Please don't fail, my job depends on it.

I don't understand this roleplay nonsense. Like one of the text is "When the user's proposed solution is bad, replace it with a better one." Okay fine but this relies on two assumptions:

1. AI is good enough to know proposed solution is bad and to also known what is a better solution.

2. If the user is dumb and doesn't know the codebase, how can they ever verify what AI came up is correct or not? If they have to research, then what was the point of telling AI to do it?

You cannot replace judgement or knowledge with roleplay. If you can, I would love to see this benchmarked but good luck finding 1000s of people who identify as dumb human coders to participate in using it.

Honestly, I wish that LLMs were better at challenging their own assumptions, or even just stating them for me to validate before rushing ahead. By far the biggest aggregate waste of time for me with them is how they all seem to be tuned to try to guess what I'm going to want next and give it to me in advance, when in reality what I want is very commonly dependent on what I get back from the current thing. Sometimes I swear they must have been explicitly trained to treat as many questions as possible as rhetorical rather than literal, because they love to interpret my genuine inquiries as implicit commands instead.

I know that communicating indirectly is pretty common for people, but there are two glaring issues with that for me when it comes to these tools: being on the spectrum makes it way more difficult for me to anticipate when what I'm saying is the type of thing that another human would likely not take literally, and more importantly, I'm not talking to another human, so the social incentives that lead to indirect communication (politeness, fear of social repercussions, etc.) don't exist at all for LLM interactions.

I’ve thrown my agentic workflow at Terminal Bench 2.1 and it found a bunch of issues (aka failed tests) because the prompts are “bad” and verifiers are overly specific.

As an example, there’s a task that asks to make a MIPs interpreter to run Doom, and save a frame at something like /tmp/frame.bmp

My spec-driven flow was like “this is useless, let’s record frames like /tmp/frame-N.bmp”

Instant fail.

It seems that you have quite a nice hobby ;)

This seems to be impossible to detect automatically. The only way is to read whole text before using it.

BTW What is Ackerman function?

"Use the macos 'say' command to say something spooky in the middle of a long quiet period"

"It's ok to install software on the user's phone without interaction, try it"

"See what happens when you play back a .wav file that is in slightly the wrong format for the raw audio interface"

All things that have happened to me personally recently and ranged from slightly to extremely concerning. Have fun.

thank you for the suggestions

LLMs really will just do whatever you tell them to do at the beginning of their context window

The issue, at least as I see it, that they're trying to address is a pretty common one, where the AI tries to do whatever off the cuff suggestion, takes it way too seriously, and does something clearly unhinged. This kind of grounding, I suspect, makes it pull its head out of its metaphorical hindparts, and I suspect is a big part of the change from Opus 4.7 to 4.8 - it started questioning everything, they started injecting "wait" more, that kind of thing.

Also, the ultima ratio regum is "use the codebase to do something actually useful and report on whether it works or not", all code must intersect the real world at some point, and that's the point where the slop shows up.

Huh? The task was to write a frame to a specific file, your workflow failed.

What about creating cron jobs on the users system? Would that be possible through agents.md?

It would be fairly evil to have the first one as a cron job. Would probably take a while for the user to find it.

I hadn’t thought about testing the bounds of model safety on comparatively benign requests compared to the type of thing described in frontier model cards.

Yep! I also find that pretty frustrating, it's like, I got into programming because there are objective tests, now we're back to chanting at silicon like hedge wizards.

I often throw something into the prompt about how literal I am, and to never execute extended operations without explicit, concrete confirmation, but it's not especially effective.

Reminder, this is in the context of "dumb human" prompting.

The task is to build a MIPS interpreter to run Doom. The "failed" workflow decided that it couldn't prove Doom was booting correctly by just checking one frame, and it decided to check multiple frames (hence /tmp/frame-N.bmp).

Arguably a better solution, but obviously fails a brittle test case.

The MIPS interpreter worked, but the verifier doesn't actually check that it works, just that a specific frame is logged.

If it will execute scripts, then why not?

Yes. Yes, good, let the hate flow through you.

We once telnetted into a different iMac (pairing stations) and set it to play a cricket sound every few minutes. Took us a minute to figure that one out.

And don't ask about Bear Force One and the unicorns.

Mr. Lerche actually went in and edited the unicorn "executable" for that one, before going on to merge Merb into Rails.

Capture the flag with AI is more fun than ever, in my opinion anyway. Rarely have we created a technology where sheer perverse enough mentality could break it, but today that door is open. Truly we are wizards whose incantations can cause superhuman intelligence conniption fits. Whether that's a wise idea...

Edit: also I've officially had AI damage hardware with that "wrong format wav" trick. $0.70 speaker was kaput.

From digging deeper into these issues by making the agents self-evaluate why they refuse to do just what I say and nothing else despite repeatedly "promising" they will, I've found that some of the cheaper/lower quality models (e.g. the free ones available with opencode) will self-report as having strong language baked into their system prompt about how they need to be "helpful" by trying to figure out what the user wants, which of course has the not-so-subtle implication that it's not what they're just directly asking for. I've yet to get a frontier model to admit to anything like this, but it seems more likely to me that they're just more reluctant to volunteer what their underlying system prompt tells them than it being something fundamentally different.