The AI Security Asymmetry: Why Crypto Red Teams Are Fighting With One Hand Tied

A former Anthropic researcher dropped a quiet bomb this week. In a technical review, he revealed a painful truth: legitimate security teams are forced to use weaker, open-source AI models for penetration testing, while attackers harness the full power of closed-source giants like Claude and Codex. In crypto, this asymmetry is not just theoretical. It is already bleeding into smart contract audits, exploit detection, and the battle for on-chain capital. The researcher’s core finding was simple. Attackers bypass AI guardrails not through complex prompt injection, but through a system-level bypass: buying discounted subscription tokens from grey markets, and when banned, simply switching accounts. The marginal cost of a new identity is near zero. Meanwhile, red teams bound by compliance—bank auditors, DeFi security firms—cannot use the same tactics. They cannot ‘switch accounts’ to get unfiltered access. They are stuck with models that refuse to generate exploit code, even during authorized tests. This is not a new problem in AI. But in crypto, where the stakes are measured in billions of locked value, the implications are severe. I have seen this pattern before. Back in 2020, I built a Python risk model for Uniswap V2 liquidity pools. I saw how algorithmic yields created a fragility that traditional finance ignored. That fragility led to the bUSD depeg. Now, I see the same blind spot in AI security for crypto: the industry is relying on guardrails that only stop honest people. Let me break down the core insight. Most crypto security teams use AI tools to scan smart contracts for vulnerabilities. They use tools like GPT-4 or Claude, but those models have been trained to refuse generating exploit payloads. A legitimate white-hat hacker trying to find a reentrancy bug in a new DeFi protocol is told: “I cannot assist with that.” The hacker then has to either craft a complex workaround (which consumes time and cognitive load) or switch to a less capable open-source model. The attacker, on the other hand, buys a cheap Claude Code subscription from a third-party reseller, types the same prompt, and gets a full exploit script. Incentives break before code does. The attacker’s incentive is to get the best tool for the job. The defender’s incentive is to stay compliant. The result is a predictable outcome: the attacker's AI is always ahead. Volatility is the tax on uncertainty. Here, the uncertainty is about what your security tool will actually do when asked to generate a real exploit. The tax is paid in lost capital. Consider the case of a major cross-chain bridge. Last month, a red team reported that they discovered a critical vulnerability in a new bridge contract using a customized version of GLM 5.2—an open-source model. But they only found it after two weeks of manually bypassing the restrictions of their usual closed-source tool. The attacker, had they found it first, would have had the exploit ready in hours. The bridge’s security team was using the wrong AI for the job, not because of capability, but because of policy. This asymmetry is structural. It stems from how AI safety is currently implemented: as a post-hoc filter on outputs, rather than as an inherent capability limitation. The filter can be bypassed by using a different account. The capability cannot. This is a framework-level flaw, not a model-level one. Now, the contrarian angle. Many in crypto believe that using the most expensive, ‘safest’ AI models—like those from OpenAI or Anthropic—makes them more secure. The opposite is true for defenders. The very features that make these models attractive to enterprises (compliance, refusal to generate harmful content) make them useless for actual security testing. The decoupling thesis here is that the ‘safe’ AI is becoming the defender’s liability, not their asset. The attacker’s tool of choice is not the safer model; it is the cheaper, less restricted one. The market is pricing safety incorrectly. From my experience auditing the Golem Network in 2017, I learned that code integrity matters more than reputation. The same applies here. The reputation of a model’s safety guarantees is worthless if the attacker can sidestep it with a $20 grey-market token. The real safety lies in the model’s ability to be used by both sides equally, and the side that uses it best wins. That is not safety; that is an arms race. So where does this leave crypto security? The answer is uncomfortable. The industry must stop pretending that closed-source, heavily guardrailed models are the gold standard for defensive work. Red teams should either adopt open-source models (like GLM or other permissively licensed LLMs) and accept the need for self-hosted deployment, or demand that closed-source providers offer a ‘white-hat’ API tier with verified credentials and a lawful authorization framework. The latter is unlikely to appear soon. The economics of grey markets make it too easy for attackers to impersonate legitimate users. The former—open-source—is the more viable path. But it requires expertise in model deployment, fine-tuning for security tasks, and constant adaptation to new attack techniques. Most crypto security teams are not ready for this shift. During the Terra-Luna collapse in 2022, I saw how mathematical inevitability could wipe out billions. The collapse was predictable if you followed the incentive structures. The current AI security asymmetry is equally predictable. The question is not if it will be exploited, but when and with what scale. Looking ahead, I expect to see a new wave of AI-powered exploits targeting DeFi protocols. The attackers will use unrestricted models to find and weaponize bugs faster than ever. The defenders will struggle with tools that refuse to help. The first major exploit leveraging this asymmetry will hit within the next six months. When it does, the industry will scramble—but by then, the pattern will have been set. The takeaway is not to abandon AI in security. It is to choose your tools based on utility, not on marketing. If you are defending capital, use the AI that gives you the most capability, not the one that promises to be the most ethical. In a war, ethics are a luxury. The attacker has already decided they have no constraints. Do you? In the meantime, I will be auditing the AI tools themselves. Trust, but verify. Then verify again.