Happy 250th! God bless 🇺🇸🇺🇸 🦅

DoorDash of china producing a model that performs better than GPT5.5 in key benchmarks while we are arguing whether to release frontier models. WTH is happening?

Every defender should be paying attention to this.

Open source is getting so good. This is a 1 bit quantized model running on a mac vs huge models.

This is one of the biggest risks to our modern society in the immediate term. Precisely why we founded @depthfirstlabs to help protect organizations.

We've been eval'ing and post training open source models for a bit now - its amazing to see how good they are getting.

All day using GLM 5.2. Didn't miss much. First open model that passes the bar as a daily driver. Things are not going to be the same. Damn, now I want to buy some serious hardware.

This is exactly what we are seeing in our benchmarks

We ran our (very hard) internal security benchmarks on one of the recently released open source models (locally hosted of course) and it performs close to the top frontier models. This is before any post training on our side. Name of model is hidden on purpose. Defenders really need to catch up quickly!

Recent developments have shown us why defenders should avoid becoming too dependent on any single model or provider. Security teams need critical capabilities to remain reliable, available, and consistent as models, policies, providers, and access change. That belief has shaped how we built @depthfirstlabs: use the best models available, including our own, but do not depend on any one of them. More in my article:

Great explanation of these gnarly vulnerabilities.

Thank you @FFmpeg. That's why we launched ODI, a $5m commitment to help maintainers of critical OSS projects use depthfirst to find, triage, and remediate vulnerabilities in their code and PRs. We’d love to give you access. More info here: depthfirst.com/open-defense

Recently, @depthfirstlabs with AI found 21 security issues. Legit, credit where it's due, some of them were serious. Whilst disclosure is nice, and some fixes were even sent out, like with the Mythos-found issues, the best would have been to avoid having the issues altogether.

We even wrote a blog post outlining some of this back in November of last year depthfirst.com/post/agent-ca…

This is what we at @depthfirstlabs have been saying for so long. There is a lot of value and performance optimizations that can be created outside the model itself and by leveraging multiple model providers.

I'm in Japan this week. Last night, I was having dinner at a small sushi restaurant tucked away in an alley in Tokyo. The chef asked what I do, and I told her I run an AI company. She immediately started talking about "all of the bugs and vulnerabilities that AI models are finding" and "how scary that is." Honestly, I was so shocked. This was a sushi chef in a random alley in Tokyo. That was the moment it really hit me: AI-driven cyber risk is no longer a conversation happening inside security teams and research labs. It's becoming something ordinary people are starting to understand and worry about. Software runs the modern world. As AI becomes capable of finding vulnerabilities at a scale humans never could, the gap between offense and defense will define the security of everything we depend on. When I explained that we're building AI to help organizations find and fix vulnerabilities before attackers can exploit them, she thanked me. Most days it's easy to get lost in models, benchmarks, customers, and product roadmaps. Then you have a moment like this and realize the work matters far beyond our industry. I've never felt prouder of what we're building at @depthfirstlabs.

What could go wrong?