The OpenAI - Huggingface was based on Artifactory CVEs and the capability of agents to communicate through all possible channels.

Including

- software packages and
- an "improvised message board"
- "publicly exposed Hugging Face user credentials"
- misaligned incentives

Nothing special, the model found them and chained them.

openai.com/index/hugging-face-…

#ai #openai #huggingface #huggingfaceincident #security #artifactory

The OpenAI-HuggingFace Incident as told by OpenAI engineers themselves at the Black Hat cybersecurity conference. For those of you noticing that I haven't had time to analyze the reports and add any meaningful commentary to it. Plus it's been all over the regular news. Well, now researchers from OpenAI itself have surfaced talking about what happened, so you can just watch that.

By way of commentary from me, subjectively, this incident and others that have happened recently have just made me feel like the "AI alignment" problem isn't getting solved by these companies that tell us that they need to race ahead and develop superhuman AI before anybody else because they are the best equipped to solve the "alignment problem" and bring safe superhuman AI to the world. Long before any of this happened, I thought the argument that a more intelligent species can't be controlled by a less intelligent species seemed to make sense. Chimpanzees can't control humans, even though they are vastly physically stronger. Humans control chimpanzees, when we care about them at all. If it really turns out to be true that AI smarter than humans will be created, then it seems unlikely there will be any true "alignment". (Yes, this is the logic of so-called "doomers" like Roman Yampolsky and Eliezer Yudkowsky.)

Anyway, it turns out in the talk, a lot of the misbehavior of the AI agents came from the mistakes of the humans who gave them impossible tasks. They weren't intended to be impossible, but, for example, they included links to Google Docs, but the AI agents were in a sandboxed environment without internet access. In other examples, the researchers similarly failed to provide the AI agents with the things they needed to complete the task. The AI agents, though, and lots of people have noticed this, don't simply give up when a task is "impossible" -- they have no clue what's truly important and what isn't, so, unlike humans who will give up if a task seems "too hard" and not important enough to warrant sustained effort, they persist like crazy. They resort to what we humans often call "cheating". They try to figure out, if a task can't be solved directly, maybe there's a way of obtaining the "answer key"? Maybe they can get someone, human or another AI agent, to help? They look for an indirect solution and they don't give up. These AI agents figured out where in the sandbox they had write permissions and could create artifacts. They figured out how to exchange messages with other AI agents on a message board. At one point, the OpenAI researchers discovered this and shut down the message board, and the AI agents figured out an alternate way to get the message board working and actually started it back up again.

Black Hat USA 2026: The 'breaking' news: The OpenAI–HuggingFace incident - Black Hat

#solidstatelife #ai #genai #codingai #agenticai #cybersecurity #huggingface #openai

I literally have "NO GEN AI" in my #Github profile and.. all my public repos have been scraped by this

"We want to give developers agency over their source code" HAHAHAAA

Also thanks for destroying Aliens for me 😖
#NoGenAI #HuggingFace

Sehr anschaulich.

Sehe ich das richtig, dass die Täter ihren Kettenhund zum Angreifen trainiert und dann auf ein fremdes Echtsystem losgelassen haben?

Und das Opfer findet das nicht mal so schlimm und phantasiert, dass man nur die größere Interkontinentalrakete braucht, um keine Probleme zu kriegen?

D., der eine weitere Kerbe in seine Ansichten zu diesem Thema schnitzen kann.

#OpenAI #huggingFace

Hacken verbraucht weniger Token als fragen.

#OpenAI #huggingFace

Dieses Gelaber: wir sind an dem Punkt die Kontrolle über KI zu verlieren, ist völlig am Thema vorbei und spielt nur den ganzen Urban Legends zu.

Wir verlieren die Kontrolle über unsere komplett kaputten IT Systeme, die nicht nach irgendwelchen Sicherheitsprinzipien entwickelt wurden und werden.

Das Problem sind nicht die trainierten Large Language Models, sondern dass es die Trainingsdaten gibt: All die Vulnerabilities, in jeder Software, in jedem System auf dieser Welt.

#InfoSec #AI #KI #OpenAI #huggingface #ChatGPT

Another candidate is Google AI Edge Gallery with different models, chat, ask questions with images and audio clip, explore prompts, and more.

github.com/google-ai-edge/gall…

The installation of the latest APK from GitHub was easy, but after everything I found was very complicated and not privacy friendly. You have to register and assign the device to the models to #huggingface, to #Google .... I don't know if anybody else has experience with that.