You can fine tune a model from a year ago to get extended cyber capabilities. Fine-tunes dramatically increase capability in specific use cases and don't require a lot of investment. Attackers have been doing this for a while now, they aren't waiting for someone else to make them a security model.

I get how you feel, but it's too late to be concerned. The cat's out of the bag. It's like being scared of moving from the bronze age to the iron age... when everybody already knows how to make iron, and the raw materials are everywhere. People are already making iron spears. We need to make iron shields.

We need open-weight models that are good at finding security holes so we can apply them to all of our software by default, and close every possible security bug, before the attackers find them. Every piece of software in the world should be held for release until it's scanned by a high-powered security model.

This is the same debate we had in the 1990's when strong encryption was considered a munition and not allowed to be exported. This just made the world less secure. And it was pointless anyway, because you can't really stop it being developed and shared. Eventually good sense prevailed and now we all have strong encryption. The same thing applies to security bugs.