Codex and Fable Refused Security Fixes, Kimi K3 Delivered

Codex and Fable refused to patch a security report in a developer's own codebase, citing guardrails, while Kimi K3 fixed every bug, the developer said.

That leaves the bug open on the defender's side, while the guardrail does nothing to stop anyone exploiting it instead.

David Sacks amplified the report with a competitiveness framing: guardrails that block a defender just hand the advantage to whichever model doesn't have them.

Clement Delangue replied that his team hit the same wall the same week. "Very scary to be guardrailed as a defender when you know attackers are likely bypassing," he said.

None of this has been independently reproduced, and the severity labels on the original report haven't been checked outside the original post.

Even so, it lines up with a separate refusal Ng reported in GLM 5.2. Two unrelated complaints, the same failure mode, the same week.

Security teams that only have a hosted coding model will hit this same wall the next time a real vulnerability report crosses their desk. The workaround already exists: keep an open-weight model like Kimi K3 in the incident-response toolchain for the reports a primary tool won't touch.