gck1

Heck, agents don't start editing before they're already at 70k for me.

I've played with explorer agents giving exploration summaries to help the implementer agents use more of their context for implementation, but it doesn't work as well. There's always something lost in the handoff.

This will absolutely not end well.

> According to whom?

It's very easy to answer this without my help by trying to get access to Mythos.

Do you see requirements clearly listed anywhere?Can you even apply?

What you'll find is maintainers of large open source projects and analysts' reports with vague statements like - "should follow strict security requirements":

"Trinidad also noted that the Anthropic announcement pointed out that each of the 150 new participants, in Anthropic’s phrasing, “will need to meet our security requirements before they gain access.”

Trinidad said the security requirement claim doesn’t build confidence, because “nobody knows what those security requirements are.” [1]

It's also some random rich companies like Hitachi or Dragos [2]

Do you trust that Hitachi and hundreds of other random organizations will be able to contain Mythos and not accidentally attack your project or your bank? I don't.

> Yes we do. That's why there is the saying "regulations are written in blood"

We absolutely don't. We have already learned with blood that gating access to security based on the number of zeroes in bank account and authority is a horrible model. We can apply this knowledge to LLMs, we don't have to spill blood again.

[1] https://www.csoonline.com/article/4180265/anthropic-grants-p...

[2] https://www.bankinfosecurity.com/anthropic-limits-on-ot-acce...

You seem to be putting a lot of weight on Anthropic employees being the smartest people in the world.

And I don't doubt that, not in the slightest. But I've seen exceptionally smart people in one field being dumber than a random kid from around the block in another.

This incident is clearly at least 2 failures that could've been easily avoided: failure to communicate, and failure to investigate the logs after letting the "most dangerous" roam free.

No, it doesn't require creating a mock internet with an alert as a side effect. Their own "most dangerous" model could have probably told them this happened if they supplied logs to it.

They had a model escape in April, roughly the same time when they were fearmongering about Mythos and how Anthropic should be the sole keyholder of cybersecurity capabilities, and it only occured to them to look inside logs when they saw someone else winning in their own game.

What, Anthropic didn't know model could escape sandbox without OpenAI reporting it?

They also gave access to Mythos (the Mythos) to some companies, based on... vibes.

Who knows how these companies are using it. If Anthropic can't effectively contain their own models, can the partners?

While the rest of us get fallbacks and warnings, not even being able to defend against the attacks they themselves are causing.

Do we really have to re-learn all the industry's knowledge the hard way?

> On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment

> In response to this incident, we began a large-scale retrospective review of our own cybersecurity evaluations

> we identified three incidents

> The incidents involved three different Claude models: [...] and an internal research test model

This reads like an attempt by Anthropic to re-secure their leading spot in "our models are the most dangerous and we also have unreleased, super-secret, research models" index.

I may be too cynical, but the well of benefit of the doubt is running very dry towards AI labs that like to engage in this game.

Recent-ish models learned to use the same trick engineers played on non-engineers, where they try to sound very smart by overcomplicating very simple concepts.

It's very taxing, especially since these are usually multi-paragraph texts. I noticed I've started doing a lot of "hey, you're talking gibberish again" a lot with 5.6 Sol.

They do have subagents, released v2 of that feature with the launch of 5.6 model series in fact. It's just... very poorly executed, is a significant regression from subagents v1 and thousands of miles behind subagents of Claude code.

- Models that can be launched as subagents are hardcoded (can only be another Sol or Terra, but not Luna). Most of the time it'll just launch same model as parent anyway.

- They encrypt initial task delegation from root agent to subagent, for whatever reason

- You can't switch into subagent view at all, despite the fact that apart from initial root>subagent task handoff, all session is visible in transcript.

It's funny how codex itself can't do Sol orchestrator / Luna implementor out of the box.

Luna is comparable to GPT 5.4 from 4 months ago on many benchmarks. I know many who have said during that time, myself included, that if that's the model they had to use for the rest of their lives, they'd be fine.

GPT 5.4 is/was a very capable model.

They're supposed to bring 5h today.

I did a full circle and essentially dropped all of my personal static workflows encoded in skills because I observed recent models picking better ad-hoc workflows for particular problems, when a static one would force a subpar one.

It seems like we all tried to contain and organize a system that simply prefers to select its own organization.

Which makes me to think that these skill packs of workflows are really made to make it easier for humans rather than agents.

It took me a few hours to find some very questionable communities, which in turn gave me access to:

- Ways to obtain cheap guarded-AI tokens that are not linked back to me and with no danger of getting my legitimate accounts banned

- Ways to get rid of guardrails and have models work on things they wouldn't otherwise work on.

The attackers were already in these communities long before I knew they existed, they already had the advantage. Ones with enough reputation probably have access to even more information and tools than I do.

It is true that these communities exist because guardrails were put in place, so yes, it is slowing them down too - as in they can't just put in their CC on claude.com and hack a hospital. But attackers are much better at finding these communities and utilizing resources available there than defenders.

Personally, I don't have any ethical concerns of utilizing these resources when I put them to actual defense, but I know many people that would, leaving them at a disadvantage.

My point is that there's only one guardrail that will effectively contain the threat the models pose, and it's in direct conflict of the big 2's goals - pull the models from worldwide access completely. Strict KYC and all. And it would only last for so long anyway.

> In cybersecurity, a level playing field favors the attacker

Yes, but didn't it always? Hence why my position is that this will get us back to relatively where we were pre-LLMs.

And I don't know what Trusted Access programs give to defenders, because as a defender who has credentials, connections, but no deep pockets and no high ranking passport, it only gave me silence. I fail to see how this is better than total access.

I don't think the world where defense is given to those that "deserve" it is the world that we all want to live in. Which brings me back to the starting point - attackers are almost completely unaffected. If I masquarade as an attacker, I get way more capabilities already.

I've got zero knowledge of bio, so can't answer that. But with cyber the answer is very simple - the attackers already have more cyber-offense capabilities and there's no putting it back.

Open/closed doesn't matter that much. You can get closed models to do a lot of cyber harm, even with all the guardrails, which currently are heavily skewed towards more false positives.

The only effective control is to level the playing field. If both offense and defense have access to the same capabilities, then we're relatively back where we started.

If you want to ensure chaos, then you do what Dario is proposing to do - create gates that attackers can bypass and defenders can not.

It's refreshing to see how there's almost no person in this thread who can't see the BS. All the goodwill that Anthropic could have had is basically gone. Anthropic is likely on the path of becoming the most hated company in the world.

So my question is: is this by design (they know nobody's buying this), or is Dario simply so out of touch with reality?

If it's the former, then why publish this?

> We should not sell powerful chips or chipmaking equipment to China

Yes, please. We don't know whether we'd have open weight models today, had the chip-prohibition not been in place. Nor would we see the more optimized models such as DeepSeek or qwen.

We also would not see new players entering RAM market after you and your pals in Silicon Valley hoarded the entire world's hardware.

So by all means, double, no, triple down on this.

> We should crack down on industrial-scale distillation operations

And let's apply this retroactively to Anthropic too. You industrial-scale-operation-distilled all of humanity's knowledge. Let's have some of that crack down on you too.

Its such a shame Android's backup/restore is such a mess, even more so in GrapheneOS. I remember the era before Google and manufacturs started cracking down on bootloaders and custom ROMs - I used an app that could do effective, actually full backup and restore in single click.

Good times.

They can still make your life very difficult. They could throw you in jail for "obstructing investigation" or something similar.

Not in US, but had my phone seized by authorities and was asked to unlock it. I'm walking free, but I think what really saved me is that I genuinely complied with investigation and the only place where I drew the line was me giving away my password.

If I used my right to remain silent AND not give away the password, I'd probably be charged with something. I'm sure its very similar in many countries, including US.

Claude's "I'm going to draw the line here", "This is where I'm going to hold the ground" always rubs me the wrong way. Classifiers rejecting a request are one thing, but there's something very troubling about machine saying "I'm going to draw the line".

That's brilliant, I should try that.

I usually just start by preloadig context with plausible legitimate use, have it work and obviously fail, and then ask to figure it out without ever mentioning any high risk words. Model offers to RE itself and classifiers are happy.

> so you haven’t actually used Claude Code yet.

Where do you think the principle came from? I've used claude code for a year, and stopped February this year.

Reverse engineering. Codex sometimes displays an advisory prompt when classifier trips - "Wait longer while we evaluate this request further or use a dumber model". If you do nothing, it'll just take some time and almost always succeed.

It does require some brainwashing of the model to get it to the state where model itself agrees to do RE work though. But at least it's all predictable.

Every time an online chatter (e.g. "limits are better", "model is better") makes me to reevaluate my principle of never paying Anthropic, I go to the model card, which strengthens my belief in the principle.

Why is Anthropic is so hell-bent on this auto/silent downgrade? Do they have a single user who prefers an auto-lobotomization instead of a refusal? Have they learned nothing from the backlash the first time?

It's always slightly amusing to me how SE has the most restrictive cloudflare turnstile config set.

On the rare occasion that I DO want to go there, they greet me with an impossible gate that takes 15+ seconds to pass on Brave and gets invalidated quickly.

If anyone from SE is reading this: you already failed to protect your data from the LLM crawlers, SE is no longer that much interesting to them. The only visitors you're gating today are not bots, they're humans.

And they had actual community! Never have I been frequent on any manufacture's discussion forum, but with OnePlus, I was. It was wild to see a manufacturer helping you with rooting their device.

Then I saw the announcement that they'll be merging the bloatware Chinese version of their OS and that was the last day I held my OnePlus phone.

Had they not taken that path, I'd likely have bought at least 3 of their phones since then.

GPT 5.6* throw fits on anything even remotely related to reverse engineering, and I'm not ever paying anything more than $20 to Anthropic anymore.

How's Kimi in this area?

And recently, since GPT 5.6, OpenAI basically doesn't show anything but a single line, 5 word titles of reasoning traces - titles of summaries of reasoning i presume.

It's effectively just a completely hidden thing now.

And the names they came up with mirror the names OAI models come up with when I try to have them suggest codenames for projects. Just lacking any sort of imagination or coherence.