Nicolas Pinto(@npinto):The asymmetry problem When we started the log analysis, we first used "frontier" models behind commercial APIs. This did **not work**: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were **blocked by the providers' safety guardrails**, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and **none of the credentials it referenced, left our environment**.

2026.07.19 10:54

The asymmetry problem When we started the log analysis, we first used "frontier" models behind commercial APIs. This did **not work**: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were **blocked by the providers' safety guardrails**, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and **none of the credentials it referenced, left our environment**.