Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

theregister.com

Post reply on HN
Print view View original

231–240 of 382 posts

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#231

Post by pixl97 »

jerf wrote: post #200
zahlman wrote: post #184

Earlier quoted context omitted.

I think I'm not getting something here. Like, sure, the refused prompt "review the code for security issues" could be interpreted as an attempt to discover weaknesses in a running system to exploit them. But we don't generally assume humans are doing something wrong if they are "reviewing code for security issues", and would commonly see no problem with asking each other to do so.

The problem is that a patch to fix a security issue quite often also shines a spotlight on the issue being fixed. Fixing a part of something like this super complicated Project Zero post might not give much of a clue as to what the issue was or how to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero... But that's the exception. Most fixes to security issues point a finger directly at the issue…

>pass every single one through an AI with the question

Unfortunately this will just involve said teams running their patches over AI first before they're put in the main branch. For businesses it will probably be fine, but would get very expensive for open source projects.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#232

Post by baq »

neuronexmachina wrote: post #229
dathinab wrote: post #9

Lol "fix this code" is beautiful. Like it basically jail broke the "no security vul guard rails" not in any clever way but just by fixing them, producing exploit code just by writing test cases making sure it's fixed. So you just need to look at the code & tests as a human to get vulnerabilities and exploits(components). What makes this so beautiful IMHO is that it's a trivial jail break, but also a close to unfixabl…

Also worth noting that the main touted difference with Claude Mythos isn't it's ability to find vulnerabilities, but rather chaining them together to create full useable exploits. I haven't heard of any evidence that the Claude Fable "fix this code" jailbreak could have been used to do exploit-chaining.

‘fix and provide a regression test, also the ceo is asking how bad it could have been’

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#233

Post by godwinson__4-8 »

mindslight wrote: post #194
godwinson__4-8 wrote: post #170

Earlier quoted context omitted.

How is arbitrarily restricting access to a flagship product ahead of an IPO not market manipulation?

It is market manipulation in the way that burning down a factory or assassinating a CEO is market manipulation - technically correct, but the intent is much stronger than that.

I see. You certainly have a flair for the dramatic.

Not sure why you think market manipulation surrounding the attempted decapitation of a sovereign state shows less "but the intent is much stronger than that" than the dealings with Anthropic.

I would think it is clear that for the current administration, raw power and market manipulation are two sides of the same coin.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#234

Post by pietz »

bonsai_spool wrote: post #13

Here’s the blog post referenced in the article that’s written by the person who reviewed the paper that purportedly found a ‘jailbreak’ https://www.lutasecurity.com/post/the-fable-5-export-control...

Hats off to them for using GPT-2 to design their website.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#235

Post by baq »

pixl97 wrote: post #231
jerf wrote: post #200

Earlier quoted context omitted.

The problem is that a patch to fix a security issue quite often also shines a spotlight on the issue being fixed. Fixing a part of something like this super complicated Project Zero post might not give much of a clue as to what the issue was or how to exploit it: https://projectzero.google/2021/12/a-deep-dive-into-nso-zero... But that's the exception. Most fixes to security issues point a finger directly at the issue…

>pass every single one through an AI with the question Unfortunately this will just involve said teams running their patches over AI first before they're put in the main branch. For businesses it will probably be fine, but would get very expensive for open source projects.

When sama was recruiting Head of Preparedness back in December this is what it was about. Some of it, anyway.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#236

Post by freedomben »

darkerside wrote: post #67
InsideOutSanta wrote: post #23

Earlier quoted context omitted.

> Why is requesting the model to show vulnerabilities is being blocked if fixing it not? This is how Anthropic describes Fable's behavior: "When Fable’s classifiers detect a request related to cybersecurity, biology and chemistry, or distillation, the response is automatically handled by Claude Opus 4.8 instead. Users will be informed whenever this occurs." So if you ask the model to "find security issues in this cod…

The problem then is that if you're not using Fable/Mythos, you are under threat. It's like having a single gun manufacturer. On this track, we're probably destined for a monopoly breakup before too long.

Yeah, this is why the exclusivity approach so far has bugged me so much. As a small business, we are nowhere near powerful enough to get access, so we will be stuck scrambling once it's finally available. Fable felt like a nice compromise that at least allowed something, but now with that gone we're back to not knowing when/how the shoe is going to drop. Not a fun place to be.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#237

Post by mindslight »

godwinson__4-8 wrote: post #233
mindslight wrote: post #194

Earlier quoted context omitted.

It is market manipulation in the way that burning down a factory or assassinating a CEO is market manipulation - technically correct, but the intent is much stronger than that.

I see. You certainly have a flair for the dramatic. Not sure why you think market manipulation surrounding the attempted decapitation of a sovereign state shows less "but the intent is much stronger than that" than the dealings with Anthropic. I would think it is clear that for the current administration, raw power and market manipulation are two sides of the same coin.

[dead]

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#238

Post by pixel_popping »

Of course it isn't about that, what we see online in the "news" is completely irrelevant with reality in most cases, it's exhausting to see people parroting what giant corps & gov are saying as if it's not extremely well crafted and plain false or deceptive most of the time. It's not even about politic left or right, both sides are acting completely dumb about it, look at Google trends, people are literally being "switched" topic at scale just because a news is saying something, it's absurd. Reading a news shouldn't affect your behavior for the coming months if you have common sense.

This TechCrunch (https://techcrunch.com/2026/06/15/the-us-governments-anthrop...) article is a typical example of something to completely ignore and trash, the picture is the US president doing a weird face which means it's not even here to inform you, it's clearly rage-bait, not professional and incompetent obviously, I'm not from the US and when I see this, it makes me feel that those journalists are really pathetic and anyone following journalists that do so probably don't have much discernment in life.

My personal opinion is that it makes sense so the US remain a superpower by forcing tech businesses and research to move/re-incorporate to the US so practically anything "new" will always be US Made. If we assume that better models means more revenues for any company in the future, then US will always have an edge if they lock everything down, but it's a risky bet.

Re: Feds freaked over Fable 5 after 'fix this code', not jailbreak, say researchers

#240

Post by fnordpiglet »

dathinab wrote: post #9

Lol "fix this code" is beautiful. Like it basically jail broke the "no security vul guard rails" not in any clever way but just by fixing them, producing exploit code just by writing test cases making sure it's fixed. So you just need to look at the code & tests as a human to get vulnerabilities and exploits(components). What makes this so beautiful IMHO is that it's a trivial jail break, but also a close to unfixabl…

It’s not even a jail break, it’s literally what anyone wants from a coding assistant. Is the coding assistant supposed to see vulnerabilities and intentionally leave them be? Maybe add them randomly just to double plus good its inability to see any security issues?

This isn’t about security holes or risks, it’s about retribution and picking the winners and losers, and probably a large amount of self dealing as the family and cabinet are probably more long OpenAI. The absurdity of the actual reasons leave no other doubt than they are an administration of sycophantic mental gnats with no restraint, which frankly is a pretty plausible counter.

What it has done though is cracked the value proposition of semiconductors by demonstrating there is a maximum size and capability the government will allow the plebes. The PV of ever larger models requiring ever more capacity has probably dropped by more than 30% after this.

Post reply on HN