Web apps are where I have this trouble.

Making a web app secure is literally just finding and patching vulnerabilities, instead of finding and exploiting them. You could have the AI "try to make this app secure", find what it patches, and use it for exploits, and the AI can't know if that's what you're trying to do or not. I don't know how you can get around this. I get around it by not using Anthropic products, at present.

▲

Exoristos 10 hours ago | parent [-]

Not to endorse OpenAI's particular guardrails, but unless you're doing something groundbreaking, security best practices should be more than enough for web development.

	▲	ipsod 10 hours ago \| parent \| next [-]
		OpenAI is what I use most. Sol 5.6 still rejects a few requests a day when I'm working on web apps, but, overall, it's not too bad. I wish it'd auto-resume and try again, instead of waiting for me to intervene, but it's rare enough that it's not a huge deal. It probably doesn't help that I'm using frameworkless PHP - I imagine a lot triggers could be avoided if I was using a framework where secure features were baked in.
	▲	re-thc 10 hours ago \| parent \| prev [-]
		With OpenAI you can also apply for the security program, which doesn't require you to be a certified pentester (as per Anthropic).