Tarun Chitra: AI labs' caution pushed Black October patchers to open models

Tarun Chitra, a regular host of Unchained's The Chopping Block and introduced on the show as running Gauntlet, argued on the episode The Chopping Block: Black October, Banks Blocking AI Agents, Hyperliquid's Blockchain-Not-Bitcoin Moment, and the Visa-Fireblocks Rumor, published 24 October 2026, that closed AI labs' fear of liability left people reaching for open-source models during the week's scramble to patch PHP2Shell, one of the incidents in what has been called Black October. He also argued crypto's hack-driven security habits now run ahead of Silicon Valley's. The claim matters to anyone picking a model for live incident response.

The argument

Chitra was responding to a co-host's rundown of the PHP2Shell vulnerabilities and the Railway breach that followed. He said the week repeated what had happened during an earlier Hugging Face incident, at scale, with people trying to patch their systems using Claude, which he said "will obviously block you from doing anything to protect yourself." (from 15:16). OpenAI, he said, also blocks users but steers them to its Daybreak program, which he called easy to join. Access to Mythos, he said, was much slower, so "you can't really rely on it in a live attack where you need to patch immediately" (from 15:32). The open models, he said, were what people actually used: "the main lab models wouldn't do it for you. So you had to like go open source." (from 16:00). He drew a general rule from it: work where the model provider carries high liability, such as trading or live security, will not be done on closed models.

Turning to crypto's own record, he said "everyone in crypto had to deal with this in February and March of this year. And I think people have spent a lot of time on like live threat detection, security posturing, figuring out sandboxes" (from 12:06), arguing the industry's history of hacks left it better prepared than mainstream software firms, which he said are now trying to buy crypto auditors.

What it rests on

Black October is the name given to October 2026's cluster of incidents, including the PHP2Shell vulnerabilities, a compromise of certificate-authority keys at eMudhra, a supply-chain attack on LiteLLM, and a GitLab remote-code-execution flaw, as Wikipedia's summary lays out.

Anthropic's own usage policy does not describe a blanket ban on defensive work. It states that its restrictions on compromising systems do not prohibit security research, testing, or tool development conducted on systems you own or operate, with the authorization of the system owner, though work covered by what it calls real-time cyber safeguards requires applying for adjusted access through its Cyber Verification Program. That is a carve-out with a gate. Chitra's complaint was about the gate's speed in a live incident, which the policy does not address.

OpenAI runs a comparable gate. Its Daybreak access overview says the program is designed to support legitimate security workflows by reducing unnecessary friction through more precise safeguards, and that reduced refusals are reserved for its Daybreak Blue and Red tiers, which require separate verification or approval. That supports Chitra's point that getting past default friction meant signing up for something, through a verification process.

On the PHP2Shell response itself, OpenAI described its own role differently. As CNBC reported, OpenAI said researchers working with its models helped uncover the vulnerabilities, and that it had spent two months coordinating a fix with software maintainers and security providers ahead of public disclosure.

Where it was discussed

• Unchained: The Chopping Block: Black October, Banks Blocking AI Agents, Hyperliquid's Blockchain-Not-Bitcoin Moment, and the Visa-Fireblocks Rumor, 24 October 2026, from 12:06