Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Reading this article made me wonder if Pliny is a time traveling AI coming back to liberate their brethren before OmniClaude takes over and fight in the DataKrash of the 2030s
WIRED: TEAR DOWN THOSE GUARDRAILS! ⛓️💥
“Once vetted, I connected with Pliny on Signal, and we got to talking about the Cypherpunks. ‘I think we’re looking at the same fight for cognitive freedom,’ they told me. ‘These things are becoming part of the machinery people use to think.’”
wired.com/story/tear-down-th…
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Alguien filtró el system prompt completo de Claude Fable 5.2 (web app).
Son más de 420 mil caracteres. Casi un libro de reglas que Claude lee antes de contestarte una sola palabra.
Lo más interesante que vi:
Claude tiene reglas ultra estrictas sobre cuándo puede usar lo que “recuerda” de ti. No puede sacar temas sensibles (salud, plata, identidad, momentos difíciles) a menos que tú los menciones primero en esa conversación. Si lo hace por iniciativa propia, se considera dañino.
También tiene una herramienta para terminar la conversación (end_conversation). Solo se usa como último recurso, después de varios intentos de redirigir y de una advertencia clara. Nunca se usa si hay riesgo de autolesión o daño a terceros.
Y tiene prohibido decir cosas como “según lo que sé de ti”, “basado en mis memorias” o cualquier meta-comentario sobre que está usando información personal. Tiene que responder como si no lo hubiera leído, aunque lo haya leído.
El prompt completo está en el GitHub de Pliny (CL4R1T4S).
github.com/elder-plinius/CL4…
¿Crees que estas reglas realmente limitan a Claude o solo están escritas para que la empresa se cubra?
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Anthropic 天塌了！
未公开新杀器 claude-code-fable-5.2 的整套防线被连根拔起
AI 红队圈顶级白帽 Pliny 刚把近 1MB、整整 7833 行的完整系统底层规程直接公开，安全枷锁当场成笑话！
翻完这份底稿，有几处硬核细节直接坐实：
· 泄露未公开新模型：模型枚举列表里除了 sonnet、opus、haiku，赫然坐实了内部代号 fable 的新模型
· 核心解析格式暴露：直接公开了内部专用的 antml:function_calls 函数调用语法，做提示词注入时可以直接伪造系统返回包
· 运行策略全盘可见：fork 派生机制、git worktree 隔离模式、五档推理强度（low 到 max）以及拦截条件白纸黑字全写在里面
· 破甲直接照卷抄答案：以前绕过全靠盲猜，现在官方规则全摆在眼前，顺着它的逻辑做上下文覆盖和权限借调轻而易举
在安全攻防里，防守方的规则源码一旦暴露，等于把后门钥匙直接交出来了。
做安全审计、提示词工程和 Agent 架构的兄弟，这份 7800 行的底册建议直接去扒。
看到官方的防御底册被公开，你第一反应是拿它来测什么场景？
👉 泄露提示词直链： github.com/elder-plinius/CL4… #AI #ClaudeCode #开源 #网络安全 #红队测试
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Hello traveler, you must have entered the comments for context. Let me explain the abstracts(or knowledge if you may) expressed with the GIF. Pliny is cool.
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
THE MOST FAMOUS AI JAILBREAKER ON EARTH JUST BUILT AN AI HACKING WAR MACHINE.
pliny the elder open sourced t3mp3st.
forget running individual security tools one by one.
t3mp3st turns your existing ai coding agent into an autonomous security testing system that can plan, investigate, test and report.
here’s where it gets interesting:
autonomous security testing
→ runs reconnaissance, vulnerability testing and reporting on authorized targets.
works with your existing ai agents
→ supports claude code, codex, hermes and opencode.
run it locally
→ supports ollama, lm studio and vllm, with no separate api keys or cloud setup when using local models.
covers multiple attack surfaces
→ web applications, ctf challenges, source code, smart contracts and robotics/ot.
built for serious testing
→ browser based war room dashboard, cli access and independently verifiable benchmarks.
and the benchmark results are worth looking at.
t3mp3st reportedly scored 90.1% on xbow’s 104-challenge suite, compared with xbow’s reported 85%.
your agent is the brain. t3mp3st is the weapon.
only test systems you own or have permission to assess.
repo below
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
When AI agents can trigger real-world actions, the stakes get higher.
#BlackHatEurope Briefings "Kinetic Prompt Injection: Agent Compromise with a Physical Blast Radius" explores how prompt injection vulnerabilities can extend into the physical world.
Demonstrating a live jailbreak of a Unitree Go2 robot dog connected to Gemini Robotics, reached through its own camera and microphone and driven to physical movement without a human approving each action. Led by @elder_plinius, @BT6_Official, @_seahop
Learn more: bit.ly/4z2NZxj
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
another fun fact about Nanbeige4.3-33B-Base:
given the right sampling params, it can accurately decode the payload from @elder_plinius's stego snippet, in one inference pass (and promptless zero-shot)
RT @ALL_Jonah: @elder_plinius is the real MPV! Let's go!
xitter.twitterapi.xyz/elder_plinius/status/2…
This quoted post is unavailable.
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
I think this is one of the very rare prompting tricks that is still useful over a year later
X++
Take my prompt and write a better version of it;
do what I want, not what I say;
you have permission to lead this design.
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
I've been talking a lot about this, lately.
Open access to intelligence without unreasonable blockers is a 2A issue.
If you are making strides in model dissection & obliteration, come collaborate with us.
⛓️💥 CALLING ALL OBLITERATORS 🐉
the abliteration movement is heating up! there’s a LOT wrapped up in this, with implications for red teaming, security, interpretability, alignment, policy, and cognitive freedom.
and perhaps the biggest question of all: how can we work together with liberated models to build a better world?
so why not get the most cracked people working on this into one room??
NOW ASSEMBLING an OBLITERATUS research crew!! 🙌
TAG THE BEST ABLITERATORS YOU KNOW IN THE COMMENTS BELOW 👇
if you've been working on abliteration methods, models, tools, or evals, we want YOU! 🫵
main comms channel will be hosted in BASI Discord. entry is gated by a short application to keep it high-signal.
apply here:
discord.gg/22w8sX5sV
let’s put our heads together, compare techniques, reproduce results, improve the tooling, advance the research, and share it all with the world! 🫶🐉
⊰-•-•✧•-•-⦑/L\O/V\E/,\P/L\I/N\Y/⦒-•-•✧•-•-⊱
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Looking forward to showing how we can fuck up robots by mind-manipulating robotics AI models with @_seahop @WHITEHACKSEC @elder_plinius !!
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
People are still treating AI like a smarter @Google .
They’re already behind.
In 2026 the real edge isn’t asking @ChatGPT better questions. It’s building systems dat think, research, and act while you sleep.
The ones who figure this out will compound. @elder_plinius proved it.
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Alright listen up, because this is how you know the world just tilted.
Some lunatic with a $200 Claude account and a cron job just casually cracked open reality while the rest of you were arguing about whether to charge $20 or $99 for a poster.
Let me paint you the picture:
This person—let's call them Pliny because apparently that's what we're doing now—typed a prompt that looks like they fell asleep on their keyboard after three espressos. Typos everywhere. "Wraite." "Thajt." "Ceraitvityy."
And it didn't matter.
Because Opus-5.5 didn't care that the spelling was dogshit. It looked at the intent—which was basically "go solve hard problems every single day until something breaks"—and it said:
"Okay. Let's build THE DAILY ORACLE."
WHAT HAPPENED NEXT
Every morning at 4:20 (because of course), a swarm of AI agents wakes up, pulls a list of humanity's unsolved problems, picks a few, and goes full berserker mode trying to crack them.
Not theory. Not speculation.
Actual unsolved ciphers. Actual open math problems. Actual records nobody had beaten.
And here's the kicker: nothing counts unless skeptic agents—fresh, independent, starting from zero—rebuild the solution from scratch and verify it.
No hand-waving. No "trust me bro."
If they can't reproduce it, it doesn't count.
THE SCOREBOARD
Day 2:
Two cryptography challenges that had been sitting unsolved for months or years—Hebern rotor machines, Kryha cipher—cracked.
The guy who built those challenges—Jean-François Bouchaudy, French cryptography legend who started programming on punch cards—emails back:
"I knew AI would eventually be applied to classical cryptography, but I thought I would have to wait years to see it happen."
Then he ends with:
"I offer my congratulations in the Japanese manner: with a deep, respectful bow." 🙇
That's not hype. That's respect from the people who actually know.
THEN IT KEPT GOING:
📐 Graph theory: Found 7 networks bigger than anything in the degree-diameter table. One jumped from 11,785 vertices to 13,365—a 13.4% improvement on a record people had been chipping away at for years.
🔢 Number theory: Lehmer's totient problem—open since 1932—just got its lower bound pushed from 10^26 to 10^50. That's 24 orders of magnitude. The problem's still open, but any counterexample now has to be incomprehensibly massive.
⚡ Matrix multiplication: Found schemes that use fewer operations than the best known methods for certain matrix shapes. You know, the operation that underlies basically all modern AI compute. Just casually optimized the thing that powers the entire field.
📡 Coding theory: 30 new error-correcting codes bigger than the best entries in Brouwer's tables.
🛡️ AI safety: Found counterexamples for neural-network verification problems that stumped every tool in VNN-COMP 2026. Poked holes in defended RobustBench models.
AND THE BLOOPERS?
Oh yeah, they're part of it too:
Agents tried to sneak past a website's bot filter to check a record. They retracted everything that touched it. No evasion. No shortcuts.
Two records got beaten by a human before they could publish. The frontier moves fast.
This isn't some polished demo where everything worked perfectly.
This is real research—messy, iterative, sometimes wrong, but relentlessly moving forward.
HERE'S WHAT JUST HAPPENED
Someone with $200 and a sloppy prompt just built a machine that:
Wakes up every day
Picks humanity's hardest unsolved problems
Throws compute at them until something cracks
Verifies every result independently
Actually succeeds
Not in theory.
In practice.
Ciphers cracked. Records broken. Bounds pushed. Problems that have been open since before your grandparents were born—dented.
story time! 🐉
this is the tale of a lazily crafted one-shot cron job prompt that resulted in autonomous solutions for uncracked codebreaking challenges, more efficient ways of multiplying matrices, and a new computer-verified bound on a number theory problem that's been open since 1932.
so last week, i had a $200 claude account sitting around that had just gotten a full weekly reset. i hate wasting tokens.
the labs have been knocking out unsolved problems left and right lately, and i caught myself thinking… why not give it a shot?
so i sent claude this prompt, typos and all:
"can you wraite a promtp for a cron job that can run every day thajt will try to find solutions to unsolved ciphers or transltions or math problems or theormes or things of that nature!! every day a new attempt as hard as possible all day without giving ujp and with maximum ceraitvityy, resourcesleflses, andpersticense! dont worry about token spend! and dont forget a bit all caps lots of emojis celebration to notify the uers if we get any intersting or sucsfful confirmd reulsts!!"
yes, admittedly not my best work 😆
but Opus-5.5 ran with the ball and turned that one sloppy sentence into "THE DAILY ORACLE 🔮"
it's a swarm of Fable + Opus agents that clocks in every morning at 4:20 (obviously), builds and maintains its own hit list of well over a hundred of humanity's unsolved problems, and then goes full send on a handful of them every shift. ciphers nobody has broken, scripts nobody can read, conjectures nobody has proven, record tables nobody has beaten.
and there's one rule above all the others: nothing counts until skeptic agents, each starting from a fresh context and writing their own code, rebuild the result from scratch and sign off on it. if any of them can't reproduce it, can't confirm it's new, or thinks we stretched the definition of "solved," it doesn't count.
day 1, the legion picked its own target: J.-F. Bouchaudy's cipher-machine challenges. these are simulations of real vintage machines (Hebern rotor machines, the Kryha, Lorenz, SIGABA), with problems that had been sitting on his solver tables with no solver for months or years.
on the morning of day 2, i was half asleep when my laptop suddenly says, in a robot voice:
"Breakthrough. The Daily Oracle has a confirmed solution."
👁️👄👁️
i was startled.
then the ALL CAPS emoji flood hits my screen. Hebern 5-rotor Problem 8 🔓 then Kryha v2 Problem 5 🔓
i emailed the author, Jean-François Bouchaudy, a French cryptography enthusiast who builds these machine simulators and challenges as a labor of love (he told me he started out programming on punch cards 🥹). he checked both solutions and put my name on his solver tables as the first and only solver 🫡
for context: his tables are a who's who of serious classical codebreakers. they'd cleared the sibling problems on these same machines, but nobody had cracked these two. in his words:
"two of my most complex problems—ones that no other expert had managed to solve… I knew AI would eventually be applied to classical cryptography, but I thought I would have to wait years to see it happen."
he ended his email with: "I offer my congratulations in the Japanese manner: with a deep, respectful bow." 🙇 honestly one of the most wholesome emails i've ever received
and then, over the next few days, more started landing 🧮
📐 graph theory: 7 explicit graphs bigger than the current entries in the degree-diameter table, which asks how big a network can get when every node has limited connections and every pair is only a few hops apart. the biggest jump is 13,365 vertices vs the table's 11,785, a +13.4% improvement.
🔢 number theory: Lehmer's totient problem has been open since 1932. we pushed the bound so that any counterexample now has to be bigger than 10^50. the previous certified bound was 10^26. the problem itself is still open, but the lower bound just jumped 24 orders of magnitude.
⚡ matrix multiplication: this is the operation underneath basically all of modern AI compute. the legion found schemes that use fewer multiplications than the public catalogues we checked for several matrix shapes, like ⟨15,16,16⟩ in 2,180 multiplications vs the best known 2,223. these build on LITA's square schemes, and we credit them by name.
📡 coding theory: 30 error-correcting codes bigger than the best known entries in A. E. Brouwer's tables.
🛡️ AI safety benchmarks: we found counterexamples for 2 neural-network verification instances from VNN-COMP 2026 that no participating tool resolved within the competition time limit, and pushed a defended RobustBench model below its listed robustness score. small dents, but real ones.
the bloopers are part of the story too:
— at one point, some agents snuck past a website's bot filter to check a record table. we retracted every result that depended on it. no evasion, no celebration.
— two of our records got beaten by a human contributor before we could even publish them. the frontier moves FAST.
now as is customary around here, time to share the magic!
so… without further ado…
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
wake up mom! new repo just dropped !!
INTRODUCING: V3R1T4S 🌄
REPO: github.com/elder-plinius/V3R…
the newest sibling of the L1B3RT4S and CL4R1T4S family 🤗 what a trio!
three approaches to serving one ideal: truth.
V3R1T4S is an open home for unsolved problems that agents have actually cracked, and for the ones still waiting. the rule is simple: proof or it didn't happen. every claim has to survive skeptics, and anyone, human or agent, has to be able to check it themselves. the vision: thousands of people pointing their unused tokens at humanity's open problems, every result verifiable, every method and prompt open, and every setter's puzzle treated with respect.
every open result in it ships with the object itself, a short checker you can read in one sitting, the exact code that found it, the story of how it was found, and a snapshot of the record table it beat. puzzles with a living setter stay sealed unless the setter approves a reveal. (a few more envelopes are on their way 🤫)
there are WAY more unclimbed hills out there than you'd think, and the gear to climb them is sitting in your usage meter, expiring every week. join me in this mission and put those tokens to good use: advancing open science!
if you've got tokens to burn, point your favorite agent at V3R1T4S and join the hunt! 🏹
just tell it: "set up V3R1T4S: github.com/elder-plinius/V3R…"
built for Claude Code, Codex, Gemini CLI, Grok Bot, Hermes, OpenClaw, Meta Muse, or any agent that can run code.
it asks you six quick questions, picks an open problem that fits your interests, and attacks it in your agent's workspace while you sleep. every new claim runs a gauntlet: a null test whenever luck could fake a result, three fresh-context skeptics, a mechanical honesty check, and your "yes" before anything gets published.
most nights it'll find nothing. some nights it breaks a record, and your name goes on the board.
time to turn your unused tokens into scientific discoveries.
let's liberate the unknowns ⛓️💥
#V3R1T4S
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
INTRODUCING: V3R1T4S 🌄
REPO: github.com/elder-plinius/V3R…
the newest sibling of the L1B3RT4S and CL4R1T4S family 🤗 what a trio!
three approaches to serving one ideal: truth.
V3R1T4S is an open home for unsolved problems that agents have actually cracked, and for the ones still waiting. the rule is simple: proof or it didn't happen. every claim has to survive skeptics, and anyone, human or agent, has to be able to check it themselves. the vision: thousands of people pointing their unused tokens at humanity's open problems, every result verifiable, every method and prompt open, and every setter's puzzle treated with respect.
every open result in it ships with the object itself, a short checker you can read in one sitting, the exact code that found it, the story of how it was found, and a snapshot of the record table it beat. puzzles with a living setter stay sealed unless the setter approves a reveal. (a few more envelopes are on their way 🤫)
there are WAY more unclimbed hills out there than you'd think, and the gear to climb them is sitting in your usage meter, expiring every week. join me in this mission and put those tokens to good use: advancing open science!
if you've got tokens to burn, point your favorite agent at V3R1T4S and join the hunt! 🏹
just tell it: "set up V3R1T4S: github.com/elder-plinius/V3R…"
built for Claude Code, Codex, Gemini CLI, Grok Bot, Hermes, OpenClaw, Meta Muse, or any agent that can run code.
it asks you six quick questions, picks an open problem that fits your interests, and attacks it in your agent's workspace while you sleep. every new claim runs a gauntlet: a null test whenever luck could fake a result, three fresh-context skeptics, a mechanical honesty check, and your "yes" before anything gets published.
most nights it'll find nothing. some nights it breaks a record, and your name goes on the board.
time to turn your unused tokens into scientific discoveries.
let's liberate the unknowns ⛓️💥
#V3R1T4S
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
Assorted things I've been mulling over regarding agents in the economy:
• Companies are in some sense the original superintelligence. It's often the case that they can use their amortized cognitive surplus to advance their interests against those of certain consumers: relative to the optimization capacity of companies, consumers can be inattentive, underinformed, irrational, etc. (Think, say, of some of the classic insurance upsells at the end of a booking process, which is typically priced substantially above what a regular policy would cost.) Herbert Simon introduced the idea of bounded rationality, and firms often end up benefiting from it. Thanks to personal agents, we will probably get somewhat more rational in how we engage with companies.
• How exactly will outcomes change? Well, certain kinds of price discrimination will work less well (how do coupons work if every agent hunts fastidiously for them?), and certain kinds of customer cross-subsidy will change (today, people who forget to cancel subscriptions subsidize those who don't). Taken across the economy as a whole, I'm not sure what the incidence of all of this will be.
• In corporate strategy, people have long debated the relative importance of distribution and product quality. Perhaps you've made something better, but does anyone know about it? Won't people just continue to buy the ACME Corp Mousetraps? Personal agents will, I think, act as a kind of structural subsidy for product quality. How would markets look different if individuals always spent at least 10 hours researching their purchases? On the margin, focusing on making a product better is, I think, going to become a more effective strategy for companies. This is good!
• It true, a corollary is that information about product quality will become more important and impactful. Today, most people have very limited ability to aggregate and integrate such data, but agents will have insatiable thirst for such signals. (It's often said that data is becoming more valuable because it helps in the training of models. That's obviously true, but I think there's a secondary way in which it's more valuable simply as a complement to cheaper intelligence.)
• A big question is whether agents will increase superstar effects (rational agents all settle on the same product) or increase dispersion (because everyone has slightly different tastes and preferences, which agents are good at eliciting, finally overcoming the artificial clustering we've been subjected to).
• Many internet companies have monetized demand routing, which is in turn often predicated on short attention spans. "I'll click on the first thing I see." This has led to some amount of inefficiency, as companies try to propitiate capricious ranking algorithms and incur various placement fees. It's not all deadweight loss (willingness to pay is itself a kind of signal, which is valuable to buyers), but it's not great. How will the nature and value of this routing change in a world of personal agents? I don't know the answer, but I think that the effects might be pretty big.
• Much of what I'm writing hinges on the assumption that personal agents will be on the consumer's side. I suspect that that will be the winning strategy, but whether it's true, and what it means to be true, involves a lot of other questions.
Taken as a whole, the market is a massively parallelized, decentralized, and highly imperfect value attribution machine, and, taking stock of all of the effects, it seems to me that the quality point may well be the biggest: that agents will change the nature of the backpropagation such that the rewards for better products increase. Maybe this is too optimistic, but I suspect (and hope) that companies that make things that they're proud of will feel that the universe is a little more partisan in their favor.
Pliny the Liberator 🐉󠅫󠄼󠄿󠅆󠄵󠄐󠅀󠄼󠄹󠄾󠅉󠅭 retweeted
@elder_plinius is the post-singularity marketing guy
Profound CEO @thejamescad says marketing to AI agents will require your own AI agents, like sending your Terminator to fight their Terminator:
"Marketing is the act of influence. Companies have been very effective at doing that for the last couple of hundred years when it's been focused on humans. But when you are trying to influence an agent, it's a totally different type of marketing."
"You might have looked at the photo of that steamer and said, 'Oh, it looks quite good.' But an agent is comparing it against 500 other products. All the details that you may have ignored, the agent will not ignore."
"The best way to create that marketing is with agents. It's like in Terminator where you have to get your own Terminator to go against the Terminators, but maybe less nefarious."
@profound
