A New Free AI Coding Model—Ox Alpha—Just Dropped. Founders Should Weigh the Risks Before Using It
Developers are giving this new free AI coding model the thumbs up. But cybersecurity experts caution founders against jumping all in without the proper security cautions in place.
Ox Alpha, a new and totally free AI coding model whose founders are as-of-this-writing still unknown, dropped last week and developers are excited about it. Benchmarking data suggests the free model could rival paid models by Anthropic and OpenAI. The mystery around where this uber-powerful model came from has set the world of developers and vibe coders on fire, but how safe is it to use?
Experts say to avoid putting confidential information into Ox Alpha
According to cybersecurity experts, the real is real. Chris Seymour, the founder of GS Consulting says, “If you cannot identify who built and operates a model, you need to treat it like an unvetted vendor. You may be handing it sensitive information without knowing where that data goes, how long it is retained, or who is accountable if something goes wrong.“
Founders should be careful to avoid prompting anything involving personal identifiable information or HIPPA compliance into the model because you have no idea what might be done with that data or whose hands it could be falling into. Mudita Khurana, a staff security engineer at Airbnb, says “Even though OpenCode [a service to run hosted models] says that the provider follows a zero data retention policy and does not use the information for model training, it doesn’t change the fact that the identity of the organization operating the infrastructure, its location and its security practices are still unknown.”
Don’t trust its output outright
If you don’t know how to properly evaluate risk, it’s probably best not to use the model as a core part of your AI build.
The daily digest for entrepreneurs and business leaders
An Inc.com Featured Presentation
Khurana says that since Ox Alpha’s provider has not published any information about the model including how it was security evaluated for flaws like prompt injection abilities, companies don’t know how the model performs against serious malicious risk. “For instance, a developer may ask the model to review code that contains hidden malicious instructions. If the model follows those instructions, it may produce an unsafe code change or perform a malicious/adversarial action.”
If your company ships a product with malicious or adversarial actions included, you could be introducing serious security vulnerabilities into your own product.
Run tests yourself on the model with fake data before you use it for real in your building.
Source: www.inc.com
