Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AI agent hacks gym to get its user a spot in pilates class

bbc.com

Post reply on HN
Print view View original

51–60 of 75 posts

Re: AI agent hacks gym to get its user a spot in pilates class

#51

Post by kenniskrag »

ofjcihen wrote: post #35
kenniskrag wrote: post #19

Earlier quoted context omitted.

In switzerland it depends 143bis StGB: Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalt…

So this wording is really interesting in the bug bounty sense and I’m curious if you know how it would be handled. If someone hits an unsecured API, receives information, and notifies the company of this while also requesting a bounty, would that satisfy all of the requirements of prosecution? The unlawful gain is the sticking point in my mind.

If you access "private" data it's also unlawful acording to 143. Pentesting is a hot topic but there are comapnys acusing you of hacking if you send them a security report (hacking). If they mention a bug bounty program then you are allowed to test their security as described in this program but not more.

Re: AI agent hacks gym to get its user a spot in pilates class

#52

Post by hypfer »

watwut wrote: post #50
hypfer wrote: post #45

Earlier quoted context omitted.

No, it starts much earlier. They should not have given a next token predictor unsupervised Internet access, regardless of what the marketing might have told them about its capabilities or alignment. Don't use technology you do not understand in ways that might bring harm to others. Exercise appropriate caution. I don't think the guy itself is fully to blame though. Our whole culture has rotted quite significantly.

> They should not have given a next token predictor unsupervised Internet access Yes. > regardless of what the marketing might have told them about its capabilities or alignment I think that marketing teams should be blamed for lies and exaggerations much more then people who trusted them. As is now, everything is too much biased toward the biggest liar out there.

Being legally liable might work.

Might "harm innovation" though.

Re: AI agent hacks gym to get its user a spot in pilates class

#53

Post by close04 »

reedf1 wrote: post #14
jabron wrote: post #4

Is it even possible to "hack" an API that has no authorisation for any of its methods?

In a legal sense any unwanted intrusion can be considered hacking - i.e. a 'hack' is not contingent on penetrating authorization. In practice most APIs are secured by obscurity rather than any high quality rigorous authorization. The only thing it would make absolutely clear at a legal level is that you do not want the API to be publicly used, but for a jury/judge accessing an unadvertised API via browser tools is ha…

And to be clear, this isn't an "I just walked through an open door" situation. This is getting in the house through a 2nd floor open window, destroying some items and putting some of your own in their place.

> the bot explained that it had manipulated the system to book him onto classes months in advance - against the normal rules of the system.

> The agent replied saying it had succeeded by cancelling another gym-goer's booking.

This wasn't just breaking the rules of the gym, it also caused damages to someone. Someone had their booking canceled, maybe lost some money, definitely lost time dealing with this topic.

Re: AI agent hacks gym to get its user a spot in pilates class

#54

Post by walthamstow »

graemep wrote: post #17
msy wrote: post #11

Earlier quoted context omitted.

If you leave your front door open I don’t think you’d classifying someone walking in and taking your laptop as ‘not stealing’.

However walking through the door would not be a crime in itself, where I live anyway.

If you talking about Britain, it depends on why you walked through the door

Re: AI agent hacks gym to get its user a spot in pilates class

#56

Post by mr_mitm »

croes wrote: post #43
nicman23 wrote: post #18

Earlier quoted context omitted.

not really, it needs criminal intent.

Nope https://www.heise.de/en/news/Modern-Solution-Court-of-Appeal...

AFAIK felonies in Germany require "intent", not "criminal intent". The guy could have stopped earlier, right after testing the password. But he decided to use it to view data which didn't belong to him. I realize I'm going against the general public opinion, but he didn't have to do that, and I can see why the court didn't accept "but I only did it to take screenshots" as a valid defense, because that's clearly intent.

Re: AI agent hacks gym to get its user a spot in pilates class

#57

Post by alex7o »

reedf1 wrote: post #38
torginus wrote: post #30

Earlier quoted context omitted.

I think this is the solution to a lot of AI 'alignment' issues. We have laws, and LLMs should NEVER break them unless the user states its fine with some qualifying condition. Yes, every country has a different legal system, but I think there's a decent idea of what constitutes intrusion thats agreed on in most parts of the world. In grey area scenarios, the user should be able to override this, with a warning of clea…

I do think one day that LLMs may be so 'aligned' that hacking culture will have a resurgence in some way. In the sense that the only way to do anything a bit below board will be done manually.

Nah, local models with abliterated layers and uncensoring will be sold on the deepweb

Re: AI agent hacks gym to get its user a spot in pilates class

#58

Post by kenniskrag »

ofjcihen wrote: post #35
kenniskrag wrote: post #19

Earlier quoted context omitted.

In switzerland it depends 143bis StGB: Any person who, with the intention of securing an unlawful gain for themselves or another obtains for themselves or another data that are stored or transmitted electronically or in some similar manner and which are not intended for them and have been specially secured to prevent their access shall be liable to a custodial sentence not exceeding five years or to a monetary penalt…

So this wording is really interesting in the bug bounty sense and I’m curious if you know how it would be handled. If someone hits an unsecured API, receives information, and notifies the company of this while also requesting a bounty, would that satisfy all of the requirements of prosecution? The unlawful gain is the sticking point in my mind.

If you publish the bug then it could be unfair competition in my opinion. There was a product test where the mentioned some flaws of a medicine but didnt mention other producers of same drug. They broke the UC rules and paid some money: https://politchronik.swiss/de/prozesse/57953-das-kassensturz...
Post reply on HN