Bender
8 hours ago
I can't go more than about ~4 hours without Claude (Opus 5.5) getting the [cyber] shock collar and most of the time it isn't even me asking Claude to perform a security analysis.
Making matters worse it's defensive security which leads me to my personal opinion and my personal conclusion it is not possible for people to get secure code out of Claude, in my opinion. Claude is programmed to write secure code but gets zapped by the [cyber] shock collar and then they try to up-sell Mythos but to use that I have to go through a verification program that I can't even apply for since I do not have an enterprise account.
Secure code is not a value-add. It is a mandatory part of software development. Surely they can find other means of revenue generation that do not assume secure code is optional.
Oh but I can just pick another model (downgrade). No thanks. Fortunately this is just hobby crap. I can not fathom depending on them for anything work related.
JoTurk
8 hours ago
Both Claude and Codex refused to help verify, triage, or develop proof-of-concept reproductions for any of the issues reported by oss-scanner. This was counterproductive, as we were trying to fix the vulnerabilities and coordinate CVE disclosures as quickly as possible. We already had detailed vulnerability reports from Anthropic, so refusing to help us validate and fix those same issues made no sense at all!