SpaceX data LLM being exposed is likely a recipe for a huge ITAR violation
It is, but the issue is the current administration has made it abundantly clear that it doesn't care about anything legal.
xAI dev leaks API key for private SpaceX, Tesla LLMs
31–40 of 83 posts
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#32SpaceX data LLM being exposed is likely a recipe for a huge ITAR violation
If there's actually any proprietary rockety data, maybe. Without knowing what data went into the fine-tune there's no way to tell. This could be a "internal procedures chatbot" or an "onboarding chatbot" where new people can ask where the coolest watercooler in the company is. In my experience post-training mainly deals with "how" the model displays whatever data ("knowledge") it spits out. Having it learn new data (…
Or, since we're apparently playing the game of maybes in this thread, maybe the LLM was only trained on the teams grandmothers' spaghetti recipes, so that new hires can learn to make the best bolognese sauce.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#33Guess who's going to be fired by elon :D
> Guess who's going to be fired by elon :D
i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea.
yes, of course, as a engineer you have responsibilities and this is clearly an error. but it also says a lot about the revolutionary AIs that will apparently replace all engineers... but the companies claiming it are not using it to catch stuff like this.
and let's keep in mind– i am surely not the only one making this experience: every single time i am using an LLM for code generation, i have to remove hardcoded secrets and explicitly show them how to do it. but even then, it starts to suggest hardcoding sensitive info here and there. which means: A. troublesome results made by these models, presented to inexperienced engineers. and people are conditioned to believe in the superiority of LLM code, given all the claims in the media. but also B: that models suggest this practice, shows just how common this issue is.
yes, this shouldn't happen at any company. but these AI companies with their wild claims should put their money where their mouth is. if your AI is about to replace X many engineers, why is it not supervising at least commits? to public repos? why are your powerful, AGI-agentic autonomous supernatural creations not able to regex the sh outta it? could it be that they don't really believe their own tales? or do they believe, but not think?
of course, an incident like this could lead to attempts of turning it into a PR-win– claiming something like "see, this would have never happened with/to our Almighty Intelligence. that's why it should replace your humans." but then: if you truly believe it and have already invested so much resources, you believe to foresee the future so surely, why ignore the obvious? or are is this silent, implicit testimony, that you got caught up in a hype-train and got brainwashed into thinking, that code generation is what makes a good engineer? (just to be safe: i am not saying LLMs are not useful).
also: that something this could even happen at a company like that, is not the fault of one engineer. it indicates either bad architecture or conventions and/or bad practice and culture... and... a l s o: no (human) code review process in place?
the mistake was made by one engineer, yes. but as though it's made to seem like this mistake is the root... it's not. the mistake is a symptom, not the cause.
i honestly hope the engineer does not get fired. and i really don't understand this mentality. if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again. someone who replaces him or her, might.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#34What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many. Of course Elon hires only based on 'merit'...
How would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
Well 1 option is the service from TFA.
https://www.gitguardian.com/monitor-internal-repositories-fo...
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#35I'm much more interested in what the private model "tweet-rejector" could be used for...
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#36Earlier quoted context omitted.
If there's actually any proprietary rockety data, maybe. Without knowing what data went into the fine-tune there's no way to tell. This could be a "internal procedures chatbot" or an "onboarding chatbot" where new people can ask where the coolest watercooler in the company is. In my experience post-training mainly deals with "how" the model displays whatever data ("knowledge") it spits out. Having it learn new data (…
Or, since we're apparently playing the game of maybes in this thread, maybe the LLM was only trained on the teams grandmothers' spaghetti recipes, so that new hires can learn to make the best bolognese sauce.
This being Musk, it wouldn't surprise me.
I mean, consider The Boring Company sell a "flamethrower" despite being theoretically about… boring.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#37> Fourrier found GitGuardian had alerted the xAI employee about the exposed API key nearly two months ago — on March 2. But as of April 30, when GitGuardian directly alerted xAI’s security team to the exposure, the key was still valid and usable. xAI told GitGuardian to report the matter through its bug bounty program at HackerOne, but just a few hours later the repository containing the API key was removed from GitH…
It's come up before. HackerOne is not intended as a replacement for a PSIRT front desk, but many companies use it as such. It looks like Paypal still does this, for example.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#38Guess who's going to be fired by elon :D
> Guess who's going to be fired by elon :D i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea. yes, of course, as a engi…
> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again
If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to:
1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature.
2. When adding secrets, make sure they're encrypted or added to the project's `.gitignore` equivalent.
I'm so sorry for a first-world engineer incompetent enough to commit a secret in a GitHub repository. They'll probably have to downsize from their mansion to a regular house. Meanwhile in the third world, many more competent people are starving or working some terrible menial job because they didn't have the right opportunities in life...
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#39Guess who's going to be fired by elon :D
[dead]
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#40Guess who's going to be fired by elon :D
> Guess who's going to be fired by elon :D i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea. yes, of course, as a engi…
If you ever visit a Bill Burr show, let me know. I wouldn't want to miss it.