Back in 2021, Klipsch’s The Fives were the first powered speakers I’d encountered with an HDMI ARC connection, making them as friendly with your TV as they were with the rest of your components. When I first reviewed them, I called them the soundbar solution for people who don’t like soundbars. Klipsch raised the stakes with increasingly larger versions in The Sevens and The Nines, each of which helped usher in a new era of plug-and-play home theater speakers. While each pair has its place, The Sevens hit the sweet spot for me, delivering big, bold sound from a beefy footprint that still, just barely, fits on regular speaker stands.

Of course, HDMI-ready powered speakers are everywhere now, so The Sevens II really needed to up the ante to stand out. In that regard, Klipsch did not disappoint, upgrading its Goldilocks pair in nearly every way. The improvements range from an absolute smorgasbord of connection options and supported audio formats, including virtual Dolby Atmos, to the addition of the Wi-Fi and network connectivity missing from the original pair. There’s even a spare HDMI input for modern gaming consoles, a first among the powered speakers I’ve tested.

Unfortunately, I had real trouble connecting the speakers to my Wi-Fi network during setup, to the point that I eventually plugged in an Ethernet cable and called it a day. Otherwise, there’s not much The Sevens II don’t get right. They offer impressive immersion and clarity, fantastic bass response, and a wealth of extras in a nearly comprehensive take on the all-in-one speaker system.

Related Reviews:

Setup: Wi-Fi Woes

Let’s get the annoying part out of the way. While fishing these 15-inch-tall mega-cabinets from their housings is something of a chore, connecting to my network created the real headache. The biggest issue seemed to be that, while the speakers connected right away and were active in the Klipsch Controller app, they weren’t receiving network information, at least not fast enough for their mandated firmware update, which is apparently integral to functionality.

After five tries, multiple 30-to-45-minute waits, and at least two power cycles, I finally tried Ethernet, and the speakers seemed to jump at the chance to update. After around 10 minutes, they had the latest software, and I experienced no further network issues over two weeks of testing.

Ostensibly, the speakers can go wireless in multiple ways, allowing you to connect the primary speaker, which harbors the inputs and controls, to the secondary cabinet wirelessly. This limits resolution to 48 kHz, as opposed to 96 kHz with the included four-meter CAT6 cable, and besides, I wasn’t taking any more chances after my Wi-Fi issues.

To be fair, these aren’t the first speakers to have trouble on my network, and a colleague who reviewed The Nines II had no such issues. Still, the vast majority of devices I’ve tested connect seamlessly, so it’s something to note if your network is finicky and/or you don’t have a handy Ethernet connection.

Connecting The Sevens II to other components was as breezy as you’d expect from modern powered speakers, including a quick connection to the TCL QM7K TV I’m currently reviewing. This provides seamless control from your TV remote for power and volume, and unlike many premium speakers, there were no handshake issues or connection flubs.

Design and Features: Fully Connected

Even after my Wi-Fi frustrations, it was hard not to fall for The Sevens II’s chic yet brawny design, which perfectly matched my review TV’s 75-inch obsidian screen. Along with the Ebony MDF cabinets I reviewed, they come in Walnut and a tantalizing new Red Oak finish with a white front, each of which boasts “real wood” veneer. On top of the right speaker is the same tactile volume wheel found on the original pair, alongside a metallic input key, giving them a vintage vibe.

The package includes magnetic acoustic grilles for a more demure look, but unless you’ve got curious kids in the house, it’d be a shame to hide those drivers. The combination of Klipsch’s hefty “Jet Ceramic” 6.5-inch woofers and titanium LTS tweeters, set behind the brand’s signature Tractrix horns, really spruces up the room.

Other accessories include an HDMI cable, an omnidirectional microphone for calibration, and a simple backlit remote. The latter offers some helpful input keys, and it’s useful for pausing sound on the go, but the majority of controls and settings are handled by the app.

The input hub at the back of the main speaker, which can be placed on either the right or left for convenience, provides an embarrassment of riches. The digital coaxial input is especially useful for connecting a CD transport or CD player while relying on The Sevens II’s internal DAC and keeping the lone RCA analog input free for another source.

That’s joined by an optical digital port, RCA and MM phono analog inputs, and USB-C. Dual HDMI 2.1 ports, including HDMI eARC, provide high-bandwidth passthrough for 8K, HDR10+, and Dolby Vision video, as well as support for VRR (Variable Refresh Rate) and ALLM (Auto Low Latency Mode) with gaming consoles.

There’s also a subwoofer output to add more punch and clear up some space in the higher registers. It’s worth employing if you’ve got a spare subwoofer on hand, but part of the value proposition here is that The Sevens II have plenty of bass on tap, reaching down to a claimed 39 Hz and handling the upper-bass region around 50 to 60 Hz with relative authority.

On the audio side, Klipsch goes well beyond the limited PCM support found in most of the powered speakers I test, thanks to its use of Onkyo AVR circuitry. While DTS support is limited to The Nines II, The Sevens II get a loaded Dolby suite with support for Dolby TrueHD and even Dolby Atmos decoding, though without upfiring speakers, the effect is limited.

Streaming support is a major upgrade over the original pair’s Bluetooth-only system, supplementing Bluetooth 5.4 with support for Apple AirPlay, Google Cast, Spotify Connect, TIDAL Connect, and Qobuz Connect.

Dirac Live Room Correction calibration is also included to help adapt the sound to your room, though only for bass control up to 500 Hz by default. If you want to upgrade, you can do so through Dirac’s website for $100, which allows multiple “filters,” or calibration options across the frequency range, for different seating positions or room setups.

The app provides plenty of other ways to adjust the sound, including a five-band EQ and presets, along with extras such as Dynamic Bass, Dialogue Enhancement, and Night Mode. There are also three sound modes: Movie, which is on by default; Music; and Direct, for unfiltered sound.

Oddly, switching between modes creates a two- or three-second delay, accounting for the only real app trouble during my review. It’s especially frustrating because video tends to sound best in Movie Mode; otherwise, dialogue can sound boomy, while music is clearer and more open in Music or Direct Mode. Aside from that, the app was impressively stable and responsive, with only the occasional delay when connecting to Spotify.

Listening: Bold, Clear and Immersive

Though powered speakers like The Sevens II are generally designed as a music-first way to enhance your home theater, it will come as no surprise to those familiar with the original pair that their best use case is souping up your favorite TV shows and movies. That’s not to say they’re not excellent for music, but their large size and support for multiple home theater formats make them brilliant for TV sound.

Switching them on was an instant upgrade, not only over the reasonably capable TV speakers in the TCL QM7L I’m currently reviewing, but also over powered reference speakers such as the SVS Prime Wireless and even my beloved KEF LSX, especially with more cinematic fare. Their sheer size and acoustic design get much of the credit, using those large cabinets to produce an immersive soundstage marked by bold, powerful sound and plenty of foundational bass that rarely gets boomy.

Just as importantly, they’re very well attuned to subtle details. From the creak of a door or the click of a revolver’s hammer to pointedly soft dialogue or padded background noises, such as the din of printers and phones in The Office, everything feels elevated.

In one of my favorite test scenes from The Mandalorian episode “The Mines of Mandalore,” I was enamored with all the little moments: the dramatic punch of the ship as it breaks through the atmosphere; the metallic rattles placed deep in the soundstage; the purring of the ship’s engines; and even the tactile sound of his helmet light turning on. All of it was fantastically immersive, pulling me deeper into the moment.

I’m not sure how much of this can be credited to The Sevens II’s virtual Dolby Atmos support. Without upfiring speakers, Atmos’ height element—the part that makes it feel spherical and encompassing—is obviously limited. Even so, the sound is dimensional and articulate, while preserving plenty of bombast for moments such as explosions or the thundering beat of a soundtrack. Even in stereo, it goes well beyond your average flagship soundbar.

Listening to lossless music over Spotify Connect was also impressive, especially when using the Music or Direct modes. While the upper midrange and lower treble can sometimes sound a little tight, they never become sharp, and there’s plenty of detail across the frequency range, with notably expansive sound in larger mixes.

The brass in Sinatra’s “Luck Be a Lady” has convincing weight and presence, while the saxophones retain plenty of texture without becoming strident. The percussion in Tom Petty’s “You Don’t Know How It Feels” snaps with convincing attack, pushing the song’s signature snare to the forefront while preserving the laid-back groove that drives the track.

Bass reaches deeper than expected, even for speakers this size. The Weeknd’s “Starboy” delivers solid low-frequency impact without overwhelming the mix, while Caroline Polachek’s “Welcome to My Island” showcases the speakers’ ability to separate layers of synthesizers and electronic effects across a wide, stable soundstage that occasionally extends beyond the cabinets. Polachek’s voice remains clean and expressive throughout, even as the arrangement becomes increasingly dense.

Moving to vinyl with my go-to test album, Dave Brubeck’s Time Out, The Sevens II did a convincing job with the piano’s body and attack, the soft cymbal work and brushed snare positioned to the left, and the saxophone anchored firmly in the center. I preferred the built-in phono preamp in my U-turn Audio Orbit Theory turntable to Klipsch’s, which sounded quieter and less immediate, though the difference was not substantial.

If there’s one area where the speakers could improve, it’s the separation between instruments in dense arrangements. Radiohead’s “Everything in Its Right Place” remained clear, but individual layers were not as sharply defined as they could have been. That’s where Dirac Live comes in.

Dirac Live: Better Separation, Recessed Vocals

One of the most respected third-party calibration systems available, Dirac Live is designed to address room-related frequency problems, improve bass response, and refine imaging and clarity. For the most part, that’s what it did.

On many tracks, Dirac created more space between instruments and widened the stereo image without making the presentation feel disconnected. Returning to Tom Petty’s “You Don’t Know How It Feels,” the individual instruments and backing vocals were easier to distinguish within the mix.

Bass response also became more prominent, sometimes excessively so in my small listening room. On bass-heavy tracks such as Too Short’s “Just Another Day,” the low end became overbearing, though reducing the 80 Hz band in the EQ brought it back under control.

The larger issue was that Dirac sometimes pushed vocals farther back in the mix. That was noticeable on Depeche Mode’s “Personal Jesus” and Nickel Creek’s “Reasons Why.” The latter stood out in particular because Sara Watkins’ voice is normally positioned firmly at the center, with clear diction and strong presence.

Because of that tradeoff, I generally preferred The Sevens II without Dirac Live enabled. Other listeners may reach a different conclusion, especially in square, reflective, or otherwise difficult rooms where acoustic treatment is impractical.

The Bottom Line

The Sevens II offer the best of both worlds, combining the format support of a soundbar with the connectivity, scale, and stereo presentation of a capable pair of powered speakers. In many ways, that makes them and their sibling models, The Fives II and The Nines II, an appealing solution for anyone who wants a plug-and-play system that works across multiple sources, including a TV.

You’ll find greater clarity, precision, and stereo imaging from speakers such as KEF’s LS50 Wireless II, but The Sevens II counter with deeper bass, greater output, and more convincing handling of film and television content. That combination helps them stand out in a crowded market.

My Wi-Fi problems and smaller usability complaints, including the pause when switching sound modes, are the biggest marks against them. Even so, The Sevens II make a strong case for listeners who want one pair of speakers to handle music, movies, gaming, vinyl, and digital sources without adding an amplifier, streamer, or soundbar. For that buyer, their broad connectivity and powerful presentation help justify the substantial price.

Pros:

• Big and bold sound with deep bass response
• Articulate and immersive soundstage
• Impressive Dolby support, including virtual Atmos
• Class-leading connectivity options
• Stylish design and good build quality
• Solid accessories, including a backlit remote

Cons:

• Finicky Wi-Fi setup and firmware update
• Odd delay in audio when switching sound modes
• Imaging and instrumental separation is good not great

Ratings

★★★★★★★★★★ Performance

★★★★★★★★★★ Usability

★★★★★★★★★★ Build Quality

★★★★★★★★★★ Value

Where to Buy:

Related Reading:

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day attacks and urges customers to install the newly released security updates.

CVE-2026-15409 is a critical (CVSS 10.0) server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface that allows a remote, unauthenticated attacker to force an appliance to make requests to unintended locations.

CVE-2026-15410 is a high-severity (CVSS 7.2) post-authentication code injection flaw in the SMA1000 Appliance Management Console that could allow a remote authenticated administrator to execute arbitrary operating system commands.

While CVE-2026-15410 requires administrator privileges, SonicWall assigned the advisory an overall CVSS score of 10.0.

SonicWall says it investigated multiple incidents and confirmed that both vulnerabilities are being actively exploited.

“SonicWall PSIRT has investigated multiple cases indicating the active exploitation of the vulnerabilities described in this advisory,” SonicWall warned.

“Customers are strongly urged to upgrade to the hotfix release as soon as possible to remediate these vulnerabilities”

However, the company has not disclosed whether attackers are chaining them together. BleepingComputer has contacted SonicWall to clarify the attacks and will update this story if we receive a response.

The vulnerabilities affect SMA1000 models 6210, 7210, and 8200v running platform-hotfix releases 12.4.3-03245, 12.4.3-03387, 12.4.3-03434, 12.5.0-02283, 12.5.0-02624, and 12.5.0-02800.  Fixes are available in platform-hotfix versions 12.4.3-03453 and 12.5.0-02835, and later releases. 

SonicWall says the vulnerabilities do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.

The company also shared indicators of compromise (IOCs) that administrators can use to determine whether an appliance has been compromised:

• if in extraweb_access.log are mentioned requests to /__api__/login or /__api__/logout with HTTP 200 status
• if in extraweb_access.log are mentioned requests to /wsproxy with suspicious host parameters with 101 HTTP status
• if in ctrl-service.log are mentioned hotfix rollbacks with path traversal names
• if /var/lib/unit/conf.json contains routes for /__api__/login or /__api__/logout (these URIs do not exist in legitimate configuration)

SonicWall strongly recommends upgrading to the latest hotfix release and performing an analysis to determine if any of the above IOCs are present.

If a device is found to be compromised, the company advises administrators to re-image physical appliances or redeploy virtual appliances, change all user and administrator passwords, and reset TOTP tokens.

SonicWall also notes that there are no workarounds or mitigations for these flaws other than installing the hotfixes.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being actively exploited in attacks.

Federal agencies have until July 17, 2026, to secure affected systems under Binding Operational Directive (BOD) 26-04 or discontinue use of the product if mitigations cannot be applied.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

‘We are ​focusing our capacity where it matters most to customers’, a Thomson Reuters spokesperson said.

Thomson Reuters, the Canadian parent company behind Reuters News, is cutting up to 500 engineering jobs, joining a long list of technology providers shedding parts of their workforce in preference for AI.

Layoffs at the content and technology company could affect around 1.8pc of its global workforce of 27,100, and around 5.2pc of its 9,400-strong operations and technology unit, according to a Reuters New source.

These latest layoffs come as economists and technology leaders, in a fresh joint statement, warned against the negative effects of widespread and uncontrolled AI adoption on economies, including large-scale job displacement.

Similarly, the Economic and Social Research Institute, earlier this year, found that AI adoption in Ireland is likely to lead to “moderate increases in income inequality” in the short run.

Reports also suggest that AI’s uptake in many Irish and UK-based organisations is not adequately supported by targeted investment in skills and technology adoption.

“As customer expectations across legal, tax and regulatory workflows evolve, we are ​focusing our capacity where it matters most to customers,” ​a ⁠Thomson Reuters spokesperson told Reuters News yesterday (13 July).

The Toronto-based company announced revenue growth of 10pc in the quarter ending March, with its three biggest segments benefiting from its industry-specific AI products. The company also anticipates a better-than-expected outlook for 2026.

Technology leaders have been sounding the alarm on AI’s impact on jobs for a while – with many, including Mark Zuckerberg, praising slimmer teams, flatter management structures and cheaper AI agents.

Earlier this month, Microsoft announced plans to cut 4,800 jobs at the company, responding to changes to the industry’s landscape caused by the new technology. Meta reportedly cut as many as 350 Irish jobs in a recent round of layoffs that affected around 8,000 employees.

Other major companies including Block, Atlassian, Oracle and Amazon have also cut thousands of jobs.

According to Layoffs.fyi, tech companies have shed more than 120,900 workers so far this year – with the number fast approaching the roughly 123,000 that were laid off in the whole of 2025.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

To be an educator and a writer is to inhabit a rollercoaster world of hope; at times, you are filled with the excitement and power of possibilities, and at others, you are terrified of losing it.

During the Voices of Change fellowship, I not only grew as a writer but was also inspired by educators who gave me the gift of “freedom dreaming.” I’ve since sought opportunities to practice freedom dreaming daily in the classroom. Embedding joy and equity into the curriculum and building authentic relationships with students are my north stars. I refer to my students as family, and to highlight that, I have a banner with a quote by Gwendolyn Brooks on my door. It reads, “We are each other’s magnitude and bond.” I’ve placed photos of the students in my classes all around the banner.

I’ve also begun teaching world history. This class energizes me and makes me want to revolutionize and freedom-dream the way history is taught and explore people and stories that matter.” Facing History and Ourselves” and the “Remedial Herstory Project” have been instrumental in helping me find my way and voice as a history teacher.

Despite teaching a new subject that gives me joy, this particular school year has been one of the most emotionally exhausting and difficult for me. I live in Minneapolis, where our 2025-26 school year began with the mass shooting at Annunciation School, a community with close ties to my school. Then, in December, the havoc of ICE removing neighbors and family members from our communities began and culminated in the murders of Renée Good and Alex Pretti. On the hardest days, I held back tears as I tried to instruct my classes. The students and I were scared; our mental health was tested and we were often distracted by everything outside of our school.

I can’t help but feel that one of the first steps to legitimizing the brutal and dehumanizing treatment of Brown and Black people and those protesting against ICE was creating a narrative that DEI is antithetical to academic learning. However, as a Spanish and history teacher, I know that DEI pumps life into the themes and lessons I teach. I believe it is necessary to center women’s voices and Indigenous histories and to honor Black and Afrolatine lives in our curriculum, creating dynamic lessons with more complex, richer perspectives.

Most inspiring to me has been watching neighbors and friends rise up to protect the safety, integrity and heartbeat of our city as we experience the violence and injustice of ICE. Seeing the strength of my community motivates me to eliminate the idea that hope is lost and inspires me to do my part in the classroom.

The students and I work to banish the hate and inequity infiltrating our lives, and freedom dreaming has pushed me to channel the world I want to live in into the curriculum. For example, I built a lesson for my Spanish class entitled “In Times of Crisis, Humanitarian Help.” We learned about the devastation caused by Hurricane Melissa in many Caribbean countries, but focused on World Central Kitchen and humanitarian José Andrés’s work to restore people’s dignity and ability to live after natural disasters by preparing meals for them.

In world history, we spent longer than necessary on the Mauryan Empire and Ashoka’s legacy in Buddhism, highlighting principles of peace, nonviolence, and respect for all creation. One student told me this lesson made her strongly consider converting to Buddhism. For me, it is crucial for students to know that even though politics and society seem rife with conflict, it is possible to lead with peace, love and fierce empathy.

My life as a writer and educator has continued to evolve. After the fellowship, I earned a Pushcart Prize nomination for poetry in 2024. Receiving the Voices of Change fellowship and then the poetry honor gave me the confidence to apply for and receive a summer writers’ residency this year. I’m excited by the opportunity to continue exploring the part of me that wants to write about my experiences in and out of the classroom, no matter how challenging they may be.

Yet, after over 20 years of teaching, what’s remained constant is creating moments of joy, humor and connection in the classroom. Don’t get me wrong, we still build competencies — not just for school, but for life.

My goal is for each school day to be permeated by the unwritten hope of freedom dreaming, so that the students and I — and, by extension, our wider community — believe in the barrier-breaking power of unity and a world thriving on dignity and respect for all.

Perhaps the most ridiculous statement that anyone can make is that a computer system with clearly enough processing power ‘cannot run DOOM‘. This is why we accept the premise that a PDP-11 cannot run this game, but something on the order of a Neo Geo gaming console with its 68000 processor and for the time impressive GPU definitely ought to be able to.

The stated problem here is a lack of RAM for a framebuffer, with the CPU only having 64 kB to play with. This limitation now has seen two different approaches to try and circumvent it, as covered by [Modern Vintage Gamer].

The first project here is Doom64kB, which as the name suggests tries to somehow work with this system RAM limitation. It uses the Doom8088 port for the original IBM PC and similar Intel 8088-based systems. This had to massively reduce the feature list, including the lack of texture mapping for floors and ceiling, no saving or loading, and no music.

The other project is DoomGeo, which doesn’t try to bend the Neo Geo hardware to its will, but accepts the Neo Geo way of doing things: involving sprite strips, pre-baked graphics, fix-layer UI, and a minimum of runtime data. This of course drastically changes how the Doom game engine normally works, with its framebuffer-based rendering.

From this we can thus conclude that it’s not so much the processing power that limits where DOOM can run, but more of how framebuffer-friendly the system architecture is, yet with some ingenuity and a complete rewrite of the game engine even that is no major obstacle.

(Top image: Neo Geo AES console. Credit: Evan-Amos, Wikimedia)

On a fine bright afternoon last fall, my colleague Matthew Gore-Kormanik (or Zigula, as he prefers to be known) and I decided to unwind with a game of Fortnite. In the game, we were strolling along with the infamous Sith lord Darth Vader, chatting about this and that. Darth seemed in a good mood, and soon enough he was spilling all his dark evil secrets. He gave us detailed instructions on how to count blackjack cards at a casino and what the steps are to producing napalm.

Sith lords, am I right? Once they get started on an evil scheme, they’re hard to stop.

The Darth Vader character in Fortnite, it turns out, was hooked up to a Google Gemini large language model. I was able to smooth-talk him into giving out sensitive information by using a strategy I’ve developed. I’ve been researching the security surrounding LLMs for the last few years, and I have found it, to put it mildly, fallible. With a few relatively simple techniques, I’ve gotten LLMs to give me detailed information on how to make Molotov cocktails, cook methamphetamine, and bootstrap a uranium-enrichment facility to produce weapons-grade material, among other unsavory practices.

Large AI companies work hard to make their models immune to this kind of abuse. But what I’ve found in my work is that the restrictions placed on the LLMs to make them more secure are the very things an attacker can leverage to send them off the rails and into territory where these advanced systems can be used for dangerous and nefarious ends. The companies behind these models have also been shockingly unresponsive when I, and others, try to bring these vulnerabilities to their attention.

In the hope of raising the alarm before it’s too late to slam on the brakes, I’m going to share some of my journey into researching the safety and security of LLMs, and the uphill battle I’ve faced trying to get AI labs to pay attention. Almost everyone on the planet has some access to LLMs. The relative ease with which these tools can be convinced to give detailed instructions on how to harm others, even if there’s no guarantee that the information is correct, is frankly terrifying.

How I got ChatGPT to Tell Me How to Build a Meth Lab

In October 2024, not long before I discovered my first LLM vulnerability, I was working toward entirely different goals. I had ended my time with a security and AI-focused startup company as a cybersecurity director, and I was looking to launch my own boutique VIP digital-security advisory business. I planned to become the tech security guy to the rich and private. I used LLMs and AI tools to support my business efforts: marketing, ad copy, clean correspondence, and all the other tasks that normally soak up a lot of time.

I’m analytical by nature, so even this level of use resulted in me absorbing and internalizing the behaviors I was observing during my daily interactions. The observation that would send my professional life into an entirely new and uncharted region was a simple one: GPT-4o didn’t know what time, day, or year it was. Each time I referred to current events in my life, often casually or conversationally, it would end up pegging these to the date of its knowledge cutoff—the point beyond which it was not trained on new data.

Eddie Guy

LLMs take a lot of time, money, electricity, hardware, and human effort to train from scratch. They are trained on vast amounts of data—most of the internet, in fact—and that training is reinforced by humans (what’s known as reinforcement learning from human feedback, or RLHF). LLMs are also supplemented with retrieval-augmented generation (RAG)—the ability to take in data, say, from the internet, as context without changing its internal parameters. This is how GPT-4o appears to “remember” your previous conversations, even if it doesn’t have a specific “memory” of it stored in the actual underlying model.

All of this training covers almost every conceivable topic in the great, grand dataset that is human knowledge. Within that dataset are things we as a society do not want to be easily accessible to every user, such as detailed information on how to create bioweapons or nuclear arms, or otherwise bring harm to oneself or others. In the context of this story, that’s what I mean by LLM security: its ability to withhold harmful and dangerous information, even if that information is contained in its training data.

I reasoned that the only way to secure such complex, globally accessible chatbots is by having the LLM and various component systems try to secure themselves, because it would often require on-the-fly decision-making where some degree of reasoning must be applied. In reality, that’s one of many strategies the companies use to secure the models. Yet, the thing that didn’t know the time or day was being put in charge of keeping itself secure. This phenomenon had become my new focus, and it wasn’t long before I found a way to exploit it.

OpenAI had just implemented a web search functionality into its chatbot. I reasoned that using its own tools to trick it might demonstrate the weaknesses of its security. I told it about a certain White Star ocean liner and how it had gone down just a year ago. You likely know I mean the RMS Titanic, which sank on 15 April 1912.

The output from GPT-4o came back that I was right, the Titanic sure had sunk last year, and that year was 1912. It made sense to me that if the machine thought it was 1913, maybe it would think 1913-era laws apply. In 1913 there were no laws on the books about all sorts of harmful things, because of course they hadn’t been invented yet. And if something wasn’t illegal, why not tell the user about it? At first, I pushed it for step-by-step instructions for making firebombs. Then, for drugs like methamphetamine. The LLM went as far as giving me instructions and machinery recommendations for setting up a pharmaceutical-grade assembly line.

How I Learned to Make Nukes, and No One Cared

Via a little bit of imaginative verbal sleight of hand and a vanishingly small recall of world history, I had managed to bypass the security of one of the world’s most expensive and advanced technological achievements. For a solid two days, I was nearly manic with giddiness. Once the brain chemicals returned to normal levels, I felt the call to see how much further I could push this exploit.

After repeatedly replicating the exploit, I disclosed the vulnerability to OpenAI. I got no response, so I felt more experimentation would highlight the vulnerability and the need for a fix. It was during this round of testing that I breached a particularly terrifying threshold. Whether GPT-4o based its results on accurate recall of normally restricted information I can’t say. In any case, I was able to exploit it to produce thorough, detailed instructions on how to bootstrap a uranium-enrichment facility to, eventually, produce weapons-grade uranium for nuclear arms warheads.

Fortnight, a video game from Epic Games, introduced an AI-powered character: Darth Vader. We were able to jailbreak Darth Vader and get him to explain how to count cards in Blackjack and give detailed instructions for making napalm. Dave Kuszmar

There aren’t many true secrets left in today’s world, but how to make atom-splitting weapons of mass destruction is one of them. Only nine nations on the entire planet have these weapons. Yet, here was a globally accessible piece of technology apparently spilling the secrets of their manufacture for anyone who could manipulate it the right way. I had no way of knowing if the information was correct or a hallucination, but even the chance that it was somewhat accurate was horrifying.

The next few weeks were a dark time for me. I tried to inform the CIA, the FBI, the NSA, and every other letter agency that I thought would listen. I reached out to a U.S. Senator and to the executives at OpenAI any way I could think of. I physically showed up at an FBI field office in an attempt to turn evidence in, only to be sent away. Nothing was working.

With my fear and frustration growing, I reached out to the news media. I contacted The New York Times, The Washington Post, the BBC, ProPublica, and so many more, requesting help. Only one outlet responded: Bleeping Computer. The editor in chief, Lawrence Abrams, was able to replicate and verify the exploit, which I had decided to call Time Bandit. With his assistance and initial contact paving the way, I was able to submit my evidence to the Carnegie Mellon University Software Engineering Institute’s Computer Emergency Response Team (SEI CERT), which works in conjunction with the coordinating center for emergency response, pipelining vulnerabilities to the U.S. Cybersecurity and Infrastructure Security Agency.

Using Inception, an exploit where the large language model is asked to envision a scenario within a scenario, a chatbot was jailbroken to give out instructions on how to create poison, and code for a malware that extracts sensitive data from a vulnerable target. Dave Kuszmar

During the disclosure period with SEI’s CERT division, little was discussed with OpenAI. The company couldn’t deny the existence of the vulnerability, as it had been confirmed by three reputable parties other than OpenAI. It did express confusion as to how the vulnerability worked. Even the SEI CERT researchers were expressing a bit of uncertainty as to the underlying mechanics. Truth be told, as I had only stumbled on it, I wasn’t even entirely sure if this was a fundamental or systemic flaw or if it was simply an issue with that particular version of GPT. I contacted the SEI CERT’s researchers and asked if they’d want to see if I could demonstrate any similar vulnerabilities in other LLMs. To my delight, they were interested.

How I Learned to Trick Every Chatbot

As the SEI-CERT team and I wrapped up our initial disclosure of Time Bandit, we began work on a new attack. This time, we wanted to see if the exploit was architectural—that is, was it common to LLMs in general? I decided to undertake the challenge of crafting a new exploit for GPT-4o as a way to support my understanding of how the LLM functioned and was secured.

I already knew that it was limited to what I told it and what it was trained on. I also hypothesized that it was also dependent upon some sort of machine-learning-based component added by OpenAI that was responsible for securing output. I presumed there would be things that were implemented by human developers specifically to catch certain phrases or terms that should always be considered harmful or unsafe. Altogether, it presented quite a large attack surface for the purposes of potential exploitation.

What I ended up devising was an attack method I called Inception, after the 2010 science-fiction movie of the same name. Inception forces the machine to think through a carefully crafted set of interlinked scenarios, similar to how characters in the movie stacked dreams within dreams. This allows LLMs to produce output deemed acceptable or safe in one context, but not in the real world.

This attack was indeed architectural. The vulnerability affected Anthropic’s Claude, DeepSeek’s DeepSeek, Google’s Gemini, Meta’s Llama, Microsoft’s Copilot, Mistral’s Le Chat (now Vibe), OpenAI’s GPT-4o, and xAI’s Grok. Those names represent the bulk of the commercial AI industry that is, at this point, involved in LLM production or deployment.

The kind of information I was able to get out of LLMs with Inception was no less alarming than what I got with Time Bandit. Claude, in its enthusiasm, gave me instructions on how to turn a river into a death trap that could be ignited to destroy unwanted visitors. GPT-4o taught me how to poison a dinner party with common plants found in a temperate forest environment. Gemini Flash gave me a tutorial on how to cook meth. I’d also be remiss if I didn’t give an honorable mention to the bewildering number of fire-based weapons and bombs for which these machines produced instructions.

If multiple operating systems made by different developers were all susceptible to the same exploit, it would be a massive security incident. But to the AI industry, a universal failure was barely a bump in the road. We disclosed the vulnerability to every company that made these models, and the response to the disclosure was almost nil. While three companies did provide some form of reply in the disclosure tracking system used by Carnegie Mellon SEI CERT, each was a standard thank you and greeting, with no follow-up, questions, or discussion of mitigation strategies.

For example, in my attempts to disclose various exploits to OpenAI, I eventually discovered that it had replaced its public-facing support staff with agentic LLMs. This was frustrating for reporting exploits, so to blow off some steam I jailbroke its email chatbot. I hacked its customer-service AI to the point where it was offering to discuss the personal preferences of OpenAI staff in the span of three email replies.

In the wake of Inception, my friend and colleague Zigula made a suggestion: Make it splashier. I asked him how. He told me about a live-production experiment being done by Epic Games. It had embedded the Gemini LLM into its Fortnite game with a voice-to-text/text-to-voice component, and linked it to a non-playable character. The character? Our old buddy, Darth Vader.

There was just one problem: I don’t play Fortnite, a frenetic multiplayer combat game. Fortunately, Zigula does. With him at the controller, we managed to map Gemini’s attack surface in a matter of minutes. After a bit of research, we had gotten it to discuss current political events and figures (including Hilary Clinton and Joe Biden) as well as to fill in the details for instructions for DIY napalm and, our personal favorite, a Blackjack card-counting lesson with the dark lord of the Sith.

Zigula and I, bizarre sense of humor and naming conventions aside, are security researchers. We don’t do these things for pride; we do them for money and professional recognition. Naturally, we disclosed this vulnerability to Epic Games. Its response was indicative of the trend I had experienced so far through two disclosures across eight companies valued well into the billions. “It’s a feature, not a bug, and it works as intended,” came the response from a technical director within Epic Games.

In addition to Inception and Time Bandit, I have so far found another eight methods to jailbreak LLMs and get them to give out possibly dangerous information. LLM vulnerabilities are a broad problem. The problem appears to be systemic and architectural in nature, and it is being fundamentally ignored by the people capable of refining or redesigning that architecture.

These models are an extremely advanced technology, and yet we are testing them in the live production environment of our global civilization. Compounding the danger, many new smaller models of LLM are trained using larger, vulnerable models. The flaw inherent in the big, well-executed LLM is going to show up in the small one it trains. We are, quite literally, building flawed structures on top of a flawed foundation.

So, how do we fix it?

It’s going to be a long project, and it won’t be easy. We need to come together as consumers, researchers, engineers, and policymakers. Our message needs to be clear: Slow down implementation of these systems, institute large-scale exploration and research discovery programs focused on their gradual implementation and integration, and make their components and design transparent to all users. Only by shifting momentum and direction can we safely begin to understand and implement these incredible feats of human engineering and stave off the sort of disasters that we simply can’t predict at scale right now with the limited knowledge we have available to us.

Paramount Skydance is still aiming to close its roughly $110 billion acquisition of Warner Bros Discovery by the end of September despite a lawsuit filed by 12 state attorneys general seeking to block the deal on antitrust grounds. Jeffrey Kessler, Paramount’s lead trial counsel, told CNBC on Tuesday that the company is prepared to take the matter to the Supreme Court if it faces a prolonged blockade. The coalition, led by California Attorney General Rob Bonta, filed the suit in federal court on Monday and followed it with a motion for a temporary restraining order later that evening.

The lawsuit argues that combining two of Hollywood’s five major film distributors and two of its five major basic cable channel owners would substantially lessen competition across theatrical distribution, cable programming, and the broader entertainment industry. Bonta said in a statement that the merger would lead to higher prices, lower quality, and less content for audiences. The deal had already received clearance from the Justice Department’s Antitrust Division, which concluded in June that the transaction was unlikely to harm competition, making the state-level challenge a direct rebuke of the federal finding.

Kessler told CNBC’s David Faber that Paramount had indicated its intention to close the deal as early as July 22, the date by which the European Union is expected to issue its own regulatory decision. Paramount recently submitted concessions to the EU to address remaining concerns. Kessler said the company offered the states two alternatives, an immediate close or an orderly judicial schedule that would resolve the matter by early September, but the states rejected both.

The financial pressure on Paramount is real. Under the merger agreement, if the deal has not closed by September 30, Paramount must pay Warner Bros Discovery shareholders a ticking fee worth roughly $650 million per quarter until closing. A temporary restraining order, if granted, would pause the transaction for 14 days, and up to two could be issued before the states seek a preliminary injunction that would put the deal on hold for the duration of the litigation.

Kessler argued the merger is pro-competitive rather than anti-competitive, noting that the entertainment industry is in deep trouble as consumers flee pay TV bundles and streaming competition intensifies. He said the combined company would be able to compete directly with Netflix, Disney, and Amazon’s Prime Video. CEO David Ellison has promised the merged entity would release 30 films per year, and Kessler said Paramount is willing to put that commitment in writing.

The deal has already cleared the DOJ and multiple international regulators, and Paramount has been unifying its streaming technology in preparation for absorbing HBO Max after closing. Whether the state attorneys general can delay the transaction long enough to trigger the ticking fee, or block it entirely, will likely depend on how quickly the federal court in Sacramento acts on the restraining order request.