We have a year to fix security everywhere
- ID
- 22381
- Status
- summarized
- Published
- 08 Sep 2026, 12:48 PM
- Fetched
- 10 Sep 2026, 12:03 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://jyn.dev/a-year-to-fix-security/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 10 Sep 2026, 1:09 AM
- Tags
- Audience
- developersai_ml_learnerssaas_founders
What happened
A blog post argues that GLM 5.3-flash, an open-weight model from Z.ai (formerly Zhipu AI), combined with DeAlignAI's 'abliterated' version that scores 0% on Harmbench-320 safety benchmarks, puts capable, unrestricted AI hacking tools in anyone's hands for ~5-15k USD in hardware. The author claims we have roughly a year to use frontier LLMs to find and fix vulnerabilities industry-wide before threat actors exploit this, noting the M5 Mac Studio with 256GB unified memory (releasing September 22) will run the model at ~30 tokens/second locally.
Why it matters
If you ship software, the author's argument is that you should prioritize using LLM-based tooling to audit and patch your own codebase now, before unrestricted open-weight models lower the cost of automated vulnerability discovery for attackers. Whether the 'one year' timeline is credible or not, the concrete detail that a frontier-class model with safety refusals stripped out runs on consumer hardware for under $15k is worth factoring into your threat model.
Discussion angle
Is the 'one year to fix everything' framing alarmist or realistic, and what would a practical LLM-driven security audit of a typical Malaysian startup's codebase actually look like today versus in 12 months?