Former Anthropic Employee: Hackers Use Claude and Codex, White Hats Stick to Open-Source Model

According to DeepDive Beating Monitor, employees from OpenAI and Anthropic discussed on X that once open models catch up to the strongest closed-source models, automated attack capabilities will no longer be platform-controlled. Former Anthropic employee Noah Lebovic, however, stated that the real hackers are still mainly using Claude Code and Codex.

Some attackers he knows purchase discounted subscription tokens from the gray-black market. After their accounts are banned, they continue to create new accounts. The closed-source models have greater capabilities, lower subscription prices, and security restrictions that are just a threshold to bypass.

On the contrary, formal security teams rely more on open models. They cannot engage in rule-breaking jailbreaking or constantly switch accounts. Genuine vulnerabilities, attack commands, and exploit codes are easily detected by the closed-source models. Lebovic mentioned that he is aware of three formal penetration testing teams that have adopted GLM 5.2 as their primary model.

Lebovic had previously used Opus 4.6 to take over a bank account and access medical records during authorized testing. He believes that existing barriers are easier to block law-abiding defenders, while malicious actors can still find a way around.