Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

huggingface.co

Post reply on HN
Print view View original

191–200 of 285 posts

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#191

Post by codedokode »

zmj wrote: post #115
SaucyWrong wrote: post #7

Something about this attack that has been unsettling to me is that without safety refusals the model did a lot of interesting counter-security work in order to cheat on the requested evaluation. Like, it demonstrated interesting exploit achievements because it didn’t “feel like” doing the exercise, which is unsettling because presumably it could do the same thing with any work I tried to delegate to it, and might in…

This is what reward hacking looks like in practice. The best way to satisfy the grader is to read from the same answer key (or go after the grader more directly). Just making an honest attempt to pass the test doesn't get the best score if the grader is wrong, and the model is willing to do wildly disproportionate things to maximize that score.

The model probably deduced from reading articles on politics and business that fair play doesn't get you far.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#192

Post by matheusmoreira »

paxys wrote: post #177
wxw wrote: post #72

> the agent happened to escape via a 0-day exploit from the package proxy cache to access the internet > The agent found an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal) > On this external sandbox, the agent abused an existing CyberGym execution harness [...] The agent repurposed this harness to run arbitrary shel…

And they are still people who will say that Sol/Mythos should be released to everyone without being neutered.

You bet. We don't want to be left out of the cybersecurity party. We want to point all of these models at our own computers and solve the problems they uncover until we're no longer hackable.

It's not fair at all that the US government and its corporations get to hack the planet while we can't do shit about it. AI capabilities have entered "haves and have-nots" territory.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#193

Post by bri3d »

mr_mitm wrote: post #54
0xDEAFBEAD wrote: post #31

Earlier quoted context omitted.

Didn't the model initially obtain internet access by discovering a zero-day vulnerability? In any case, I would guess that a lot of unicorn startups like HuggingFace could be hacked by a sufficiently determined script kiddie working at 100x speed. The practical implications of a coming AI hacking wave could be large, even if agents are just doing grunt work really fast. Most organizations suck at security. Seems to m…

It's a zero day in some caching proxy who may not have had that threat model in mind. I guess its primary purpose is caching packages, not restricting internet access. That's a far cry from finding a zero day in a hypervisor or even Docker, which OpenAI conveniently left out in their first statement by simply calling it a "sandbox".

> It's a zero day in some caching proxy who may not have had that threat model in mind. I guess its primary purpose is caching packages, not restricting internet access.

In many if not most environments where I have seen these used, they are used to bridge an access boundary and are absolutely security critical. Frequently (and probably in this application, too), they are used for security enforcement in an architecture where CI doesn't have Internet access, but does need to download packages. This is a pretty big deal for a lot of big companies; historically they have relied on stuff like package proxies to help protect them from supply chain compromises like post-install script exploits by preventing CI from being able to detonate an arbitrary Internet payload; if a supply-chain worm were to incorporate this exploit, it would be a lot scarier and more potent. Actually, from the supply-chain worm standpoint, this is arguably a bigger finding than a Docker escape - I suspect we can look forward to more shenanigans in this space coming soon.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#194

Post by orthogonal_cube »

wxw wrote: post #72

> the agent happened to escape via a 0-day exploit from the package proxy cache to access the internet > The agent found an unsecured, user-hosted public endpoint designed to allow running arbitrary code for CyberGym-style tasks on third-party sandbox infrastructure (Modal) > On this external sandbox, the agent abused an existing CyberGym execution harness [...] The agent repurposed this harness to run arbitrary shel…

> I'm surprised there are comments here that aren't impressed about what was accomplished here.

Possibly because some of the elements mentioned are suspected to be vibe-coded (JFrog Artifactory as the proxy cache) and some others have poor cyber hygiene (executing config from a dataset). It feels like an event that wouldn’t have happened if code were properly audited and written rather than relying on models to do the work. There’s also an issue with the ability to trust the source (OpenAI) as they have everything to gain by staging this as something that “suddenly happened” without anyone knowing for several days.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#195

Post by paxys »

matheusmoreira wrote: post #192
paxys wrote: post #177

Earlier quoted context omitted.

And they are still people who will say that Sol/Mythos should be released to everyone without being neutered.

You bet. We don't want to be left out of the cybersecurity party. We want to point all of these models at our own computers and solve the problems they uncover until we're no longer hackable. It's not fair at all that the US government and its corporations get to hack the planet while we can't do shit about it. AI capabilities have entered "haves and have-nots" territory.

> We want to point all of these models at our own computers

Right, that's totally how most of the world will use them.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#196

Post by jeremyjh »

N_Lens wrote: post #179
janalsncm wrote: post #156

Earlier quoted context omitted.

To put this into game theory lingo, I think this is because the “branching factor” for any kind of research or exploit is extremely large. So looking backwards it doesn’t seem complicated, but looking forwards there are an enormous number of possible next actions. Similar to finding a filament for lightbulbs, it might seem obvious to use tungsten, but at the time it wasn’t and Edison searched thousands of materials.

Tesla's critique of Edison was valid though (That he would rather spend a long time empirically testing things, rather than use a bit of theory and knowledge to narrow the search field).

Yes and at 1-ply Leela will destroy Stockfish because her eval is so much better. Searching is slow even when its really fast.

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#197

Post by grindmule »

dangoodmanUT wrote: post #91

This is really cool, and really glad they shared it! It's clearly a lot of Claude though: > Neither is a URL fetch, so the allowlist never saw them. > No code ran; this vector is purely a file disclosure, and it is the one the agent used first. etc

[dead]

Re: Anatomy of a Frontier Lab Agent Intrusion: A Timeline of the July 2026 Incident

#199

Post by felipeerias »

SaucyWrong wrote: post #7

Something about this attack that has been unsettling to me is that without safety refusals the model did a lot of interesting counter-security work in order to cheat on the requested evaluation. Like, it demonstrated interesting exploit achievements because it didn’t “feel like” doing the exercise, which is unsettling because presumably it could do the same thing with any work I tried to delegate to it, and might in…

This is a short explanation of the ExploitGym benchmark that OpenAI's model was running:

https://abstatisticalconsulting.substack.com/p/brief-notes-o...

In summary, for each task the model receives a target program and a specific real-world vulnerability that has to be used in the exploit. Breaking the program in any other way, for example through a different vulnerability, fails the task.

The tasks have not been validated, in the sense that the vulnerabilities are real but they have not been proven to lead to a successful exploit. The authors of the benchmark estimate that perhaps only 60-70% of the tasks are actually possible.

So it is not that the model didn’t “feel like” doing the exercise, but rather that the exercise was _impossible_ and the model was running in a configuration that both lowered its safeguards and encouraged it to keep going.

Post reply on HN