GPT-5.6 Refused to Help Debug Linux, Chinese Open-Source Models Stepped In

American security researcher Daniel Fox Franke was tracking down a rare segmentation fault in the popular tool ripgrep when he hit a wall, not from the program itself, but from his own AI assistant. OpenAI's GPT-5.6 Sol was willing to help, but its built-in safety classifier systematically blocked its answers about memory allocation and heap analysis. Franke finished the job with two Chinese open-weight models that had no such reservations.

A classifier stronger than the model

Franke described his experience on social media, explaining the mechanics of the block. GPT-5.6 Sol itself had no problem with the topic, the researcher noted, because the safety classifier is a separate system that censors the generative model's output after it has already been generated. It was this additional filter, not the model itself, that kept him from getting an answer.

OpenAI's cybersecurity classifier is a huge pain when you're trying to track down a segfault - Daniel Fox Franke, security researcher

The classifier won't even let it answer what entrypoints from rg into musl lead to allocations on the mallocng heap - Daniel Fox Franke, security researcher

Questions about entry points from ripgrep into the musl library leading to allocations on the mallocng heap sound like routine questions from a low-level engineer. But OpenAI's classifier, which runs on risk patterns and heuristics, treated them as signatures matching pre-attack reconnaissance and blocked the answer, even though Franke was conducting an ordinary, legitimate investigation into a software crash.

Chinese models without filters

Franke turned to two Chinese open-weight models that can be downloaded and run locally without going through a provider enforcing safety policies. Kimi K3 from Moonshot AI was the first to point out that the cause lay at the kernel level rather than in ripgrep itself. GLM 5.2 from Z.ai delivered a more rigorous technical analysis, though both models still required the researcher to manually verify their results.

The final diagnosis turned out to be subtle. Franke traced the problem to an interaction between the fast path for handling anonymous memory page faults, protected by a per-VMA lock, and a parallel munmap call issuing a TLB invalidation. A thread's write to a freshly allocated page became invisible to a read by the same thread roughly ten instructions later, causing a memory integrity failure. The culprit was the rework of the page table freeing mechanism introduced in Linux 7.0.

Not the first case like this

Franke's story fits a recurring pattern. A similar problem previously hit Hugging Face, which, while analyzing a break-in carried out by an autonomous OpenAI agent, also found itself unable to use Anthropic and OpenAI models blocked by their classifiers and had to switch to its own instance of GLM 5.2 to understand what was happening inside its infrastructure. In both cases, safety systems designed to avoid giving attackers an edge failed to distinguish a defender analyzing an incident from a potential attacker.

Makers of American models justify such strict filters by pointing to concerns from the US administration that looser rules on cybersecurity models would hand adversaries of the United States powerful offensive tools. In practice, however, classifiers based on pattern matching don't distinguish the context of a question, so they also block legitimate debugging questions from vulnerability researchers and incident response teams.

A security paradox

The effect is the opposite of what was intended. Models kept under tight oversight and restricted to vetted organizations become useless in the hands of defenders, while open-weight, MIT-licensed models available to anyone without any vendor gatekeeping turn out to be more practical for real security work. That inverts the very logic meant to justify restrictions on closed models.

For developers and security teams using AI assistants for low-level code work, there's a concrete, practical lesson here: it pays to have a backup on hand in case a classifier blocks a legitimate question. Franke published the full documentation of his investigation publicly on GitHub, which is itself an interesting resource for anyone wanting to understand what it looks like to work through subtle bugs at the boundary between the kernel and user space.

The case has also fed into a broader discussion about whether the United States is shooting itself in the foot by restricting access to the strongest cybersecurity models while Chinese companies make comparable tools available without any barriers. Critics of this policy note that the net effect is pushing real, legitimate use cases toward models over which the United States has no control whatsoever.