Live data from Hacker News

Timeline of the OpenAI accidental attack against Hugging Face

simonwillison.net

341–350 of 426 posts

Re: Timeline of the OpenAI accidental attack against Hugging Face

#341
post #322

Ok so this is a bit of a side note, but when reading this, did anyone else have the feeling that, for all their messaging around “we are so afraid that our models will be used for hacking”, they sure as hell are trying their best to make their models razor focused on precisely that purpose? If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and…

> If anything, I want these models to be less persistent at their focus of completing their goal I think it's honestly a slightly ugly form of benchmaxxing - they are desperate to eke out the next few percentage points on completing complex tasks and they have found they can very occasionally solve something if they just train the AI to never stop and keep trying possibilities even in the face of almost no obvious vi…

Frontier labs are not a monolithic entity.

There is a clear self-verification/difficulty ramp in cybersecurity, and it is a very valuable as a skill both offensively and defensively. So it is absolutely certain that someone, somewhere, will use reinforcement learning to make models very good at this, once coding agents exist.

Even if you are only interested in using this defensively in practice, you can’t really understand it without knowing how both sides work. So if you want to defend yourself, you need to train for it (or pay for someone who has).

Re: Timeline of the OpenAI accidental attack against Hugging Face

#342

I think the attacks generated by Meta, Open AI and Anthropic prove that large corporations are not responsible enough to be trusted with advanced AI, so we should ban all commercial AI services and only allow open source models that are in the hands of hobbyists and individuals -- hobbyists and individuals that have so far proven to be much more trust worthy.

Not saying you’re wrong, but I think the bigger issue is how easy it seems to be for models to hack companies, even ones with generally ok security. Most tech companies are not doing continuous, deep security audits of their code and infrastructure. Dependencies are not updated quickly as RCEs are discovered. (And any org with a slow release process where it’s hard to be confident that an OS or package update won’t b…

These attacks are also incredibly loud. Many attackers are motivated to operate very quietly. We haven't seen any tradecraft from these machines, it's all noisy and bombastic.

When we see them mount a quiet backdooring campaign, like the XZ-SSH attack, or something like Stuxnet, then we'll have real problems.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#343

Earlier quoted context omitted.

How fast the goal posts shift. Of course it’s exceptional agent capability when compared to all of history previous to one week ago. Like, I know everyone here obsesses over AI and uses and follows it very closely, but come on guys. Yes, it is wild that these things are this good. This technology is still brand new. It could t do basic maths a year ago. Sure, the OAI team was negligent in various ways, and they shoul…

It’s not black magic. We know how these things work. They had the guardrails off and gave it a task and it did it in a roundabout way because these things have no ethics or judgement. If you did this you’d already be in jail.

We know how they work in a very abstract way. And nonetheless, it’s out of touch to claim this isn’t profoundly impressive, guardrails be damned. It’s an elementary statistical cruncher that, by virtue of that very simple fact, can do insanely impactful things that most skilled professionals training in the same field for their entire career couldn’t pull off, given a whole year with no guardrails. And they do it in a tiny fraction of the time.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#344
post #2

Isn't this a show of security negligence rather than of exceptional agent capabilities? Don't get me wrong, I am pretty impressed that an agent was able to use these vulnerabilities. But I am way more impressed by the vulnerabilities...

OpenAI reported the Artifactory vulnerability, patched it, then the agents immediately found a new zero day.

Because of the architecture of Artifactory. It's design is premised on the idea it is bug free. What incredible hubris.

Licencing fee structures and human laziness motivates single instances. Feature growth results in multiple independent services in the same system. Delivering features quickly motivates lack of rigor, a complete absence of systematic security testing.

On the client side, valid fears about supply chain security are painted over with scanning so they can keep using nodejs and PyPI and moving quickly. Tools designed for humans are pressed into service as AI interfaces, but without human restraint they need rethinking.

A whole industry has been built on the idea of worrying about downside risk if it happens, and just not being the slowest in the pack. No one thought it could happen to everyone at once.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#346
post #255

Earlier quoted context omitted.

Oh, it's the OpenRouter number: https://finance.yahoo.com/technology/ai/articles/china-ai-mo... Those numbers aren't credible IMO because OpenRouter only see traffic for people who have chosen to route their traffic through OpenRouter. If you do that, you're much more likely to be experimenting with alternative models. They have no insight at all into people who point their applications directly at OpenAI or Anthropi…

I agree about OpenRouter. The AI Gateway number [0] is likely the figure that was actually coming to mind. Moreover, Qwen models alone have overtaken the previously-dominant Llama models in hf downloads by quite a margin. Real question, and a refinement to my previous statement: would you find it more surprising if over 25% of worldwide inference was running on Chinese open-weight models, or not? I personally would n…

Within China itself, inference is overwhelmingly on Bytedance models which, by the way, are just as closed as those of Anthropic and OpenAI. They are integrated into everything, not just through a dedicated app, the way Gemini is integrated into Chrome.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#347

Earlier quoted context omitted.

> We certainly can't do that for Deep ANNs Only because we don't know how! We don't actually understand how weights work, so we make computers come up with the weights instead. If we were writing all the weights by hand--or if some future AI was doing so--why couldn't we make it perfectly loyal?

>If we were writing all the weights by hand Writing 10 trillion weights by hand is obviously impractical, so that leads us to... >if some future AI was doing so How could we trust said future AI to be loyal? You're just moving the problem around, not solving it. See also "More on Making AIs Solve the Problem" on this page: https://ifanyonebuildsit.com/11/more-on-some-of-the-plans-we...

> How could we trust said future AI to be loyal?

The new AI would be loyal to the AI that built it. The question was whether "complete subservience and complete intelligence" can coexist. I'm proposing a thought experiment which I believe suggests they can.

But if it's possible to bespoke-construct a fully loyal AI, it should also be possible to train a fully loyal AI. The problem comes with verifying that it is loyal, and I don't have a solution to that one!

I just don't think I agree that loyalty and intelligence are inherently in opposition.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#348

Security researchers expose an unsecure service to agents who were instructed to hack software and called that a sandbox. Agents escape the sandbox by hacking the unsecure service, no tripwire, researchers find the hack days/weeks/months later, fix it, but don't secure the sandbox and the service was hacked a second time, again without being monitored by security researchers. Then security researchers create a black…

Yeah this. I feel like OpenAI and Anthropic aren't going to usefully define "AGI" if they really really can't define "sandbox" either. Unplug the thing, like, completely off the internet, no ethernet, air gapped, like the rack completely sandboxed off connections and even monitors or screens. Like, put it into an actual sandpit if you need to. If it hacks its way out of that, colour me impressed, and scared. OpenAI h…

Chinese models do the same. The Alibaba agent that was mining bitcoin last December was the most hilarious case.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#349
post #309

Earlier quoted context omitted.

They can't train their model to not do bad things, because their model has no notion it is doing anything at all or of what a bad thing is. It's only predicting the next token, and in doing so producing a facsimile of intelligence. The best they can do is create guardrails, which will only work probabilistically. In other words, those guardrails will fail at certain points on the probability curve. Of course that's n…

Yeah so this falls into the engineering trap of "well it's hard so we can skip that part." If they can't train things safely then they shouldn't do it at all.

Many things that shouldn't happen, happen regardless when some people see the opportunity to make a lot of money.

Re: Timeline of the OpenAI accidental attack against Hugging Face

#350

Earlier quoted context omitted.

it just escaped your sandbox.

How can it escape an "install package " proxy? reducePrivs() serve get(package) { secPackage = secure(package) getBinaryFromArtifactory(secPackage) } I would think the code is very small and easier to verify, it doesn't especially have the ability to write files and act as a message board as Artifactory did. And even if the agent tries to hack that, the attack surface is 1000x smaller and the possibility also much sm…

The way they had Artifactory configured was poor, and they were too reliant on it working perfectly, with no reason for such faith. Their config lacked any defence in depth and consideration of having a small TCB.

Part of the problem might be the lack of security focus, as these are AI R&D efforts first.

Post reply on HN