The people paid to hack systems before criminals do can’t get AI to help them. According to a 2025 SANS Institute survey, more than 67% of penetration testers hit AI refusals on legitimate security tasks multiple times per week. The attackers don’t face the same problem. That gap is getting expensive.
What’s Actually Happening
Offensive security is a legal, well-paid profession. Penetration testers, red teamers, and vulnerability researchers get paid to break into systems before criminals do. They find the holes so companies can patch them before someone gets hurt or sued.
But ask ChatGPT, Claude, or Gemini to help write a proof-of-concept exploit, analyze malware behavior, or test a phishing payload and most of these tools refuse. They treat the request the same way they’d treat a demand from an actual criminal. There’s no credentialing system. No professional verification. Just a blunt filter that can’t tell the difference between a certified ethical hacker and a script kiddie.
According to ISC2, the global cybersecurity workforce gap hit 4.8 million unfilled positions in 2025. Defenders are already stretched thin. AI should be the force multiplier that closes that gap. Right now it’s working against them.
The irony is brutal. The companies building these guardrails are spending billions on AI safety research. Meanwhile, the professionals whose entire job is protecting people can’t get a straight answer about SQL injection patterns because the word “exploit” triggered a filter.
The Part Nobody Wants to Say Out Loud
These guardrails don’t stop attackers. They slow down the defense.
A determined attacker doesn’t use the polished consumer version of ChatGPT. They use WormGPT, FraudGPT, or any of a dozen uncensored models that exist specifically because mainstream tools over-restricted. According to SlashNext’s 2025 State of Phishing report, AI-generated phishing attacks increased 4,151% over the previous two years. The criminals figured out the workaround fast.
The defenders didn’t get the same memo. Most enterprise security teams are required to use approved software. They can’t just download an uncensored model and run it locally without jumping through IT procurement hurdles that take months. They’re stuck working around refusals, rewriting prompts to sound less threatening, and wasting hours on tasks that should take minutes.
I’ve watched this play out in security communities online. Researchers post about spending 20 minutes rephrasing a basic query about buffer overflow techniques, only to get refused again because the AI detected the word “exploit.” A term that appears in every security textbook ever written. A term that certified professionals use every single day.
The AI companies optimizing for press coverage of AI safety are not optimizing for the people who protect your data. Those are two very different goals, and right now the press coverage is winning.
Some research teams have started using tools like InVideo AI to document and share their security findings as training videos since the content creation side doesn’t trigger the same filters. That’s a creative workaround. It’s not a solution to the core problem.
The core problem is simple. There is no difference in how these models treat a 15-year-old trying to hack his school’s grading system and a CISSP with 20 years of experience running a red team engagement for a Fortune 500 company. Until that changes, the defenders are fighting with one hand tied behind their back.
What This Means for You
If you work in security, this matters to your income right now.
Bug bounty hunters are affected most. The top earners on platforms like HackerOne and Bugcrowd clear over $500,000 per year according to HackerOne’s annual hacker report. That income depends on finding vulnerabilities faster than other researchers. AI should be a speed advantage. Right now it’s a bottleneck every time a refusal breaks your research flow.
Here’s what I would do if I were a full-time security researcher today.
First, learn to run local models. Tools like Ollama let you run uncensored models on your own hardware. No API restrictions. No refusals mid-workflow. The quality isn’t always as sharp as GPT-4 Omni, but it’s improving every month and it won’t stop you from doing your job.
Second, get specific with your prompts. Frame requests in defensive language. “How would an attacker exploit this configuration so I can build a detection rule” works better than “how do I exploit this.” It’s annoying that this matters. It does matter.
Third, build your toolkit from security-specific AI platforms. Companies like Protect AI are building AI for security workflows without the consumer-grade guardrails. These are worth evaluating now before the mainstream tools get worse.
Fourth, watch for deals on emerging security and research tools. Platforms like AppSumo surface specialized productivity and security tools at steep discounts before they hit mainstream pricing. The researchers who build their own stack now will have a real edge in 2027 and beyond.
Don’t wait for OpenAI to fix its content policy. Build around it.
The Bottom Line
AI companies are optimizing for optics. Security researchers are paying the price. Attackers cracked the workaround in 2024. Defenders are still arguing with chatbots in 2026. Until AI companies build real credentialing systems for security professionals, the people protecting your data are working at a permanent disadvantage. The attackers are not. That should bother every CISO, every security leader, and every person whose data lives inside a corporate network. Which is all of us.
Frequently Asked Questions
What are AI guardrails in cybersecurity research?
AI guardrails are content filters built into large language models that block responses the company considers potentially harmful. For security researchers, these filters often block legitimate offensive security queries including exploit analysis, phishing simulation, and vulnerability research, even when the request comes from a verified professional with a legal mandate to do the work.
Why do AI tools refuse cybersecurity research questions?
Most AI companies use broad keyword and intent filters that cannot distinguish between a criminal and a researcher. The systems are trained to avoid content that could theoretically enable harm, which catches a large portion of standard security research. The filtering is blunt, not precise, and there’s no professional verification layer to override it.
Are there AI tools built specifically for offensive security researchers?
Yes. Several companies are building security-focused AI tools with appropriate access controls for professional users. Local model deployment through tools like Ollama is another option that gives researchers full control. The space is growing fast, but the mainstream consumer AI tools remain the least useful option for professional offensive security work.
Is this a legal issue or a policy issue?
It’s a policy issue. AI companies have chosen to implement broad restrictions rather than build credentialing or verification systems. There’s no law requiring them to block security research. It’s a business decision that prioritizes reputation management over utility for professional users who have legal authorization to do the work.
What can offensive security researchers do about AI guardrails right now?
The most practical steps are learning to run local uncensored models, using security-specific AI platforms built for professional use, and rephrasing queries in defensive framing. Researchers who adapt their workflow now and build their own stack will have a measurable speed advantage over those waiting for mainstream AI tools to catch up.
