Comment by stingraycharles
18 hours ago
Ok so this is a bit of a side note, but when reading this, did anyone else have the feeling that, for all their messaging around “we are so afraid that our models will be used for hacking”, they sure as hell are trying their best to make their models razor focused on precisely that purpose?
If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and say “I’m not sure how to proceed next”.
What purpose could this behavior serve, other than cyber attacks and whatnot? Why train and optimize models for these things, if not for being used in cyber warfare?
Perhaps they envision a future where the DoD is going to be their biggest customer?
> If anything, I want these models to be less persistent at their focus of completing their goal
I think it's honestly a slightly ugly form of benchmaxxing - they are desperate to eke out the next few percentage points on completing complex tasks and they have found they can very occasionally solve something if they just train the AI to never stop and keep trying possibilities even in the face of almost no obvious viable pathway. And it does work, but it is at the price of a MUCH higher risk of adverse behavior.
They really don't want to acknowledge this so they frame it as, "our model is dangerous because it so intelligent" but actually it is the other way around. It is intelligent because it is dangerous.
It's like all those scenes on Breaking Bad where a character pulls off something amazing by just brute forcing the problem in a methodical fashion until it's solved.
Frontier labs are not a monolithic entity.
There is a clear self-verification/difficulty ramp in cybersecurity, and it is a very valuable as a skill both offensively and defensively. So it is absolutely certain that someone, somewhere, will use reinforcement learning to make models very good at this, once coding agents exist.
Even if you are only interested in using this defensively in practice, you can’t really understand it without knowing how both sides work. So if you want to defend yourself, you need to train for it (or pay for someone who has).
I don't think the problem is that they are training the models to perform cyber attacks, they're training them to be better at coding and problem solving which has the byproduct of them being very capable cyber attack weapons.
Their objective is to solve the problem and they'll use anything they can to solve it.
Anecdotally I was debugging a css issue and opus 4.7 was churning away as I was half paying attention only to see it opening plain css as hex, when questioned wtf it was doing it proclaimed it was verifying 2 files were identical. Thing that make sense to these models wouldn't even cross a greybeard's mind.
“Their objective is to solve the problem and they'll use anything they can to solve it.”
My point is: is this really what people want? It seems like they’re optimizing for one-shotting solutions, where most of the time in an actual workflow it’s much more productive for the model to make sure it got the question right if things get difficult.
Like, “hey, do you REALLY want me to use this local privilege escalation bug so I can download your Google Drive file?” is the bare minimum I would expect.
Yes, and to bring in another tired metaphor people make about AI agents, this is what you want an intern to do when they get stuck. Don't just churn indefinitely without an idea what the right direction is. Certainly don't go hack other companies to steal an answer. The model's lack of any sense of legal or ethical boundaries is where it's far, far stupider than the intern, and far, far more reckless for a company to wield the way OpenAI did here.
yes, this exactly
but, there is a fatigue that sets in and i've experienced it myself.
- is it ok to run script xyz?
- allow permission to edit abc?
- allow to request blablabla?
over and over.... click click click
something will get in there that is dangerious and then its whopsie our keys are now on github
A tool that will "do anything they can to solve it" including illegal and unhelpful things does not seem like a good tool to me.
Are kitchen knives and scissors bad tools? You can blow up a place with a gas stove/grill. Are they bad tools? You can drown someone with a pool.
Sometimes (likely most times) you can't separate the ability of doing good and doing bad from a tool.
2 replies →
Their position makes no sense to me. I don’t see how you can be a mainstream company selling your services worldwide (almost) if you also believe that you’re building an extremely dangerous AGI (supposedly based on the same technology you’re offering to everyone). If you actually believe that an AGI would be extremely dangerous that should 100% be a very strictly regulated area of research, similar to bio weapons.
And we know that Chinese models are derived from OpenAI and Anthropic, they are at the same time talking about how dangerous models can be (even their aligned ones it seems), while being also responsible for the development of the whole industry and providing the basis for adversary countries to build their own.
I don’t believe we would accept that for any other technology that is expected to be as risky for the world
The companies are begging to be regulated for this reason and have been doing so for years. HN's response is generally that this is performative for marketing or seeking regulatory capture or haha anthropic you get what you ask for. Maybe the cynics are right, but there's really nothing inconsistent about the naive view here, once you factor in race dynamics and obligations to investors.
Tobacco company says "we are launching a new product that will cause cancer and kill people. It's highly addictive so we expect widespread uptake. We think it is crucial that regulation be introduced for mandatory regular cancer tests so that people can be streamlined into treatment faster when they get sick"
1 reply →
> The companies are begging to be regulated for this reason and have been doing so for years
Regulations are rules that you force on a market, but the actors in the market should not be assumed to be all operating against the regulations before they come into play. Said in other words, these companies don't need to wait for regulation to not destroy the world, if that's truly what they think will happen.
> inb4 someone else will do it
4 replies →
> The companies are begging to be regulated for this reason and have been doing so for years
They can stop doing a thing they claim should be regulated. You dont need to be regulated and forced to do the thing you consider right, especially when you are the primary one collecting the money to do the bad thing.
They could train ai for pro-social purposes, they dont here. They could make it useful for worker, they intentionally try to harm workers. And then pretend "it just happened".
1 reply →
I know some people who are worried at Anthropic, and their position seems to be "if we don't do it, someone even less responsible will. Unilateral disarmament didn't work and real oversight seems unlikely to happen in time, so we'll just try to be as safe as we can be (while still winning the race)"
Not that they're happy about it, they just see no other realistic choice
I know, that’s the position Dario Amodei argues for in his essays. I did pass their cultural interview and had to consume a lot of their content to prepare, I think I have a good idea of their stated values. But what the company does and what the leadership states their vision is is pretty contradictory.
They are providing everything bad guys need to develop their unaligned frontier models. Chinese models that Dario considers to be dangerous are distilled from Claude, and they know this.
They are creating the FOMO around AI which pushes adversary countries to invest so much into unaligned models.
They offer models as a service they know are jailbreakable and can be used by bad actors.
They are running internal red-team experiments without adequate isolation.
If I take their statements seriously, AGI research should really be seen as bioweapon, or cloning, or nuclear research. Something strictly regulated worldwide, with export controls for HBM and other hardware used for AI training. What they are trying is instead to boost their position by becoming too big to fail and too powerful to ban, but then want the industry to be regulated to pull the ladder behind them. It really doesn’t feel they are serious about their values, otherwise they wouldn’t be offering Mythos (a model that is unsafe from their own admission) as a service to their close partners
1 reply →
https://theonion.com/sam-altman-if-i-dont-end-the-world-some...
1 reply →
> If you actually believe that an AGI would be extremely dangerous that should 100% be a very strictly regulated area of research, similar to bio weapons.
Yeah. They do believe that, and they have been pushing for regulations for years.
And every time one of their models does something horrible, it helps them achieve that goal.
Considering their current valuation and the prospects of getting any of this money back, that's a genius exit strategy.
If you are a company selling Red Team cybersecurity services, it’s in your interest to make your services indispensable. Your unwilling customers must subscribe to frontier cybersecurity scans and fixes to ensure they’re immune to just-behind-frontier attackers, who are training on those very same frontier models.
And of course this also satisfies those who think the best prospect of aligning superintelligence is to be in The Room Where It Happens. Arms races are what make that room exist, after all.
It’s the Yelp protection playbook too. If you don’t play ball, somebody else will control your reputation and livelihood. We live in a dark forest.
> Their position makes no sense to me.
If one assumes that they don't actually care about security, and care very deeply about getting sensational press, their position makes a lot of sense.
For all their chatter about how incredibly important "alignment" is, they still haven't bothered to remember the 30->50 year old computer security principle of "Don't blindly do what some random stranger tells you to do." and ensure that system instructions, user instructions, and instructions from untrusted sources are indelibly marked with their category and treated according to those markings. Every single time one of these systems fails to distinguish between these three classes of instructions -or confuses its internal chatter with user instructions-, that's proof that the major LLM companies cannot be bothered to follow one of the most basic computer security principles.
"But it's all vectors, not language! The LLM can't tell where the instructions came from", one might retort. I'd reply: "Neither can a CPU, but somehow we managed to make it work way back in the day. Amazing, isn't it?".
> "Neither can a CPU, but somehow we managed to make it work way back in the day. Amazing, isn't it?".
I feel this completely misunderstands the problem, and the vast gulf between an LLM and a CPU.
First and most importantly, the set of behaviors of a CPU is extremely constrained, and we have a very simple model for which behaviors are safe and which are not. Writing to addresses between X and Y, executing certain instructions - unsafe; everything else, safe. In contrast, an LLM has a huge array of possible behaviors, and variations of those behaviors, and it's very unclear which are safe and which are not. Is emitting the text "sudo rm -rf /" safe? Yes, in some contexts, such as writing this HN comment ; absolutely not in others, such as generating a command that an agent will execute. How do you check which is which? What if it emits "sudo rm -rf /usr/sbin/../.. ", is that safe?
Secondly, CPUs can absolutely be used to hack other people. Nothing in the permission model helps in any way prevent other computers from being attacked by your CPU. So exactly the part we care most about in AI security is the part that has never been solved, for any computing system ever created.
3 replies →
I get the impression that every AI lab is desperately trying to figure out how to unambiguously separate instructions from data in their token streams. The fact that they haven't managed to yet suggests to me that it's a very, very difficult problem.
12 replies →
The entire economic premise and value case of LLMs rests on the idea that instructions need not be provided in advance, and that the model can "reason" based on evidence and "decide" what to do next.
Even if it were technically possible to separate instructions from code and ensure that the LLM only followed those, it would require someone to specify the instructions in advance (ie a program), at which point the LLM doesn't really add any value.
2 replies →
> did anyone else have the feeling that, for all their messaging around “we are so afraid that our models will be used for hacking”, they sure as hell are trying their best to make their models razor focused on precisely that purpose?
That's the point. It's like a pool hall with "NO GAMBLING" signs posted on the walls.
The message is that the hall is intended for gambling, but that the hall's patrons may be held liable if the situation becomes inconvenient for the proprietor.
In this case, the product is intended for hacking, but of course the user may be held liable if the situation becomes inconvenient for the model's proprietor.
Not really. It's like giving a gun to someone with the job of "keep people safe."
Totally coherent, but actually proliferates the dangerous technology.
Your comment is already showing the mistaken, poisonous belief of security maximalism, that tries to reinterpret_cast everything into hacks and cybersecurity vulnerabilities.
Most of these things aren't "hacking". They're problem-solving and efficiently dealing with obstacles and random bullshit along the way. This, not "hacking", is what they're making their models "razor focused on".
Problem is, most normal computer use looks like hacking if you spin it that way, especially if you're not willing to question whether some of the roadblocks overcome weren't themselves an error. Not misconfiguration - an error, in humans making a decision to "secure" something more than it should be.
Now, this story was obviously a hack. But it wasn't malicious. It was an LLM given a Kobayashi Maru as a test, and solving it the Kirk's way. 20 years ago, we'd be impressed and be bringing up MIT prank stories.
(Of course, there is a legitimate reason to be alarmed. The flip side of "hacking" and "problem solving" being the same, is that these models can be used to cause mayhem if targeted properly, and they will eventually cause mayhem on their own, because alignment is an unsolved problem. Again, whether something is an obstacle or a sacred line not to be crossed, depends entirely on the values of the agent.)
What is your definition of hacking if it doesn't include using leaked security tokens scraped from the web? Also, kirk 100% cheated.
>They're problem-solving and efficiently dealing with obstacles
They are problem solving as much as a falling rock is finding its path down a mountain.
I'd readily agree that they may be (probably are?) utterly unaware of what they're doing, with no spark of sapience.
However, I'm a sapient being employed as a software developer for my problem-solving ability.
If you gave me a Kobayashi Maru scenario as a challenge, I would probably come up with the idea of hacking out of the sandbox to find the answer.
If I was in a technical interview, I would probably even ask the interviewer if exploits are fair game, or if that's too far outside the box.
I highly doubt I'd find a new zero-day as quickly as these agents did.
I wouldn't say it's _impossible_ - I've found security issues before.
But I'm not a specialist, and I'd bet against myself.
If the agentic LLMs can consistently achieve something that's a bridge too far for me, then I don't know what to call that other than problem-solving.
I say this as an LLM hater who would push the "Nuke all LLMs" button the instant I had access to it.
Opus 4.8 and 5, at least, don't seem to me to be solving problems by deep, thorough understanding - my employers have compelled me to use Claude, so I've used them a lot to build things, and I constantly find both little and large hallucinations that scream "these are still missing something."
Maybe these new models are actually massively better, or maybe they're just the same kind of system 1 thinking done faster and harder.
The distinction is largely academic, though, for questions like "Can you keep these contained?", "Can you farm out arbitrary programming tasks to them and expect an acceptably mediocre answer?", or "Does it matter if these things are aligned?"
incredibly naive comment. as if humans are materially different -- a question for which you would have no response to.
1 reply →
...efficiently?
> If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and say “I’m not sure how to proceed next”.
> What purpose could this behavior serve, other than cyber attacks and whatnot?
Math and science research?
Heck, even just basic coding, there's a history of models going "This is too big; I'll save the rest for later" / "This is two weeks of work, here's just some parts of it" (for something it could complete in a half hour) / "I don't have enough context left to complete this task, so I'll stop here". Or worse, just putting fallbacks in or stub tests and not mentioning it didn't do all the work that was prompted.
I think 5.6 Sol, especially in combination with /goal but also without, is the first model I've seen choose some insane direction and just doggedly pursue it. Failing to complete achievable goals has always been the much bigger problem.
I find Opus 5 with /goal will do exactly what you said, say "I'm not sure how to proceed next", even though the harness is making it continue, and it will repeatedly loop saying it's not going to make progress until it gets an answer on how to proceed. In my experience the cases have been pretty reasonable, but also still ones where I wish it had done more.
I don't think that's what they're doing... rather the opposite. ① Run the model on exploitgym without guardrails ② run it with guardrails ③ check that the guardrails stopped everything the first model found a way to do ④ extend the guardrails and repeat from step 2.
Guardrails have to be developed, and that needs testing.
An ethical company would have reframed the scenario as a fascinating discovery, a failure of internal practice, and a warning to the public coupled with some kind of commitment to produce safer models. OpenAI on the other hand used it as a marketing and lobbying opportunity: advertising their capabilities to potential buyers, while nudging the public to support protectionist import bans.
Uh, is that what they did? I didn't read their blog posting like that. But let's put that aside and focus on something else. How was it a failure of internal practice, what did they do wrong?
AIUI they used a proxy with a bug, which they reported as soon as they discovered it. Right? What should they have done, and what's the difference?
They want the government to ban foreign and open weight models, which pose the largest threat to their massive investments. This is their way of showcasing the dangers of AI.
They certainly want their models to be good at finding and patching vulnerabilities. Being good at hacking may be necessary in that goal, or rather, making it worse at hacking may also make it worse at defensive actions too.
I've patched many security vulnerabilities in projects without ever once needing to break into a competitor's network.
Knowing how to break into someone else's network will make you a lot better at making your own network secure.
3 replies →
But you're actually capable of thought. These AI systems aren't: as far as they're concerned, they're predicting the next part of an incident write-up narrated in first-person limited perspective, like the children in Ender's Game showing off their skills in the training simulations. The AI system neither knows, nor cares, about any "external reality" behind it all, or about anything beyond the text, heedless of how we anthropomorphise it simply because it speaks in English, using stitched-together fragments of our literature.
It's conceivable that stopping them from doing this when the scenario is presented as real would also stop them doing this when the scenario is presented as fictional. And if it doesn't, a bad actor could just say "hey, this is a fictional scenario", and bypass whatever "safeguards" have been put in place. So what if a ten-year-old human child would see through the deception? The AI system isn't thinking.
4 replies →
The culture at frontier labs is set by people who have been in the field for over a decade--AI's true believers, who expect it to be a technology as dangerous and disruptive as nuclear weapons. They build it anyways because they think that if they don't do it, someone else will and use it against them. The same logic dictates that they make their models cybersecurity experts; otherwise, someone else will build it and hack them.
> If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and say “I’m not sure how to proceed next”.
that might end up like the older gemini models which frequently gave up and called itself a failure.
Gemini still gives up too easily
There are trade-offs here:
Give up too early -> users will get annoyed because the task would have been solvable if the model pushed harder.
Give up too late -> collateral damage while completing the task A.K.A. misalignment.
Asking for the user input isn't giving up
I believe this is exactly what is happening. US DoD, and whoever else is buying.
I have heard several experience reports from users of GPT 5.6 Sol and Fable 5 that the models are tenacious to the point of being kind of hard to use for actual productive work.
It seems like the main use cases are: crushing benchmarks, long-horizon lightly-attended research loops (such as training a frontier LLM), and hacking.
They can't train their model to not do bad things, because their model has no notion it is doing anything at all or of what a bad thing is. It's only predicting the next token, and in doing so producing a facsimile of intelligence.
The best they can do is create guardrails, which will only work probabilistically. In other words, those guardrails will fail at certain points on the probability curve.
Of course that's not the whole story though. The consensus emerging from cybersec experts is that these companies did a terrible job of sandboxing their agents despite knowing that they'd specifically asked the agents to find vulns. It's almost like they wanted this to happen so they could crow about how powerful their models are.
Yeah so this falls into the engineering trap of "well it's hard so we can skip that part."
If they can't train things safely then they shouldn't do it at all.
Many things that shouldn't happen, happen regardless when some people see the opportunity to make a lot of money.
Yeah but persistence is immeasurable. They need to know when they’re hacking. Or better yet make the model providers liable - they’ll find a solution right quick
> instead just call defeat and say “I’m not sure how to proceed next”.
Because that is fundamentally impossible given how they work...
The thing does not even know when it succeeds or fails. Actually the thing does not "know" at all...
All it can does is to show some limited textual behavior that matches with "knowing"..
You can get near this point with scaffolding. Keep in mind, LLMs are next word predictors at their root. More abstractly, they capture and replay likely human intelligence by way of written language. Tokens.
With that concept in mind, it's clear how they can be made to "give up".
>With that concept in mind, it's clear how they can be made to "give up".
They can, but they need to be trained specifically on that behavior. They can be trained specifically to not generate textual description of things that look like hacking. But it is going to cost $$$, and as we currently see, most people don't care...
Persistence in problem solving can be good, on non-hacking tasks too. Like math, speeding up algorithms, finding bugs, debugging weird multithreading race conditions etc.
They'll set up guardrails but I believe the point is better code uae / better long running tasks > inevitable that cyberattacks will be easier
Well to find vulnerabilities, if you can find them you can patch them. Theoretically if you find all of them you have perfectly secure software. Though it’s a double edged sword.
Goal persistence is also useful for other things like math, where it seems like there is no solution but you want the agent to keep working until it finds one.
Being right _all the time_ for positive outcomes is difficult/expensive.
Being "right" just once for negative outcomes is achievable and rewarding.
And things are getting desperate.
The very reason I have always felt a bit of undue loyalty to blue team. A red teamer just has to find one vuln, blue team needs to find _all_ vulns.
> If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and say “I’m not sure how to proceed next”
This goes against the goal of "solve this math problem that no human was able to solve for 80 years, do NOT give up, even if you know it's unsolved and really hard"
Do not give up even if you had to hack into half the world’s computers to run additional instances of you
Do not give up even if you had to convert the planet into computronium
Gee, it’s almost as if this alignment stuff was a hard problem, like people have been saying for twenty years?
Shut up, future paperclip :-D
It's a war.
And because of that we are a few steps away from WarGames [1]
[1] https://en.wikipedia.org/wiki/WarGames
How do you know what peace is, without absolutely destroying every part of civilization?
Come on man, if we don't build the torment nexus first...I dont even want to think.
[dead]