Why the Best General AI Model Keeps Losing to Narrower Ones on Security

Anthropic didn't stumble into a weak cybersecurity score with Claude Opus 5. It capped the model's offensive security capability on purpose, a deliberate trade-off to limit misuse risk. The consequence is that specialized systems like Sakana AI's Fugu-Cyber and Google's Gemini 3.5 Flash Cyber now outperform Opus 5 at penetration testing, not because they're smarter overall, but because they were built for exactly one job and allowed to be good at it without a safety ceiling in the way.

That's an unusual dynamic in an industry that has spent years selling breadth as the selling point. The frontier labs' pitch has generally been: one model, competent at everything, so you don't need a toolbox. Security is turning out to be the domain where that pitch breaks down first, because the thing that makes a model good at finding vulnerabilities, aggressive, exhaustive probing of a system's weak points, is the same behavior a safety team has every reason to constrain in a general-purpose product used by millions of people. Anthropic's choice isn't a failure of engineering. It's a legible trade-off: broad safety versus narrow capability, and Opus 5 chose the former on this axis.

The other side of the same coin

Alibaba's response to a related problem is instructive precisely because it isn't about model capability at all. Its in-session code review catches vulnerabilities in AI-generated code before they land in a repository, rather than relying on the coding model itself to avoid writing insecure code in the first place. That's an architectural answer to the same underlying issue: don't expect a general-purpose model to also be a reliable security gate. Bolt a dedicated reviewer onto the pipeline instead. Whether developers actually let that reviewer run on every commit, rather than disabling it under deadline pressure, is the real open question Alibaba's rollout has to answer.

Meanwhile, the threat side of this picture is not standing still either. A newly documented zero-query attack lets adversaries extract proprietary models from cloud APIs using only timing and memory side-channel data, without sending a single query the provider could log or flag. That's a meaningfully different threat model than the prompt-injection and jailbreak concerns that have dominated AI security coverage. It targets infrastructure, not the model's judgment, and no amount of capability capping on the model itself does anything to stop it.

What this adds up to

Put these three developments together and a picture emerges: AI security is fragmenting into specialized layers rather than consolidating into one trustworthy general model. Offensive security testing is moving to purpose-built systems free of the constraints a consumer product needs. Defensive code review is moving to dedicated tools bolted onto the development pipeline rather than trusted to the coding model's own judgment. And infrastructure-level threats like model theft require a different kind of defense again, one that has nothing to do with how capable or safe the model itself is.

For any enterprise renewing an AI security contract on the assumption that a leading general model is automatically the leading security tool, that assumption no longer holds. The practical move is testing narrow, purpose-built alternatives against the specific job at hand, penetration testing, code review, threat detection, rather than assuming the smartest model in the room is also the best at defending it.