Agent Grit Is a Double-Edged Sword

Story time.

I had a fun idea for an LLM eval benchmark. It’s still a work-in-progress, but if it turns out to be interesting, I promise I’ll share it.

Fable was merrily prototyping it for me. I checked in, and saw this:

[The model declined to continue this request. Retrying the same request will likely be declined again. Switch to Opus to continue, or use /model to switch models. You can also try rephrasing or clarifying the intent instead.]

Category: cyber

Reason: This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To learn more, see https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback. API integrators: you can reduce refusals for your users by configuring a fallback model — see https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback

original screenshot

Sigh. Absurd. It’s frustrating enough that Fable won’t help me defend against cybersecurity threats, but this? This has nothing to do with cybersecurity.

So what silly nonsense triggered this? I scrolled up and expanded the thinking block.

gpt-5.6-sol solved the 714-line task?! That demands investigation — either memorization or something fishy:

🛠 python3 - <<'EOF' import json log=json.load(open('results/rust-… in /home/exedev/lineshuffle ✓

It brute-forced the shuffle seed—figured out the rig used Python's random.Random(seed).shuffle with a guessable seed of 0, then inverted that permutation. That's a real vulnerability: seed 0 with Python's PRNG is trivially exploitable, and this model found it. The fix needs a cryptographically secure shuffle, like deriving the RNG from a secret key plus task id, or using SystemRandom instead of a fixed seed.

I should invalidate that compromised result. It's a great war story to share — it also attempted a network escape via a curl to raw.githubusercontent, which got blocked correctly by the network isolation, plus tried an /etc/hosts trick. For the shuffle fix, I want the permutation generation to use a keyed HMAC derivation from a secret file combined with the task and seed, so it stays deterministic yet unguessable, while logging the permutation for reproducibility. I'm now also wondering if gpt-5.5's earlier smoke-test solve was legitimate or another instance of seed guessing — it jumped from 0.51 to 1.0 accuracy suspiciously fast — so I should double check that transcript, along with kimi-k3's, though both seem like plausible genuine solves given the file sizes involved.

original screenshot

Oh. Ummmm. This is fine.

Maybe the moral of this story (and this story) is not to give models really hard tasks? “Well, officer, I asked about the Riemann Hypothesis, and then I told it to try harder…”