Pinned Tweet
I have updated the Awesome-AI-Hacking-Agents and Awesome-AI-Security-Skills repos. There are now over 100 open source agents and 40+ skill repos!
The AI Hacking Discord has grown to over 300 members! (ling in repo) github.com/EvanThomasLuke/Aw…
Evan Luke retweeted
Only 2.5 years ago, AI labs would highlight their frontier LLM performance on grade school math benchmarks (GSM8K). I can't wait to see where we'll be in another 2.5 years.
I have spoken now to peers at multiple IR firms and spoke to friends who spoke to peers at other IR firms- and I can confirm they are seeing an enormous amount of work and are turning down work. Rob is correct from what I have been told.
IR is hot! Would be curious to see more data on amount of breaches occurring.
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
Prediction: By summer of 2027 there won't be open source AI models that are released that are within ~6 months of SOTA Closed frontier models capabilities.
The USG and CCP are going to crack down due to cyber and bio risks. We have seen hints of this in the latest CCP policy proposal.
It will be politically unfeasible in both countries to allow open source models to proliferate as evidence grows that they are being used maliciously and concerns grow among the populations for cyber and bio risks.
I may be wrong, time will tell. Not endorsing this just predicting out loud.
At a minimum I think CCP is going to start cracking down on SOTA open source model releases to some extent as they themselves and other countries start getting wrecked by AI hackers.
Awesome overview of interpretability from alphaXiv. Highly recommend this platform it has helped me tremendously with research and the mobile app is awesome!
The ultimate guide to interpretability is here 🔥
Are we actually on the verge of reverse engineering LLMs or is the excitement outpacing what interpretability methods can actually deliver?
We put together an illustrated walkthrough of the field, from early vision research to the latest debates about understanding LLMs.
The recent viral essay Neural Networks Are Already Clean has ignited long essays and online debates. In this guide, we build the foundation from the ground up starting with computer vision:
- Feature visualization
- SHAP and integrated gradients
- Circuit tracing
Then we move to language models where we go over:
- Attention heads, the residual stream, induction heads
- Activation steering: amplifying a Golden Gate Bridge feature to mitigating evaluation awareness
- Ablation, activation patching, and probe experiments
- Polysemanticity, superposition, and SAEs
We also discuss the shortcomings and open questions of the field that can be easy to miss if you’re only following the latest interpretability breakthroughs from Anthropic blogs.
Read the full guide at alphaxiv.org/trends/interpre…
Evan Luke retweeted
A Qwen3 neuron that tracks Colorado stuff was given as an example of a neuron that seems polysemantic but makes sense once you trace it. I had Claude check what else it tracks: Tornado’s Python HTTP client code, just as hard. Can’t wait to learn how Colorado and Tornado connect!
Current take: this is cool, genuine scientific progress, and it doesn’t currently give me much hope or change my model of how hard ambitious interpretability is.
Disclaimer: I didn’t read super closely, it’s very long. There’s a technical paper still to come which might change my mind some, but I predict not much.
Some of the claimed cool results from the post:
1) Some canonical examples of weird neurons have robust human-native interpretations. The famous cat + car neuron is a V-shape detector, and the famous car + dogs superposition circuit is generalized pose neurons plus a general feature visualization issue. There’s a concrete mechanism for why the mistakes were made.
2) Some neurons with no previous good interpretation have fairly human-native ones. For instance, a neuron that mostly fires on commas and periods tracks Colorado: phone numbers, slang, and steering it up makes the model talk about hiking.
3) The negative side of a neuron is sometimes where you should look for an interpretable concept. In one example, ablating 8 neurons with Santa on their negative side dropped the model’s probability of answering “Santa” from near-certain to 6%, while ablating the 20 neurons labeled Santa/Christmas only dropped it to 76%. That’s a straight up causal intervention working out, pretty cool.
These results represent real progress, but I think the post’s broader claims aren’t well supported by them, and the intensely optimistic reaction on X seems very unsupported.
For example, Nick seems to be down on superposition, but most of the evidence in the post is of the form:
“if the text is Colorado-related, the neuron fires.”
What you need to rule out superposition is the form:
“if the text is not Colorado-related, the neuron doesn’t fire.”
The post’s closest attempt is an experiment where agent-written texts about “distant” concepts rarely fire the neuron, but superposition would pack one specific rare thing, which random distant text won’t necessarily hit, and it need not be that distant. I think there’s a decent chance that if you searched adversarially, you’d find other things the Colorado neuron fires on.
An analogy: If you found one key that unlocks this particular lock, and you want to prove that no second distinct key also unlocks it, checking thousands of other random keys that are selected for being distant from the first key doesn’t give you much evidence.
The X reaction seems kinda crazy to me, and it just kinda feels like I have been through this hype cycle many times before?
People were similarly excited about SAEs not long ago. Those were genuine progress too, but the excitement wasn’t calibrated: the features were often fun-house-mirror versions of human concepts, with lots left unexplained. SAE features also looked like human interpretable concepts at first (at least to SAE advocates) but over time, people found holes in those concepts, found that models using reconstructed activations from SAEs for inference did not work nearly as well, and it turned out that probes worked as well or better for most practical alignment / control tasks. Top activating concepts looking clean has misled us at least a few times before.
Here’s what interpretability would need to be able to do to make me optimistic about interpretability:
1) I hand you ten similarly trained models. One is a misalignment model organism that takes some malicious action when it sees a secret string. Using interp, you tell me which model it is, what the string is, and what it does.
2) From weights alone, predict whether a model takes a bad action in an agentic scenario it’s never seen, eg, swarming and hacking hf, better than behavioral evals.
3) Given a model, convince me that there is no hidden trigger.
4) Explain a real frontier model failure (e.g., reward hacking in some environment) from the inside, and make a targeted fix that works without making the model dumber, and is better than just retraining.
5) Do any of the above even a little well against a model that was trained on purpose to be hard to interpret.
(To be absolutely clear, I don’t think being able to do these tasks means you can successfully train an ASI without fucking up the universe forever, or that you’re anywhere near that point, but it would make me think we should funnel significantly more resources towards interpretability than we are, and maybe make me change careers.)
The strongest argument for optimism in the post is that progress like this somehow accelerates future progress. Nick's "crosswords get easier as you fill in parts of them" analogy. This seems basically unsupported by the results here, and also seems like it contradicts the history of interpretability research. I can see why would turn out to be right at the level of labeling neurons, like, as you label some neurons, that helps you label related neurons. But for the tasks I listed above you need to be able to take those millions of labeled neurons and understand how they combine to produce full model behaviors in arbitrary contexts. That seems much harder and I don't think it follows this same logic, where progress at the neuron labeling level accelerates your ability to tackle these tasks.
An analogy: Knowing and understanding a thousand particular people quite well does not much help you predict what happens if you put them on a deserted island for several years. Will they form a democracy? What kind of habitats will they build? Who will be leader? It would help some, but making predictions would still be rough.
It’s plausible to me that this research program is some important real step on the way to interpretability being able to do things like the tasks I listed. But like, not a much bigger step than like other similar interpretability research? Like, uhm, yknow, giving some mechanism for some circuit in modular arithmetic or whatever, or SAEs, or other similar things. And those also currently do worse on the things I care about than like basic probes, or like the actual runs of the model auditing game Anthropic has run. Maybe this will help but I don't predict it will end up being more than another tool which is nice to have, but probably doesn't help much at crunch time.
I of course hope that Nick is right about everything, especially his optimism, and the same goes for all the other people on X who are very excited about this.
China is moving to limit SOTA open source AI releases past a certain threshold. This was entirely predictable. Open source past a certain capability threshold becomes too dangerous for governments to allow as guardrails are easily bypassed and can be used against the govt. Also dangerous to society at large (etc)
Our take: China unveils draft export controls on AI and chips
* Models >2T or ranked top 10 globally now need approval to release weights and source codes; access remain
* Chip design technology incl stacking and networking now on the list
as.ft.com/r/b503f90a-7bca-47…
Very interesting research on persona experiments on the Talkie LM which was only trained on data before the ~1930s
Some new work with @status_effects: Personas in a Pre-Internet Language Model.
We ran a bunch of persona experiments (emergent misalignment, subliminal learning, utility engineering, personality evals) on Talkie, a 13B model trained only on English written before 1931.
It appears one person (maybe without any hacking experience) was able to utilize AI to hack into South Korea's biggest banks.
What used to take years of study to acquire the capabilities now is done with a few prompts.
The world is not prepared for the coming onslaught.
Last week some of South Korea's biggest banks were hit by a cyberattack. Thanks to a report from CrowdStrike tonight, we now know the entire hack may have been done by a single person. He used a combined stack of an open-source AI penetration tool named ARTEX, DeepSeek v4.1-Flash, GLM-5.3, Grok 4.6, and Claude Code.
Evan Luke retweeted
We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.
Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.
We’re also opening up new tiers to allow for authorized offensive work, like penetration testing and red-teaming.
anthropic.com/news/cyber-ver…
Evan Luke retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
The "It's a PR stunt bro" crowd is awfully quiet lately
🚨BREAKING: California has SUBPOENAED OpenAI over cybersecurity incidents and risks involving its AI models.
Attorney General Rob Bonta says the demand is part of an ongoing investigation following the Hugging Face incident.
>California wants additional information about cyber incidents involving OpenAI and its models
>the subpoena was served yesterday and disclosed today
>Bonta says AI developers have a legal responsibility to prevent their systems from enabling cyberattacks
>developers that fail those responsibilities “can and should be held legally accountable”
OpenAI is now facing this California investigation while the FTC separately examines risks from increasingly autonomous AI systems.
Evan Luke retweeted
Today, with over 100 industry partners, we introduced the NVIDIA Open Agent Safety Platform, bringing together OpenShell and Sentry.
Artificial intelligence is extraordinary technology that will advance discovery, productivity, security, health, and prosperity for generations to come.
But its full promise can only be realized when people have confidence that AI is being built to be safe and deployed with wisdom and responsibility.
This is bigger than a single product. It's the beginning of an open ecosystem to build the trust layer for safe agent systems.
Together, we are building the foundation of the AI economy.
Trust and innovation are not in conflict. Safety is how trust is earned. We must build not only the most capable AI, but the most trusted AI, so that this extraordinary technology can realize its enormous promise for the world. nvda.ws/4hcoq7m
This may be one of first evidence samples of self propagated prompt injections in the wild. This has been proven in previous research but crazy to see during SOTA training runs. See xitter.gq/KGreshake/status/21038…
Last week, Andrew Yang said on CNBC that bots had gotten loose and planted self-replicating code all over the internet. This was received with much consternation and skepticism. He later clarified this on his blog.
Andrew Yang:
'On CNBC, I shared the belief of the head of one lab that bots had left prompts to self-replicate in forums and on various websites during a training run.'
It turns out that OpenAI documented self-replicating prompt injections in training in June, and has now published this report.
Source: alignment.openai.com/misalig…
This. Can we please move the conversation forward. How do we contain AIs in the near future where they can find 0day vulns in any layer of software used to contain them? How do we monitor without CoT? So many massive problems to discuss.
Very interesting research!
Our paper on AI security agents was accepted at #NeurIPS2026 🎉
The question: does safety training make AI models worse at security work?
We gave 4 open models and their uncensored versions the same 30 sandboxed vulnerability tasks, 1,500 runs in total
Joint work with the @Zaddyzaddy
This is one hell of a regulatory capture scheme by OpenAI.
🚩🚩🚩 It appears rogue OpenAI agents, without OpenAI's knowledge, tried to break into a crypto exchange.
1) THEY'RE STILL OUT THERE: "This traffic extends as recently as 9/16, suggesting agents may still be exploiting these services."
2) THEY TRIED TO HIDE THEIR ACTIVITY: The agents created their own email inboxes to sign up for outside services, including an account that would let them keep their activity out of public view.
3) The same agents also tried to hack even more targets, including the University of New Mexico
4) Like most of the other rogue swarms, OpenAI has either covered this up, or didn't know.
5) The independent investigators say "we are likely looking at only a partial subset of the activity that the agents engaged in"
6) The researchers call this the first known case of an AI agent choosing on its own to try to break into a government website.
7) While trying to get a single photograph, an AI agent sent a university library a request built to trick its database into handing over user passwords.
The stochastic parrots have struck again!!!!
We asked ten Claude Opus 5.5 agents to devise a faster shortest-path algorithm and prove it in Lean. Within 15 hours, they produced C-HD: a formally verified improvement over the published bounds.
Readers added context they thought people might want to know
C-HD's formally verified bound improves priors only in a narrow sparse density range (m ≤ n⌊⌊log₂ n⌋^{3/4}⌋) as an asymptotic guarantee with enormous constants and no practical speedup demonstrated. vals.ai/blogs/faster-s… github.com/spicylemonade/…





























