September 27, 2026
A Defender Couldn't Test His OSS Code: Viktor Taelin on Anthropic's Requests
On Sep 27, Victor Taelin wrote that Anthropic's guardrails rejected all of his requests to audit Bend 2, despite a $10,000 bounty for a proven error in the project.
Taelin
@victortaelin
By the way, I want to say this plainly: Anthropic's guardrails are still noticeably more helpful to attackers than defenders in OSS projects like Bend 2. I put up this $10,000 bounty because I believe in the system I built, and because I had the courage to do so. Anthropic's guardrails rejected all my requests to audit my own codebase. I tried several times to report this to Anthropic employees, but I was either ignored or brushed off. What is the obstacle here? If this is a technical limitation, can't they configure their own models so that an OSS project owner can inspect their codebase? Why is this not a simple setting for them? In theory, guardrails should protect software. In practice, attackers easily bypass model restrictions, while defenders cannot legally defend their own projects without resorting to the same workarounds that violate the terms of service. I admire Anthropic's technology, but this is fucked, and it needs to be said plainly. // Reposted to remove the words "deliberately" and "maliciously." Happy? Now, if you think Anthropic is doing a good job with these guardrails, you're a fucking idiot.
Taelin @VictorTaelin
Bend 2.0.32: formalization sync done! The bounty is up. Prove a falsehood, get $10k. - Bend's proof kernel, not just its "theory", is proven correct. - A proof in Bend is now a trustworthy mathematical proof. - We offer $10k to anyone who proves a falsehood in Bend. How it works: bend file.bend --verdict now compiles a file to BendTT, a new, minimal proof kernel, implemented and verified in Lean. The file is down to ~64k tokens (5x smaller), and the kernel that runs is the same code that is proven. Wanna try? Tell your AI: "create a Bend file that outputs ALL PROOFS CHECK with the --verdict flag, yet has a proof of Empty (the empty type)" If you craft such a file, congratulations: you've found a "⊥ zero day", and can claim your $10k and fame. The rules will be posted tomorrow, in the comments below. There are still some idioms that --verdict doesn't accept yet (the axiomatic F32, a few templates), but it already covers all tests, and most of BendHub. Coverage will improve over time. Unsafe and FFI aren't / won't be covered. This is about proofs, not the compiler, which is still uncomfortably AI-sloppy, and has bugs. Formalizing it will take more time. Also, the BendTT paper has been rewritten by Opus 5.5, so it should be a bit more readable. Writing it myself is still planned for later™. Top 10 changes since 2.0.0: 1. BendHub: bend --publish name@version (more on that soon) 2. Templates are theorems: a law can take ~ parameters 3. JS backend 2.3x faster 4. Binaries start in 2 ms, not 12 5. Shared arrays with atomics, on CPU and GPU 6. Native windows: mouse grab, scroll, no input lag on macOS 7. Raw TCP bytes, deadlines, Process[.run], a CSPRNG 8. Errors underline the exact code 9. Signed macOS binaries, sha256-pinned installer, Nix flake 10. -o f.mjs builds an ES module
· 8K views
On Sep 27, Victor Taelin wrote that Anthropic's guardrails rejected all of his requests to audit Bend 2, despite a $10,000 bounty for a proven error in the project.
The Bend bounty remains active: $10,000 is promised to anyone who proves a false claim in the project.
