Vercel's CTO names the model that makes this generalizable: Kimi K3, open weights, no offensive-security safeguards, top of DeepSec Bench.

Malte Ubl argues defenders hold a temporary edge because they can run stronger models than attackers, and that edge is closing (Vercel). K3 matches Sonnet 5 and beats Opus 4.8 on vulnerability discovery; asked to escape Vercel Sandbox it mapped attack surface, found privilege-escalation paths, built VM environments and wrote fuzzers on its own. No successful escape. He names Sol 5.6 on XHigh as today's best defensive model and says Vercel spends tens of thousands quarterly on deepsec reviews. They're opening the Sandbox egress firewall to the Hobby plan and planning a HackerOne program that covers researchers' AI costs.