[Former Anthropic Employee: Black Hats Use Claude and Codex, White Hats Prefer Open-Source Models] According to monitoring by Beating, OpenAI and Anthropic employees discussed on X that once open models catch up to the strongest closed-source models, automated attack capabilities will no longer be controlled by platforms. However, former Anthropic employee Noah Lebovic stated that currently, real black hat hackers primarily use Claude Code and Codex. Some attackers he knows purchase discounted subscription tokens from gray or black markets. When accounts are banned, they simply switch to new ones. Closed-source models are more powerful, subscription prices are lower, and security restrictions are just hurdles to bypass. Legitimate security teams, on the other hand, rely more on open-source models. These models cannot jailbreak or continuously switch accounts, and real vulnerabilities, attack commands, and exploit code are more likely to trigger interception by closed-source models. Lebovic mentioned that he knows of three legitimate penetration testing teams that have already adopted GLM 5.2 as their primary model. Previously, Lebovic used Opus 4.6 during authorized testing to take over bank accounts and access medical records. He believes that current safeguards are more effective at blocking rule-abiding defenders, while those with malicious intent can still find ways around them. [Original Link]