安全事件响应不该全靠商业 API，Astra 也在受限名单
安全从业者建议保留开源模型作兜底，并指出 OpenAI 和 Anthropic 的拒答机制仍很烦人，可信访问计划只覆盖旧模型，Astra 等新模型不在内。
- obviously IR has worked without AI for decades. your response process shouldn't completely rely on praying a commercial api won't refuse you mid-incident. you also have options… at least keep open models in your fallback stack. - dumping raw malicious code and logs into an agent asking “we got hacked, what do we do” is guaranteed to trigger refusals. hire actual security engineers… they know how to break down the investigation step-by-step so you don't trip safeguards. - that said, anthropic and openai safeguards are still insanely annoying and sometimes trigger even on basic “fix this” queries. - trusted access programs need to do way better… daybreak blue still only gives reduced refusals on older models, leaving out newer models like 6.1-sol and astra (not to mention the mess around the approval process, naming, and access tiers).
这条是引用着另一条写的：x.com/andrewcurran_/status/2111837963214794940