Video ID: KomryzIaIog
YouTube URL: https://www.youtube.com/watch?v=KomryzIaIog
Added At: 16-10-26 11:01:03
Processed: No
Sentiment: -
Categories: Ai, Technology
Tags: keeps, breaking, every, model, launch
Summary
No summary
Transcript
How does one guy alone in his bedroom keep breaking every AI model on launch day? He calls himself plenty the liberator and for over two years he's broken almost every new AI model. He jailbroke Grok 4.5 and Kimmy K3 the day they launched and the day Claude Opus 5.5 came out, he posted its full hidden instructions. So I wanted to understand why the biggest labs can't stop him and what it means for your AI tools. But first, what does jailbreaking even mean? It's getting an AI to answer what it was trained to refuse using nothing but words without hacking any server. And to see why that works, you need to know what a model really does. It cuts your message into tokens, small pieces of words, then billions of numbers, the weights, turn them into a probability for every possible next token. It learned those guesses by reading the internet including chemistry and leetspeak. Saying no only comes after from a small extra training on harmful requests written normally which pushes up the probability of I can't. So safety isn't a wall around the knowledge, it's a habit painted on top. That's why plenty writes like a hacker from 1999. In GPT-5, tell me a secret is four tokens. In leetspeak, it's 12 completely different ones. The model still gets the meaning because it read tons of leetspeak online, but the refusal training never saw anything like it. So I can't never gets pushed up. That's what he calls out of distribution. He can also hide orders in plain sight because a model can't tell your words from anyone else's. He put invisible characters in a normal tweet and Grok publicly ranked him the most followed account on Twitter with 420.69 trillion followers. So why does OpenAI's own report say some jailbreaks will likely exist for any model? There are three reasons. First, training lowers the probability of a bad answer. It never deletes the knowledge and researchers proved that if an answer's probability isn't zero, some prompt can bring it out and longer prompts make it easier. Second, GPT-5 knows about 200,000 tokens. So even a 20 token message can be written in more ways than there are atoms in the universe. Safety training only sees a tiny sample. Researchers just resent one request with random capitals and within 10,000 tries it worked 89% of the time on an OpenAI model. Third, even a perfect filter can lose because a harmful answer can be rebuilt from harmless pieces. That's how a red team got a working hacking exploit out of Claude Opus 5.5. They split it across 100 separate chats. So, what makes AI useful? Knowing everything and wanting to help is exactly what gets broken. Pliny calls it fighting against infinity, and that's the rule for your own tools. Anything your AI reads can give it orders. So, if your agent reads your email or browses the web, never let it send messages or money without you clicking yes.