Open Proposal: Proof of Good Intention for Independent Security Researchers (ISRs) TL;DR: What if Bug Bounty / VDP platforms started distributing tokens and used their reputation platforms to attribute the cyber frontier model tokens to ISRs? To quote the open letter signed by all these big companies, one of the main goal in the coming months should be to: "Empower more defenders with cyber-capable AI". The best cyber models are available to a few companies (thankfully highly talented ones like @trailofbits have access to it), but not to independent security researchers and average-scale companies. On the other side, attackers have more AI power than ever: the open source models benchmarks are skyrocketing, they're easy to uncensor and chinese GPUs are getting quite powerful as well for a lower cost, also everyone has access to better models through AI providers. Independent Security Researchers (ISRs) with good intentions are slowed down because they have neither the best models, nor the means to build their uncensored alternatives. I think a good way to face the issue would be to help them to go faster and deeper with better models and harnesses. @trailofbits and @PashovAuditGrp open sourced their security review skills, @cantinasecurity is starting to open access to their harness to ISRs. This is the right direction, but we need to find a solution for the model side. Large firms are super efficient in using these smart model to contribute to the security space. ISRs will do more duplicated work, yes, but they represent a way bigger force of action that will focus on more codebases, industries, niches, and explore many many more ideas. They are a super good steering force for these smart cyber tokens we can generate, and should not be left behind in this cyber race. Option 1 (current state): restrict all models for cyber, give ISR cyber capabilities only with the previous, not frontier, models (like opus 4.8), in exchange for KYC, hard 2FA and quick resume check. Option 2 (not gonna happen): open source all the harnesses, make everything available to everyone and let natural selection happens. Probably not the best, we want to give the good guys an advantage here. Bad guys usually move way too fast in cybersec. **OPTION 3**: make people earn their access to better cyber models and harnesses. Like Option 1, but here we add a reputation score: the more issues you find with the token we give you, the more you earn "smarter cyber tokens". So an ISR could start with a normal cyber model, find a few Bug Bounty or VDP or CVE, report them to AI provider for review, then be credited proportionally with some better cyber model credits. At first they will just have enough smarter credits to deep dive one of their ongoing research ideas, but the more reputation they earn, the more budget they have, until the best ISRs start having most of their tokens from the best cyber models and best cyber harnesses access. The "token rate" you earn from reputation could diminish with time to penalize inactive researchers. If a malicious usage is detected, the reputation would hit severe penalties, or a complete ban. These security accounts should all be restricted with strong 2FA (like what @OpenAI did by making FIDO key mandatory as a 2FA) and maybe more access policy like VPNs or allowed IP to prevent these accounts from getting in the wrong hands. 1) The increase of reputation score through appropriate vuln disclosures / bbps, gives confidence that the researcher has good intention 2) The KYC helps gain confidence, as you can take potential legal actions against the researcher 3) These platforms can have extra monitoring on what the ISRs are doing, maybe an even more restrictive option would be that the ISRs must apply to programs or specify which targets they are focused on so monitoring can take that into action. 4) They can add vouching mechanisms where people can vouch for others to increase their reputation, but can lose reputation if the person they've vouched for did bad things with the tokens ETC There could also be bonus reputation if you work on the platform curated list of important projects to audit. This would open up the frontier models to ISRs with good intentions, but it could go even further: creating new ISRs. To do this there could be an Academy program where people starting in the field would learn how to use these tools (model, harnesses), and how to responsibly disclose findings. There could be a special CTF that would make you earn the base reputation points you need to start playing with the basic models for cyber work. I think this ISRs AI platform would either be run by: 1. AI model providers: @OpenAI and @AnthropicAI directly, they manage the model access. 2. Bug Bounty platforms like @Hacker0x01 @intigriti @HackenProof @immunefi, @cantinasecurity etc. because they already manage the reputation and selection of ISRs for private competitions and audits. Or at least work with them to collect trusted reputation score. 3. AI inference providers, like @OpenRouter or @AskVenice Also note that here ISRs could be mid-market security firms, who would KYB and still have to prove their reputation. Reputation, sybil resistant systems, proof of humanity etc are things that have been explored a lot by the web3 industries, maybe we can take some learning from there! Happy to brainstorm this further