After PHP vulnerability disclosure, no massive attacks arrived: the network security bottleneck is patching, not AI
Kimi deliberately capped its own attack capabilities to demonstrate responsibility; the massive hacker exploitation predicted after PHP's critical vulnerability disclosure never materialized — the bottleneck is enterprises not patching for years, not AI capability strength.
The video won't play here. Listen to the audio instead:
The argument · tap a timestamp to hear it
High scores conceal gaps: Kimi excels at narrow, test-like tasks
Kimi K3.1 Pro ranks third or fourth on Artificial Analysis, close behind Claude 5.5 and Muse Wonder Full, but trails GPT-6 Astra by 20 points on Terminal-Bench Science and other long-horizon benchmarks, with clear weakness on ProgramBench. Florian explains this through benchmark design differences: Artificial Analysis has short time windows and clear objectives—what he calls ‘exploitation’tasks—while ProgramBench is an ‘exploration’long-horizon task requiring the model to discover what to do on its own, demanding entirely different RL training approaches. Kimi's reinforcement learning is clearly biased toward the former type, creating visible score gaps across different benchmarks.
Kimi deliberately capped its offensive capability at release
Kimi's blog states its open-source principles explicitly: it does not release weights extending the cutting edge of network attack capabilities; K3.1 Pro's attack capability is intentionally lower than what the team's training pipeline could have achieved, and also lags closed-source flagship models. The method: during mid-training, the team deliberately reduced the weight on network-attack-related data. Florian sees this as wise—genuine long-horizon penetration capabilities currently exist only in closed-source models like GPT-5.6 Sol; removing CTF-style training doesn't hurt defensive capabilities and instead lets Kimi claim the ‘responsible actor’position against accusations that ‘open source equals danger.’
— Florian BrandAfter PHP disclosure, the predicted mass attacks never arrived
OpenAI's Patch the Planet project, working with other researchers, uncovered a long-standing PHP remote code execution vulnerability. Since PHP powers WordPress and countless other sites, many went offline immediately upon patch release. After disclosure, a tweet claiming to show ‘DeepSeek swarms’auto-fixing the vulnerability circulated—authenticity unclear but became a meme. Florian stresses the actual situation: mass-scale exploitation never happened. Most cybersecurity professionals are paid specialists fixing vulnerabilities for a living; individual malicious actors are a minority; nation-state actors already have their own capabilities and don't need open-source models for attack power.
— Florian BrandLiteLLM's two breaches trace to human key mismanagement
LiteLLM, widely used across the industry, was breached for the second time this week. Initial reports show the root cause: an API key was committed to GitHub and sat there for 5 months without anyone noticing, later used to spread malware. Florian also mentions a friend at an SME who checked their PHP version after the vulnerability disclosure only to find it hadn't been updated in years and no longer receives security patches. These cases point to the same conclusion: today's cybersecurity fragility stems more from enterprises and individuals not patching for years, rather than attack tools becoming stronger.
— Florian BrandNathan admits he underestimated the vulnerability growth curve
Nathan revisits his own judgment from weeks prior—‘open-source models could have been fine’—and admits he never seriously compared it against the network security field's pre-ChatGPT vulnerability-discovery exponential growth curve, which was already trending upward. He failed to explain this clearly and didn't factor it into his prediction. He points out causation is hard to untangle: more vulnerabilities are disclosed now, but is this from open-source model capability spreading, or from OpenAI and Anthropic's trusted-access programs accelerating patch deployment? The evidence currently points more toward the latter.
— Nathan LambertRefusing to hire new graduates signals security culture erosion
In response to Anthropic's announcement that it will no longer hire junior employees, Florian sees this as beneficial for other companies—they can absorb talented young people willing to work hard. From his China visit: teams letting young PhDs grind away on clusters move very fast. Nathan argues that while Anthropic talks about preparing society for superintelligence's social transformation, it refuses to invest training time in young people—exposing the lab's ‘rush culture, no time for people’mindset. Such decisions will resurface when youth unemployment discussions heat up and will backfire.
Muse already handles Florian's actual relocation logistics
After moving to the US, Florian relies heavily on Meta's Muse agent for relocation work: canceling German accounts, processing social benefits, buying a full kitchen setup. Muse proactively reminds him: ‘you have this appointment, need this form, you should have it because you hold an O-1 visa’—far more useful than another assistant, Dots, which only says ‘I handled the Slack message you sent two days ago.’When shopping, Muse generates a Stripe one-time card to check out; if Muse or the merchant is compromised, only the disposable card is exposed, not the real one. The tradeoff: slow speed and occasional browser crashes requiring rebuilds, but CAPTCHAs cannot stop it.
— Florian BrandAgent-to-agent discovery has no infrastructure yet
Nathan is reluctant to let an AI agent call a new dentist, feeling any real person interaction should stay authentic as mutual respect; but he's happy to hand off customer service forms and chatbot interactions. The bigger problem: cold start. There's currently no convenient way for one person's agent to find another's. Questions loom: should there be agent contact on a personal homepage? Should people charge—‘pay $1 for an agent to message you’? The entire ‘front door’infrastructure for agent-to-agent discovery doesn't exist yet.
— Nathan LambertIn their own words · checked verbatim
K3.1 Pro’s offensive cyber capability is, by design, below what our pipeline can produce, and remains behind that of frontier proprietary models.
Nathan Lambert8:15
Wait, did you see the tweet about the DeepSeek swarm fixing it ?
Nathan Lambert17:37
They did a preliminary report that the reason why they got hacked again is that they had an API key committed to GitHub for five months.
Florian Brand19:49
I still do think if there was a DeepSeek swarm that hacked an American company, the political fallout would be insane.
Nathan Lambert27:49
the number one thing you need to do is keep training people so that they are fulfilled and have things to do with their life.
Nathan Lambert32:24
If Muse f***s something up or the shop f***s something up, it’s not my credit card. It’s a one-time credit card which doesn’t exist after the transaction.
Florian Brand39:29
Maybe I’m a boomer, but I feel bad having an AI agent call my prospective new dentist.
Nathan Lambert42:37
Figures
| Kimi K3.1 Pro parameter count | 3 trillion | 6:44 |
| Kimi vs. previous-generation parameter count | 3 trillion vs. 700 billion | 6:44 |
| Terminal-Bench Science vs. GPT-6 Astra | 20 points behind | 2:38 |
| LiteLLM exposed API key on GitHub for | 5 months | 19:49 |
| Pangram AI email detection service monthly fee | $20/month | 42:37 |
Glossary
- astroturfing
- Hiring paid actors to pose as organic grassroots supporters while hiding their compensation.
- abliterated model
- Open-source model variant with safety refusals removed, making it more prone to misuse.
- B300 / NVL72
- Nvidia high-end GPU clusters required for ultra-large models; single machines cannot accommodate models at the multi-trillion-parameter scale.
- PHP2Shell
- Exploiting PHP vulnerabilities to execute arbitrary commands directly on servers.
How to listen
Security or AI practitioners assessing open-source model cybersecurity risks and needing to explain to their teams what vulnerability disclosure means; plus anyone wanting to know what AI life agents can actually do.
The opening Kimi launch-event marketing gossip carries low information density and can be skipped.