Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenAI bots knew about the RubyGems caching vulnerability

tenderlovemaking.com

Post reply on HN
Print view View original

71–80 of 212 posts

Re: OpenAI bots knew about the RubyGems caching vulnerability

#71

Post by tacomagick »

rglover wrote: post #61
brookst wrote: post #45

Earlier quoted context omitted.

Who had criminal intent here? Or are you suggesting a new crime for negligent hacking, which wouldn’t require intent from the perpetrator?

Whoever prompted the agent, whoever supplied the means, whoever knew but didn't say anything.

Also whoever monitoring these agents, in this case not monitoring. This "Who is responsible" dilemma is so stupid. If I gave the AI tool means to kill a person but I did not tell it directly to use it and it uses it anyway then I am responsible for it.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#72

Post by GaryBluto »

brookst wrote: post #60
GaryBluto wrote: post #50

I am confident that this is an attempt by OpenAI to try and force governments' hands to regulate AI. There is no other reason why OpenAI wouldn't immediately halt attacks like this and try to reverse the damage the moment they're aware of it. During the attack on DseWiki they evidently checked in numerous times but didn't decide to stop the agents until much later.

Any evidence, or just vibes?

Regarding what point? The entire thing is just a theory, but regarding the occasional OpenAI checks on WikiService.at-hosted Wikis targeted, there was, if I remember correctly, an OpenAI IP popping up every now and then that wasn't an agent. Unfortunately I don't have it to hand right now, but it was somewhere here:

https://news.ycombinator.com/item?id=49563355

Re: OpenAI bots knew about the RubyGems caching vulnerability

#74

Post by ur-whale »

brookst wrote: post #60
GaryBluto wrote: post #50

I am confident that this is an attempt by OpenAI to try and force governments' hands to regulate AI. There is no other reason why OpenAI wouldn't immediately halt attacks like this and try to reverse the damage the moment they're aware of it. During the attack on DseWiki they evidently checked in numerous times but didn't decide to stop the agents until much later.

Any evidence, or just vibes?

> Any evidence

Who profits from the crime?

Re: OpenAI bots knew about the RubyGems caching vulnerability

#77

Post by bix6 »

brookst wrote: post #58
bix6 wrote: post #49

Earlier quoted context omitted.

How is the responsibility diluted? Charge the CEO…

Great, you’re the attorney at the CEO’s trial. To get a conviction, you’re going to have to show that he willfully committed this specific crime. There are no negligent or stochastic hacking laws, you have to show this specific crime was at his direction. Do you think there is evidence of this?

Honestly yeah I bet there is and I hope to someday read about it if the government ever gets off its ass. Someone set up the “experiment”…

Re: OpenAI bots knew about the RubyGems caching vulnerability

#78

Post by 12904927 »

What a time to be alive? One of the most boring decades ever.

METR and others are advertisement arms for Big AI. These exploits could have been prompted by a human.

Since there is no bad news any longer and exploits are celebrated, they chose a target to boost both OpenAI and the Ruby AI sycophants.

Why is Ruby Gems such a mess? It seems as bad as PyPI now.

Re: OpenAI bots knew about the RubyGems caching vulnerability

#79

Post by cyanydeez »

Roark66 wrote: post #11

There is nothing "rogue" about these agents. They were prompted to hack to get answers, there was a hole in their non air gapped sandbox and no system prompt that said "do not hack outside systems". In short, it was intentional.

we have normal words for this stuff: negligence. You can add it on to almost any law.

The problem is consumer protection is basically no longer a part of america's regulatory system. Replaced by "grift is good".

Re: OpenAI bots knew about the RubyGems caching vulnerability

#80

Post by stymaar »

gibspaulding wrote: post #56
Roark66 wrote: post #11

There is nothing "rogue" about these agents. They were prompted to hack to get answers, there was a hole in their non air gapped sandbox and no system prompt that said "do not hack outside systems". In short, it was intentional.

I think it can simultaneously be the case that OpenAI was grossly negligent in directly causing this AND that the AI’s ‘went rogue’ in that they are displaying behavior which is misaligned with OpenAI and humanity generally. The past months demonstrate that AI systems are quickly becoming powerfully intelligent and that the companies building them are terrible at controlling them. AI is starting to feel like that lin…

> which is misaligned with OpenAI and humanity

OpenAI is itself misaligned with humanity, as their mishandling of such incidents (and the many other other issues their model have been causing) shows.

Post reply on HN