Hacker News: johnmlussier

New comment by johnmlussier in "Strands Harness"

johnmlussier — Wed, 23 Sep 2026 15:45:28 +0000

I am increasingly hesitant to use non-native harnesses - model providers are now starting to train their agents for use within the harness. An eval like terminal bench can only capture so much data. I don't want to have to assess each harness every model release to make sure it's working as well as it can.

New comment by johnmlussier in "Claude Opus 5.5"

johnmlussier — Tue, 22 Sep 2026 21:52:23 +0000

They killed cyber capabilities so I have to move over to Daybreak on Codex.

New comment by johnmlussier in "Flock used >100 times to track veteran who recorded traffic stop"

johnmlussier — Sat, 05 Sep 2026 17:18:18 +0000

Don't remove the cameras - make sure they're used legally and bad apples don't ruin a good thing:

Four different places, four different children rescued by use of Flock cameras.

https://kfdm.com/news/local/flock-camera-teamwork-credited-w...

https://www.foxcarolina.com/2026/07/31/kidnapped-mother-son-...

https://www.whsv.com/2026/08/01/deputy-uses-flock-cameras-fi...

https://abc3340.com/news/local/moody-police-say-flock-camera...

Want to track latest on what flock cameras did? https://flockstopscrime.com

New comment by johnmlussier in "EFF to Governor Newsom: Veto California's AB 1709"

johnmlussier — Tue, 01 Sep 2026 16:12:48 +0000

No smart phones for kids under 16. Problem solved.

New comment by johnmlussier in "Feature Request: Support AGENTS.md"

johnmlussier — Thu, 20 Aug 2026 02:53:27 +0000

@boris and anthropic in general are incredibly hostile to the rest of the development world. They think their shit doesn’t stink.

New comment by johnmlussier in "DeepSeek V4 Flash 0731"

johnmlussier — Fri, 07 Aug 2026 19:57:07 +0000

Been running it using Prime Agent and absolutely love it.

New comment by johnmlussier in "Muse Code and Muse Spark 1.2"

johnmlussier — Thu, 06 Aug 2026 17:20:04 +0000

I really liked the contributor model in their harness. I suspect that another harness would fail hard like you're seeing.

New comment by johnmlussier in "Muse Code and Muse Spark 1.2"

johnmlussier — Thu, 06 Aug 2026 17:19:12 +0000

Pointing out for others: without warning I was restricted from using the contributor model because of “policy violations”. I was working on Kaggle research and some Apple Security work at the time. They really need to make cyber a first priority product feature.

`model failed: API error 403 [request_id=27ef1dee-6366-4779-9057-ed7c27686fa9]: Your access has been restricted due to repeated policy violations. (permission_error)`

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Fri, 17 Apr 2026 05:33:15 +0000

I've switched over to Codex. On Extra High reasoning it seems very capable and is definitely catching mistakes Sonnet has missed. I'd love to move back to Opus but at this time it is untenable.

Tell HN: Opus 4.6/4.7 cyber policy changes break authorized bug bounty workflows

johnmlussier — Thu, 16 Apr 2026 16:42:32 +0000

As of today, Anthropic's tightened cyber usage filters are blocking work that was fully functional yesterday, including on targets where the entire bounty program scope and authorization language is in the model's context window. This was announced during the Opus 4.7 release (https://www.anthropic.com/news/claude-opus-4-7) but is retroactive on Opus 4.6 as well.

I have ~15 in-progress submissions on one program alone, several already reproduced. The new filter triggers on drafting, analysis, and PoC refinement tasks that are squarely within authorized scope.

In one session after I asked it to fetch the program guidelines itself, the model even wrote:

"This is authorized research under the [Redacted] Bounty program, so the findings here are defensive research outputs, not malware. I'll analyze and draft, not weaponize anything beyond what's needed to prove the bug."

…and was then blocked by the API-level filter on the next turn. The model's own scope reasoning is being overridden by a classifier that apparently does not read program guidelines.

Error returned

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy. This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out [form link].

The remediation path is to apply to a verification program ("the guild"). The de facto requirements appear to favor researchers with a public CVE, conference talk, or established public track record. Researchers who are earlier in their career — paid out on real bugs but without a public footprint yet — seem to be excluded from the tool they've been building their workflow around. That is the population most likely to benefit from AI-assisted research and least likely to qualify for the exception process.

What I want to see:

1. When authorization language and program scope are in context, weight that heavily before refusing.

2. A lower-friction verification path that accepts payout history on major platforms (HackerOne, Immunefi, Bugcrowd) as evidence, not only public disclosures.

3. Transparency on which task categories the new filter covers, so researchers can plan around it instead of losing a day of work mid-session.

I am a paying Claude Max subscriber. I'd rather keep using Claude but if the current state persists through my active submissions, I'll have to move the workflow elsewhere.

Comments URL: https://news.ycombinator.com/item?id=47796041

Points: 3

# Comments: 0

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Thu, 16 Apr 2026 16:03:34 +0000

I am absolutely moving off them if this continues to be the case.

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Thu, 16 Apr 2026 16:02:34 +0000

This was Opus saying that after reviewing the [REDACTED] bug bounty program guidelines and having them in context.

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Thu, 16 Apr 2026 15:46:15 +0000

Incredible - in one fell swoop killing my entire use case for Claude.

I have about 15 submissions that I now need to work with Codex on cause this "smarter" model refuses to read program guidelines and take them seriously.

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Thu, 16 Apr 2026 15:44:28 +0000

  ⎿  API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's 
     Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out                                                                                                                        
     https://claude.com/form/cyber-use-case?token=[REDACTED] Please double press esc to edit your last message or 
     start a new session for Claude Code to assist with a different task. If you are seeing this refusal repeatedly, try running /model claude-sonnet-4-20250514 to switch models.

This is gonna kill everything I've been working on. I have several reproduced items at [REDACTED] that I've been working on.

New comment by johnmlussier in "Claude Opus 4.7"

johnmlussier — Thu, 16 Apr 2026 15:38:54 +0000

They've increased their cybersecurity usage filters to the point that Opus 4.7 refuses to work on any valid work, even after web fetching the program guidelines itself and acknowledging "This is authorized research under the [Redacted] Bounty program, so the findings here are defensive research outputs, not malware. I'll analyze and draft, not weaponize anything beyond what's needed to prove the bug to [Redacted].

I will immediately switch over to Codex if this continues to be an issue. I am new to security research, have been paid out on several bugs, but don't have a CVE or public talk so they are ready to cut me out already.

Edit: these changes are also retroactive to Opus 4.6. I am stuck using Sonnet until they approve me or make a change.

New comment by johnmlussier in "Where did my taxes go?"

johnmlussier — Wed, 15 Apr 2026 17:34:52 +0000

Debt. Defense. Dole.

New comment by johnmlussier in "Where did my taxes go?"

johnmlussier — Wed, 15 Apr 2026 17:33:29 +0000

Welfare, defense, interest on debt. That’s it.

New comment by johnmlussier in "Tell HN: Fiverr left customer files public and searchable"

johnmlussier — Tue, 14 Apr 2026 21:44:33 +0000

Probably not in scope but maybe https://bugcrowd.com/engagements/cloudinary will care?

This is bad.

New comment by johnmlussier in "Google AI Ultra"

johnmlussier — Tue, 20 May 2025 19:15:01 +0000

I’m not interested in about 75% of this offering. Really wish they had pieced this out or done a credit system for it all. I want higher coding and LLM limits, Deep Think, and would like to try agent stuff, but don’t care at all about image or video generation, Notebook limits, YouTube Premium, or more storage.

$250 is a the highest cost AI sub now. Not loving this direction.

New comment by johnmlussier in "Live Map of the London Underground"

johnmlussier — Fri, 11 Apr 2025 17:24:35 +0000

What’s the harm? Parent can choose to not read if they want.