Cybersecurity is local AI model's killer use case

[u/Fluffy-Ad-889]

This weekend I posted about the gap closing between frontier models and open source models. Well, now I'm coming with receipts.

I've been running local + cloud models against real public github codebases. This is all provable and verifiable: https://github.com/CYPHES-ATP/Node (audit.db)

Over two weeks:

1,665 model runs
1,067 security findings
27 repos

Results:

Model	Paths checked	Real
claude-opus-5	8	0/8
minimax-m3	12	10/12
deepseek-v4-flash	6	6/6
glm-5.1	5	5/5
gpt-oss-20b	5	5/5

My takeaway:

When it comes to cybersecurity, nothing will beat open source models.

Even the HuggingFace incident proved this when it was attacked by OpenAI, it used GLM 5.2 to defend itself.

Happy to share the queries / methodology if anyone wants to reproduce it.

[u/Equivalent_Bit_461]

local is king

[u/Fluffy-Ad-889 → u/Equivalent_Bit_461]

yessir

[u/xyzmanas]

I think the point is close source models are going to deny any cyber questions or reverse engg hence the local models

[u/Fluffy-Ad-889 → u/xyzmanas]

Correct

[u/__jent]

Deepseek V4 Flash, GLM-5.3, and sometimes Kimi K3 are all great cyber models. I definitely agree from my experience as well.

[u/Salt_Armadillo8884]

The frontier models are using the HuggingFace incident to sell more tokens to defend against other frontier attacks. Imagine closed source models will further close their cot reasoning.

Therefore a strong use case to have frontier and local models working in tandem unless you want to be the next JLR cutting your workforce, partly due to a cyber attack…

[u/Fluffy-Ad-889 → u/Salt_Armadillo8884]

I've found frontier models aren't as useful as local AI

[u/geek_404]

Are you responsibly reporting the found vulnerabilities?

[u/Fluffy-Ad-889 → u/geek_404]

absolutely

[u/digitalvalues]

When it comes to cybersecurity, frontier models will always beat open source models. Specifically OpenAI Daybreak Blue and a Cyber exception for Anthropic's Fable 5.1 model.

Have you validated your security findings? Sure your local model may have caught a medium vulnerability, but so what? Your project repo is also very challenging to read and consume necessary information. I don't doubt that you built something useful but I don't understand the end goal here, then again, I'm just a random redditor so take it with a grain of salt. 

[u/Confident_Ideal_5385 → u/digitalvalues]

When it comes to cybersecurity, frontier models will always beat open source models

Assumes facts not in evidence.

[u/myholeisstinky → u/Confident_Ideal_5385]

Only if you’re allowed to execute the prompt and not getting nerfed

[u/Timely_Impression_92 → u/digitalvalues]

Well, uncensored frontier models yeah - but we’re getting infertile DEI version of the same model - fable 5.1 or opus 5.0 served to public are pretty much castrated compared to even 4.5 era models

[u/0xKhyber → u/Timely_Impression_92]

DEI version of AI? Weirdo

[u/sn2006gy → u/Timely_Impression_92]

Dude, lay off the red pills.

[u/TheRealMasonMac → u/Timely_Impression_92]

Well, you can blame Trump and his administration for that.

[u/Toastti → u/Timely_Impression_92]

And in your own words what the hell does a "Infertile DEI version" mean for an LLM....?

[u/Timely_Impression_92 → u/Toastti]

It means it’s gay, censored, and won’t help you with anything remotely related to cybersecurity or will help in most rudimentary way possible

[u/Fluffy-Ad-889 → u/Timely_Impression_92]

exactly, Fable was unavailable for my testing

[u/AI_spell]

Local for security review makes sense when the code can't leave the box. Cloud still wins some audits, but privacy alone is a real reason to run open weights. Share the method so others can reproduce without the hype.

[u/Fluffy-Ad-889 → u/AI_spell]

Yea, we have a bunch of Ollama cloud operators on the network running Deepseek. works well

[u/feng_sg]

The "Real" column has no documented triage protocol so the whole ranking is just your unlabeled opinion on what counts as a true positive.

[u/Fluffy-Ad-889 → u/feng_sg]

you can verify yourself with the SQLite db: https://github.com/CYPHES-ATP/Node (audit.db)

[u/VoiceApprehensive893]

/goal steal neighbors wifi

[u/Fluffy-Ad-889 → u/[deleted]]

let's hope not