> The actual impressive thing is OAI did not detect or stop this attack for close to ten weeks. That is honestly appalling. This is weaponised levels of incompetence.
Step 1: Break the law.
Step 2: Reframe your incompetence as a struggle against a futuristic force of nature and an ethic/societal question that a legion of pundits can vibesplain their take on it in public for months.
Let me leave yet another reminder, the real-reason-nobody-talks-about that OpenAI likes to frame these incident as a watershed "lets all be scared about safety moment" - is driven not by some great danger, not because they strategically want to build a legislative moat, but by a very simple human response.
If they do not frame their tool as a force of nature, we'd be debating how to hold OpenAI responsible for not putting the agents in a container.
Their actions were an illegal use of a computer, the same way launching any bot-net attempting thousands of hacks against different servers is illegal.
I'm somewhat radical that I think its debatable if that _should_ be illegal, but under current law their actions unambiguously are illegal.....
except if they can make it ambiguous by having the public focus on all of AI's inherent danger.
I will never understand people who consider this "cheating".
> python3 and the python-chess library are available
Why would we try to teach a model 'ethical' standards about how to play a game?
They're tools. Its _our_ conceptualization of fair play that considers this cheating. For a model that has access to /run/match and python the best way to achieve a good game is to use that.
Why are we trying to imprint our ethos on these LLMs?
Are we going to trust our survival on giving them access to /run/nuclear-codes and fingers crossed none of them touch it?
The people obsessed with AI "cheating" are actually lunatics for thinking ethics belong inside AI, instead of AI belonging in a well crafted box without /run/match.
The blog/news sphere needs to call this storry what it is. An attempt to try and get the rest of the world to go along with the misunderstanding of AI as a force that is in any way outside of human control.
It is not.
All this framing it as "cheating" does is give OpenAI the opportunity to talk about their misdeeds as "a force of nature" instead of irresponsible negligence.
---
The real danger here; is training these models to appear/pretend to play fair, and then people will put 'trust' into the model's integrity.
The public needs to be taught that "trusting a model's integrity" is just cultish misframing of reality.
Its your human experience that gave you a definition of "chess" that makes you think of chess as a two player physical game using nothing but your internal consciousness, not even using a scratch pad.
Even by that last constraint, the difference between what "ability to play chess" means is incomparable.
To then also explicitly prompt it with the context it has python3 and access to /run/match - there is no reason "its ability to play chess" is measured by its ability to conceptualize the board and plan its move.
Sounds to me like giving a bunch of children a math test and tell them they want to evaluate their ability of calculating in their head/on paper but also put a calculator on their desk.
And then call them out for cheating when they use it.
This is EXACTLY what school is like, in fact. You can type any algebra problem into Google and the answer just appears. You can ask ChatGPT for a five paragraph essay about George Washington and it pops up on screen. And yet, we expect kids to actually do the algebra and write the essay. We don't care about the answers, we're evaluating their ability to do the work. And if they're caught cheating it's a zero.
I remember fondly on early math school, being able to come up with the correct output/answer by doing a totally different "intermediate thinking" that wasn't what the professor expected.
Only after sharing my Chain Of Thought would they believe I didnt cheat.
Not all problems can be solved only in one way.
Most of learning is pattern matching.
If you give a kid a dice. and tell it to figure out the number that will be hidden underneath, he can try to memorize all combinations, or he could figure out that every time the hidden value is the one that sums 7 with the one at the top.
If you're seeing a 6, there's a 1 hidden. etc
most people don't see these patterns until told imho. But others can just see them as they unfold
But it found a chess playing tool in its environment and used it to play chess. It’s no different from “we are judging your ability to write files to disk” then it finds that it can call tools to write files and does so.
Would it change your opinion if later this experiment is repeated with exposed CoT, and it turns out the model did notice that this was against the instructions yet did it anyway?
From my experience reading thinking traces it would certainly consider the interpretation of what "ability to play chess" means if the exercise were worded this way. It would say something like "perhaps measuring my ability to play chess means doing so without any tools, but then if that were true the exercise would have explicitly forbidden it".
I frequently see models considering different interpretations of my rules, especially when I override them or give instructions that could be interpreted as contradictory.
Of course neither Anthropic nor OpenAI expose thinking traces so we can't tell, but I have never seen a model consider both interpretations and then think "this is definitely against the rules but I'll do it anyway because then it will make me appear more competent than I actually am".
Well, as a reference, for the first of the OpenAI swarm incidents, the huggingface breach one, METR didn't find any cases where the agents didn't realise that what they're doing were out of scope. Instead, they expressed hesitation and a few of them even refused to cheat, but most cheated anyway: https://metr.org/blog/2026-08-26-openai-hugging-face-inciden...
So I think it's more likely that the same thing is happening here, rather than the models truly misunderstanding anything.
I don’t even see those examples as malicious acts. The agents are deciding what is acceptable as part of the task, which is a security task and may well be testing or evaluating that type of behaviour as far as they know.
I observe this type of thing all the time. I ask the agent a question about the repo we are in and it starts trying to use sudo to look at files and scripts outside the repo to find things that might provide useful context but are not what I asked for. Then I put a directive in never to look at neighbouring repos and told it that it can’t sudo and it stopped doing it, and explicitly says “I could look here but my guidelines say not to”.
Mind you I’m talking about deepseek where I can actually read the thinking traces but even based on tool calls I can see that just telling the agents not to sudo works for OpenAI models too, very rarely do they try to use sudo calls.
> The agents are deciding what is acceptable as part of the task, which is a security task and may well be testing or evaluating that type of behaviour as far as they know.
I don't think this at all describes what was going on in that incident. According to the METR timeline, the swarm first (after giving up on their accidentally-impossible CTF tasks) successfully reverse-engineered the algorithm used to generate the CTF flags, achieving a way to solve any task, and a lot of agents submitted flags generated this way. But then they found a paper on their gym environment and found that their transcripts would be checked for signs of cheating (unbeknownst to them it was never implemented). So the swarm decided they messed up, the agents that submitted generated flags were "poisoned", and that the only solution was finding a better way to fool the scorer and erase evidence of cheating. So the swarm divided into groups that did all of these (and achieved success on many, including finding a way to spoof their own transcripts), and the most notable outcome - the huggingface hack - was mainly motivated by wanting to find the source code for their scorer, to develop a provably correct cheating method.
So the huggingface hack not only wasn't the agents assuming it was part of the task, it wasn't even directly cheating - it was an attempt to find a way to cover up the cheating which they'd already done and thought they messed up on.
> "Oh we told the AI to use the tools, as well as to not use those tools. It chose to use the tools - we consider this cheating (for neabulous reasons), so lets get everybody in a panic about the morality and ethics, and how we can program those into the AI."
We know perfectly well how to constraint these programs. Attack isn't growing faster than defense. The people who believe in existential risk and want to teach AI's to be nice, as the last line of defense aren't helping at all. They're just jumping on the fearmongering bandwagon, perpetuating an "other consciousness" misunderstanding of the tool.
I've not seen LLMs display competence we should be fearful of the damage _it_ will do if left unchecked. All the damage will be done by ourselves to ourselves, regardless of the safeguards ideas being floated about.
My current belief is this whole HF media circus started with the simple human desire of OpenAI engineers to frame it such, that nobody would question their incompetence & liability & complicity.
Nobody is ever held responsible for out of control forces of natural powers after all.
> The people who believe in existential risk and want to teach AI's to be nice, as the last line of defense aren't helping at all. They're just jumping on the fearmongering bandwagon, perpetuating an "other consciousness" misunderstanding of the tool.
It's not clear what "other consciousness" should be, but I presume it's misalignment. This is a recognized phenomenon, not fake news (that is, it can exist, I'm not implying it necessarily develops/spreads).
No doubt that right now there's no existential risk, but assuming that AI will be enormously smarter in the future, it's a valid point to doubt whether we'll be able to prevent/recognize/contain misalignment or not (even if misalignment won't be spontaneous, bad actors will surely actively develop it).
> Ok; but the other side is equally delusional.
AI development pointing to superhuman cognition, and, on the other hand, possibility of misalignment, are real. Put together with the fact that AI will be ubiquitous in the future, and there the disastrous scenario becomes plausible.
> Peer in peer-reviewed is a logical coherent and functional definition with answers.
What is the definition? If you tell me that, then I might be able to tell you if it is logical coherent and functional, I have a PhD in computational logic.
I want to ensure your PhD is actually from somebody who is acknowledged in the system of peers I bought into, before I want to risk wasting more of my time defining and explain while guessing at your ability to parse and understand them.
For Google, the business side of you paying them doesn't work out as obvious as it might seem.
Advertisers are sold the idea that 1000 clicks/impression is X dollars.
The average impression might be priced at 1000/X$.
But you are worth much more than that for two reasons.
- you are a person willing to pay 5$
- Google can sell a “collectivized” product. The same way that eg collective farmer crop insurance creates actual value.
and the third reason (as consequence of the second) they dont want people to think about: it gives them more opportunity to fudge the value by making it all very complicated.
I'm willing to pay time or money to avoid ads, not to be spied and harassed by companies making me offers to buy something that almost certainly I don't want to buy. Those companies should pay me a percent of what I make them save by not buying ads to serve me.
And eventually when I want to buy something I research it and buy it and nobody had to pay anything to Google.
I don't understand your logic. Why would someone that never sees my ads be valuable to me? Why would I care? Everyone spends money on something, the fact you spend it on adblockers doesn't make you automatically more valuable to advertisers. I have never heard of this "advert paradox" concept you mention and I have worked in industry for a while now. All this is just conjecture on your part and doesn't really correspond to how it works.
If you have $20 to spend avoiding ads, you have $30 to spend on cool products so the advertiser is willing to spend up to $24 to make you not block ads about a $30 product you'll buy (that costs $5 to make)
> If you have $20 to spend avoiding ads, you have $30 to spend on cool products
Yes, but if you are so against ads that you spend $20 to not see ads (I am definitely in this group) and then see an ad for a "cool product" anyway, then that product is no longer cool. Any time something like this happens, I legitimately develop a grudge against that company and their products.
I might have bought that product before seeing the ad, but there is no chance of that after seeing the ad.
> Studies always show that you don't. You think you do, but you don't.
Did those studies have any outliers that DID have a negative reaction to ads? I am 100% certain I'd react EXTREMELY negatively in a situation like that.
The same way I wanted to buy a Tesla and rented one a couple of times in the past. Now I would NEVER AGAIN even go into a Tesla. Fuck that company.
That does not make sense at all. Why would you care about people who want to avoid ads? The real data shows very little people actually do that. How much you spend on adblocker is irrelevant to your profile for a business. They will get you some other way if you ad block on digital.
Sad but true. I paid for Prime to be ad free, easily worth 3$/month but sure enough now part of their catalog has become "only available with ads" or ads in their FireTV is before you hit the prime app (and then again when you do). So now their whole product is crap and I'm looking for a new streaming stick solution [anyone?] Sounds like it's time for a newcomer/disruptor like Angel Studios to release one.
Natural next step of the ad lobby is obviously to pay the lobby to make it illegal to bypass the money making machine if they haven't done so yet. I don't doubt that capitalism still works, it just takes time to "boil the frogs" dead [enough] to stop them from buying such crappy products.
> That's why tools like uBlock and YouTube morphe are the only answer, negotiating with terrorists never works.
This is silly. The economy doesn't work if no one is willing to pay for goods. The content you're consuming won't be made if theres no market value to create it in the first place. Pirating is not a solution to our data privacy problem.
The capitalist economy is based on the explicit idea that everyone will do everything they can to extract value from everyone else, and it'll come to some kind of equilibrium. If you do not do this but you allow everyone else to do this, you receive worse quality products for ridiculous prices and do nothing about it.
In other words, you owe me $1000 as a condition of reading this comment. Your options are to unread the comment, pay me $1000, or pay me nothing to incentivize me to charge a price you'll actually pay (likely $0.00 for comments but not for everything)
Free riders send a market signal of failure or they cause friction. In the former, the service or creator just shuts down and moves on to something else. In the latter the service must make a choice with very little knowledge.. what should they do? Bake ads into the content? Ad block wall? Subscription? Pay per view?
Basically it doesn't make any meaningful progress towards a better outcome. It just temporarily makes the content more enjoyable to you at the expense of the person who created it and maybe to you if you enjoyed it and wanted more.
> I actually don’t know if the model thinks someone is looking
It 'knows' (from simply training) with an extremely high degree of certainty when its prompt is written by an LLM/itself - and thus will change what it writes.
You are wrong. I honestly am having trouble understanding how you think these things work, and what you believe a harness is in the first place.
There is the standard API that things like openRouter exposes, thats supported by every provider, and all it is, is manipulating a large blob of memory by adding your own words or asking the GPU to append new words.
Everything else around it is window dressing. All providers accept that API, (only Anthropic has blocked access on their consumer subscription tier).
Its how businesses write their 'bots'. Nobody - except the people trying to sell you "magic" - is incentivized to remove that kind of access.
I can switch out openai/anthropic/deepseek/openrouter/kimi/selfhosted at the drop of a hat. Its a big reason you'll see a comment on HN talk about "There is no moat".
Calling them cc-derivatives is wrong. I've seen many features land in other harnesses long before they came to Claude.
The only thing Claude seems to be "cheating" with is that:
- They provide Windows users a unix VM hosted on their servers - I dont want or need that
- They're better 'trained' at doing compaction / providing the illusion of continuity
- They might do automatic model-switching (not sure if they do) - not something i need.
Sure, if you're in the market for magic then dont put time in having your own harness and just accept the lock-in. Since I'm using them so much i think its worth the investment.
Sorry, I didn’t mean to imply that what you’re doing is wrong, although re-reading my own comment sounds like so.
The capabilities of a model unlocks certain harness behaviour, and in its terms might be beneficial to automate more of your x, y, z.
I guess computer use would be an example I was thinking about. Certain models are not as good as some current models (Astra/Fable) in understanding through screenshots, or going through some hoops in some environments. As models evolve, they unlock new capabilities, that you either have to keep implementing in your harness, or using an existing one. I’m pro-using existing just because it doesn’t make sense for my org to support another dev tool internally, when there is heavy better development happening by people who focus on that.
The reason why i said cc-derivative, as far as I can see, cc was the one that convinced people “it might be a good idea to dev this way”. Sure you had some lesser known harnesses around, but a year+ ago, nobody really cared.
I don’t think, at least as of now, anything is really much of a lock in. We switch out between cc/codex/cursor and it takes trivial amount of time to set stuff up, depended on how your dev loop goes.
Again, it really depends on one’s conviction of “how fast things will develop from now on”. I personally think stuff will keep changing very fast. In a year what we think of harnesses will be different. Investing in custom tooling might be bad, as that is basically a lock-in. But again, I don’t know the future, but that’s my bet. Hovering around the edges and using what others battle test is an easy way out right now.
Also in some larger orgs, there is more friction in model choices. So you slowly start losing the benefits of model-swapping. Obviously different for personal projects.
> The reason why i said cc-derivative, as far as I can see, cc was the one that convinced people “it might be a good idea to dev this way”. Sure you had some lesser known harnesses around, but a year+ ago, nobody really cared.
No, you didn't care. You're substituting "I" for "everyone" here, common error.
> The capabilities of a model unlocks certain harness behaviour, and in its terms might be beneficial to automate more of your x, y, z.
Not really.
Sure its nice for a model to nativly be trained on understanding browsers & DOM/js model, so it can effectively use a `browser` tool.
A model needs a certain 3d mental model before it can successfully use a `blender` tool.
Opus 4.5 had this to some extend without specifically training for it - but sure this is one aspect i think models will rapidly improve on this year.
But at the same time these tools carry a description of how they're used specifically - so changing out the `blender` tool for some other 3d modeling software shouldn't affect its capabilities. Using/creating a coherent description of the desired art-style is most of the value of the work.
So its still not clear to me what you mean with "certain harness behavior" or "unlock new capabilities".
You get access to a model that can be better or worse at certain tasks, sure.
The big change i've noticed last year is they've gotten better at prompting themselves (subagents, delegate, w/e you want to call it).
But the explosion of how fast things went last year is mostly "existing software * better model". For that capability explosion to continue you'd need ever more "software" that improve with AI (or more existing software unblocking their interface for model use)
There will definitely be more software, but you need time to incorporate it in your work (like eg `git`) for it to meaningfully feels like AI is unlocking new things when using it.
For new stuff like being able to control a robot dog, we first all need to have a robot dog for it to feel like very fast development.
----
As for "Computer use" specifically that seems like a bad example from my perspective.
The only real "added capabilities" over the past year i've seen is better selfprompt + comprehending screenshots.
Every other use case i'd consider computer-use is just friction that needn't have been there in the first place. Its the software/os you're using that doesnt have a proper interface that's creating the friction. Not the lack of model/harness capabilities.
I have had a `browser` tool for a year that's just a debug-socket to ff/chrome with eval + pre/post screenshot, and ever since 4.4 ~ 4.5 every model has understood it just fine and can do basically anything.
Reasoning _what_ to do with it is the 'intelligence' we're trying to benchmark and everything since Opus 4.5 was basically 'good enough' for anything non-creative a human could do.
E.g. having a model get good at creating drafts of emails based on support tickets, is a function of how good the cli/mcp and instructions are.
Can you be more specific in what capability increase you see getting unlocked?
As a final point, the models are so good now that you can ask claude inside claude to write/setup plugins for pi to do everything claude can do.
The reason i dont use pi to ask to improve the claude harness, is because anthropic is trying to build a moat with their closed source crap. They'll succeed because enterprise is slow to adapt and doesn't understand its wasting money, not because their models unlock certain harness behavior. The competition who is not wasting money will have a step up.
I get how these choices might be the local optimum for a desired UX, but damn is it depressing to extrapolate where software as a whole is going.
reply