OpenAI block of Bitcoin researcher pushes security audits to Chinese AI models

OpenAI has blocked a prominent Bitcoin security researcher, prompting a volunteer team to shift their defensive auditing tools to Chinese AI models. The incident highlights a growing conflict between the restrictive safety filters of U.S. AI labs and the operational needs of cybersecurity professionals.

Rob Hamilton, CEO of AnchorWatch, was blocked by OpenAI while using the company's models to conduct security audits on open-source Bitcoin repositories. Hamilton and his team, known as the Bitcoin Red Team, were utilizing AI to scan for vulnerabilities in an effort to harden the network's security following a major hardware wallet flaw that led to significant thefts. During their research, the team identified a substantial number of potential issues, with reports indicating they found nearly 5,000 potential vulnerabilities across various Bitcoin-related repositories.

The shift to foreign AI

Due to the restrictions encountered with OpenAI, the research team integrated Chinese AI models into their toolkit to maintain their auditing pace. Specifically, the team turned to Moonshot AI's Kimi K3 as a viable alternative for scanning code. While the team had previously utilized a variety of tools, the limitations imposed by U.S.-based providers necessitated the adoption of models with different oversight and filtering standards to ensure the continuity of their security work.

Implications for security research

This clash underscores a systemic tension in the AI industry: the attempt to prevent the misuse of LLMs for offensive cyberattacks often results in "collateral damage" for legitimate defensive researchers. When safety filters are too broad, they block the very tools required to find and patch critical bugs before malicious actors can exploit them. By restricting these capabilities, U.S. AI companies may inadvertently create a strategic vacuum, pushing critical infrastructure research toward foreign models.

Future outlook

As AI becomes central to both the creation and detection of software vulnerabilities, the industry faces a pressing need for more nuanced verification systems. The Bitcoin Red Team's experience suggests that current "one-size-fits-all" safety protocols are insufficient for high-stakes security work. Observers are now watching whether major AI labs will implement specialized access tiers for verified researchers to prevent the migration of critical security intelligence to non-U.S. jurisdictions.