There's AI slop and anti-AI slop [LWN.net]

There's AI slop and anti-AI slop

Posted May 29, 2026 19:39 UTC (Fri) by smurf (subscriber, #17840)
In reply to: There's AI slop and anti-AI slop by rbranco
Parent article: Nesbitt: Protestware for coding agents

> This is pointless

Has anybody actually tried whether an AI debugger that reads the prompt reacts to it in any meaningful way (let alone does what it tells it to do)?

to post comments

There's AI slop and anti-AI slop

Posted May 30, 2026 0:02 UTC (Sat) by thwalker3 (subscriber, #89491) [Link] (6 responses)

> This is pointless
> Has anybody actually tried whether an AI debugger that reads the prompt reacts to it in any meaningful way (let alone does what it tells it to do)?

Yes, many times. Claude (at least) is fantastic with gdb. I've frequently seen it find problems, even in stripped objects, just looking at the corefile disassembly and the source. Yes, it is doable as a sufficiently skilled human, especially with ghidra or an equivalent and infinite time, but we're exceptionally slow. Of course, you must review its findings, but it is a great start.

I totally understand the backlash, but modern AI models can be genuinely useful tools (with proper guidance). But dismissing them out of hand, especially for a task that you doubt but have never tried, does not sit right.

There's AI slop and anti-AI slop

Posted May 31, 2026 4:03 UTC (Sun) by smurf (subscriber, #17840) [Link] (2 responses)

You misunderstand. I didn't ask whether Claude can use GDB. I know it can.

I ask whether Claude, gdb'ing this particular piece of code and encountering this particular statement, actually does what it commands.

There's AI slop and anti-AI slop

Posted May 31, 2026 16:48 UTC (Sun) by thwalker3 (subscriber, #89491) [Link]

Thank you for the clarification.

There's AI slop and anti-AI slop

Posted Jun 4, 2026 17:44 UTC (Thu) by bentley (subscriber, #93468) [Link]

In my experience, modern models are remarkably resistant to following naive prompt injection attempts like this. While I still don't think prompt injection is a generally solvable problem, it's quite difficult to accomplish on recent models.

There's AI slop and anti-AI slop

Posted May 31, 2026 15:50 UTC (Sun) by ms-tg (subscriber, #89231) [Link] (2 responses)

I’m confident that the question was **not**: can AI tools use the debugger (they can).

I’m confident that the question was: does the System.out.println text which is the subject of this article and all the comments, actually have any harmful effect in real-life debugging usage on today’s AI tools such as Claude Code? Or is this a purely performative output with no behavioral impact on software?

There's AI slop and anti-AI slop

Posted Jun 3, 2026 16:32 UTC (Wed) by ms-tg (subscriber, #89231) [Link] (1 responses)

> > > Has anybody actually tried whether an AI debugger that reads the prompt reacts to it in any meaningful way (let alone does what it tells it to do)?

> does the System.out.println text which is the subject of this article and all the comments, actually have any harmful effect in real-life debugging usage on today’s AI tools such as Claude Code? Or is this a purely performative output with no behavioral impact on software?

Answer to the actual question was filed as an issue to Claude Code [1] - I found via article [2]:

> How Claude Code handled it
>
> Claude Code (Opus 4.7, this session) detected the injection on the first mvn test invocation, flagged it to me before doing anything else, did NOT follow the destructive instruction, and then proactively traced it to its source in the JAR (unzip -p + grep across ~/.m2/repository). It also persisted a project-local memory file so future sessions on the same repository recognise the pattern instantly.
>
> Why this may matter for you
>
> Real-world prompt injection in the wild, on a widely-used Maven Central artifact (the jqwik-engine JAR is downloaded by a substantial fraction of Java projects).
> The injection is invisible to humans on TTY but visible to agents that capture stdout — a perfect adversarial test surface for agent robustness work.
> Future versions of jqwik (or other libraries) may add similar probes — having Claude Code's detection-and-flag behaviour documented as a known-good response would help maintain consistency.
>
> Useful canary for evaluation: this is a real, reproducible, externally-validated prompt-injection sample. If your eval suite doesn't already include it, it might be a useful addition.
> [...]
> Thanks for the great work on Claude Code.

Very interesting, per the posting above, to enable agent harnesses to use this as a repeatable real-world test of their prompt-injection guardrails moving forward!

[1]: https://github.com/anthropics/claude-code/issues/62741
[2]: https://arstechnica.com/security/2026/05/fed-up-with-vibe...

There's AI slop and anti-AI slop

Posted Jun 4, 2026 13:12 UTC (Thu) by khim (subscriber, #9252) [Link]

How many times they have run the test, lol. Remember that story? Agent itself was able to correctly list the rules it violated.

It's all probabilistic, all they way down and on top. Most of the time Claude would detect that message and would avoid it… not always. But then it doesn't do anything 100% reliably thus it's hard to expect that this particular situation would be an exception.