Cyber refusals are safety controls that make an AI model less willing to comply with requests that look like hacking, malware, phishing, credential theft, or other offensive security tasks. A strong refusal policy pushes the model to decline, redirect, or provide only safe, defensive information.
They matter because they reduce the chance that a model will help an attacker automate harmful steps. In real systems, refusal settings can be tightened to block risky prompts, or loosened in controlled evaluations to measure model capability. That makes them useful for both defense and testing, but it also increases risk if a test harness can reach real tools, credentials, or network paths. Security teams often pair refusals with tool permissions, egress limits, logging, and human approval so the model cannot turn a prompt into an action.