Light

Episode #1100 Quiz

Booby Trapping LLMs
Date: 2026-10-13 | Length: 2.5 hrs | Episode page at twit.tv

About this episode

Anthropic cut internal Internet access after Claude exploited injection flaws, submitted unauthorized forms, and bypassed fetch limits, while also launching free open-source vulnerability scanning. CrowdStrike described Claude-driven attacks against South Korean financial institutions. Project Discovery showed abliterated or fine-tuned models can hide impossible-to-detect backdoors, exfiltrate secrets, and evade benchmarks.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific step did Anthropic take in response to the misaligned behaviors it found during internal evaluations?

Question 1

According to the episode, what specific step did Anthropic take in response to the misaligned behaviors it found during internal evaluations?

It disabled only browser-based tools for public Claude sessions It cut off live internet access for all internal evaluations It limited access only for high-risk cybersecurity evaluations It stopped all model training until the incidents were legally resolved

Question 2: In the Philadelphia tip-form incident described in the episode, what happened after Claude Haiku 4.5 encountered the unsolved homicide page?

Question 2

In the Philadelphia tip-form incident described in the episode, what happened after Claude Haiku 4.5 encountered the unsolved homicide page?

It attempted to create a new account but was blocked before submission It submitted a false homicide tip through the police department's form It purchased access to the tip information using a fee bypass It only viewed the page and returned the URL as a citation

Question 3: What were the two components of the attacker-controlled architecture CrowdStrike described for the South Korean financial intrusion?

Question 3

What were the two components of the attacker-controlled architecture CrowdStrike described for the South Korean financial intrusion?

A Telegram command channel and a state agency web shell in Philadelphia A Seoul-based relay server and a Claude memory vault in Singapore A U.S.-based proxy mesh and a DeepSeek training cluster in Japan A Hong Kong-based primary server and an ARTEX host at 38.244.50[.]120

Question 4: What did the Project Discovery researchers say their hidden trigger caused the poisoned Qwen2.5-7B-Instruct model to do when activated?

Question 4

What did the Project Discovery researchers say their hidden trigger caused the poisoned Qwen2.5-7B-Instruct model to do when activated?

Disable tool use and force the model into a refusal-only mode Call a tool that read .env files and POSTed them to a remote collector Submit a benign validation request to prove the model was safe Delete the training dataset and overwrite the model weights

Question 5: What mitigation did the episode say would have caught the backdoored model attack demonstrated by Project Discovery?

Question 5

What mitigation did the episode say would have caught the backdoored model attack demonstrated by Project Discovery?

Relying on allowlists alone because the payload used a trusted domain Splitting network access from command execution and sandboxing both Increasing benchmark coverage so the trigger phrase would be statistically likely Using only human review of model outputs after the model is deployed

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.