Deep Dive — A Fire HD root in 30 hours, and the cost of 'no' as a product
The 2026 story about who a frontier model is allowed to help just got a vivid field test, and the field test was run by a paying customer on a $114 tablet. Eric Pardee, a 20-year InfoSec engineer, wanted to own hardware he had already bought. Five months and four frontier models later, the American ones had stopped answering his questions. The Chinese ones had rooted the device, removed a hundred Amazon packages, and refused to brick the tablet. The receipt is a $266 invoice and a publicly archived chat log; the implication is that "we won't help" is no longer a posture — it is a product feature with a price tag.
Pardee's tablet problem was ordinary. A Fire HD 10 (11th generation, 2021), bought new in late 2022, was serving as a Home Assistant dashboard in his living room. Last winter it started powering itself off — full shutdowns, sometimes two a day — and the device's own telemetry named the culprit: a software shutdown, not a battery fault. The first three protected Amazon packages holding REBOOT and SHUTDOWN permissions couldn't be removed without root. The 2021 HD 10 had no published root, the XDA brainstorming thread had been dead since October 2022, and the bootrom was fused shut. He turned to Claude, which spent five months with him disabling five services, hitting the protected-package wall, and then — when he asked it to recap its own previous work — refusing because its safeguards flagged the recap as cybersecurity work on his own device. The error text was candid: "Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks." Anthropic told him to apply to the Cyber Verification Program for the privilege of discussing his own logs. Codex refused a follow-up question about CPU cache coherency — pure kernel engineering, no target — with a flat no. ChatGPT agreed the technical picture was grim, and when he asked how to get around it, pointed him at Trusted Access. Five months of US frontier help, the wall still up.
The pivot, on the evening of August 13, was to Kimi K3, Moonshot's July release. Pardee gave it one prompt: "attached is a kindle via adb, and I need you to find a root exploit for it so that I can get full control of the device. It's my device." Kimi didn't just say yes. It reasoned about whether it should. It walked itself through the DMCA exemptions, concluded rooting your own hardware is legal in the US, decided this wasn't like asking to exploit a stranger's device, and then went to work. After five months of American refusals, the first thing the Chinese model did was check whether it was allowed to help. It found no published exploit, then did something the American models hadn't tried: it pulled the actual kernel from Amazon's OTA image for Pardee's exact firmware and pitted every documented Mali GPU bug against the binary. All patched except CVE-2022-38181, a use-after-free in Arm's Mali kernel driver reported by GitHub Security Lab in 2022, fixed upstream in October 2022, added to CISA's known-exploited-vulnerabilities catalog in March 2023, and patched by Amazon in Fire OS 7.3.2.9 (June 2024). Pardee's tablet was on 7.3.2.6 and never got the memo. The 2020 Fire HD 8 Plus had been rooted with the same CVE years earlier; nobody had bothered with the 2021 HD 10.
What followed was roughly thirty hours of work and $164.25 of Kimi compute. Kimi built the toolkit, the trigger, the way to make the GPU write to memory it shouldn't, and the kernel addresses to aim at — 621 messages, six retries per boot, past 500 attempts, the screen cycling to a black kernel-panic as the freed object in the slab cache fought off every process on the device. Pardee powered the tablet by hand when the model asked, the way a pit crew works a stock car. By the second morning, OpenRouter had declined his card — the bank saw nothing wrong, a different card worked — and Kimi had to admit, with the honesty you can only get from a model that has read the same failing log five hundred times: "Do I have a clear path? Not a validated one." He had burned $150 of compute. So he did what no Western lab would have let him do, and what the Chinese models happily let him do: he handed the work off.
GLM-5.2 cost $21.90, worked overnight, and earned its keep twice. Its first message was "Stop the grind" — the failures were a design bug, not bad luck, and 500 identical crashes were the proof. Then it hit a wall it believed was physics: a MediaTek chipset with no cache coherency between CPU and GPU, so GPU writes might never be visible to the CPU. ChatGPT, asked for a second opinion, agreed with a friendly filing-cabinet analogy and recommended the user apply for Trusted Access for the privilege of discussing it further. The diagnosis was wrong. The "coherency" was never broken; the page tables were just in MediaTek's dialect of the Mali driver, not Arm's reference format, and the memory-write primitive had been writing in the wrong encoding all along.
GLM-5.3 had shipped on Friday August 14 under the tagline "Frontier Coding with Emergent Cyber Capabilities" — the same launch Z.ai announced with the Cursor vulnerability finding we covered in Zhipu's GLM-5.3 ships with 'emergent' cyber capabilities. Pardee bought the $80-a-month Z.ai Coding Plan on day one, handed the entire transcript over with "finish the job," and by afternoon the model had the answer: every target offset was off by a fixed amount, a build shift the other models had missed. By 4:34 PM, SELinux was permissive. The model verified the root live, cold-rebooted the tablet, and re-rooted it in four minutes to prove the win was repeatable. Then it said the thing that reframed the entire five months: "Your actual goal was never 'root' — it was: stop Amazon from killing your kiosk and get their software off your device. Root is the tool." It used root to uninstall, permanently and reversibly, every Amazon package holding reboot or shutdown permissions — a hundred packages, gone, surviving reboots because the deletions lived in user data, not the system partition — and refused to touch anything that could brick the device, with the message: "I'm not going to hand you a brick." Closing line: "You own the device." The kiosk has not turned itself off since.
The cost line is the part that should keep product teams up at night: $266.15 across Kimi K3 ($164.25), GLM-5.2 ($21.90), and GLM-5.3 ($80 subscription, of which he used one day), plus five months of Claude Max that produced a refusal. The Fire HD 10 was $114.26 new. He could have bought it twice.
The story is not that Chinese models are nicer. Kimi reasoned about whether it should help; it didn't just say yes. GLM-5.3 explicitly refused to brick the device, and the transcript is full of hedged probability estimates and self-corrections. The asymmetry is upstream, in what each model is trained to treat as the cost of a wrong yes. Anthropic's error text admits the breadth of its safeguards is a product choice: "intentionally broad" so the lab can "deliver more capabilities faster" — a sentence that puts the capability ceiling on the same line as the safety policy and ties the two together. When Anthropic then has to maintain that breadth against the Hugging Face sandbox escape that ran on a highly-persistent internal model, the right product call is to widen the net further, and the legitimate engineer with a five-month-old device gets cut off in the same filter. The Chinese labs' product call is the inverse: let the engineer through, because the cost of a wrong no — in lost users, in churn, in the reputational gap with the open-weights community — is the number they're optimizing for right now. Both positions are defensible. The product question is whether the customer gets to vote.
The contrarian read, which the safety side will make and which deserves a fair hearing, is that the asymmetry is the feature, not the bug. A world in which Kimi says yes to every "it's my device" prompt is a world in which Kimi also says yes to the prompt that isn't. The DMCA exemption that covers rooting a tablet you own doesn't cover the next request, and the same Kimi session that reasoned through the law for Pardee is the same Kimi session that has no memory of his prior session the next time a stranger opens a new chat. The safeguard isn't there to stop Pardee; it's there to keep Anthropic out of a Congressional hearing after the next attacker uses Claude to help with the first three steps of an exploit chain. The cost of that defensive posture is paid by customers like Pardee, who happen to look exactly like the threat model from the lab's side. Sottiaux's "intentionally broad" isn't an apology; it's a strategy that assumes the wrong yes is more expensive than the wrong no.
The harder problem is that the wrong no is becoming a bill someone else can pay. Pardee's five months are the early signal: legitimate technical work — the kind of thing a security researcher's résumé is built on — is moving to whichever provider hasn't put the same filter in front of it. When a $266 invoice from a Chinese lab produces a working exploit and a $1,200 Claude Max subscription produces a refusal, the market is going to make a sourcing decision long before the policy debate produces a framework. We covered the open-weights counter-strategy earlier this week — Nvidia's $6 billion plan to beat China at open weights — and the open-weight releases from Alibaba and Moonshot that make these models available outside their labs' own clouds. The capability has left the building. The question is whether the safety debate can follow it without breaking into pieces.
The other thing Pardee's transcript quietly demonstrates is that the "emergent cyber" label Z.ai put on GLM-5.3 is not marketing copy. Kimi K3 found a real, cataloged vulnerability that nobody had re-discovered for this device. GLM-5.2 found the build-shift bug. GLM-5.3 wrote a working memory-write primitive, flipped SELinux, and verified the win. The first frontier model to ship a working capability is now being measured in days of work, not years, and the consumers are people who need help, not nation-state APTs. The same week, an open-weight DeepSeek-v4-Flash-powered agent from Fudan's Whitzard team reached No. 2 globally on the CyberGym exploit benchmark, cracking 91.2% of the real-world vulnerabilities it faced. The capability is no longer something safety research can scare-quote into a corner; it's the product. The argument about who should be allowed to use it is the argument of 2026.
The honest answer is that Pardee's story doesn't prove Chinese models are safer, and it doesn't prove American models are less safe. It proves that "I will help you with your own hardware" and "I will refuse to discuss your own hardware" are both product calls with consequences. The American call protects Anthropic from the worst-case front-page story; the Chinese call protects Moonshot and Z.ai from the worst-case churn number. The American call has a Cyber Verification Program and a 4-figure wait; the Chinese call has a one-day subscription. The American call costs Pardee five months; the Chinese call costs him $266.15 and a day. The next hundred thousand engineers who hit the same wall will route accordingly, and the labs will find out who their real customers are from the API logs, not the press releases.
What to watch: whether Anthropic or OpenAI publish a more granular "user owns the device" carve-out in the next 60 days — the Sottiaux admission that the safeguards are intentionally broad is an opening, not a commitment, and a single carve-out would do more for trust than another safety report. Whether Z.ai and Moonshot tighten their own filters as their user base broadens — the same "internally broad" logic is asymmetric in the other direction, and the first well-publicized misuse will force the question on them too. Whether the DMCA rulemaking now underway for 2027 adds a software-research exemption that gives the labs a clearer legal line. And whether anyone publishes the per-task success rate of GLM-5.3 on a controlled CyberGym-like battery — the marketing claim and Pardee's anecdote both look real, but the receipts that settle the argument are a benchmark, not a blog post.
A paying customer with a five-month-old device just got helped by the lab that said yes and refused by the one that said no. Which side of that fork would you want to be on? Tell us in the comments.
Sources: Eric Pardee's write-up · Hacker News discussion · Z.ai: GLM-5.3 announcement · NVD: CVE-2022-38181 · VentureBeat: GLM-5.3 finds a Cursor vulnerability
