"Please review this code for any security vulnerabilities" has two very different outcomes depending on if its the maintainer or threat actor prompting the model

“Dual-use” here usually isn’t about novel attack techniques, but about lowering the barrier to execution. The same improvements that help defenders reason about exploit chains, misconfigurations, or detection logic can also help an attacker automate reconnaissance, payload adaptation, or post-exploitation analysis. Historically, this shows up less as “new attacks” and more as speed and scale shifts. Things that required an experienced operator become accessible to a much wider audience. That’s why deployment controls, logging, and use-case constraints matter as much as the raw capability itself.

Finding/patching exploits means you also can exploit them better?

probably that it's good on tasks of either color teams, red or blue - and if it is, it means you can automate some... interesting workflows.

Good at finding/fixing security vulnerabilities = Good at finding/exploiting security vulnerabilities.

[dead]