News for hackers. Stuff that matters.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by swatcoder on Wednesday June 03, 2026 @10:30PM (#48392929)
> Eventually I’ll reach a point where I am forced to choose between the useful aspects of the model and the limiting ones instead of just picking the most capable model out there

No, the choice will be whether or not to to upgrade to "Claude Security Professional" or whatever they want to brand it as.

What look like tightening "constraints" today are just setting up the upsell opportunities of tomorrow.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bryanrasmussen on Thursday June 04, 2026 @01:20AM (#48394292)
>What look like tightening "constraints" today are just setting up the upsell opportunities of tomorrow.

on the one hand agree, but on the other hand think it's reasonable in that they can then verify the person allowed to purchase access to that model is in fact a Security professional and should be allowed to do stuff like crack security.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by applfanboysbgon on Thursday June 04, 2026 @01:25AM (#48394346)
So, supposing it's true that these models completely change the security field and humans are ~obsolete other than as pilots guiding them what to crack, you think it's reasonable that Anthropic and OpenAI should unilaterally determine who gets to be a security professional? I hope you do understand that is what you are suggesting.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by fc417fc802 on Thursday June 04, 2026 @02:33AM (#48394842)
Why should anyone get to determine that? Do people really want us to move to an exclusionary guild system? I thought the experience with proprietary versus open source over the past 30 years had driven home the point that closed ecosystems are almost always far worse for security.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @05:51AM (#48396334)
Additionally, even if there is a guild - no guild ever let a vendor pick and choose what their capabilities were, that would be insanely dumb.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @09:12AM (#48398175)
Vendors choose what capabilities they create and sell literally all day every day.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by ambicapter on Thursday June 04, 2026 @10:39AM (#48399377)
You should read that sentence as

> Additionally, even if there is a guild - no guild ever let a vendor pick and choose what [the guild's] capabilities were, that would be insanely dumb.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @10:54AM (#48399626)
But that's not true. Again: Vendors absolutely pick and choose what their customers' capabilities are. Regardless of whether "the guild allows them to." Guilds can't force people to make or sell tools against their will – obviously.

The analog you're trying to describe doesn't exist, which is Anthropic saying nobody else can make and sell an offensive model to "the guild."

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @11:02AM (#48399734)
Guilds often very much did assert what people could and could not build - historically.

Against their will.

Historically that is a major reason why guilds existed, actually.

It’s an extremely modern invention that corps have these type of power over their customers.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @11:11AM (#48399870)
You've lost the thread.

Here's your original claim: "no guild ever let a vendor pick and choose what their capabilities were"

A carpenter's guild can prevent other people from doing carpentry. That is not what's being discussed here.

A carpenter's guild cannot force a horseshoe maker to begin making hammers. That is what's being discussed.

Your initial claim was analogous to "never before has a horseshoe maker been able to decline making hammers when the carpenter's guild needed hammers"

Obviously they have and any other state of affairs would be flatly insane.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @01:10PM (#48401550)
That is not my example at all, if we’re talking coding agents eh?
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @01:21PM (#48401712)
Your claim was that guilds have never allowed vendors to tell them what they're allowed to do.

That would imply that guilds have always had the ability to force vendors to create and sell the tools the guilds wanted.

That would imply that carpenters' guilds could force horseshoe manufacturers to make hammers.

That is obviously not true, therefore your original claim is false.

It's not true for carpenters and hammers nor for cybersecurity researchers and LLMs.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @02:22PM (#48402567)
Bwahaha. You’re really reaching there.

A vendor can still do something, even if the guild wouldn’t allow them to do it, if the guild didn’t have the power to stop them.

It used to be a guild vs a blacksmith (or the blacksmiths guild). Now it’s trillion dollar corps against smaller islands of un-organized individuals.

That’s new regardless of how you try to argue it.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @02:27PM (#48402664)
> basic deductive logic

> "Bwahaha. You’re really reaching there."

No. Customers have never been able to compel their suppliers to make or sell certain products against their will (except in collectivist regimes or like 0.00001% of natsec related instances)

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @04:35PM (#48404276)
This conversation gets more and more bizarre, but I’ll bite.

1) pharmaceutical companies are regularly compelled to produce specific pharmaceuticals to continue to be allowed to exist.

2) hospitals are regularly compelled to treat patients even if they can’t afford treatment, if it is a life threatening emergency.

3) car manufacturers are always compelled to produce vehicles that meet a litany of safety, weight, and efficiency standards or they can’t produce at all.

4) defense contractors are regularly compelled to produce specific defense related products for long periods of time after they would otherwise have stopped, or else.

5) even your neighborhood gas station is likely compelled to provide air refills, free or at minimal cost, or else.

6) during a wartime (command) economy, which has happened numerous times in the US alone in the last 100 years, companies have to make what their customers (the people of the United States) demand or else.

7) utilities like electric utilities regularly have to give out freebies or take losses on things as demanded by regulators, at customers behest.

Or if we go back a bit, blacksmiths, quarries, masons, etc. all had to deal with producing what the government/lord at the time wanted - often on penalty of death - during wartime, or just because they were ordered to do so.

Seriously, what are you going on about?

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @04:48PM (#48404428)
1) Not by their customers they're not, lol

2) Not by their customers they're not, lol

3) Not by their customers they're not, lol

4) The US government can compel production, but it's extremely rare

5) Not by their customers they're not, lol

6) Yep this can happen, but is extremely unusual

7) Not by their customers they're not, lol

We're illustrating how ridiculous your claim that "guilds have always been able to declare what vendors create for them" is

Now you're talking about government regulations for some reason. Even your examples of customers being able to compel production are actually examples of governments being able to compel production, and in just a few of these scenarios the government is the customer. But it's their power as governments, not their power as customers that can compel production.

As stated: you've lost the thread. You're talking about totally irrelevant stuff.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @05:48PM (#48405065)
And regulations are totally not written by people elected to do so - by their customers? And many of those, the customer is the gov’t and literally doing so?

You do you dude.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @05:54PM (#48405132)
lmfao, yes dude for sure.

By that logic, anyone can force anyone to do anything. Great insight.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @09:27PM (#48406897)
I swear, it’s like you can’t even read your own comments. Bizarre.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by fc417fc802 on Thursday June 04, 2026 @04:03PM (#48403883)
A more charitable interpretation might be that a guild would not be expected to passively allow such a situation to continue to exist. I think you'd expect a guild to directly contract for the desired tools or failing that to move into production themselves.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Thursday June 04, 2026 @04:55PM (#48404496)
Sure! And Anthropic isn't preventing other people from making offensive cyber models.

"The guild" is absolutely free to go seek other vendors if Anthropic declines to sell to them.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Friday June 05, 2026 @06:45AM (#48410606)
I take it you didn’t see the announcement where Anthropic is trying to get all new development banned, so they are ‘sole source’? [https://www.telegraph.co.uk/business/2026/06/04/worlds-most-...]
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by estearum on Friday June 05, 2026 @08:53AM (#48411756)
Regulatory capture: A vendor using regulation to prevent potential competitors from producing or selling competitive goods or services

What we're discussing in this thread: A customer compelling a vendor to produce and sell a specific good or service

Do you think these are similar?

The fact that Anthropic is doing one thing (regulatory capture) is entirely irrelevant as to whether they're allowed to engage in a completely different thing (declining to sell their services/products to specific people).

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by tredre3 on Thursday June 04, 2026 @06:21PM (#48405427)
> the experience with proprietary versus open source over the past 30 years had driven home the point that closed ecosystems are almost always far worse for security.

Has it? Can you prove it? I've been using computers for almost 40 years. I've seen foss-enthusiasts repeat that claim ad-nauseam, without proof. All they ave is the vague, hand-wavy, "millions of people read the code!!11".

I use both proprietary and foss software. I write both proprietary and foss software. I have not noticed a meaningful difference in security.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by fc417fc802 on Thursday June 04, 2026 @07:47PM (#48406219)
Then I think you haven't been paying attention. We regularly see examples of companies attempting to cover up vulnerabilities, attacking security researchers, dragging their feet on fixes, etc. Meanwhile you can easily see for yourself how long it takes various FOSS projects to get patched and often what the attitude of the devs is.

You can also take an aggregate view. Presumably skilled developers working on major projects should be expected to have similar rates of security issues. So compare CVE frequency between various FOSS and closed source projects.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by Forgeties79 on Thursday June 04, 2026 @02:09AM (#48394655)
Not to mention how wild it is to operate under the assumption that they won’t give a license to an LLM that can do illegal actions to someone who shouldn’t have it. Offering it at all is an ethically dicey question.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by lazide on Thursday June 04, 2026 @05:52AM (#48396343)
Lol, how is any of this illegal?

Illegal or not requires context that an LLM can not ever have, like if it is owned by the user, if there is permission, etc.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bryanrasmussen on Thursday June 04, 2026 @03:14AM (#48395191)
I wish you understood that there are organizations of security professions that are not controlled by Anthropic and OpenAI and that it is a common thing that when companies of any type sell to professionals of any type it is not the companies that determine whether or not the people they sell to are professionals but membership in professional organizations.

As an example the people who sell police uniforms check that the person they are selling to is in fact a policeman (at least in the jurisdictions I have lived in, you may have had a different experience which would certainly explain what to me seems a farcical misapprehension of how modern civilization works)

I mean I just wish you understood, and really that everyone understood, that this kind of three part communication (company selling, buyer, professional organization certifying buyer) is often when buying things that are considered to have security implications.

>So, supposing it's true that these models completely change the security field and humans are ~obsolete

OK, well that strike me as a really crazy level of supposition there.

I would suppose that these models make it easier for people who want to do bad things to do bad things at scale, at the same time allowing people who want to stop bad things to help identify potential targets.

Based on my supposition I would want to stop the first and find a way of helping the second. Also because I have another supposition that the first thing is easier to do than the second.

But you obviously feel differently about this issue, no doubt because of your position of great moral stature and insight, and this no doubt prompts you to wish to me to understand things that from my position seem absolutely ludicrous.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bandrami on Thursday June 04, 2026 @04:24AM (#48395768)
Like Medeco claims to do with key blanks? I'm not hopeful.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bigiain on Thursday June 04, 2026 @02:12AM (#48394675)
And next month you'll need to add on "Claude Database Pro" or you'll just get a working (for demo purposes with dozens of db rows) but completely un indexed database schema and a refusal to optimise SQL requests.

And the month after you'll need "Claude DataScience Pro" to get any Python Pandas or NumPy code generated.

And and and...

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by animuchan on Thursday June 04, 2026 @03:55AM (#48395550)
This is why I'm thankful for Chinese LLM research. They'll keep us honest.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by rurban on Friday June 05, 2026 @08:47AM (#48411678)
Well, I'd prefer bugfixes over exploit vectors. This will keep us honest.

With pi or better omp it would be incredibly easy to adjust the Claude system prompt so it will be easy to do what the Chinese models or gpt did. That's how the Chinese were training their models btw

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by patates on Thursday June 04, 2026 @03:06AM (#48395124)
Isn't this inline with trying to leave no money on the table?

I'd hate it, sure, but it wouldn't surprise me.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by ben_w on Thursday June 04, 2026 @04:45AM (#48395937)
While this is a perfectly reasonable thing to expect when the models are competent enough, half the conversation on places like Hacker News are about all the times an LLM has produced garbage that was harmful to a business either by hallucinations, by deleting something critical during the work, or by hitting some endpoint way too often and denial-of-servicing it.

Right now, the software guardrails in LLMs are useful for the same kinds of reasons factories have hardware guardrails: to reduce the rate at which errors become "incidents".

Just because they sometimes delete the production database rather than sometimes spilling a thousand tons of incandescent molten metal over a factory floor, doesn't mean LLMs are safe enough to be used the way they're actually being used.

https://simonwillison.net/2025/Dec/10/normalization-of-devia...

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by throwway120385 on Thursday June 04, 2026 @10:27AM (#48399176)
I think you're assuming too much care. Right now they haven't adopted that business model because they don't see it as a viable business model. As soon as they realize that they can lock certain categories of query behind a different subscription they will do that. We saw the same thing with streaming services and basically every other kind of online service -- small, singular subscription followed by a gold rush and then suddenly there's an upcharge for access to every other publisher's catalog of movies.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by ben_w on Thursday June 04, 2026 @03:39PM (#48403623)
That kind of thing is basically why I wrote the opening clause of the first sentence.

i.e., yeah, probably.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by goosejuice on Thursday June 04, 2026 @05:02AM (#48396044)
This is an incredibly unlikely scenario
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bandrami on Thursday June 04, 2026 @06:06AM (#48396444)
Same thing with the weird push towards humanoid robots.

"They can do anything!"

Sure, once you subscribe to the $15/mo laundry package, the $25/mo lawn care package (with the $10/mo hedge trimmer upgrade), and the $10/mo dog-walking package.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by animuchan on Thursday June 04, 2026 @07:11AM (#48396982)
And in the end the big reveal is, it was a dude in VR all along, piloting the dumb things remotely. Every single time, without exception.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by steveBK123 on Thursday June 04, 2026 @07:34AM (#48397185)
I think it’s just riding off LLM coattails.

We don’t have good world models. We have had bipedal robotics in various POC demo-ready forms for decades.

It turns out that industrial, purpose build robotics is an easier and better market.

I’m still not completely convinced a robot that’s shaped like a human is the best design other than for PR.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by bandrami on Thursday June 04, 2026 @10:22AM (#48399084)
I remember nearly losing my mind at that stupid conveyor belt sorting demonstation because

1. The human beat the robot, but more importantly

2. We've had non-humanoid conveyor belt sorting machinery for decades that beats both

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by plagiarist on Thursday June 04, 2026 @04:02PM (#48403873)
When we are stabbed to death by impoverished dudes who are piloting a robot worth more than a decade of their income to do household chores for 16 hours a day, we will deserve it.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by swiftcoder on Thursday June 04, 2026 @05:54AM (#48396359)
> What look like tightening "constraints" today are just setting up the upsell opportunities of tomorrow.

I don't buy this, because is predicated on staying permanently far ahead of the open weights models.

If in the future Anthropic fully stops you from doing security research, you can be sure some other provider will sell you an 'unshackled' DeepSeek v8 Pro...

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by embedding-shape on Thursday June 04, 2026 @06:31AM (#48396642)
> I don't buy this, because is predicated on staying permanently far ahead of the open weights models.

In my mind, that fits exactly how the SOTA labs think today about what they're doing, they're all both working towards and expecting to stay permanently ahead of FOSS, otherwise they'd change their tune really quickly, if they didn't think that was possible.

Sure, you might be able to use DeepSeek V8 Pro instead for the same purposes, but that'll hardly stop Anthropic from trying to sell bundles of use cases instead and claim it's "ethical AI", "Patriotic AI" or some marketing terms like that.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by swiftcoder on Thursday June 04, 2026 @06:39AM (#48396709)
> fits exactly how the SOTA labs think today about what they're doing, they're all both working towards and expecting to stay permanently ahead of FOSS

They are just straight up delusional, no? Or at least, have a vested financial interest in maintaining said delusion until the money runs out. They have to hit the point of diminishing returns at some point...

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by embedding-shape on Thursday June 04, 2026 @06:57AM (#48396868)
> They are just straight up delusional, no?

Well, I guess that's one way to put it. Another is "dress for the job you want", startup culture typically seems to shove people in the direction of "aim big and believe in yourself, regardless of what others say" so naturally you get these companies who seem very disconnected from reality.

I'd also wager a guess that the amount of money makes people's reasoning and perspectives get very messed up as well, for better or worse.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by tardedmeme on Thursday June 04, 2026 @06:49AM (#48396802)
FYI there are no FOSS LLMs
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by embedding-shape on Thursday June 04, 2026 @06:54AM (#48396841)
> FYI there are no FOSS LLMs

FYI there is and been for a long time. Won't claim they're SOTA, but they exists. From the top of my head, I think Olmo (https://allenai.org/olmo) was pretty early, but been more since then too.

I agree most releases today that claim to be "open source" actually aren't, but that doesn't mean "FOSS LLMs" don't exists at all.

Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by arcanemachiner on Thursday June 04, 2026 @02:19PM (#48402526)
I believe Nemotron also publishes their dataset.
Re:I built a vulnerable app and spent $1,500 seeing if LLMs ... by me-vs-cat on Friday June 05, 2026 @11:09AM (#48413560)
What? You can't give access to that kind of power to just anyone with $5,000/month.

These people should be trained and licensed before they get access. Thankfully, Anthropic has worked with regulators to develop the appropriate courses to maintain your license -- don't worry, the series is cheap when you buy all up through OT XVII. And because Anthropic has been approved as Security Overseer, we will take care of reporting back to the license bureau on our monitoring of your work to ensure you meet your ongoing license responsibilities and are able to keep your license.

Which regulators? You know, the new agency led by several of our former mid-level executives. With relationships like that, we were honored to lead the Industry Coalition that donated the final-draft regulations.