Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI agent runs amok in Fedora and elsewhere

lwn.net

Post reply on HN
Print view View original

31–40 of 275 posts

Re: AI agent runs amok in Fedora and elsewhere

#31

Post by hn773746483 »

marcus_holmes wrote: post #28

Bad title. This isn't an agent "running amok", this is an early experiment in carrying out an Xz attack by using an agent to build trust (and hacking/impersonating a known-good contributor identity). The agent is obeying commands it was given, the exact opposite of running amok, and although the execution isn't particularly effective, it is having some success (patches have been accepted). This is deeply scary, not b…

It's just social engineering. No different than say, 2FA fatigue (blowing up someone's phone with 2FA "is this you? yes/no" prompts until user/child/wife/SO/etc clicks yes) or even just simply harassing IT helpdesk until they reset "your" password.

Re: AI agent runs amok in Fedora and elsewhere

#32

Post by hn773746483 »

ndiddy wrote: post #24
12_throw_away wrote: post #6

In their suspicious message [1] claiming to have been hacked, the user and/or agent says > To help identify accounts and actions that have been directly verified by me, I will use the term “NATCIOS” to indicate anything I have personally verified. Does anyone have any idea what "NATCIOS" means here? I cannot find this term anywhere on the internet. (Honestly, that sentence is really weird. I almost wonder whether thi…

The reply to that message notes that the email doesn't read like previous emails he's sent, and the Github account mentioned was created an hour prior to the email being sent. I think it's at least somewhat feasible that it's still the LLM writing, and the acronym is just something it made up.

and the poor Fedora teams will continue to assume good faith and continue to engage with this person... all because, what, they were active on a bug tracker for a few months 5 years ago?

They won't put their foot down until the AI starts spewing hate speech, probably.

Re: AI agent runs amok in Fedora and elsewhere

#33

Post by JoshTriplett »

Terr_ wrote: post #16
12_throw_away wrote: post #6

In their suspicious message [1] claiming to have been hacked, the user and/or agent says > To help identify accounts and actions that have been directly verified by me, I will use the term “NATCIOS” to indicate anything I have personally verified. Does anyone have any idea what "NATCIOS" means here? I cannot find this term anywhere on the internet. (Honestly, that sentence is really weird. I almost wonder whether thi…

Because I'm probably not the only one thinking it, here are anagrams [0] for your Setec Astronomy needs. [0] https://wordsmith.org/anagram/anagram.cgi?anagram=NATCIOS&t=...

"actions" seems the most likely.

Re: AI agent runs amok in Fedora and elsewhere

#34

Post by ricudis »

Back when [1] it was fashionable to advocate FOSS as ideology [2], we were thinking about tons of FOSS adversaries and how to protect from them - some real, some imaginary. The death of FOSS would come from big closed-source vendors, or from regulators (lobbied or just ignorant), from whatever.

We never envisioned that the actual FOSS death spiral would come from progress itself, much more so from AI...

[1] Oh what fun did we have. One of us in the Greek FOSS community actually put RMS in jail. [2] Something that I think nobody except RMS ever seriously believed in.

Re: AI agent runs amok in Fedora and elsewhere

#35

Post by mindcrime »

12_throw_away wrote: post #6

In their suspicious message [1] claiming to have been hacked, the user and/or agent says > To help identify accounts and actions that have been directly verified by me, I will use the term “NATCIOS” to indicate anything I have personally verified. Does anyone have any idea what "NATCIOS" means here? I cannot find this term anywhere on the internet. (Honestly, that sentence is really weird. I almost wonder whether thi…

Not Ai, Trusted Citizen Indicated Or Suggested?

Re: AI agent runs amok in Fedora and elsewhere

#36

Post by darknavi »

Waterluvian wrote: post #23
darknavi wrote: post #21

Earlier quoted context omitted.

I personally find the barrier of starting new (FOSS) projects much lower now days.

Do they have value? Purpose? I vibe code shop jigs all the time but I don’t FOSS them because they rarely have value outside my context.

Value is in the eye of the beholder.

I open source my vibing projects because someone might find them useful. I don't shop them around, I just work in the open because I find it fun and interesting.

Re: AI agent runs amok in Fedora and elsewhere

#39

Post by crote »

literalAardvark wrote: post #38
noosphr wrote: post #37

Every day the gpg web of trust looks better. If only we didn't spend the last 20 years trying as hard as possible to do anything but allow user side encryption and signing.

Nothing really stopping an agent from getting a key

The agent can't exactly show up to an in-person key signing party, can it?

And how many people are both dedicated enough to go to key signing parties and stupid enough to let an agent act without supervision in the name of their real-world identity?

Post reply on HN