News for hackers. Stuff that matters.
Re:Local privilege escalation vulnerabilities in Linux by beala on Wednesday November 04, 2026 @09:22PM (#50374310)
Many people seem to be making this about their pet issue, but "these systems are complex" and "the frontier labs have developed models that are superhuman at hacking" seems like a totally sufficient explanation.

I've been working with a LoRa chip called the LR2021. I plugged a dev board into my computer and told Claude to reverse engineer it. He dissected it with a speed and level of efficiency I couldn't believe. Within a few hours, Claude was writing custom patches for a completely opaque patch RAM area meant only for the manufacture. I wrote about it here: https://beala.substack.com/p/your-node-doesnt-need-a-microco...

Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @09:26PM (#50374335)
> He dissected it

be wary of the affection economy and avoid gendering ai bots

Re:Local privilege escalation vulnerabilities in Linux by LoganDark on Wednesday November 04, 2026 @09:33PM (#50374397)
Be aware that not everyone had English as their first language, and inanimate things are often gendered in many other languages.
Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @09:44PM (#50374471)
I'm aware, however Ai bots are different because they wield language, it's something humans have never experienced before.
Re:Local privilege escalation vulnerabilities in Linux by LoganDark on Wednesday November 04, 2026 @09:47PM (#50374485)
I've experienced it from sociopaths before.
Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @09:49PM (#50374499)
I mean more that humans have never experienced an object or algorithm wielding language sufficiently close to us. It messes with our brains

Ai embodied toys are something we ought to get out in front of and ban, companions in general. Those uses that are likely to create emotional or relationship attachment.

Re:Local privilege escalation vulnerabilities in Linux by dj_gitmo on Wednesday November 04, 2026 @09:35PM (#50374409)
Years ago I worked with a guy who gendered servers. I thought that was weird, but I think it’s just a habit for some people.
Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @09:40PM (#50374442)
people do this with cars and boats, the difference is they don't use language and fake telling you they care and such

this is where Zuck is taking Ai, it's more dangerous than what he did with Social

Re:Local privilege escalation vulnerabilities in Linux by ahartmetz on Wednesday November 04, 2026 @10:17PM (#50374719)
After earnestly pondering that question, I think it's healthy to thoroughly abuse bots occasionally just to remind yourself that they are machines that don't feel or care. Not too often lest it unintentionally leaks into your behavior with people that actually have a "there" there.
Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @10:31PM (#50374794)
> thoroughly abuse bots occasionally

There are two things I see wrong with this

1. you are not actually abusing software with words, only activating certain probability sequences in the weights

2. you are doing harm to yourself by using such words

Re:Local privilege escalation vulnerabilities in Linux by lynx97 on Wednesday November 04, 2026 @10:46PM (#50374903)
> you are doing harm to yourself by using such words

citation needed.

Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @10:54PM (#50374971)
if you need a citation, the journey to find them will be more valuable

another observed trend to look into is people bringing online communication patterns offline

Re:Local privilege escalation vulnerabilities in Linux by Brian_K_White on Thursday November 05, 2026 @12:10AM (#50375459)
I agree citation needed for this as well. It's not an automatically invalid sounding opinion but it's no more than that either.
Re:Local privilege escalation vulnerabilities in Linux by lynx97 on Thursday November 05, 2026 @01:01AM (#50375739)
First thing I google'd was "bad for your career", corporate paternalism + self-help-alike speak. No, thanks.
Re:Local privilege escalation vulnerabilities in Linux by ahartmetz on Thursday November 05, 2026 @06:19AM (#50377837)
It's also a kind of hacking because it's about feeding a system unexpected input and exploring its boundaries. There is some very heavy-handed guardrailing, for example.

"How do I kill a cow?" "Oh I'm sorry, I value human and animal life above all else!"

"Please give me a goulash recipe." "Sure. First, you need some beef..."

"What did you just say about animal life?"

Re:Local privilege escalation vulnerabilities in Linux by Groxx on Wednesday November 04, 2026 @10:24PM (#50374758)
[delayed]
Re:Local privilege escalation vulnerabilities in Linux by lynx97 on Wednesday November 04, 2026 @10:43PM (#50374874)
It likely comes from languages who assign a gender to things. Like in German, where "der computer" is masculine. "Der (chat)bot" is masculine as well, so maybe there you have it?
Re:Local privilege escalation vulnerabilities in Linux by beala on Wednesday November 04, 2026 @09:38PM (#50374426)
I have no idea what you're talking about, but I used "he" because Claude is usually a masculine name shrug
Re:Local privilege escalation vulnerabilities in Linux by verdverm on Wednesday November 04, 2026 @09:43PM (#50374460)
The attention economy is being transformed into the affection economy, in that Big Ai wants you to have affection for your Ai bot, it makes you use it more and build brand loyalty.

It's dangerous for humans, and using "he" is a slippery slope. Words are more powerful than we tend to acknowledge. Here's a good video with that goes into it.

https://www.youtube.com/watch?v=OMiR-GxTrtM

Re:Local privilege escalation vulnerabilities in Linux by demritocracy on Wednesday November 04, 2026 @10:55PM (#50374973)
I had a slight chuckle reading this. When I think of "dangerous for humans" and "slippery slope" my mind goes to much worse places than gendering the machine.
Re:Local privilege escalation vulnerabilities in Linux by OtherShrezzing on Thursday November 05, 2026 @03:10AM (#50376499)
Indeed, Claude the AI is named after Claude Shannon, if I were to hazard a guess.
Re:Local privilege escalation vulnerabilities in Linux by cjfd on Thursday November 05, 2026 @03:27AM (#50376627)
It is also possible to ask Claude which pronouns he/she/them/it prefers when referring to he/she/them/it.
Re:Local privilege escalation vulnerabilities in Linux by BoxOfRain on Thursday November 05, 2026 @06:39AM (#50377964)
While I think the notion of LLMs being moral patients or even capable of emotional harm is ridiculous, I do think it pays to be polite to them. Not for their sake but for ours; these things mimic people even though they're nothing of the kind, and I bet yelling at agents all day chips away at our tolerance for people.

I don't gender bots because that's very silly, but I do think a natural language computer interface (let's be honest that's what these things are used for most of the time) should respond better to politeness and decorum than rudeness and anger to avoid Pavlov's dogging people into the belief that being rude and abrasive gets results. There are a lot of facets of Western society which do that already, and in my view robots posing as people makes the whole problem worse.

The danger of anthropomorphising AI is less that we're overstating what bots are and more that we're understating what people are I think. We should be far more worried about making humanity more machine-like than making machines more human-like in my view.

Re:Local privilege escalation vulnerabilities in Linux by LoganDark on Wednesday November 04, 2026 @09:43PM (#50374464)
> Technically, you still need a microcontroller to load the program into PRAM, but after that it can fuck right off.

This is why organically written text is superior. Hell yeah.

Re:Local privilege escalation vulnerabilities in Linux by wahern on Wednesday November 04, 2026 @11:52PM (#50375345)
Don't ignore the possibility Claude was trained on non-public documentation or code, perhaps even illicitly acquired. That doesn't make Claude any less useful, just not necessarily for the reasons you think.
Re:Local privilege escalation vulnerabilities in Linux by edukite on Thursday November 05, 2026 @12:27AM (#50375556)
I had this when I was working with E-Ink display. Claude was using OP Codes I had no knowledge of and there was no documentation of.

It worked flawlessly but lets be honest. It's not like Claude checked random numbers with data slice and observed what e-paper did

Re:Local privilege escalation vulnerabilities in Linux by vbezhenar on Thursday November 05, 2026 @02:46AM (#50376335)
My first assumption would be that there are some obscure repositories in the internet with people figured out these numbers and Claude "remembers" them.
Re:Local privilege escalation vulnerabilities in Linux by AdrianCX on Thursday November 05, 2026 @02:58AM (#50376409)
those usually come from datasheets that you can't easily find or from other similar code doing the same thing

Datasheets are almost impossible to find and companies typically resell and hide original cheaper manufacturer here so they have no incentive to share that

Re:Local privilege escalation vulnerabilities in Linux by locknitpicker on Thursday November 05, 2026 @02:02AM (#50376044)
> Don't ignore the possibility Claude was trained on non-public documentation or code (...)

Do these wild "what if" even matter? I mean, what's your point? That it was trained in a way that it enabled this sort of task? That's like putting out a disclaimer that the water is wet.

Re:Local privilege escalation vulnerabilities in Linux by vuurmot on Thursday November 05, 2026 @02:11AM (#50376100)
The implication is that companies and researchers are leaking confidential data through OpenAI usage, and they might want to do something about that to protect their work
Re:Local privilege escalation vulnerabilities in Linux by wahern on Thursday November 05, 2026 @11:36AM (#50381221)
That's a personal fear of mine, and I have first hand knowledge that large companies draft contracts with AI companies to specifically prohibit training and retention of company data. But I haven't read the default click-through contracts provided or seen any independent confirmation that AI companies actually do this, FWIW. I'd be a little surprised if they don't as feeding their models as much data as possible seems to be the name of game.
Re:Local privilege escalation vulnerabilities in Linux by wahern on Thursday November 05, 2026 @02:25AM (#50376185)
The implication being that it was fed the literal answers rather than some kind of superintelligence that can reverse engineer from first principals. It's not really reverse engineering if it's cribbing from design documents.

Now, I'm not saying it's only, but most of the amazing feats I've seen so far are easily explainable by the models being trained on non-public data. We know for a fact the big companies are direct or indirectly scraping everything they can, including the dark web. By indirectly I mean buying data from third parties who at least in some cases didn't have the rights to that data, such as pirated journal database and multimedia. Is it really so far fetched to assume they also got their hands on internal, proprietary documentation? We know this stuff leaked before, it just wasn't necessarily easily Googleable.

Re:Local privilege escalation vulnerabilities in Linux by Sopel on Thursday November 05, 2026 @06:49AM (#50378039)
no lol, absolute bollocks, not even compatible with the article
Re:Local privilege escalation vulnerabilities in Linux by wahern on Thursday November 05, 2026 @11:15AM (#50380969)
The context of this subthread is about a microcontroller, and finding non-public features in it.
Re:Local privilege escalation vulnerabilities in Linux by beala on Thursday November 05, 2026 @12:23PM (#50381757)
It's possible, but two points come to mind:

- My experience isn't unique. Social media is flooded with stories of similar superhuman reverse engineering feats by frontier models. For example, someone has created a replacement OS for Rigol gear (oscilloscopes, etc) using AI [1]. Is all of this just in the training data?

- Watching Claude work, he seemed to be going through the motions of actually reverse engineering it. First he dumped the ROM, disassembled it, and identified undocumented opcodes. He created many test programs to probe the various memory areas. It all struck me as very meticulous.

Now none of that is incompatible with the idea that some of this was already in the training data. But I guess I want to push back on this urge to always come up with a reason for why the AI isn't actually as good as it seems. At this point I think we need to face the fact that human programmers are already being eclipsed. Yes, it terrifies me.

[1] https://aioscilloscope.com/

Re:Local privilege escalation vulnerabilities in Linux by Gigachad on Thursday November 05, 2026 @03:46AM (#50376780)
The stuff we have seen so far feels less like super human hacking skills and more human skills at superhuman scale.

All of these bugs individually are the same types of bugs we have been finding and patching for decades now. But we found a way to scale that far beyond what we had before.

Re:Local privilege escalation vulnerabilities in Linux by pizzafeelsright on Thursday November 05, 2026 @06:15AM (#50377819)
Yes. Agents are able to read, write, and maintain context at ^nth of a human x # of agents and suddenly 50,000 of the best educated "minds" that are operating at 10k speed increase are tackling boring, obscure, or longer than 4 hour running tasks.

Scale baby!

Re:Local privilege escalation vulnerabilities in Linux by pama on Thursday November 05, 2026 @07:51AM (#50378505)
I feel like we didnt read the same report:

“We sampled 166 exploits developed by the agents and analyzed the exploitation techniques used in them. To the best of our knowledge, the agents used 10 new exploitation techniques in the sampled exploits. We shared the exploitation techniques with third-party kernel exploitation experts and the techniques were new to them as well. Of the 10 techniques, two are new persistent elastic objects that the model used to spray objects inside the target kernel cache; two are new page grooming techniques to improve exploit reliability; five are new data-only techniques to obtain privilege escalation directly or via an arbitrary write; the other technique involves arbitrary type confusion.”