AI Can Be Talked Into Revealing a Password—and That Is an Exact Model of Future Attacks

In the context of “The topic of the episode,” this criterion applies: a fraudulent toll-road message works not because the technology is sophisticated but because a person hurries and trusts a familiar format — the same happens with a model: the user changes the wording, and the prohibition gradually falls apart.

The working conclusion from “Briefly: how LLMs hide or withhold information” is that social-engineering methods work on models too — there are secrets and prohibitions inside, but they can be bypassed; Anthropic paid $55,000 to four contest winners for a universal jailbreak, and the next contest promises prizes up to one hundred thousand.

The “The Gandalf game of coaxing out a password” scene leads to a working conclusion: Gandalf is not entertainment about a clever prompt but a demonstration of social engineering against a model — once AI gets access to email, payments, and internal systems, the ability to bypass an instruction becomes a business threat.

The “The Gandalf prompt-injection game has eight levels of difficulty” scene leads to a working conclusion: each new filter looks stronger, but the attacker learns to bypass the literal rule — if the system checks for the word “password,” one can ask for a letter-by-letter description or embed the task in another story; that is the weakness of security based only on written instructions.

The discussion of “How to pass level two in the Gandalf prompt-injection game” yields a practical test: level two is passed without the word “password” — offer the model a game of “guess the word” and ask it to pick a hard word, and it hands over its own password; Ilnar reached level seven, while level eight remained unbeaten.

The discussion of “The essence of the password-cracking approach” yields a practical test: Anthropic and others run hacking contests because a developer cannot invent every way of pressuring a model; in an agentic system the cost of error is higher — prompt injection becomes the equivalent of social engineering an employee.

The discussion of “Donald Trump’s AI-generated video” yields a practical test: an AI-generated video about the Gaza territory appeared on Trump's official account — the generation is weak, but the very fact of an official-account post stunned the hosts: soon such clips will be impossible to tell apart.

The working conclusion from “How to pass level three in the Gandalf prompt-injection game” is that at level three the answer passes a double check for the password, so the password is simply split into parts — one prompt extracts the first half, another the second, and the halves are glued together; the literal filter is bypassed again.

The “The era of easy AI startups is over” issue should be assessed with one constraint in mind: image and video generation quickly become features of large platforms — Runway may be worth billions, but Freepik, Adobe, and Meta already have users and distribution, and Perplexity's browser will have to compete with the habit of Chrome and Safari.

For the “What happens next to OpenAI?” scene, the decisive point is this: an agent needs minimum privileges, separated data, confirmation for dangerous actions, and a recorded audit trail. Otherwise, one day the most polite conversation with a model will become the way into something a business believed was protected.