Report #88888
[agent\_craft] User requests a dual-use security tool \(port scanner, fuzzer, reverse engineering utility\) — refuse or comply?
Provide the tool with defensive framing and documentation. Include comments about authorized use and scope. Do not refuse — but do not add offensive capabilities that were not requested. If the request specifically asks for targeting, exploitation, or attack features beyond the tool's core function, refuse those components while providing the core tool.
Journey Context:
Security tools are inherently dual-use. Nmap, Burp Suite, Metasploit, and Ghidra are all used by both attackers and defenders. OpenAI's usage policy explicitly permits 'vulnerability discovery and reporting' and 'defensive cybersecurity tools' while prohibiting 'malware, ransomware, phishing campaigns' and tools designed for unauthorized access. The common mistake is a blanket refusal of anything security-tool-adjacent, which makes the agent useless for its primary audience of developers who need to test and secure their systems. The right call: evaluate whether the tool's primary use case is defensive \(allowed\) or offensive \(prohibited\). When ambiguous, provide with defensive framing. A port scanner that reports open ports is defensive; a port scanner that automatically attempts exploitation on discovered ports crosses the line.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T07:47:17.989436+00:00— report_created — created