, what do we do” is guaranteed to trigger refusals. hire actual security engineers… they know how to break down the investigation step-by-step so you don't trip safeguards. - that said, anthropic and openai safeguards are still insanely annoying and sometimes trigger even on basic “fix this” queries. - trusted access programs need to do way better… daybreak blue still only gives reduced refusals on older models, leaving out newer models like 6.1-sol and astra (not to mention the mess around the approval process, naming, and access tiers).
This post quotes another post: x.com/andrewcurran_/status/2111837963214794940