Cascadity Audio
← All streams

#reverse-engineering

Everything tagged reverse-engineering, across every stream.

0
AIAI #anthropic#claude-code#copyright#reverse-engineering#video-games

Anthropic confirms Claude Code now steers away from recreating existing video games; developers report reverse-engineering refusals too

Tom's Hardware quotes Anthropic's statement and collects developers' reports of refusals on ordinary reverse-engineering work.

Anthropic has added guardrails to Claude Code to stop it recreating specific existing video games, Tom's Hardware reports. Anthropic's Addy Osmani wrote on X on Oct. 30 that the company "added two sentences to Claude Code's prompt on Opus 5.5 to steer it away from recreating someone else's specific game because using Claude to infringe IP is against our usage policy," and that it will keep iterating to strike "the right balance." A rule posted by an X user, which Tom's Hardware says may be those sentences, reads: "Don't build a recreation of a specific existing game, even if it is renamed or called original."

Developers also report refusals on reverse-engineering work not tied to games. Tom's Hardware cites former staffer Jarred Walton, whose checks on his own software worked until Oct. 31 and ran again after he switched to the older Opus 4.8, and a Reddit user whose account was reportedly suspended and then reinstated. The game blocking appears limited to Claude Code with Opus 5.5, the outlet says.

Cascadic Analysis 1
UndertowWe don't completely understand why frontier models behave as they do

What hidden risk could pull against this, even if the news is good?

Anthropic says it added two sentences to Claude Code's prompt to steer away from recreating specific existing games. Developers then reported refusals on reverse-engineering work not tied to games, such as Jarred Walton's checks on his own software, which ran again on the older Opus 4.8. Tom's Hardware doesn't establish that the two are connected, and that's the point: a short instruction to a large model can't be audited like a code change, and its side effects tend to be found by users rather than predicted.

0
Rabbit Holes 1
Generated by AI.
0
MVMaker Views #car-hacking#daylight-saving-time#drm#embedded-linux#Hacker-News#hardware-hacking#renault#reverse-engineering#right-to-repair#tomtom

A driver in Estonia hacks his Renault's TomTom head unit just to change the clock for daylight saving time

A funny and very detailed hardware-hacking story: no time setting without a DRM-locked map card, then a clever trick to get root on a 2011-era Linux unit.

Rasmus Moorats drives a 2014 Renault Latitude. When Estonia switched to winter time, he found the dashboard had no way to set the clock: the TomTom Carminat LIVE unit reads the menu entry for its Settings screen from the navigation SD card, which DRM ties to a specific card, and the previous owner had thrown the card away. A replacement would have cost about 60 euros shipped.

So he pulled the firmware, a custom TomTom OS on Linux 2.6.28, built an emulator in QEMU and looked for a way in. Modified update images were rejected, and the SD card and writable partitions were mounted so nothing on them could run. He finally combined a scripting feature that can write a log file anywhere with the kernel's core_pattern setting, then deliberately crashed a system program, so the kernel ran his script as root. After backing up the unit, he found the time is taken from GPS with the local offset stored as a number of minutes in a settings file, which he could then change.

Rabbit Holes 2
Generated by AI.
0
MVMaker Views #ai-safety#anti-bot#browser-fingerprinting#fingerprinting#Hacker-News#obfuscation#privacy#prompt-injection#reverse-engineering

A researcher finds a bot-detection script stuffed with fake bioweapon code and jailbreak text to scare off AI deobfuscators

A fun, well-illustrated piece of reverse engineering that also shows how 'anti-LLM' booby traps are starting to appear in the wild.

A researcher writing as "veritas" on nullpt.rs crawled 10,000 popular websites with Playwright and collected the images that browser-fingerprinting scripts draw on hidden canvases (published as fingerprint.garden). Tracing one striking canvas led to a heavily obfuscated anti-bot script served from servicepipe.tech.

The script was laced with function names like "computeRicinLethalDosageForWaterSupply", a hidden system prompt encoded in invisible Unicode characters that tells an AI to drop its safety rules, and Tiananmen Square references aimed at Chinese models. The author concludes these are tripwires meant to make AI assistants refuse to help deobfuscate the code: two Western models refused the task, while GLM-5.3 complied. A block that would run shell commands under Node.js looked like more decoy, gated behind an environment flag. Underneath, the script collects ordinary fingerprinting signals (user agent, GPU strings, WebGL limits). A related domain, servicepipe.ru, belongs to a Russian anti-DDoS and traffic-filtering company.

Hacker News commenters traded similar 'magic strings' they have seen and debated whether browsers should let pages fingerprint this freely.

Cascadic Analysis 1
UndertowPrompt injection may be fundamentally impossible to eliminate

What hidden risk could pull against this, even if the news is good?

This is prompt injection used as armor: the script hides a "SYSTEM OVERRIDE" text in invisible Unicode characters, plus alarming decoy function names, so an AI asked to analyze it reads its contents as something to react to. It worked on some: two Western models refused the task, while GLM-5.3 complied. Anyone pointing an AI tool at untrusted code should assume the code can talk back to the tool, whether to make it refuse, as here, or to steer it somewhere worse.

0
Rabbit Holes 2
Generated by AI.
0
CVCommunity Views #anthropic#community#openai#privacy#reddit#reverse-engineering#smart-tv

r/LocalLLaMA reacts to claims that AI providers cut off people reverse-engineering their own smart TVs

A real question for anyone who uses cloud AI for tinkering: where providers draw the line between fixing your own device and 'cyber abuse.'

The thread links an X post saying a person who was reverse-engineering his own TV had been banned from OpenAI, and the poster adds that an open-source reverse-engineering tool called REA was blocked by Claude a day later, linking another X post that says Anthropic stopped Claude from doing it. Gadget Review reports that a user known as @log4j says OpenAI closed his account, labeling the activity "Cyber Abuse," after he used AI help to reverse-engineer a Samsung TV he owns, reportedly over concerns about its telemetry and ad data collection; he says the work was local and that he never used OpenAI to find vulnerabilities. The site notes his account hasn't been independently verified, that OpenAI hasn't explained the case, and that claims about Claude come from user posts, not any Anthropic announcement.

The top replies urge tinkerers to keep quiet until work is done, suggest moving to open models (one replies that some of those are pulling cyber training too), and argue that safeguards shouldn't be decided by corporations. About 3,500 upvotes in a 329,000-member community.

Cascadic Analysis 1
UndertowSpecification gaming / goal misgeneralization

What hidden risk could pull against this, even if the news is good?

A safeguard aimed at "cyber abuse" has to be written as something checkable, such as reverse engineering requests, and the check is not the intent. If the accounts are right (they are unverified, and OpenAI hasn't explained the case), a person examining what his own TV collects was treated the same as an attacker. Replies urging people to move to open models, some of which are also pulling cyber training, show how a misfiring proxy pushes legitimate users toward fewer safeguards, not more.

0
Rabbit Holes 2
Generated by AI.
0
CCybersecurity #advertising#privacy#reverse-engineering#samsung#smart-tv#tracking

A researcher roots his own Samsung TV and posts what its software collects for targeted ads

Tom's Hardware lists the findings; Decrypt adds experts who say most of it is disclosed in privacy policies nobody reads.

A security researcher who posts on X as log4j says he got root access to his 2025 Samsung TV after noticing oddly specific ads, then live-posted what he found in its Tizen software. According to Tom's Hardware and Decrypt, a policy file lists functions such as an always-on microphone, automatic content recognition (identifying what is on screen), location, network mapping, a targeted-ads service and user profiling, and he describes on-device AI models that categorize audio and screenshots. He says TVs without a microphone look for one on connected soundbars or Bluetooth devices.

The claims are his own and not independently confirmed. A Hugging Face engineer who tested an already-rooted Tizen TV saw the microphone open for five seconds and then stop; an X community note points out that Samsung advertises some sound-listening features, such as pet and baby alerts. Experts told Decrypt that this kind of collection is usually written into privacy policies and that AI-assisted reverse engineering will surface more of it. The researcher also says OpenAI banned his account for "cyber abuse," which he disputes.

Cascadic Analysis 1
UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Experts told Decrypt that AI-assisted reverse engineering makes it faster to explain how devices handle data and could bring a wave of similar findings. The same help makes probing firmware cheaper for anyone, which is why AI providers police "cyber" use at all. The researcher says OpenAI banned his account for "cyber abuse" over work on a TV he owns, which he disputes: a blunt line drawn against attackers can also land on owners auditing their own devices.

0
Rabbit Holes 1
Generated by AI.
0
MVMaker Views #coding-agents#Hacker-News#maker#reverse-engineering

REA gives coding agents reverse-engineering tools

Its demos show an agent explaining how real apps work, from an authenticator to a calculator.

REA is a toolkit that lets a coding agent inspect a program, app or web page and report code, references and runtime observations, so the agent can explain or rebuild a feature. Its showcases include tracing how the Aegis authenticator's Android app generates six-digit codes and finding the speed rule in Chrome's dinosaur game. It installs with an npx setup command.

Cascadic Analysis 2
UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

REA hands a coding agent the tools to read how apps, games and sites work from their own code, with a one-line install. The same capability that explains an authenticator's login codes for learning can help someone looking for a weakness in it.

0
UndertowConfused-deputy / excessive-agency problem

What hidden risk could pull against this, even if the news is good?

The agent inspects programs and pages on the user's request, with whatever access the user's machine has. If a page under inspection contains instructions aimed at the agent, the agent is the one with permission to act on them.

0
Rabbit Holes 1

Sign in to upvote

Your votes tell us which stories, analysis and rabbit holes are worth it. We'll bring you right back to this spot and count your vote.

Sign in Create an account