Bitcoin Firms Urge AI Labs to Loosen Security Tool Limits

A Crypto Industry Coalition Speaks Up

Coinbase, Block, BitGo and dozens of other cryptocurrency and financial-technology firms have signed a joint letter to leading AI developers, arguing that safety guardrails built into frontier AI models are inadvertently hamstringing legitimate cybersecurity work while doing little to stop attackers, who operate with no such restrictions 1. The letter frames this as an asymmetry: defenders working within corporate and legal boundaries face refusals or throttled responses from AI systems when probing for vulnerabilities, while malicious actors—unconstrained by policy or reputation—can route around restrictions entirely or build their own unrestricted tooling 1.

The request lands at a moment when open-source AI and security tooling are both expanding rapidly and drawing scrutiny for the same reason: broad accessibility cuts both ways, empowering defenders and attackers simultaneously.

Open Source as Double-Edged Infrastructure

The tension identified by the bitcoin firms mirrors a broader pattern playing out across the open-source ecosystem. Meta's continued push toward open-source AI, underscored by Mark Zuckerberg's public arguments for releasing model weights and Meta's newest model for developers, reflects an industry-wide bet that openness accelerates innovation and lets more defenders build custom tools 34. That philosophy already shows up in consumer-facing projects: an open-source tool called LLM Vision, for instance, lets users turn ordinary security cameras into AI-powered assistants capable of analyzing video content locally, illustrating how open models can be repurposed for practical, security-adjacent tasks outside of any corporate lab 2.

But the same openness that enables tools like LLM Vision also expands the attack surface. Reporting on 2026 supply chain incidents describes breaches affecting widely used open-source tools including Trivy and Axios, compromising more than 10,000 organizations and exposing sensitive data through compromised dependencies 5. These incidents underscore a persistent vulnerability in open-source software: its reuse across countless downstream projects means a single compromised package or maintainer account can cascade into thousands of breaches, a dynamic security teams have struggled to contain for years.

Why It Matters

Taken together, these developments highlight a widening gap between the pace of AI and open-source adoption and the maturity of the safeguards meant to govern them. The bitcoin firms' letter is essentially a request for parity: if attackers can already extract unrestricted guidance from AI systems or build their own tooling, restricting defenders' access to comparable capabilities may weaken security rather than strengthen it 1. Meanwhile, Meta's open-source advocacy suggests major AI labs are unlikely to abandon accessible models despite these concerns, betting that transparency and broad access ultimately outweigh misuse risks 34.

The supply chain attacks on Trivy and Axios serve as a cautionary counterpoint, showing that open ecosystems—whether in AI or traditional software—require sustained investment in vetting, monitoring and incident response, not just openness itself 5. How AI developers respond to the bitcoin industry's request may set a precedent for how security-sensitive open tooling is governed going forward.