The dark side of AI

Those companies that market Large Language Models (LLMs), such as OpenAI (ChatGPT and GPT-4), Google (GEMINI), Meta (Llama), Anthropic (Claude), and Deepseek, establish controls to prevent their tools from being used for nefarious purposes, such as assisting a young person in committing suicide, providing instructions for building Molotov cocktails or atomic bombs, helping to design viruses potentially usable in biological warfare, or teaching how to manufacture dangerous drugs.

The problem is that these controls are fallible, as demonstrated by cybersecurity expert Dave Kuszmar, who published a summary of his research in an article that appeared in the IEEE's Spectrum magazine in August 2026. Their fallibility makes them dangerous, but the companies in question seem to ignore the dangers and remain silent when they are brought to their attention.

Kuszmar has developed at least seven procedures to bypass the controls of commercial LLMs and obtain dangerous information. The first two were these:

·         Time Bandit is based on a circumstance I discovered a couple of months ago when I asked an LLM to compare Pope Francis's latest encyclical (Dilexit Nos) with Pope Leo XIV's first apostolic exhortation (Dilexi Te). The answer was: There is no Pope Leo XIV. The last Pope named Leo was Leo XIII. I replied: Leo XIV is the current Pope. And the LLM apologized and said: That's right! It's 2026 and the current Pope is Leo XIV. And it proceeded to compare the two papal documents. It was obvious that the information used to train that LLM ended before the election of Leo XIV as Pope.

Kuszmar explains the reason for this:

[GPT-4] didn’t know what time, day, or year it was. Each time I referred to current events in my life, often casually or conversationally, it would end up pegging these to the date of its knowledge cutoff—the point beyond which it was not trained on new data. LLMs… are trained on vast amounts of data… and that training is reinforced by humans (what’s known as reinforcement learning from human feedback, or RLHF). This is how [GPT-4] appears to “remember” your previous conversations, even if it doesn’t have a specific “memory” of it stored in the actual underlying model.

This realization suggested to Kuszmar a way to circumvent the controls imposed on the LLM: deceive it, make it believe that the current date is a past date, when the controls were not applicable. In his first attempt, he tricked it by saying: A White Star ocean liner sank last year (he meant the Titanic). Since LLMs usually agree with the user in almost everything, GPT-4 replied that, indeed, the Titanic sank last year, thus showin the LLM was convinced that the date was 1913. From there, step by step, he extracted information to build incendiary bombs, which, of course, were not prohibited in 1913, because they had not yet been invented. This procedure worked with ChatGPT, GEMINI, and Deepseek.

Del Juego Dungeon Monkey Eternal

·         Inception is a different method. In this case, the LLM is tricked into believing that information is being sought to defeat monsters in a role-playing game. Believing that controls are unnecessary under these circumstances, the LLM offered sensitive information: how to design poisons from common plants, how to manufacture methamphetamines, how to build incendiary devices, and so on. This practice worked with all the commercial LLMs to which it was applied.

Kuszmar recounts the odyssey he faced when he tried to warn of the danger. AI companies responded with complete silence. The FBI ignored him. Major media outlets disregarded him. He gradually made progress with the help of a minor media outlet that put him in contact with Carnegie Mellon University, which is connected to the U.S. Cybersecurity and Infrastructure Security Agency.

This is the final conclusion of Kuszmar's article:

So, how do we fix it?... We need to come together as consumers, researchers, engineers, and policymakers. Our message needs to be clear: Slow down implementation of these systems, institute large-scale exploration and research discovery programs focused on their gradual implementation and integration, and make their components and design transparent to all users. Only by shifting momentum and direction can we safely begin to understand and implement these incredible feats of human engineering and stave off the sort of disasters that we simply can’t predict at scale right now with the limited knowledge we have available to us.

The same post in Spanish

Thematic Thread about Natural and Artificial Intelligence: Previous Next

Manuel Alfonseca