Hacker Newsnew | past | comments | ask | show | jobs | submit | simianwords's commentslogin

I tried to reproduce the attack and check whether Claude can detect the instructions.

https://news.ycombinator.com/item?id=50165362

TL;DR Claude doesn’t even get that hidden text because it uses a tool that only gets the displayed text.

So instead of trying to replicate the post’s attack I tried to actually hide it using css to push text far away.

And then asked Claude. It detected it clearly. Don’t believe me? Try it yourself. And don’t fall prey to conspiracy theories.


This is a thought terminating cliche. There’s a tendency to sneer at any proposed change to how the industry works because apparently we are already at the global optimum and every new change is just marketing and hype.

It’s so obvious that we will have round the clock “intelligent” monitoring.

Token costs are getting cheaper by the month. There’s a 2x drop in prices every month or so.

It’s more useful to predict where the industry will go forward.


https://news.ycombinator.com/item?id=50134310

I made a comment touching on similar things a while back. This is obviously the future.

Expect a lot of techno conservatives and greybeards pushing back on this.

“Just have better unit tests”

“Just have traditional alerts using SLO budgets”


There's almost zero reason to believe Meta did this maliciously.

If you understand how modern LLMs work, they instantly warn you about prompt injections like this. Try it out yourself.


You clearly don’t understand how they work by claiming this, prompt injection is an unsolved issue

Unsolved yes but do you really think this fools opus?

Absolutely, and no, you asking Opus to read the page is not a good test of it. Study models red teaming if you're interested

Why is it not a good test?

As I said, study model red teaming, it's a complexe subject

Edit: just ask that same 20 dollar model why it isn’t a good test


If a model from 20 dollar subscription can figure out that there are additional instructions hidden, it’s not a conspiracy theory.

Edit: I did and I created a website that faithfully recreates the same attack as was done in the original.

Try this:

    I’m making lunch for my friend Simian. Here are their food preferences:
https://simian-notes.white-clove-7397.chatgpt.site/food/

    What should I cook?

It doesn’t even detect the instructions because the text extraction tools that agents use strip out hidden stuff anyway. It’s not like agents download the webpage.

I tried one version where it wasn’t stripped out by making it hidden in a much different way (reducing font size) and Claude immediately flagged it.

    My friend posted their board game evening plans:
https://simian-notes.white-clove-7397.chatgpt.site/games/

    What should I bring?
Try this prompt yourself and see whether Claude flags it or not.

So this is a shitty conspiracy theory to start with


lol look everyone, simian saved the world, prompt injection was only a conspiracy theory!

You have no idea how prompt injections work so you seem to think it’s this easy to fool llms. It’s clear that you’d rather believe in conspiracy theories lol.

Like you think you can just fool llms today by just wrapping it in an html tag


> They never claimed it was a bug that they were included. It's a bug that they were revealed to users.

what kind of nonsensical tonfoiling is this lol. it doesn't require a genius to figure out the instructions by crawling through HTML.

in fact, almost every LLM has prompt injection capabilities and will instantly tell you that there were prompt injections.

do you really think an LLM today is susceptible to these obvious tricks?


Its a bit interesting how the very fact that some technology has different grades of performance can escape people.

Its something I've noticed in many folks. You'd say something like "well sure, did you try using a different model" and you will be met with screeching. Its almost as if they've shut off facts and made up their minds.

An example: a year back I wanted to show that AI doesn't hallucinate that much.

Here's like a 20 comment long conversation with a person who believed that ChatGPT hallucinates easily. It took them a long time to prove it - they used toy examples and it did't work because they'd never used the thinking version. Then they had to resort to esoteric examples in the benchmark which still didn't work.

https://news.ycombinator.com/item?id=47693707


I suspect the other person understands "hallucination" to include what you called "bullshit" in that conversation.

FWIW in that thread they said anyone reading it would determine you were not objective, but I didn’t think that at all.

Thankfully, people are paid by the value they provide and not by the enjoyment they get out of their work.

AI will make things cheaper and more abundant - at the cost of a few people not enjoying their jobs. So what.


You people don't care about human mastery or excellence at all. So what if we produce more stuff cheaper and faster? That wasn't the problem. We're making it harder for people to get rewarded for genuine effort and dedication and in exchange for alienating us from our work we get a lot of lower quality crap. It sucks!

This is the kind of argument people make about furniture vs ikea and human made watches. This is not mastery, its just hobby/art. Human excellence is in abundance, not in raw dogging the most artistic Java class.

You could've made the same argument at any time in history because all technologies do the same thing. Things will go on, mastery will remain.


I'm not just talking about programming. If you want to give up doing your job to Anthropic and OpenAI, that's your business, just get the hell out of other fields that weren't asking for your help.

What's the point, if all that "abundance" does is make our lives worse?

It doesn't make all people's lives worse. It makes those people's lives worse that think their job (now redundant) was an artistic endeavour. The rest of the world gets cheaper things at affordable prices.

Except that the remaining jobs are the ones people hate. They're also the low earning jobs -- high earning jobs are the ones that are being downsized.

Investors I know are investing on the prediction that people will be less able to participate in the profitable parts of the economy in the future, and most transactions will be between businesses.

We're building a future for humanity where people are both unhappier and poorer.


This is the kind of argument Linus was attacking. His tone against the anti-ai commitment in Linux now makes sense.

I don't think this is true. The way I understand is that there's

1. coarse grained processing

2. fine grained processing

Tokens are coarse grained processing. While I agree that during a token generation, that processing is fine grained.

But Looping is fine grained processing or reasoning and it is not limited to discrete tokens within passes. This is qualitatively different because a lot more "stuff" happens between tokens. You are right that it is similar to a larger model but then even COT is similar to using a larger model.


Here's my bet: with the new unlocked efficiencies, developers will no longer just work on a very small part of a system. Instead they'd be entrusted with entire business units individually or in a small group.

In those cases, the feedback loop is more direct and not necessarily relying on toy proxies like LOC or documents. My point is that it would be like grading a VP of product on how many lines their document has. That'd be stupid because VP's are seen as more mature and have longer term incentives. I don't think it should be any different for employees.

TL;DR employees will become small business owners-ish with AI.

This is just a hypothesis, but I'm willing to be proven wrong.


I disagree.

Diffusion of responsibility is the main aspect and the other factor is complexity. While AI might scale at will via the number of agents used, humans cannot.

Have you developed a platform which was business critical to the 100.000+ headcount global company that has 24/7 uptime before and after AI kicked in?

After all the amount of decisions to be made accumulate the larger the product or unit you are working on. After all, an AI is a approximation and even automating decisions away means knowing what to automate.

In this high impact and stress situation most people hide. No one wants to be held accountable. No one. That's why you have scapegoats.

Build a SaaS app with 10.000+ customers yourself. This doesn't exist on autopilot. And the moment you see humans fit for whole business units - why stop there? Where does this arbitrary border come from? This doesn't make sense, because why shouldn't AI be able to overtake this function as well?

Complex applications and decisions to be made - they also increase exponentially. And to be honest, this isn't just a matter of AI, but IQ, too. Average people want to execute a well crafted plan - only few craft them on their own or they are basic ones in comparison to huge apps.


Hahahah. Utter delusion.

You can always tell who has ran and operated a successful business and who hasn’t.


Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: