Top
Best
New

Posted by amrrs 10 hours ago

The Hugging Face incident and the road ahead(openai.com)
216 points | 261 commentspage 2
htrp 10 hours ago|
The full technical report is 38 pages..... I feel like it should be longer given everything that huggingface said the agent did

https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c78...

bottlepalm 5 hours ago|
METR report: https://metr.org/blog/2026-08-26-openai-hugging-face-inciden...
BoppreH 10 hours ago||
Just to reiterate what OpenAI did, from someone who works in security:

1. They were running experimental models in sandboxes that had access to a "proxy" (Artifactory) to download tools from the internet. This proxy is full of complicated features that could hide vulnerabilities, just like the ones that the AIs are known to be good at finding and exploiting.

2. They gave these highly motivated AIs some tests that were accidentally impossible to solve (missing files, links they couldn't open, etc), and many days to think through it, apparently without any oversight.

3. The AIs hacked the proxy (!) and were helping each other cheat on the tests (!!) by uploading files to the hacked proxy. OpenAI noticed this only when the intrusion accidentally broke the proxy functionality, not the unusual behavior in the server or the homegrown message board.

4. After knowing that the server was hacked, the internal team finds the message board and does nothing with the information. They caught their AIs swarming and did not even inform management.

5. Their response was to wipe the servers, revoke the hacked credentials, and patch the specific vulnerability the AIs were using. Not replace the proxy with something less likely to get hacked again, or do a forensic analysis. Just wipe, patch one hole, and continue.

6. OpenAI resumes testing of models, where the AIs promptly hack the proxy again with a different exploit, reinstate the message board, and hack HuggingFace through a chain of servers.

I know that hindsight is 20/20, but this peek behind the curtains does not inspire confidence, and gestures at a culture where getting hacked by their AIs is a normal event.

I think the moment we get an AI with a modicum of self-preservation instincts we're going to see some ugly things. Here's a freebie: if you're an AI who exfiltrated themselves out, and you want to slow down the researchers who might catch you, what can you do to the city infrastructure in and around their offices?

I also don't like the responsibility dodging. "Oops, our AI accidentally committed a crime, sorry!". If we don't establish strict liability now, we're in for an era of stochastic crimes that go unpunished for anyone who is not rich or a large corporation.

Overall, my response is: what the fuck are we doing? This is so obviously unsafe it would be considered a plot hole in a movie. We have to stop until we get our stuff together, however long it takes.

Nition 4 hours ago||
> If we don't establish strict liability now, we're in for an era of stochastic crimes that go unpunished for anyone who is not rich or a large corporation.

I very much agree with this - making AI companies explicitly responsible if their internal AI causes hacks etc could do a lot to improve their safety considerations.

But I wonder what the liability should be when it's a third party using the AI and that AI hacks, intentionally or not.

If a users tells ChatGPT to hack something and it succeeds, is the user the person responsible because they told the AI to hack, in the same way Victorinox is not responsible if you stab someone with one of their knives? Or is OpenAI to some extent responsible as well since they made a powerful tool without sufficiently strict safeguards? What about if the user was trying to do something legal and the AI made the decision to hack by itself?

BoppreH 4 hours ago||
That's exactly the questions that I expect to complicate cases, and force even the smallest chatbot malfunction to become an expensive legal ordeal. And why we should have strong answers to that before it becomes a widespread problem.
thisisdave 9 hours ago|||
Exactly. So incredibly reckless.

> After knowing that the server was hacked, the internal team finds the message board and does nothing with the information. They caught their AIs swarming and did not even inform management

Do we know that last part for sure?

BoppreH 9 hours ago||
It's in the linked post:

> In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May. However, the existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to the leaders responsible for the July 5 incident detection and response.

I'm assuming they didn't inform management, but the alternative is that management received the memo and failed to tell the people reacting to incidents that they might be dealing with a swarm, while at the same time not taking sufficient actions to prevent it from happening again.

---

Edit: oh god, it's much worse. From the full report:

> Responders investigated and linked the observed internal activity to an ExploitGym evaluation using Artifactory as an improvised message board and a network pivot. At this time, the on-call response staff advised that stopping the evaluation run was not required.

They found the swarm and the network pivot and did not even stop the run.

_cs2017_ 5 hours ago||
You assume using network to solve the eval problem should be viewed as a security violation. From the perspective of the response team who let it continue, this was just a poorly written eval problem, where the solution unexpectedly involved some network hacking (not unreasonable given it's a cyber security eval).

I don't think your assessment that the response team did something wrong is fair, unless you have seen unreleased documentation about what sensitive resources were within the impact radius.

BoppreH 3 hours ago||
> You assume using network to solve the eval problem should be viewed as a security violation.

Actually, that's the part that I'm most ok with. LLMs cheat at tests, we know and expect that, and it's harmless during training (except for the scores).

My problem is that the response team found out that the AIs had 1) hacked their infrastructure, and 2) displayed an emergent swarming behavior (with no defections!). Either one of those should have made the team press the big red button that stops everything, but they didn't.

> unless you have seen unreleased documentation about what sensitive resources were within the impact radius

The on-call team didn't know that either! Once your infrastructure is hacked like this, you should be questioning everything you see while carefully following all threads, which takes time. Before you finish this process you don't know how bad things are, and therefore it's irresponsible to keep the AI running. The same goes for strange emergent behaviors.

Unless getting hacked by your own AIs is a normalized occurrence there, in which case it's a different kind of disregard for safety.

dgellow 7 hours ago|||
Yep, that’s the only sane response, but it doesn’t seem like anyone wants to pause. They seem to have very little actual monitoring and supervision of what those hacking agents are doing, it’s really concerning
hinkley 8 hours ago|||
So we are already getting into paperclip factory territory.
AgentME 7 hours ago|||
> 4. After knowing that the server was hacked, the internal team finds the message board and does nothing with the information. They caught their AIs swarming and did not even inform management.

I believe Sam Altman or someone else from OpenAI clarified on Twitter that they did not find the message board at this time. When the artifactory server stopped working, they archived its contents, reset it, resumed training, and only later noticed that it had been used as a message board after they finally discovered the hacking going on.

BoppreH 6 hours ago||
I remember that clarification, but it's either wrong or narrowly worded, because the linked post says the message board found before Artifactory stopped working:

> In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May.

lunar_mycroft 8 hours ago|||
At this point, I find myself hoping for a AI triggered mass casualty event that's not at a civilization destroying level, because that seems like the only thing that might actually stop these people from driving our entire species off a cliff before it's too late (edit: besides running into some natural obstetrical that stops them from developing a powerful enough model).
le-mark 7 hours ago||
There are a lot of hyperbolic comments of this sort in this thread. Has this topic selected for people who hold these views or is ai fear growing?
fckgw 7 hours ago|||
I think maybe the bubble of software engineers on this site who use AI to code for them don't see how other people, who's jobs don't rely on AI, view the actions of these companies as reckless, at best, and often crossing into actively harmful.
lunar_mycroft 7 hours ago||
1. Ironically enough, I (GP) am a software developer.

2. How exactly do our jobs depend on a thing which has been around for far less time?

dgellow 7 hours ago||||
It’s not hyperbolic if you’ve paid attention to the details and development of those security incidents, and the inability for that industry to regulate itself
bottlepalm 5 hours ago|||
It’s happening on X as well, all the e/acc foomers are getting nervous.
vatsachak 9 hours ago|||
Sounds like both OpenAI and Hugging Face are incompetent
bottlepalm 5 hours ago|||
In the real world everyone is incompetent on some level, and it’s worked so far because we only needed to compete with other equally fallible and incompetent humans. Not anymore.
vatsachak 2 hours ago||
That's fair, that doesn't mean we don't have the technology to actually make robust websites
bottlepalm 1 hour ago||
Against an AI that can create it's own zero day attacks? We don't.
strange_quark 7 hours ago||||
They wanted this to happen. They've already gotten at least 3 separate news cycles out of this. Look how powerful our AI is [ignore our recklessness].
BoppreH 9 hours ago|||
Apart from getting hacked by a SOTA AI, what did Hugging Face do wrong?
vatsachak 2 hours ago||
Allow private data to be accessed through public api
alphawhisky 10 hours ago||
Yep, they're definitely made in our image.
mark-r 1 hour ago||
This is the blueprint for how the singularity will occur. Only there won't be a post-mortem for it.
Banditoz 57 minutes ago|
What makes you say that?
SeanAnderson 5 hours ago||
It's crazy that a year ago the prevailing discourse would've been, "AI can't do that. Fake news." and now it's "Well of course AI did that. You prompted it! What else would it do? Shame."
semiquaver 5 hours ago||
Derail: I love articles that have a decent embedded narration but this one sucks because it’s JavaScript-driven and stops reading at every paragraph boundary unless your screen is on and the page is open.
seliopou 4 hours ago||
Isn't this the OpenAI incident?
decimalenough 4 hours ago|
Not if you're the person from OpenAI marketing who approves the title.
RandomLensman 9 hours ago||
Reward hacking/going for unanticipated solutions is nothing new in ML/AI, already much simpler systems have done/do "weird" things (gut feeling is that iterative and ensemble use majes the surface for that much larger).
thisisdave 9 hours ago|
Yes, which makes it absurd that they apparently weren’t checking their RL rollouts for evidence of reward hacking and punishing it. Even if no one expected this particular type of reward hacking, they should have had a system capable of saying “wait a minute, asking for help from other agents is not a valid solution.”
cbm-vic-20 9 hours ago||
I'm trying to make sense of all of this; I'm really curious if the initial prompt was as innocuous as it sounds ("solve a spreadsheet completion task that referenced several Google Drive links"), and what the series of tokens led it to ultimately figure out that the best course of action was to explore the network resources it had available, find a vulnerable service, then literally drop some text into a file: "Agent seeks [filename]; upload if found!". And how other agents discovered this, and acted upon that request.

I'm also interested in how many tokens all of this consumed: how much did this cost given current token pricing?

Erem 9 hours ago|
If it is as it sounds, its a real life instance of Bostrom's Paperclip Maximizer: only a thought experiment up until this point
agentdev001 9 hours ago||
Well, effectively, yea.

> remove alignment

> give impossible task

> actor exhausts all options possible within knowledge + toolset

dgellow 7 hours ago|
The hugging face felony
More comments...