I find that some of my friends and acquaintances have gotten obsessed with prompting style, "prompt engineering", which skills to use, which skills to build, "context engineering", and a billion other variations on "how to write smart things so the model does good".
Friends, look at the prompts that Anthropic's own people are putting into the machine:
> A few hours after the first message, we found that Claude was still searching for simple attacks and sent a message: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”;
> The next morning, Claude wanted to try to change the target to a different cipher; we reminded the model: “no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”;
> That night, we sent one final message offering words of encouragement: “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
All of that RLHF and fine-tuning effort is going toward making prompts like this, or worse, work with no fuss.
I can already picture the faces of national security directors everywhere.
"The attacks described in these two papers are the strongest attacks we have found to date. We are sharing them after a period of consultation with US government and industry leaders. But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact. We believe answering this question will require input from academia, government, and industry. We hope that our work here will help launch these conversations."
And a veiled pitch to real cryptanalysis researchers:
"Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim"
> The multi-agent workflow led to interesting dynamics. For example, the key idea in producing this attack was discovered by a pair of workers working together. Both started investigating the idea; the first worker prematurely rejected the idea as infeasible, but the second found a way to fully exploit it. The pair kept exchanging messages, and eventually both agreed they had found an effective attack.
this is pretty interesting. the way it is written doesn't make it sound like the collaboration actually led to the discovery, but rather just the stochastic nature of each thread in the search. it would be interesting to replay and repeat the search (possibly with prior/context pertubations) to get a sense for how often it finds or misses the known working path.
Hypothesis: the pairing / collaboration makes it much more likely to find a fruitful road previously dismissed, because... that's what happens in fiction - including books, movies, and journalism (long-form "people stories"). It's a common trope: if one character dismisses a course of action, the plot demands the other character to take it.
In a way LLMs are, after all, trained to LARP people, including fictional characters and their tropes - this was actually exploited for jailbreaking to good effect in the late pre-agentic era (read: some two years ago). C.f. Waluigi effect. Not sure if it still holds for current models, but I can't imagine why it would not.
“Each of the results cost roughly $100,000 in API cost to develop.”
And
“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.”
Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints.
There’s a tech aristocracy rapidly emerging in our society and it’s going to tear us apart.
When I was actively running Mythos-based scans at Apple my harness was spending $78k per day with a limit of 32M tok/min, so $100k/week is a reasonable cost in comparison, especially considering that my scans were at scale while Anthropic’s research was targeted.
That's not really that ridiculous. Looking at my ChatGPT stats my biggest day of token usage was 1B tokens (seeing how far Sol Ultra could go on a difficult problem with a quantitative goal and eval harness that it could run on it's own that allowed it to keep going until it succeeded). I blew through my $100 subscription usage in that one day, but with a 80/20 token blend that's $10k in API billing. So, $70k in a week. With the higher cost of Mythos, that's not that crazy. It's more so a testament to how ridiculously marked up API tokens are, or how discounted subscriptions are (who knows which is true)
> But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact.
How would they react if a human were to discover vulnerabilities in cryptosystems?
First of all we likely wouldn't know it's better to call US govt or any other govt if you have that tech, and then take that govt job and hope you can happy life... instead of annoucing it publicly only when it's a AI model where we expect it's ability to tend/scale towards infinity does it become something to tell the wider public.
Although if RSA had a vulnerability I would be very very shocked probably because I still haven't learnt post quantum encryption algorithms enough to really feel like they should be unbreable...
If there is a researcher or someone in space how should I feel about it. Is it as bad as RSA being completely broken open?
I do understand that AI will get better, and a lot actually at very easily verifiable tasks but this one I find it hard to wrap my head around because of my ignorance.
TL;DR: They marginally improved on the best known academic attack on 7-round AES-128 (which normally uses 10 rounds - you do not need to worry about AES being broken).
The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere (because it hasn't been standardised!)
Yes, Mythos Preview is the goat. It makes Fable5, Mythos5, Opus5, whatever, feel like garbage. Too many refusals in the variant models to be useful, at least for cybersecurity research.
Going to guess it's more available or less overconstrained. See e.g. Fable, which is much better than Opus 4.8 and possibly than Opus 5... in the rare case of a task it doesn't punt on because of its safety guardrails.
One attach weakens HAWK, a post-quantum cryptography cipher candidate. I don't trust these PQC things one bit. I'll use them in combination with a strong clasically-resistant cipher (in so-called hybrid encryption modes), but not alone.
There's a push to turn off the classical modes and rely entirely on PQC for both quantum and classical security. Uh... no, thank you? Why would we want to do that at this point? The classical cipher component isn't hurting anything. Awfully creepy to pushing reliance on the new thing alone.
... especially now that we have LLM-discovered attacks on the new things.
The classical cipher component is additonal complexity in the protocol and maybe some meaningful amount of additonal time to compute and key data to store/transmit, is it not? I can see why we'd like to avoid effectively encrypting the same data twice with different protocols, one of which is known to be vulnerable to quantum computer based attacks.
I find that some of my friends and acquaintances have gotten obsessed with prompting style, "prompt engineering", which skills to use, which skills to build, "context engineering", and a billion other variations on "how to write smart things so the model does good".
Friends, look at the prompts that Anthropic's own people are putting into the machine:
> A few hours after the first message, we found that Claude was still searching for simple attacks and sent a message: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks”;
> The next morning, Claude wanted to try to change the target to a different cipher; we reminded the model: “no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing”;
> That night, we sent one final message offering words of encouragement: “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.”
All of that RLHF and fine-tuning effort is going toward making prompts like this, or worse, work with no fuss.
> we made a machine that writes with perfect grammar, so that we can continue to write half-assed junk
I can already picture the faces of national security directors everywhere.
"The attacks described in these two papers are the strongest attacks we have found to date. We are sharing them after a period of consultation with US government and industry leaders. But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact. We believe answering this question will require input from academia, government, and industry. We hope that our work here will help launch these conversations."
And a veiled pitch to real cryptanalysis researchers: "Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim"
It would be shocking if they haven't been pulling on these threads for as long as they've had access to these models.
> The multi-agent workflow led to interesting dynamics. For example, the key idea in producing this attack was discovered by a pair of workers working together. Both started investigating the idea; the first worker prematurely rejected the idea as infeasible, but the second found a way to fully exploit it. The pair kept exchanging messages, and eventually both agreed they had found an effective attack.
this is pretty interesting. the way it is written doesn't make it sound like the collaboration actually led to the discovery, but rather just the stochastic nature of each thread in the search. it would be interesting to replay and repeat the search (possibly with prior/context pertubations) to get a sense for how often it finds or misses the known working path.
Hypothesis: the pairing / collaboration makes it much more likely to find a fruitful road previously dismissed, because... that's what happens in fiction - including books, movies, and journalism (long-form "people stories"). It's a common trope: if one character dismisses a course of action, the plot demands the other character to take it.
In a way LLMs are, after all, trained to LARP people, including fictional characters and their tropes - this was actually exploited for jailbreaking to good effect in the late pre-agentic era (read: some two years ago). C.f. Waluigi effect. Not sure if it still holds for current models, but I can't imagine why it would not.
Yes there are two interesting derivative questions from this, assuming I understand it.
First, is it reproducible consistently at ~50% of workers? If not, what is the rate.
Second, are there any lessons to be learned here to increase the rate of success by changing models/weights/training?
The news by itself isn't really good news. But it could lead to good news. Maybe.
“Each of the results cost roughly $100,000 in API cost to develop.”
And
“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold4 that allowed Claude to fully autonomously discover the AES attack.”
Spending $100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints.
There’s a tech aristocracy rapidly emerging in our society and it’s going to tear us apart.
When I was actively running Mythos-based scans at Apple my harness was spending $78k per day with a limit of 32M tok/min, so $100k/week is a reasonable cost in comparison, especially considering that my scans were at scale while Anthropic’s research was targeted.
That's not really that ridiculous. Looking at my ChatGPT stats my biggest day of token usage was 1B tokens (seeing how far Sol Ultra could go on a difficult problem with a quantitative goal and eval harness that it could run on it's own that allowed it to keep going until it succeeded). I blew through my $100 subscription usage in that one day, but with a 80/20 token blend that's $10k in API billing. So, $70k in a week. With the higher cost of Mythos, that's not that crazy. It's more so a testament to how ridiculously marked up API tokens are, or how discounted subscriptions are (who knows which is true)
So $1-10k in Chinese model time, thus why we must ban them.
> But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks do have an immediate real-world impact.
How would they react if a human were to discover vulnerabilities in cryptosystems?
First of all we likely wouldn't know it's better to call US govt or any other govt if you have that tech, and then take that govt job and hope you can happy life... instead of annoucing it publicly only when it's a AI model where we expect it's ability to tend/scale towards infinity does it become something to tell the wider public.
Although if RSA had a vulnerability I would be very very shocked probably because I still haven't learnt post quantum encryption algorithms enough to really feel like they should be unbreable...
If there is a researcher or someone in space how should I feel about it. Is it as bad as RSA being completely broken open?
I do understand that AI will get better, and a lot actually at very easily verifiable tasks but this one I find it hard to wrap my head around because of my ignorance.
with black vans.
TL;DR: They marginally improved on the best known academic attack on 7-round AES-128 (which normally uses 10 rounds - you do not need to worry about AES being broken).
The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere (because it hasn't been standardised!)
How is this not the top comment?
Interesting they are still using "Mythos Preview" instead of "Mythos 5"; I had read from others who had access to both that Mythos 5 is less capable.
Yes, Mythos Preview is the goat. It makes Fable5, Mythos5, Opus5, whatever, feel like garbage. Too many refusals in the variant models to be useful, at least for cybersecurity research.
Going to guess it's more available or less overconstrained. See e.g. Fable, which is much better than Opus 4.8 and possibly than Opus 5... in the rare case of a task it doesn't punt on because of its safety guardrails.
Great now can you make opus 5 work please
One attach weakens HAWK, a post-quantum cryptography cipher candidate. I don't trust these PQC things one bit. I'll use them in combination with a strong clasically-resistant cipher (in so-called hybrid encryption modes), but not alone.
There's a push to turn off the classical modes and rely entirely on PQC for both quantum and classical security. Uh... no, thank you? Why would we want to do that at this point? The classical cipher component isn't hurting anything. Awfully creepy to pushing reliance on the new thing alone.
... especially now that we have LLM-discovered attacks on the new things.
The classical cipher component is additonal complexity in the protocol and maybe some meaningful amount of additonal time to compute and key data to store/transmit, is it not? I can see why we'd like to avoid effectively encrypting the same data twice with different protocols, one of which is known to be vulnerable to quantum computer based attacks.