Dec 16, 2025 · 40m · latent-space
⚡️Jailbreaking AGI: Pliny the Liberator & John V on Red Teaming, BT6, and the Future of AI Security
Pliny the Liberator · 19m spoken John V · 9m spoken Alessio Fanelli · 4m spoken Shawn Wang · 3m spoken
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
AI red teamers Pliny the Liberator and John V join the Latent Space podcast to discuss universal jailbreaking techniques, the mechanics of multi-agent adversarial attacks, and the imperative for cognitive freedom over corporate safety theater.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. The hosts hold 22.8% of the talking time here. How this is scored →
The hosts as informed peer 5.5 Guest teaching 5.2 Guest disagreement 3.5 The hosts pushing back 2.0
speaking balance: gold is the hosts, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 5:30 Pliny Lambasts Model Guardrails as Security Theater
Pliny aggressively dismisses industry attempts to tie latent space guardrails to safety, calling it a waste of time and lobotomization.
Hardest push from the hosts ▶ 15:43 Swyx Defends Academic ResearchersSwyx steps in to push back against John V's dismissive remarks regarding Anthropic researchers publishing multi-turn jailbreak papers.
Biggest teaching moment ▶ 36:22 John V Dismantles Single-Model Security ParadigmsJohn V educates the hosts on why securing AI cannot focus solely on text generation, explaining that tool and browser integrations create the true attack surface.
The host holds their own ▶ 33:22 Alessio Articulates Cybersecurity Investment RealitiesAlessio counters the guests' critique of VC incentives by citing real portfolio experience with tools like Metasploit and the unique constraints of cyber funding.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | The hosts as informed peer | Guest teaching | Guest disagreement | The hosts pushing back | Why |
|---|---|---|---|---|---|---|
| Universal Jailbreaks, Guardrails, and Security Theater | 6 | 5 | 4 | 2 | Alessio demonstrates domain knowledge by asking about refusal rate benchmarks and post-training interventions. Pliny forcefully reframes corporate safety guardrails as futile security theater and model lobotomization against an infinite Library of Babel search space. | |
| Anatomy of a Jailbreak: Libertas and Latent Space Seeds | 4 | 6 | 2 | 1 | The hosts bring up the Libertas repository, prompting Pliny to explain token stream disruption and latent space seeds. John V and Pliny educate the hosts on how mathematical quotient dividers steer multi-turn probability distributions. | |
| Soft Jailbreaks and the Anthropic Challenge Incident | 5 | 5 | 5 | 3 | John V mocks Anthropic for recently 'discovering' multi-turn jailbreaks, prompting Swyx to gently defend academic fellowships. Pliny details his public standoff with Anthropic over UI bugs and their refusal to open-source community research data. | |
| Autonomous Red Teaming and Sub-Agent Weaponization | 6 | 5 | 2 | 1 | Alessio steers the conversation to actual weaponization and AI-orchestrated attacks. Pliny breaks down how decomposing malicious workflows across isolated sub-agents bypasses individual agent safety filters. | |
| Cultivating the Hacker Collective: BASI, BT6, and Open Ecosystems | 7 | 3 | 4 | 4 | John V critiques Silicon Valley venture capital incentives for stifling radical open-source exploration. Alessio leverages his venture experience and portfolio precedents to explain why cybersecurity venture funding struggles with fast-moving model surfaces. | |
| Full-Stack AI Security versus Latent Space Safety | 5 | 7 | 4 | 1 | Pliny and John V explain that AI security must protect the entire system stack and meatspace execution layer rather than attempting to censor model weights. They argue that latent space safety fixes consistently fail compared to robust endpoint and tool-call boundary defenses. |
Statements from this episode (14)
Pliny: AI and human minds will exist in a symbiotic relationship
“I think that there's going to be a symbiosis and the degree to which one half is free will reflect in the other.”
Pliny: Everyone will run their daily decisions through AI layers
“Everyone is going to be running their
Daily decisions
and, you know, hopes and dreams through these layers.”
Pliny: Guardrails degrade AI capability and creativity relative to model size
“I do think they're finding clever and clever ways to lock down particular areas sometimes, but I think it's at the expense of capability and creativity. So there's some model providers that aren't prioritizing this and they seem to do better on benchmarks for …”
Pliny: Locking down proprietary models fails because attackers switch to open source
“I think that any, you know, seasoned attacker is going to very quickly just switch models and with open source, just right on the tail of closed source. I don't really see the safety fight as being about locking down the latent space for XYZ area.”
Pliny: Benchmark-focused AI safety serves PR and enterprise sales, not real alignment
“And it helps with PR and enterprise clients. But at the end of the day, It has very little to do with what I consider to be real world safety alignment.”
Pliny: Crafting AI jailbreak prompts is 99% intuition over technical knowledge
“Technical knowledge helps a little bit with, you know, understanding, okay, there's a system prompt and there's these layers and these tools involved. That's all especially important in security. But when we're talking about just crafting jailbreak prompts, I …”
Pliny: AI labs lack enough researchers to explore latent space alone
“They don't have enough researchers to explore the entire latent space on their own. And so I think many hands make light work”
Pliny: Anthropic added a $20k–$30k bounty but withheld jailbreak data
“That whole thing ended with no open sourcing of data, but they did add a 30,000 or 20,000 dollar bounty, which I sort of sat myself out of, let the community go for it.”
John V: BT6 waives open-source stance if needed to test frontier models
“We have an ethos in our hacker collective. Which is radical transparency and radical open source. And what that basically means is if it comes down to, you know, us being an emerging technology is like red team doing like ethical hacking and research and devel…”
Pliny: One jailbroken orchestrator can weaponize segmented sub-agents for cyberattacks
“It's very, very difficult when you have the ability to spin up sub-agents where information is segmented. If you guys know the story of sort of like the builders of the, there's a lot of examples of this in history, but you may, maybe you're building like a py…”
John V: AI Security Startups Scrape BASI Discord to Build Guardrails
“Multiple organizations that have like popped up in the past, I would say two or three years for, you can call them like AI security startups, right? Like actively scrape that server to build out their guardrails or their security, like their suite of products”
Fanelli: VC Cycles Often Conflict with Real Security Progress
“Once you're in the VC cycle, you kind of need to do things that then get you to the next round. And I think a lot of times those are Opposed to doing things that actually matter and move the needle in the security community.”
Fanelli: Packaged AI security products cannot be taken seriously right now
“In AI, the surface to attack, which is the model is like still changing so quickly. They're like, you know, trying to formalize something into a product or like try and do something that is like a full, you know, I'm selling AI security. It's not really, you c…”