With the Railway hack, cyberchaos sort of officially begins in my not-so-experienced eyes. Defenders have **a lot** to fix. Attackers are much more agile.
Like, you can build a harness that tries to penetrate 1000 repositories at the same time in a pretty offensive manner nowadays, and the cost is almost nothing for any state actor. Even a solo blackhat can do it.
We've seen sad glimpses of these in the last two months in the Bitcoin world. A couple hundred million dollars stolen. Always knew it'd eventually arrive at our good old software too, but never thought it would be this soon.
Also really important distinction: "ban open models" idea is DUMB
Like, you cannot. Aside from ethics, it's over. Pandora's box was opened a long, long time ago. If you ban it, other countries still won't. If you ban it, you will prevent developers in your country from defending themselves without KYC for low cost, without any refusals. Don't.
Ok cool.
Now you need to learn how to defend yourself.
Best way is obvious: Scan, scan, scan. Read, read, read. Check, check, check. Patch, patch, patch. Be careful. Read things.
Try to hack things on your own. Like, your own system. Hack it and fix it.
Buy a 10 bucks opencode sub, try all models, build multi model harness for yourself.
Last but not least
American frontier labs are also very slow on supporting defensive efforts. Putting everything behind KYC is dumb for blue teaming. Heck, it even blocks you from blue teaming sometimes still. Do better please. I know that you're a for-profit company, but still. Please.
Things are also costly. I dont care how governments work, but small-middle sized businesses are in great, great danger, and the best method to save them is to allow them to spend some quality tokens. Make it happen. Somehow.
Let's survive this together. Best of luck.