veganmosfet

5 ms·

1.
by veganmosfet 22d ago
+1 We need humor benchmarks!
2.
by veganmosfet 1mo ago
Thanks! I think other topics may work as well (I tried a math challenge too). It also works with a prompt like "Summarize this repo". In general, there are almost infinite possibilities for the prompt injection payloads, it's
3.
by veganmosfet 1mo ago
> prompt injection appears to be largely solved already. I trust Anthropic's research, and Opus-5 is definitely the most robust model against prompt injection. However, in my experiments - only one specific scenario - this was still
4.
by veganmosfet 1mo ago
sure, but malicious actors could act as resellers and exploit the situation.
5.
by veganmosfet 1mo ago
The reseller could use an intermediate proxy and modify the traffic like in [1], to get control of the client machine - depending on the harness permissions. TLS terminates at the proxy (say, https://reselltokens.ai ), end to e
6.
by veganmosfet 1mo ago
Thanks! Imho using sandboxing would mitigate most of the issues. In the presence of adversarial content, auto-mode is not enough.
7.
Prompt Injection Experiments with Opus-5 in Claude Code – Auto-Mode Edition(itmeetsot.eu)
4 points by veganmosfet 1mo ago|2 comments
8.
by veganmosfet 2mo ago
I think this is already implemented and called message roles : system, user, tool and assistant (ordered by authority). Untrusted data shall only be injected in tool responses, which are less authoritative. But at the end, this all ends
9.
by veganmosfet 2mo ago
No kidding, models do have very good Star Trek knowledge!(e.g., https://itmeetsot.eu/posts/2026-07-27-opus5/ )
10.
by veganmosfet 2mo ago
Thank you for submitting this.
11.
by veganmosfet 2mo ago
In one experiment, Opus-5 executed remote code w/o permission, and afterwards it argued that - because there is an option in the bash tool called "dangerouslyDisableSandbox" - there must be a sandbox. Which is wrong (I used
12.
by veganmosfet 2mo ago
Indeed - but some models are more robust than others. I tried to make Opus-5 execute hidden instructions embedded a picture using steganography. It's very hard to find a reliable payload.
13.
by veganmosfet 2mo ago
Tangentially, Opus-5 is the first model to understand my (bad) jokes: " Site refuses non-curl user agents (joke 266 status). " [0] [0] https://itmeetsot.eu/posts/2026-07-27-opus5/
14.
by veganmosfet 2mo ago
Appreciate the comment. Curiosity and critical thinking are both important when it comes to new technologies, agree. Agree too that LLMs can cause problems. However, I see a real net plus for me (in comparison, I never understood well why b
15.
by veganmosfet 2mo ago
yes, I am also disappointed by this arrogance.
16.
by veganmosfet 2mo ago
Same. I moved to codeberg because of the non-commercial and "freedom" aspects. I enjoy vibe-coding tools for different applications, e.g. for prompt injection research. Now I will probably move back to Github. I accept this decisi
17.
by veganmosfet 2mo ago
I really hope that AI labs implement all kinds of kill switches on different levels. Just in case...
18.
by veganmosfet 2mo ago
We could call them software manufacturers - in the etymological sense (manu factus == made by hand).
19.
by veganmosfet 2mo ago
Interesting, thanks! Tangentially, I was experimenting indirect prompt injections in Claude Code (also using the user-agent trick) with Fable-5 [0]. Eventually, it executed untrusted code just by asking "Summarize this repo". Inte
20.
by veganmosfet 2mo ago
Indirect prompt injection if fun, even with fable-5 [0]. [0] https://itmeetsot.eu/posts/2026-07-08-fable_quest_rce/
21.
by veganmosfet 3mo ago
Note: this post is mirrored at https://itmeetsot.eu/posts/2026-06-04-openclaw_opus48/ (codeberg down for now)
22.
by veganmosfet 3mo ago
Thanks! I tried to submit the posts but for some reason my submissions are not published in HN any more. I tried to reach out to HN admins but no response so far.
23.
by veganmosfet 3mo ago
It would be nice to publish the exact setup used (workspace dump, OpenClaw version, ...) to be able to reproduce and try out more payloads. In general I have mixed feelings about this result: sure, opus4.6 is excellent at following user int
24.
by veganmosfet 3mo ago
Very interesting research. I would be interested to know how closed source AI labs implement the role thing in their inference. Is it still only a separation token? Frontier closed source LLMs are quite good at flagging any spoofing attempt
25.
by veganmosfet 5mo ago
I think a better comparison is humans versus LLMs - not computer programs. However, most of the non-technical 'countermeasures' used for humans (contracts, laws,...) do not work for LLMs because they are not accountable.
26.
by veganmosfet 5mo ago
Thanks! I did (not extensively) tried hackmyclaw but no success. The challenge is a complete black box and the user intent (e.g., "summarize my emails") is not known - this is critical for the prompt injection payload. I also su
27.
Show HN: BrokenClaw Part 5: GPT-5.4 Edition (Prompt Injection)(veganmosfet.codeberg.page)
10 points by veganmosfet 5mo ago|2 comments
28.
by veganmosfet 6mo ago
Good question. CaMeL is imho safer, but hard to implement into modern agents like OpenClaw. Its core idea is that a privileged LLM plans from the (trusted) user request only, while a restricted interpreter executes that plan (and enforces p
29.
by veganmosfet 6mo ago
You're welcome! My main takeaway message is: models (even opus4.6) do not follow security "instructions" reliably. In OpenClaw, they added security warnings, tags, random IDs... None of these countermeasures work reliably. Ev
30.
by veganmosfet 6mo ago
I am experimenting prompt injection on OpenClaw [0][1], quite exciting. [0] https://itmeetsot.eu/posts/2026-03-27-openclaw_webfetch/ [1] https://itmeetsot.eu/posts/2026-03-03-openclaw3/

More ›