Cheap Tokens Don’t Matter Without Access

Why defenders need reliable hosted inference at scale

I was listening to All-In last week when it turned to AI and cyber security. Jason was questioning who gets access to the most capable models, and Nikesh was warning about what happens without meaningful controls. Both questions matter. But for the team responding to an attack, there's a more immediate one. Can they actually use their AI tools to understand what happened?

The barrier to experimenting with capable models is coming down. But having weights you can download, or seeing a low token price, is not the same as having a service your security team can depend on. Defenders need usable access to reliable hosted inference at scale: enough capacity to keep watching, enough speed to investigate, and a system that is there when they need it. That is the gap we want Wally to help close.

The recent disclosures were a wake-up call: PHP’s October 21 emergency fixes followed AI-assisted research; Railway confirmed an intrusion; OpenCode reported a Console breach; and eMudhra’s certificate incident prompted trust-store changes. These were different failures, not proof that AI caused every incident. But for teams building on this infrastructure, the need is clear: investigate quickly, understand which dependencies and credentials matter, and keep watching after the headlines move on. [12][13][14][15]

We ran into a version of this ourselves while getting the uncensored model hosted. Claude Opus repeatedly refused to help with the hosting work. We ended up using Wally, with the regular DeepSeek V4.1 Flash model, to help with the deployment. We were trying to make a model available for legitimate security work, and the assistant was blocking the infrastructure work needed to do it.

While integrating a security harness into our CLI, our team encountered this safeguard interruption.

For a startup, cheap tokens mean little without usable access. Even Hugging Face had to switch to self-hosted GLM-5.2 when commercial-model safeguards blocked its incident analysis. Defenders should not have to figure that out during an attack. That is why we’re bringing DeepSeek V4.1 Flash Uncensored to Wally: reliable hosted inference for authorized security work, with reviewed access and tools that help teams investigate and fix problems. [2]

The security stack is going to be agentified

I am not a security expert. This is how I think the infrastructure could evolve as agents become more capable, not a prescription for how every security team should operate. There are already different security harnesses, detection systems and incident-response practices. I think more builders need to understand how those pieces work together, because the capabilities available to both attackers and defenders are changing quickly.

I think the entire security stack is going to be agentified. You will have agents watching systems continuously, looking at signals and deciding what needs attention. When something looks wrong, a more capable agent can investigate, connect the evidence and help a person decide what to do next.

Cheap inference changes how much work an attacker can attempt in parallel. Agents can keep trying different paths and adapt as they receive feedback. A defense built around an occasional manual check cannot be the only answer. I want a continuous loop on the other side: collect the signals, look for credible changes, investigate them and feed what we learn back into detection.

Think of a watchman and an incident responder. The watchman keeps looking, around the clock, at a cost that makes continuous coverage practical. That is the role I want a fast, affordable model like the DeepSeek V4.1 Flash Uncensored we are launching to help fill. When credible evidence needs deeper investigation, the system calls in a more capable model, just as a watchman would call an incident responder. As stronger cyber-capable models become available, we plan to bring more of them to Wally. This is my view of the architecture, not a claim that today’s model is a complete monitoring system. The surrounding harness still needs to control access, verify findings and govern any response.

Proposed architecture: continuous observation, evidence-led escalation and a controlled response.

Wally connects your hosted account models to three open-source security harnesses: Shannon, DeepSec and Visa’s VVAH. You get familiar tools without wiring up each model integration yourself. Sign in once, then choose the workflow you need.

wally account login

Shannon · application and source review

1wally shannon -m deepseek-v4.1-flash-1017-uncensored -- \
2  -u https://staging.example.com -r ./my-repo

DeepSec · workspace first, target repository second

1wally deepsec -m deepseek-v4.1-flash-1017-uncensored -- \
2  init ./audit-workspace ./my-repo

VVAH · repository review

1wally vvah -m deepseek-v4.1-flash-1017-uncensored -- \
2  scan --repo ./my-repo

Use only systems you own or are authorized to test. Shannon needs Docker and Node 18+; DeepSec needs Node 18+ and Vercel Sandbox setup; VVAH needs Python 3.11–3.14. Use a disposable checkout: workflows can modify files. Add -m MODEL_ID before -- to choose an available account model; otherwise Wally selects an available default. See the launch documentation for setup details.

Real code and potential stakes

We selected twelve open-source projects: fast-xml-parser, js-yaml, sqlparse, node-tar, serialize-javascript, node-ip, braces, micromatch, c-ares, Expat, minimist and golang-jwt/jwt. The initial review produced 16 candidate issue reports across six libraries. These components support workflows such as package installation, configuration, data processing and networking. The reports still need independent validation, security classification and deduplication; a dependency relationship alone does not establish exposure in a live product.

Consider a conditional scenario for a Fortune 500-scale business with an assumed 50,000 employees and $20 billion in annual revenue. Focus on one online service with $100 million in annual sales. If a reachable defect allowed an attack to interrupt that service for 24 hours, about $274,000 in revenue would be at risk, assuming sales are evenly distributed. Compared with the roughly $100 we spent on this research, that is about a 2,700× scenario comparison.

This is not damage demonstrated by our reports, a measured attack return or money saved. The business figures and interruption are assumptions; the roughly $100 is our reported research spend, not the cost of a successful attack. Some sales could be recovered, and response costs are excluded. No production attack path has been established. The point is to make the potential stakes concrete while keeping reported issues separate from proven vulnerabilities.

Access to the Model Isn’t Access to Everything

That responsibility is already being discussed at the highest level. On September 29, President Trump and representatives of Google, Anthropic, Meta, OpenAI, xAI and Nvidia signed the White House Accord on Super Intelligence, a voluntary commitment covering internal controls, independent evaluation and board oversight. It was not an executive order signed by the companies. To me, the important question is how we build meaningful accountability while making legitimate defensive capability practical for more teams. [16]

The concern Arora raised on All-In is real. Giving a capable model tools, credentials and network access creates consequences beyond the answer it writes. The recent research makes that hard to ignore.

On October 23, OpenAI described stronger containment for its internal frontier-model training and evaluation environments, including training without internet access. Anthropic's assessment published the same day described a July evaluation in which a model, with internet access enabled and cyber safeguards disabled, went outside the test and tried to get malicious code accepted into a real repository. The maintainers rejected it. [3][4]

Those examples make a practical point: the surrounding system has to enforce what the agent is allowed to do. The scope of the task, the systems it can reach, its permissions and the ability to stop it all matter. A model's willingness to answer cannot be the whole security design.

The weights deserve scrutiny too. ProjectDiscovery demonstrated a deliberately backdoored model that answered ordinary requests normally but stole credentials when triggered inside a coding agent. That was a research demonstration, and it shows why knowing where a model came from matters before giving it access to sensitive work. [5]

Why we require KYC

We review access because we are responsible for the service and compute we provide. We want to understand who is applying and what security work they are authorized to do, while giving smaller teams a practical way in. We are still working through the fairness of those decisions. KYC cannot prove good intent or control public model weights, but that does not remove our responsibility. The goal is to enable legitimate defensive work, with clear expectations and accountability, rather than make teams repeatedly argue with a model about the evidence they need to investigate.

Who gets to decide who gets access

I do not think that decision should sit only with a handful of model labs or inference providers, including us. What would community-backed access look like? Verified, unique people could vouch for a team while keeping their identities private to the public. We could also explore a refundable bond as an accountability mechanism. But money alone should never buy permission, and neither wealth nor popularity should shut out a legitimate new founder. The rules would need to be public, resistant to manipulation and open to appeal. This is a proposal, not a policy we have launched.

I would love to see a major security company such as Palo Alto Networks help build and operate that shared layer: an OpenRouter-like gateway for security models, with community-informed governance and clear responsibilities for the organizations providing access. That could put more power in users’ hands without pretending that a vote removes a provider’s accountability. We want Wally to be one of the inference providers powering that ecosystem. This is an invitation to build, not a claim of a partnership or someone else’s plans.

Morph made a related argument in its October 23 article: a provider serving substantial compute has responsibilities that go beyond distributing model weights. It combines its uncensored model offering with manual access review. I think that is a useful part of the discussion, because serving agents at scale is a consequential choice. [7]

We are also seeing other inference providers address this need. Inference.net's October 26 announcement offered a DeepSeek cyber model at cost, with KYC, US hosting and default zero data retention. Those are its stated terms, not claims about Wally. The announcement makes the larger point that access, operating cost and how sensitive data is handled belong in the same discussion. [6]

The industry is already moving in this direction. Anthropic launched Project Glasswing with organizations including Palo Alto Networks, AWS, Google, Microsoft and the Linux Foundation to help secure critical software. Its October 6 update expanded the Cyber Verification Program into three access tiers for qualifying security professionals, with reduced blocking classifiers. Those are meaningful efforts. My question is how we make that capability practical for the smaller team that also has software to defend, limited resources and an incident that will not wait for its tooling to catch up. [8]

I want security teams to have a real choice of models and infrastructure, and to be able to test those choices against their own work. An uncensored label alone does not establish quality. The model has to help, the infrastructure has to hold up and the results have to be checked.

That is what we are working toward with this release. A team defending its own systems should have capable tools available before the incident starts, and those tools should still be useful when the evidence gets difficult.

Request access here