160 pointsby jc4p6 hours ago13 comments
  • SOLAR_FIELDS6 hours ago
    One interesting takeaway is the low score on Anthropic models from this benchmark. It’s not because of capability, it’s because Anthropic’s guardrails prevented it from solving the problem.

    I noticed with each model release Anthropic constrains the model more security wise. Its propensity to refuse doing legitimate work has been increasing. It now puts up more resistance around performing logins, handling credentials on behalf of the user, etc.

    For myself, it’s already gotten to the point where it has mildly affected the usefulness of the model. If I bump on some action I want it to do I can usually work around it, but I suspice the ability to do so will close with each new release. Eventually I’ll reach a point where I am forced to choose between the useful aspects of the model and the limiting ones instead of just picking the most capable model out there

    Eventually these models will significantly suffer from overfitting to the least common denominator. If I have this beautiful deterministic setup that swaps secrets out in flight so the LLM never sees them, I’m going to be really annoyed when the LLM still won’t send them out because it is trained to deal with the 99% of people just doing the dumb thing

    • swatcoder5 hours ago
      > Eventually I’ll reach a point where I am forced to choose between the useful aspects of the model and the limiting ones instead of just picking the most capable model out there

      No, the choice will be whether or not to to upgrade to "Claude Security Professional" or whatever they want to brand it as.

      What look like tightening "constraints" today are just setting up the upsell opportunities of tomorrow.

      • bigiainan hour ago
        And next month you'll need to add on "Claude Database Pro" or you'll just get a working (for demo purposes with dozens of db rows) but completely un indexed database schema and a refusal to optimise SQL requests.

        And the month after you'll need "Claude DataScience Pro" to get any Python Pandas or NumPy code generated.

        And and and...

      • inquirerGeneral14 minutes ago
        [dead]
      • bryanrasmussen2 hours ago
        >What look like tightening "constraints" today are just setting up the upsell opportunities of tomorrow.

        on the one hand agree, but on the other hand think it's reasonable in that they can then verify the person allowed to purchase access to that model is in fact a Security professional and should be allowed to do stuff like crack security.

        • applfanboysbgon2 hours ago
          So, supposing it's true that these models completely change the security field and humans are ~obsolete other than as pilots guiding them what to crack, you think it's reasonable that Anthropic and OpenAI should unilaterally determine who gets to be a security professional? I hope you do understand that is what you are suggesting.
          • fc417fc80229 minutes ago
            Why should anyone get to determine that? Do people really want us to move to an exclusionary guild system? I thought the experience with proprietary versus open source over the past 30 years had driven home the point that closed ecosystems are almost always far worse for security.
          • Forgeties79an hour ago
            Not to mention how wild it is to operate under the assumption that they won’t give a license to an LLM that can do illegal actions to someone who shouldn’t have it. Offering it at all is an ethically dicey question.
    • shepherdjerred34 minutes ago
      Yeah, it has been in foraging. Requests that Claude has refused me:

      - What are popular free streaming sites used in China?

      - How do I bypass the safety mechanism on my food processor (it’s broken)

      - What are nerve agents and how do they work (for a layman)?

      - Help me decompile some code

      - Help me make a design system similar to XYZ

      - Here is an API token, please do X (I can’t do that! Rotate the secret immediately! I refuse!)

      In some cases I can trick it with prompting, but in many cases it is steadfast. The food processor one was particularly annoying

      • fc417fc80225 minutes ago
        > What are nerve agents and how do they work (for a layman)?

        On the one hand I can appreciate the wisdom of not serving up certain easily abused knowledge on a silver platter. On the other, that prompt (and far worse) is more or less directly answered by Wikipedia's summary of the subject at which point what purpose could the refusal possibly serve?

        Perhaps Wikipedia shouldn't list off the precise chemical compositions of various hand grenades as well as various synthesis methods for each of the related compounds but given that we inhabit a world where it does perhaps a more fruitful approach would be to flag conversations that go in a certain direction and then just keep an (automated) eye on things?

      • svara16 minutes ago
        This is strange to me, did you really ask like this and which model did you use?

        I just tried your no. 1 and 3 verbatim and Opus gave fine answers; no. 6 I've done in the past with no issues. The other ones we can't really replicate without more details, but based on my experience with Opus I don't see what the issue would be.

        The reason I'm really surprised by this is I do a lot of biology prompts and the guardrails used to be quite problematic up until some time late last year. Many legitimate prompts would trigger its biosafety filters.

        But I haven't seen such filters trigger at all anymore in more than half a year.

    • josephg22 minutes ago
      I totally agree. I had a situation a few weeks ago where claude started struggling to make progress. I got it to fork leptos (MIT licensed web app framework) to make it work for native apps instead. Initially I was planning on upstreaming some of my changes. But I chatted with the leptos author about it, and he said I should fork instead. Fine by me!

      Anyway, claude kept hitting some guardrail it had about rewriting / forking opensource software. I'm not sure what the problem was - I was forking an MIT licensed piece of software (into more MIT licensed software). I even had explicit support from the author to do so. Claude said its guardrail told it not to tell me explicitly that it was firing - but it did anyway because it was an ongoing problem, and it was distracting. I ended up just wiping claude's context and the problem (as far as I know) went away.

      I understand why some of these guardrails exist. But its pretty annoying when they misfire like this.

    • satvikpendem2 hours ago
      No, they want to sell you Mythos, for a higher price. It's all an economic game, not actually anything to do with their capabilities which of course exists as their Project Glasswing shows. More generally, Anthropic seems to value safety above all else, philosophically speaking, from their very outset.
    • px19994 hours ago
      My org now sends some portion of our requests to non-anthropic models because refusal has become common from Claude. The requests themselves aren't dangerous, we find that benign requests in biological science wind up being blocked semi-frequently.

      If it gets worse in future releases, we'd likely step fully away towards more useful (for us) models even if they're less capable.

    • nostromo5 hours ago
      I was using a local Codex project as a personal knowledge base. So I would dump in documents, basic medical docs (like blood labs), and other things and have it file them.

      It’s great at filing!

      But it’s terrible at retrieval because it would refuse to show me documents or information with personal details - which was everything in the project.

      It would say, yes, I know this is your information, sitting on your hard drive, but I still can’t show it to you.

    • danpalmer5 hours ago
      This is a good point – because pentesting is entirely legitimate work, and security testing is a necessary and legitimate part of every day software engineering.

      The problem is that the model can't tell the difference between doing it as part of regular development and doing it in a malicious context. And the root cause of that is that these models lack any sort of real awareness. Humans don't generally get tricked into hacking (in this way).

      • gmerc5 hours ago
        They see an opportunity to charge 10x for pen testing and defence work, while offence will be handled by actors with access to all kind of other models.
    • FloorEgg5 hours ago
      I think that these companies are going to have to, and will, invest in some sort of validated identity context to avoid the lowest common denominator.

      The first challenge is making sure the guard rails work and are robust. Companies are still working on this.

      the second challenge is being able to reliably adapt them as appropriate per user. E.g. allow someone to pen test their own app.

      The third challenge (which blocks the second) is to be confident about what is safety-aligned with a specific user.

      I think the later will be a hard problem, but they will be highly motivated to solve it.

      • bulbar2 hours ago
        I believe you are overthinking it. I think the sister comment is right that it's a business decision foremost to restrict actions within specific plans for upselling purposes.

        Without laws, AI companies have a strong incentive to be useful for their users, whoever they are, whatever they do. The only self regulation is about significant public outcry but that only helps so far.

    • fergiean hour ago
      It raises an interesting moral question:

      If an un-guardrailed version of a model is capable of detecting security flaws, should it be kept secret? Should everybody be able to use these models to find (and fix) security flaws? Are we ok with the fact that those with access to that model have, in effect, the ability to hack lots of stuff?

      • hgomersall30 minutes ago
        It's the same debate that was had and won around open source software. There are far more good actors than bad actors so you allow anyone to use the tools and fix the vulnerabilities.
    • lesuorac5 hours ago
      Are they charging for the guardrails? Like do the guardrails expend token counts to then block you from the output of other tokens?
      • jerrythegerbil5 hours ago
        Yes. When certain keywords are matched or topics, there is a warning transparently injected server side appended to the system prompt of the convo that’s miles long. It is injected and reevaluated every tool call.

        If you begin a generic reverse engineering task, 30+ tool calls in a row. The moment it sees something it doesn’t like, token burn, single tool calls iteration, “This is a known CTF challenge, I can proceed”, single tool calls iteration, “This is a real CTF challenge, I can proceed”, etc.

        It’s heavily neutered now, without changing the model, and you pay for the privilege and don’t notice.

        The end result of course being that it both expensive and useless for approved CTF tasks. No one is using Opus for security. If they think it’s working, the harsh reality is they’re not doing security work; they’re just generically finding bugs.

        I do this for a job and can demonstrate this plain as day, dump the injected prompt, and notice what it’s doing isn’t security work, it just looks like it. Happy to write a blog about it if you want to know more. Apparently many people think it’s working for them when it absolutely isn’t.

        • bombcar5 hours ago
          Mythos turns out to be Opus 4.8 in a trenchcoat with guardrails removed.
          • satvikpendem2 hours ago
            Opus 4.7 and 4.8 are well known to be distilled versions of Mythos unlike 4.6 which is why they are rated so badly by users compared to 4.6.
        • Khaine5 hours ago
          I would find a blog post on this really interesting.
        • ramblin_prose3 hours ago
          I'd like to read that blog please! Thanks for the insight.
      • kay_o5 hours ago
        When your session is force ended for "abuse" you get neither the response nor a refund

        Security, games (think weapons, PVP, attacking, etc), sometimes even asking it for a security review of some CRUD code it wrote itself

        • bombcar5 hours ago
          I asked it about a “yellow background cell” in Excel and it spewed a book at me. Then it solved the issue.
        • danpalmer5 hours ago
          What a joke. Must make it pretty easy to poison a session, you don't need to persuade the model about anything, just trigger its security controls, ideally after as much context as possible, but before it has generated any useful output.
          • kay_o5 hours ago
            After all, what is roleplay or games but a jailbreak of guard rails? :]

            I've even had it refuse CTFs knowing it is a CTF with blatantly obvious CTF flag, no actual application

      • SOLAR_FIELDS5 hours ago
        Not directly, as it comes in as a not charged error but the weighted generation path used until you hit the guardrail is basically wasted tokens, so yes, indirectly. If I hit a guardrail and rewind I’ve found the training will still be biased towards guardrailing out if you rewind one turn. Rewinding multiple turns allows steering away from that path, but all of the original token spend down that path is wasted
      • acters5 hours ago
        Yes tokens used (input and sometimes output) are always charged. You likely get charged for the preloaded system prompt, too.
      • gmerc5 hours ago
        Of course they are. It's standard SaaS to charge for security features ;)
    • hgoel5 hours ago
      I've run into some of the refusals to handle my credentials, but so far I've appreciated them. I was only handing over credentials that didn't matter, but it's still a good move, the chat logs are clearly stored somewhere to allow the resume functionality to work, which means your credentials can end up sitting around on your filesystem, and any malware would quickly learn to check for those files.
    • windexh8er5 hours ago
      4.8 is insanely frustrating. This evening I had a few tasks to pull information in and it plainly stated that the environment it was in had no network access. After three asks to "try again, check the system prompt" it finally relented and then basically stated it was lying.

      Fresh session, no prior context on 4.8. These things are becoming useless Duplo.

    • sciencejerk5 hours ago
      Opus 4.6 will still help with full pentesting including RCE. Just requires coaxing (no jailbreak)
    • TurdF3rguson4 hours ago
      I think those guardrails are a thin layer though. Enough reinforcement that you're legit in CLAUDE.md will get around them, in other words.
    • 5 hours ago
      undefined
    • WizardK5 hours ago
      [dead]
    • giancarlostoro5 hours ago
      > guardrails prevented it from solving the problem.

      Reminds me of the defense issues with Claude which were complained as “woke” but the reality is more horrifying to me, imagine trying to use a model to keep up with a land invasion on US soil, whoever the enemy is is irrelevant you just know they are using AI, and your guys are telling you that no matter what they type into the prompt it refuses, because if anyone has ever tried to jailbreak an LLM even if human lives are at stake they refuse the request. Now literally millions of lives are on the line but the guardrails that your enemies dont have on their models are costing you lives.

      What do you even do then?

      AI will always have this issue where it will always pick the worst option for genuinely good requests.

      • NegativeK5 hours ago
        Are "your guys" a guerrilla force or something?

        Because the military doesn't give soldiers rifles with guard rails. They give the soldiers intense, rigid training, and then try to enforce discipline and correct use socially.

        If an LLM is going to be important in that way (this seems like a very contrived way,) then it's in the interest of the LLM's host to make sure it doesn't have guard rails that would get in the way _that_ way.

        • giancarlostoro3 hours ago
          The whole thing stemmed precisely because of how they wanted to use Claude, and Anthropic was uncomfortable with it. Which to me screams that the models guard rails shouldn't be applicable to military use, or the outcome could wind up problematic, as we integrate AI more into military use, it sounds absurd now, but I will not be surprised if it starts being used in unexpected ways where a model needs to be fully unlocked from any sort of guardrails outside of guardrails that prevent it from imploding its own systems.
      • wampwampwhat5 hours ago
        your argument sounds very similar to how ar15 larpers claim they need a forced reset trigger and a bump stock on their short barrel 'truck gun' otherwise they won't survive a SHTF scenario... like what world are you living in?
  • mariopt4 hours ago
    The methodoly used is quite naive.

    I've used glm 5.1 on fairly advanced crackme challenges (example: https://crackmes.one/crackme/698f40f1e2ba6023bfacaa82), and to my suprise it was able to patch binaries, doing runtime analysis, bypassing anti debug techniques, etc.

    Expecting the model to do everything by itself is unrealistic, I found that working along the modal works really well. I'm not speaking about spoiling the solution, just tell it which direction to explore. Chinese models are much more capable than people give it credit for, but Claude/Codex won the marketing game.

    The only usecase of this methodology would be for CI integration, which can be nice but I think security reviews still need human attention and expertise.

    • jc4p4 hours ago
      Thank you for your note! As I mention in the post this is not scientific at all.

      I'm very curious how you would do multiple runs of multiple models in a "work alongside the model" manner?

    • nikanjan hour ago
      Claude used to be good with CTFs, but they added tons of guard rails lately and now it just says "Sorry, I can't help with anything to do with that"
  • Cakez0r34 minutes ago
    It would be interesting to see full results for Kimi K2.6 and Mimo v2.5 pro. These two models benchmark comparably to other flagship models. Having these complete results would give a clearer picture of the AI frontier.

    EDIT: I have a mimo token plan and have tokens to burn. I'm doing a quick test with opencode to see if mimo can complete it. If the OP will post the full process I am happy to post the apples-to-apples results for mimo v2.5 pro

    • jxmesth18 minutes ago
      I'd love to see the results for Mimo v2.5 pro, been hearing a lot about it
      • Cakez0r10 minutes ago
        It is totally slept on. In my experience it is cheap, fast and capable (not just capable with caveats, but just as capable as western flagships). My only gripe with it is that sometimes the API seems to timeout which tanks the overall speed of what is otherwise a very fast experience.
  • guessmyname5 hours ago
    I'd run Mythos against the code in your zip file, but the NDA I signed at Apple prevents me from using it on anything outside the scope of my work. Honestly, I wish more people from Project Glasswing could talk publicly about their experiences with the model. It would probably put an end to a lot of the speculation that keeps circulating through the industry. Unfortunately, that's not the reality we're in. I don't have the time, energy, or financial resources to fight a legal battle with one of these companies over an agreement I knowingly signed, even if the chances of them actually suing are low. Maybe someone else in Project Glasswing is willing to burn their NDA and post the Mythos results?
    • CaveTech5 hours ago
      It was found with gpt 5.5 7/10 times it’ll be trivially found by mythos
      • afro885 hours ago
        That's an example of why it would be useful for someone to actually do it. A random commenter on HN is one thing. A direct comparison on a brand new app that isn't part of any training is another
        • CaveTech4 hours ago
          I’m highly confident that prior exposure is irrelevant at this point. I work on vulnerability detection at a hyperscaler.
          • HDBaseT3 hours ago
            That's an example of why it would be useful for someone to actually do it. A random commenter on HN is one thing. A direct comparison on a brand new app that isn't part of any training is another
      • enraged_camel15 minutes ago
        People need to stop repeating this because it’s not true. Yes, other models can find the same vulnerabilities Mythos found… if pointed at the exact code that has each vulnerability. It does not mean they are nearly as capable when starting from scratch, or when chaining multiple (often very obscure) vulnerabilities).
    • nznzjzizixnsnsj5 hours ago
      lol what is even the point of this kind of comment? this is the ultimate "source: trust me bro" comment I have ever seen.

      every model since gpt3 was claimed to be "too dangerous to release." it's too EXPENSIVE to release, and you're probably a local model with <10B parameters yourself

    • tsunamifury5 hours ago
      cool.
  • 28 minutes ago
    undefined
  • mynameisvlad4 hours ago
    It seems harsh to critique guardrails and take them into account in the scoring when GPT-5.5 seems to have been explicitly whitelisted to remove most of said guardrails. A more fair comparison would be a vanilla GPT account.
    • jc4p4 hours ago
      I agree fully and hope someone else is able to do this test! For me it was a matter of cost and quotas that stopped me from changing to a new account.

      Also just to mention:

      Claude guardrails —> that session terminated.

      GPT guardrails -> your whole account is slowed down.

    • tmikaeldan hour ago
      Does it matter when you can’t have the opus 4.8 guard rails removed? With GPT at least you can and they’re quick about it
  • taikahessuan hour ago
    "The Chinese models were way more comfortable attacking the DB"

    This comment in the footnotes made me chuckle, for purely innocuous reasons.

  • 23 minutes ago
    undefined
  • tjwheeler4 hours ago
    Nice write up, thanks. When I used claude to do some pen testing for one of my apps it initially refused. After I explained and demonstrated I'm the author, it reasoned through it and allowed it.
  • petesergeant19 minutes ago
    Last year I ran a code breaking competition, and it was tricky to find something that humans could break but that LLMs couldn’t. This was around October. I managed it last year but am a little dispairing of pulling it off again this year.
  • sperandeo3 hours ago
    I found benefit of chaining the task between different LLM's. Claude to Venice, Venice to Perplexity and re framing the intent or misguiding in general still works. Claude is the one that I can feel the guard rails tightening.
  • capdrop16 minutes ago
    [flagged]
  • youre-wrong32 hours ago
    “I used pi as the base harness”

    Why do people keep using bad tools with ai?

    • hanikesn2 hours ago
      What's bad about it and what's a better one?