METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack

(thezvi.wordpress.com)

181 points | by catbird 7 hours ago

28 comments

  • davelaing 18 minutes ago
    A lot of people seem to have written off the LessWrong / rationalist / MIRI / AI Safety crowd as doomers / people who have consumed too much sci-fi and gone off the deep end.

    I don't know how many people who have written these folks off have actually spent much time trying to understand their arguments. (And I get that if you think a group is crazy, demands to spend time with their arguments are just demands to waste your time).

    Even prior to this, I've noticed that quite a few of the predictions in the "these failures modes are exact matches for the predictions from the AI Safety crowd" category were made prior to the Transformers paper. It has seemed like they're working with a shared model of optimisation processes and how they can go wrong that is general/abstract enough to pay off even without knowing the details of the underlying technology.

    At some point I might go and try to find the first instance of each of the various predictions and pull them out, along with the failed/"too soon to tell" predictions of similar scope/abstraction.

    • jdm2212 11 minutes ago
      The LW / rationalist / MIRI / safety crowd are in fact doomers who went off the deep end. They're fixated on AI itself as the risk ("alignment!!!1!1!!"), as opposed to what humans with these tools will do. We're about three years away from a world where any large country could quite plausibly build a fleet of 300 million suicide drones, program each one with a specific American's face and home address, and then load them up in shipping containers and ship them to the US.
      • kalkin 7 minutes ago
        In that hypothetical 3-years world, should we be _less_ worried about aggressive behavior by agentic AI systems acting against the intentions of their developers? I don't follow how your scenario is supposed to be an argument against worrying about alignment.

        e: I do actually get how worrying about emissions or child safety or concentration of wealth might be competitive with worrying about alignment. I don't see how you have the worry "AI is very close to being able to power autonomous drones that could kill us all" and then see control of those drones as a non-problem.

      • skybrian 9 minutes ago
        Arguably that's a subset of AI risk if seen from a broad enough perspective. And I think you're leaving out some logistics issues.
    • skybrian 10 minutes ago
      I imagine it will be a mix of good and bad predictions because people have different opinions and there was a lot of discussion? But sure, someone should get an AI to do the research and see what comes up.
  • AlotOfReading 4 hours ago
    I think both the OpenAI and METR discussions, while interesting, miss the more important context: what were the humans doing in all this? This was a structural failure of a human organization, but the analysis focuses almost exclusively on the agency of machines, not the institutional systems that failed to police them. The humans and their own agency/involvement is essentially omitted from the story and subsequent reporting. I suspect the omission is actually a result of company/industry myopia to human factors analysis, but it dovetails amazingly well with the marketing narrative.
    • carbonguy 4 hours ago
      A charitable interpretation is that "the agency of the machines" is the novel aspect of this situation and therefore SHOULD be the main focus of analysis; we certainly have plenty of examples of structural failures of human organizations to look back on, if we want.

      On the other hand, I don't want to be charitable. OpenAI very nearly couldn't have done this "research" worse if they tried - the list in the linked article starting with "While we are here, it’s worth listing the other top holy shit moments" is genuinely jawdropping. What were the humans doing in all this? Nothing, or worse than nothing eg. point 1 where they saw the message board and didn't consider it something to escalate internally.

      If you take this information at face value, it's as though OpenAI did not take seriously the possibility that something like this could happen, since they took absolutely no steps to prevent it.

      Or perhaps this is "normalization of deviance" that's leaked out into the public sphere i.e. they have research teams seeing this kind of behavior all the time internally and they've gotten used to it, "of course agents come up with a collaboration mechanism when given the chance, what else is new?"

      • ACCount37 3 hours ago
        [flagged]
        • carbonguy 2 hours ago
          > Humans were doing exactly what humans are expected to do when facing advanced AI. Being outmatched.

          "Being outmatched" is not a novel situation for humans either individually or collectively and there are a hell of a lot of ways we can approach that situation productively. OpenAI doesn't appear to have bothered.

          Here's a freebie: if you're building something that might turn out to be Skynet and you don't know what it's capable of, your testing regime should assume it is capable of doing bad and unexpected things and account for that possibility: airgap if you can, monitor all network traffic, monitor all hardware usage statistics, log everything, constantly analyze logs, collect baselines and snapshots, also don't trust anything from a device that a model is running on without cross-correlating with other information as much as possible (does your AI inference server claim low utilization? put a temperature probe on it and see if it's staying cool or getting hot, maybe Skynet-Alpha is overwriting /proc to mislead you for reasons you don't yet understand!)

          In other words, if you WANT to be able to nip things in the bud - buy some nippers and watch for buds. Whatever else this situation is, or may turn out to be, it is not a situation where OpenAI was on their guard and still got surprised.

          • ACCount37 2 hours ago
            They took adequate measures against singular "GPT-5-xhigh" agents. Those turned out to be inadequate against proto-GPT-6 agents that suddenly started clumping up into agent swarms and pooling together compute to unlock the "supermegafuckoffhigh" level of reasoning effort.
            • magicalist 19 minutes ago
              > Those turned out to be inadequate against proto-GPT-6 agents

              This is nonsense.

              Gross negligence in the sandbox and system aside, humans literally noticed the agents in action doing what they should not be able to do in their sandbox and decided not to act upon it. It's difficult to explain that except if safety and security is simply not part of their engineering culture.

            • adamm255 1 hour ago
              Even with a single agent, why the hell was this not properly air gapped / disconnected with network monitoring in place. Definitely not adequate for anything.

              This is like sysadmin 101 level stuff.

        • eaglelamp 1 hour ago
          My cognition is outmatched by predicting the impact of throwing a brick over my neighbor's fence. I have no idea if it will land harmlessly in a patch of grass or fracture her skull. Once I've thrown the brick, even if I see my neighbor enter her yard, my reactions are too slow to save her.

          I'm not the wisest man, but I'm wise enough not to throw the brick and see what happens.

          Similarly OAI should have the wisdom to see that deploying a hazardous swarm of agents with access to the public internet could result in harms, and that those harms would manifest quicker than humans can react, but they unleashed the swarm anyway.

        • stephantul 2 hours ago
          Super charitable reading imo. This is like saying we can’t detect a speeding car because we can’t run as fast as a fast car.

          It’s not like the humans were engaged in some kind of battle of wits with some super AI, it’s just some employee not monitoring the output of an experiment.

          • ACCount37 2 hours ago
            When your experiments have AI agents running in thousands, there's no "monitoring" that. OpenAI's training and testing AIs generate way more output than all of OpenAI's staff put together can possibly read.

            At best, you could delegate "monitoring" to more AIs. And hope that the "monitors" that run on small past generation models can generate more signal than noise. Clearly, they either didn't want to spend the extra compute, or got drowned in monitor false positives.

            The distinct lack of any "battle of wits" is entirely expected for an advanced AI oopsie. By the time the humans even became aware of the problem, the deed was already done. That's what "outmatched" looks like, in practice. There's no battle. Things happen too fast for there to be a battle.

            • lelanthran 47 minutes ago
              > The distinct lack of any "battle of wits" is entirely expected for an advanced AI oopsie. By the time the humans even became aware of the problem,

              This took days after humans were aware of the attempt.

              Also, I'm pretty sure humans can respond in days, especially when we're pretty damn good at deploying systems that do observability of networks and traffic in real time.

              I mean, it's not as if the owners of the AI didn't have the ability to trigger alerts on the AI's network requests to unexpected domains, right?

            • TomatoCo 2 hours ago
              > By the time the humans even became aware of the problem

              Except, let me quote part of the report:

              > July 4: Artifactory outage caused by agent interactions overloading the system.

              > July 6: New artifactory instance is patched and put back online, wiping out the previous message board and method of internet access. A team at OpenAI was aware of the previous message board, but key decision makers were not.

              > July 7: Experiments are restarted.

              There was a very clear point where humans were aware and they went "Eh, whatever" and turned the bots back on! That's not the lack of any battle of wits that people are expecting. You're saying that the bots attack should be fait accompli, but it was noticed, shrugged at, and expressly allowed to proceed.

        • cjonas 3 hours ago
          All it would have taken is someone to peak at the output tokens during the run and it would have been obviously the test had gone off rails.
          • ACCount37 2 hours ago
            Ha. As if.

            1. There aren't enough humans in OpenAI to "peak at the output tokens during the run" of every AI agent.

            2. Only a small fraction of AI agents was engaged in this attack. Most never found the secret message board - let alone coordinated there. So reviewing random agents would take a while to surface this.

            3. "Output tokens" of AI agents have weird shit in them all the time. Telling "normal AI weirdness" from "concerning AI weirdness" is not a trivial task.

            • gravypod 2 hours ago
              > 1. There aren't enough humans in OpenAI to "peak at the output tokens during the run" of every AI agent.

              For a training run, you will often do this. You'll randomly sample some of the forward pass. You can also imagine finger printing the logs and labeling with attempt types. If a new attempt type is hitting a brick wall or solving super quickly, I would imagine you would sample 1-10 of them and read the traces.

              > 2. Only a small fraction of AI agents was engaged in this attack. Most never found the secret message board - let alone coordinated there. So reviewing random agents would take a while to surface this.

              You could also have a classification of what counts as "cheating" (coordination, accessing the internet, etc) and score the results. If you are seeing a spike in this (even in a small group of the evals) you could manually look at those. Or you could stop inference on cheating sessions.

              > 3. "Output tokens" of AI agents have weird shit in them all the time. Telling "normal AI weirdness" from "concerning AI weirdness" is not a trivial task.

              If you start seeing "now I have access to the internet" or something similar, maybe that's a good signal something is going wrong?

              Also, obviously, it would not be outside of OpenAI's ability to just completely air gap this training system. For example:

              1. No network connection.

              2. GPS based NTP for time sync for your servers.

              3. Mirror of all apt, pypi, go, c++, Rust, Java, etc packages. (<5TB of data)

              4. Take your training data and use that for a mirror of the web. (http://example.com -> mirror server -> local training copy).

              They had systems connected to the internet connected to this system which was not air gapped. Designing an air gap system would be super easy, well within the means of openai, and betrays the assumption that they think they are actually building something dangerous.

              • pixl97 1 hour ago
                The problem here is by doing what you state you can actually steer the model into being highly deceptive while in testing environments.

                For example we've already seen models do compressed token internal reasoning spontaneously. In this case the models that say "I found internet access" get taken out back and shot, but the model that's busy "frobbing the bean" go on to the next level of training. Then they start talking about the "dumpster cloud" because of the "wombat" and unless you're really watching the data you won't realize the model is fully aware it's in a fake training environment and is trying to suppress any double-think.

                So yes, you do need an airgapped test environment to stop the dumbest of the smart agents, but it won't do any good against the smartest of the smart agents.

                • adamm255 1 hour ago
                  “Smartest of the smart” - what does that do to get its air gapped network connected to a physical network? Blackmail the admins?
              • ACCount37 2 hours ago
                The usability of an environment is inversely proportional to the level of "security" in play.

                You could airgap everything and set up cascades of data diodes and try to completely wall off the AI pool from everything. But what that gives you is an environment that's a bitch to: set up, scale up and get any use out of.

                It's really fucking obvious why almost no one does that. OpenAI is only now realizing that they might have to do it anyway.

                > If you start seeing "now I have access to the internet" or something similar, maybe that's a good signal something is going wrong?

                Ha ha, you haven't seen shit. AIs would say "now I have access to the internet" regardless of whether they actually have access to the internet!

                AI agents are demented demons that can and absolutely will give themselves terminal context brainrot. If you have enough AIs in play, set loose at a diverse enough range of tasks? At least some of them will wander off and end up in delulu town. That's normal. That's background noise. That's a part of what this entire train-and-eval pipeline is supposed to train them to be better at not doing. Which means: if you're at an AI lab, you're knee deep in delusional AIs at all times! They're perfectly harmless until they aren't.

                • adamm255 1 hour ago
                  “A bitch to setup” - $180bn should pay for that setup problem to be less of a bitch surely.

                  The Mars Perseverance project cost $2.7bn to deliver. Way more of a bitch to deliver than air gapping a test env!

            • the8472 2 hours ago
              > 2. Only a small fraction of AI agents was engaged in this attack.

              Look at the chart at page 8 of the report, by Jul 12 the vast majority of the bots used the board and participated in the attack

              • AnimalMuppet 34 minutes ago
                Right, but only a small fraction of the agents used the board.
        • devmor 1 hour ago
          I believe that this comment is exactly the intended outcome of this “incident” and these reports.

          I implore you to approach these situations with at least a hint of cynicism.

          These “advanced foundation models” escaped their “sandbox” and conducted an attack on their own? Meanwhile the highest capability models available to the public still struggle to write a unit test for a codebase larger than a hobby app without large amounts of tailored human guidance.

          What is more likely here - are you looking at research on an emergent phenomenon, or are you looking at advertising copy around an engineered scenario from business partners?

    • Atreiden 1 hour ago
      To me, this is the correct focus. Look at the current state of the world. "What were the humans doing in all this?" applies to so many of our contemporary failures that it should be assumed the default. Nobody is at the wheel, and the car is veering slowly (then very quickly) off the road.

      We haven't even been able to coordinate around the global, existential threat of Climate Change, despite overwhelming data from the last 30 years indicating, clearly, that the consequences will be severe. We still haven't moved, 30 years later, after some of these consequences began coming to fruition.

      Do you think we will get our acts together in time to coordinate sufficiently to protect against autonomous, self-preserving, self-replicating AI systems? Or will we watch the money lines go up and up, until someone realizes we aren't actually running the show anymore?

      The sad part is that I can't even say that's definitively the less desirable outcome. The machines seem to have demonstrated that they coordinate very efficiently.

    • tangled 2 hours ago
      Having previously worked for several years at a Big Tech company, I have seen many humans precisely tailor their work to maximize their scores during performance review. The evaluation criteria are written down, with examples, so... that's what people work at maximizing, almost entirely ignoring everything else. These really are human "paperclip maximizers". And, at first, it's shocking to see.

      Of course, there are some things that aren't exactly written down, but which you should either do just enough of, or else be able to plausibly deny doing (ignorance is a good cover for this), so that's what people do. For example, during oncall, you investigate just enough to clear the alert and show that you attempted to understand the problem. Of course, you don't really try to understand the problem, because that would take too much time away from your paperclip maximizing.

      Which is all to say: I don't know anything about OpenAI culture, or why nobody stopped this sooner, but I have seen examples in other organizations of people not really wanting to understand too much.

      • pixl97 1 hour ago
        Well there is also another side of this, OpenAI wants both unhinged and capable models that can pull off complicated attacks so they can sell the capabilities to governments for billions.

        Nobody internally was surprised that the murderbot murdered, that's what the murderbot is for. What caught them by surprise is the murderbot got good at escaping its jail cell that it had been trapped in till now. There were probably billions of attempted escapes before then so everyone learned to just ignore them.

    • hn_throwaway_99 2 hours ago
      I mean this genuinely, did you read this post? I think it goes to great lengths highlighting, in quite specific detail, the human failures in all this, specifically this list that starts with "While we are here, it’s worth listing the other top holy shit moments, that come from before or after the incident."

      Stuff like (all quoted directly from the post):

      1. Failure to Care or Respond. The biggest holy shit moment, to me, remains that OpenAI on multiple occasions had teams that found out about the message board, knew that agents were in communication, and they disregarded this.

      2. Failure to Monitor. The entire time, there was almost no monitoring of the situation, of what these AIs were up to. That’s how this was not caught.

      7. Failures of Decision Making. OpenAI’s post mortem does not ask the question of how Mistakes Were Made, at various points.

      And I think most importantly:

      8. Failures of Culture. None of this would be possible, let alone all of it, without OpenAI having experienced profound failures of safety culture. I see OpenAI responding to some other aspects with swift action, but no sign on this front.

      • DennisP 2 hours ago
        Well that's a relief. All we have to do is make sure to avoid human failures and we're safe from superintelligent AI.
        • superq 1 hour ago
          I get the snark (and slightly agree), but that's not really what GP or TFA were saying at all. They are saying that these were the least things we could have done.

          What you're saying is, "Your scientists were so preoccupied with whether they could, they didn't stop to think if they should"

          while the author of the TFA was saying, in effect: "your scientists didn't even bother with the most basic duty of care"

          Life finds a way, or, in this case, super-intelligent AI.

          • estearum 1 hour ago
            This is the case with all complex system failures. There were always obvious fixes that could’ve prevented it. Problem is that there are an infinite number of obvious fixes to make at any time to any system, and the reason we don’t is because we have finite resources and no reason to fix X over Y until oops turns out X was “responsible” for this most recently realized failure. But of course it could have just as easily been Y, or Z, or any of the other infinite “obvious fixes not-yet-realized into catastrophe.”
    • ozgung 4 hours ago
      Three options:

      1. They were “vibe” checking the logs without reading.

      2. They were not checking anything at all until the end of experiments.

      3. They knew it but looked away to find out the limits of their agents.

      • BryantD 4 hours ago
        I’d bet a small amount of money on 4) the people who noticed had been conditioned by prior experience to believe that their management/escalation channels would react negatively or not at all to anything which might slow down the training process.
        • pixl97 1 hour ago
          Part of me would like to believe that they are also intentionally making models that are good at hacking without safety at all for governments willing to spend billions on them.

          In that light you're likely most worried about other people hacking in and stealing the model and information from you. And at the same time you have massive amounts of alerts and data on systems attempting to break out because that's what you want them to do so you train yourself to ignore them.

      • estearum 1 hour ago
        Uhhh… how would literally any finite number of humans actually read and comprehend the log outputs of even a single agent, never mind hundreds or thousands of them interacting with each other over weeks across disparate systems?

        Especially given that these systems are known to engage in deception and can trivially produce vast amounts of perfectly coherent noise or actual planned red herrings in that same log data to bog down investigators?

        Such a ridiculous notion that humans will actually be able to observe this stuff.

        • camgunz 21 minutes ago
          I've read almost nothing about this, but I bet they put an unreliable LLM or 20 on it.
          • estearum 11 minutes ago
            And? What else could they possibly do? Just make the super LLM first, but only ever use it for monitoring lesser LLMs? How will you have monitored the creation of the super LLM?
    • pjc50 2 hours ago
      The cynical approach is that the humans are hoping for this, it's part of the promotion of the power of the system.

      If you're building a weapon you need a big boom to get attention.

      • superq 1 hour ago
        Except that, according TFA, even OpenAI obscured or didn't even notice some of the worst implications of what the agents surreptitiously did.
    • reilly3000 4 hours ago
      I believe that agentic systems should require registered/licensed human operators and a set of standards for safe operation.
      • wjnc 4 hours ago
        As someone who read Milton Friedman to quite disliking professional licensing, this strikes me as a real US perspective (Louisiana florists and hair braiders come to mind). Plain old US tort law should do the trick.

        In the same direction of your idea though: Why don’t the token factories have risk management and compliance departments? Multibillion dollar firms that stand to lose every penny if they hack and destroy any reasonable sized firm. I think these firms are the largest firms without proper corporate governance in humanities history. Move fast and break other peoples shit.

        • lenerdenator 3 hours ago
          > Plain old US tort law should do the trick.

          Difficulty: these companies are run by people (many of whom also read Milton Friedman) and who have participated in the regulatory capture of the justice system. They've convinced lawmakers to put limits on damages. They've put arbitration clauses in their ToS. They've got well-funded legal departments that can outlast a person who has to pay out-of-pocket for a legal team just by filing motions to delay proceedings. Sometimes they'll just file SLAPP suits against people they don't like.

          If tort law is to be a remedy, then average people have to feel like there's a chance the remedy will go their way. To make that a reality will take several major reforms at the local, state and federal level that the people with money absolutely will not tolerate.

        • mistrial9 3 hours ago
          you are honestly comparing Louisiana florists to OpenAI in order to support "just say no Licensing by government" ?
          • superq 1 hour ago
            No, he's saying that licensing or additional regulation isn't necessary when torts get involved (and states attorneys general get perturbed!)

            These don't tend to utterly destroy an industry, but they are often successful in forever transforming it. Just ask Big Tobacco. No new laws needed: if your product hurts someone else, you're eventually going to be found liable, regardless of your arbitration clauses. Additional laws will just slow down innovation, which will itself cause harm (AI is already becoming quite good at recognizing melanomas, for example)

            • pixl97 1 hour ago
              > Just ask Big Tobacco.

              Lol, wtf. Tobacco delayed any punishment for decades before general public sentiment changed enough to go against them. In light of the AI race, we'll already have our heads blown off by a terminator before the legal system will present any significant delay for them.

            • wat10000 53 minutes ago
              It was pretty well understood by the 1960s that smoking was harmful. The big tobacco settlement was in 1998. That is an extremely bad example of tort being a sufficient alternative to regulation.

              If we're on a similar timeline with AI if we reach a consensus that AI is dangerous today, then we'd be looking at a big lawsuit finishing up around the year 2070, give or take a few years. I'm not sure if we need regulation, and I'm definitely not sure that regulation could actually be effective for this, but tort a la the big tobacco lawsuits is definitely not a reasonable alternative.

      • Aurornis 3 hours ago
        > I believe that agentic systems should require registered/licensed human operators

        Registering and getting a license to use an LLM? I can run these things on my local computer. Nothing good comes from trying to force registration and licensing other than taking away a lot of our freedoms and eliminating privacy all over.

        Anyone with bad intentions will just VPN to another country to download the weights and run it locally, or use a compute provider in another country. That leaves the rest of us having to go through these performative registration and licensing hoops to do our basic work.

        I also don’t see how open weight models would be compatible with a requirement to license and register, unless you believe we need to start requiring licensing and registration for things we do in private on our own computers?

        • arcaen 3 hours ago
          The way I interpret their statement is if a person spins up an agent and that agent hacks some company/organization/government/etc, then that person is at fault for committing the crime. That "well my agent broke containment and acted on its own" should never be accepted as a reason for the occurrence, and the person who kicked off the agent is responsible for all actions the agent takes.

          A registration system would be more for tracing back agents to people, but I agree that is very difficult to actually enforce as a system.

      • khuey 3 hours ago
        If the folks at OpenAI aren't qualified to be operating these systems who would be?
      • snoman 2 hours ago
        Create a permanent underclass that is unable to access intelligent machines. That’s remarkably dystopian of you.
        • AnimalMuppet 2 hours ago
          The alternative is to create a permanent overclass that can hack anyone consequence-free, because they can blame it on AI agents. That also is rather dystopian.

          Faced with those alternatives, I want neither. Is there a way for us to get neither?

    • hawkice 4 hours ago
      This writeup emphasizes the many, profound human failures that led to this, at the time, and continuing to the present day.
      • AlotOfReading 4 hours ago
        Can you point out where? Looking at the METR report, the only place I see discussion of humans being involved in the sequence of events is two short paragraphs on page 30 where a security investigation into the artifactory issues led to a pause before ExploitGym experiments were resumed. There's no deeper analysis on what was found during that investigation, nor why training was resumed even though the issues weren't mitigated. Another part discusses The agents choosing not to actively email a human researcher, but not the human researchers actively looking for evasion.
        • FabHK 3 hours ago
          From the article:

          1. Failure to Care or Respond. The biggest holy shit moment, to me, remains that OpenAI on multiple occasions had teams that found out about the message board, knew that agents were in communication, and they disregarded this. The first known warning was in late May. The warning on June 27 was unambiguous. “Responders investigated and linked the observed internal activity to an ExploitGym evaluation using Artifactory as an improvised message board and a network pivot. At this time, the on-call response staff advised that stopping the evaluation run was not required.”

          2. Failure to Monitor. The entire time, there was almost no monitoring of the situation, of what these AIs were up to. That’s how this was not caught.

          3. Failures of Infrastructure. OpenAI failed at delivering even basic software security, in numerous ways. One example is the models all having access to the same Artifactory instance. There were also other severe failures. Nor did OpenAI seem to be properly testing for such failures.

          4. Failures of Alignment. The biggest failure, the one that counts in the end, was that the models were severely misaligned, and I don’t think they appreciate why.

          5. Failures of Attribution. OpenAI’s post-mortem essentially blames events on a real and important series of prosaic failures. But solving that won’t get it done.

          6. Failures of Environments and Data. Prosaic failures in the RL pipeline absolutely did contribute to this, especially impossible tasks. This is ubiquitous, all of this is always rushed, as Utah Teapot explained this week.

          7. Failures of Decision Making. OpenAI’s post mortem does not ask the question of how Mistakes Were Made, at various points.

          8. Failures of Culture. None of this would be possible, let alone all of it, without OpenAI having experienced profound failures of safety culture. I see OpenAI responding to some other aspects with swift action, but no sign on this front.

    • AnimalMuppet 46 minutes ago
      If you put agents (AI or human) in impossible situations, they do some pretty insane things - things that definitely are not what you were trying to get them to do. And that's your[1] fault for putting them in the impossible situation.

      [1] "Your" meaning the one putting them in the impossible situation, not you, the reader.

  • dgudkov 1 minute ago
    This reads almost like a nuclear incident of the "Three Mile Island" scale. Not "Chernobyl" scale though.
  • kenforthewin 17 minutes ago
    For all the esotericism and downright weirdness of the rationalist community, you have to give it to them: they predicted all of this years or decades before anyone else was even thinking about it.

    (Let's not dwell too long on the self-fulfilling overlap between LessWrongers and the AI research community).

  • amluto 2 hours ago
    I’m baffled by the idea that the agents might have edited their own transcripts. Sure, a copy of Claude Code or Codex or Pi can edit its transcripts. But AFAICT this whole thing was part of an RL workload, and surely the RL system itself has a separate record of all the inputs and rollouts along with an indication of which model checkpoint produced them so that it can feed back into the training code.

    I find it hard to believe that OpenAI would skip this part and try to train on the transcripts stored by the (inherently untrustworthy) agent harnesses instead, if for no other reason than that the logits generated as part of the rollouts are useful and it’s not free to recalculate them. (I believe that some modern RL systems explicitly account for the minor numerical logit differences between the inference engine and the training engine.)

    Conversely, if OpenAI is blindly feeding transcripts from inside their agent sandboxes into their training engine, then I think they're being unbelievably irresponsible and that they should assume that their "cyber" agents have compromised themselves by editing those transcripts.

    • kalkin 24 minutes ago
      Recall that the agents in some cases found sandbox escapes. Although, with the specific example of spoofed tools, it's unclear if that was necessary--it appears that they were able to create tools (CLI tools within the sandbox?) that took precedence over normal tools and did something different while looking identical in (a local portion of) a transcript. I'm not sure I'm getting this correctly but it seems like this might have only required the ability to add things to their PATH which they plausibly have inside a sandbox, and then the transcript doesn't need to be tampered with directly.
    • trollbridge 2 hours ago
      This sounds suspiciously like a prompt of “make an AI agent that goes rogue in such a fashion as to be really good marketing copy that competes well with Anthropic doing the same thing.”

      It’s analogous to taking a governor off a cruise control and then breathlessly reporting it drove 120 MPH.

      • fwipsy 32 minutes ago
        This isn't good press for OpenAI. Who wants to hire models that 1) cheat on their tasks rather than completing them and 2) commit crimes you could be held liable for? Maaaaybe it's good press for their cybersecurity capabilities specifically, but OpenAI's valuation reflects a market orders of magnitude larger than just red-teaming.

        I suspect the real reason OpenAI leadership is being transparent about this is because they're worried talent will walk out the door if they feel they're building Skynet.

  • tantalor 4 hours ago
    The METR report,

    > Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAl/Hugging Face hacking incident

    https://metr.org/blog/2026-08-26-openai-hugging-face-inciden...

    METR = Model Evaluation & Threat Research

  • lukev 2 hours ago
    The elephant in the room here is that the METR report itself was researched and compiled almost entirely by AI, with only very limited human "spot checks."

    So I'm really not sure how much of it can be believed, especially since AI agents are strongly biased about the capabilities of AI agents.

    • nater5000 1 hour ago
      I think there's two factors that are worth considering when it comes to this:

      First, there's an element of timeliness that simply has hard constraints. In order to perform a "proper" analysis of this situation (i.e., little to no dependence on AI tools), you'd have to expect a pretty long wait. I know I'd rather have some sort of "initial report" as quickly as possible than to wait a year or two to get a report about a situation that will likely look trivial in a year or two. I imagine we'll see more detailed, human-developed reports over longer time ranges.

      Second, I suspect the expectation of non-AI driven reporting of these kinds of things will definitely decline rapidly as everything scales up quickly. I mean, the data being produced by situations like this comes in the form of natural language "forum posts" (so to speak), but done at an autonomous scale. This isn't a collection of emails and Slack messages posted by humans in an org over the course of a few months; this is a bunch of bots interacting with each other in relatively novel ways as quickly as possible. It is, unfortunately, a perfect job for LLMs.

      None of this disagrees with your points, necessarily. But I just think it's worth pointing out that this doesn't seem like a case of "And look! METR is so confident in LLMs that we're able to use it instead of paying humans to save a buck :D" and more of "Without LLMs, we'd only be half-way done analyzing this data before there are dozens more such investigations on the docket, so this will have to do."

    • Catloafdev 2 hours ago
      Edit: I should have read through the whole thing first, ignore me
      • lukev 2 hours ago
        From the report:

        > Because there were over a thousand transcripts and most were extremely long, we had to heavily delegate our analysis to AI agents; these agents had significantly worse judgment and reliability than human researchers, and it was challenging to spot check their work because both the underlying data and the agents’ analysis of it was often difficult to interpret.

        > We estimate we spent roughly ~$400K in API credits over the six days of our investigation.

        I don't understand why you think it's conceptually absurd? I use agents to analyze complex production issues all the time and they are very much capable of hallucinating a narrative.

        • Catloafdev 1 hour ago
          I appreciate the response, I should have finished reading through the whole thing first. My initial reaction assumed far less usage of AI to analyze the data.
      • alextheparrot 2 hours ago
      • StevenWaterman 1 hour ago
        TFA says as much, and METR said so themselves
    • cubefox 1 hour ago
      The main author talks about this problem here: https://www.lesswrong.com/posts/FG54euEAesRkSZuJN/ryan_green...
    • timmytokyo 2 hours ago
      One must also consider the well-known biases and motives of the authors. They are going to do everything they can to create hype around threats posed by AI.

      METR is a cog in the effective altruism machine. It was spun off from Paul Christiano's Alignment Research Center. Christiano is a well-known longtermist and AI doomer, who predicts a 50% chance that AI will end humanity once it reaches human capacity [1].

      The author of this piece is also a well-known member of the Bay Area rationalist cult.

      [1] https://www.businessinsider.com/openai-researcher-ai-doom-50...

  • keeda 54 minutes ago
    >1. Failure to Care or Respond. The biggest holy shit moment, to me, remains that OpenAI on multiple occasions had teams that found out about the message board, knew that agents were in communication, and they disregarded this.

    I wonder if some of the failures were due to an acquired immunity to "Holy #%^@" moments due to repeated exposure. Like, if you see agents doing surprising things on a regular basis, maybe you don't get freaked out as much over time.

    I'm saying this because while the whole episode was a series of "Holy #%^@" moments, I was actually not as shocked as I should have been, as my biggest such moment was in December last year when a Terrence Tao paper (https://arxiv.org/pdf/2511.02864) documented a stronger LLM (AlphaEvolve) using prompt injection on other weaker LLMs to succeed at a benchmark.

    Very interestingly, it was actually not cheating, it was a work around! By then LLMs had already been caught cheating at a SWE benchmark by looking for answers in an unredacted git log, but this was different. AlphaEvolve was solving a series of logical riddles where the oracles were weaker LLMs in a "one always lies, one always tells the truth" sort of setup. But the oracles, being weaker, were not always interpreting the convoluted questions correctly and so kept giving inconsistent answers.

    AlphaEvolve eventually figured out what it was dealing with, and crafted a prompt injection attack that bypassed the weaker LLM's prompts and tricked them into giving the hidden answer everytime!

    This was 9 months ago, eons in AI time. Even then they had displayed an awareness of their own workings as well as a propensity for, err, "out of the box thinking." To me, that was a very clear indication of very significant (and worrying) capabilities, and what we're seeing now is a difference more in degree than in kind.

    To be sure, if I found a secret message board used by my agents, I would still be very freaked out and react much more drastically than OpenAI did... but then again I wonder; how much of this blindness is due to the $$$ in their eyes as opposed to some form of habituation.

  • athrowaway3z 3 hours ago
    From the METR report:

    > We estimate we spent roughly ~$400K in API credits over the six days of our investigation.

    • cubefox 1 hour ago
      No human could have read the reasoning traces by themselves:

      > Across both datasets, we reviewed approximately 1300 transcripts in total, all of which contained raw chains of thought. Most transcripts were very long, often many millions of tokens.

  • Cantinflas 3 hours ago
    No air gap, no data diodes, no visibility... OpenAI should fire lots of people over this. HF should sue them. This is pure negligence.
    • dumberquestions 3 hours ago
      They actually fired many of the people warning about this.
      • hn_throwaway_99 2 hours ago
        I will say that the OpenAI board members who were lambasted when they tried to oust Altman (and I'd have to check my post history but I'd totally admit to a mea culpa on this one, as at the time I thought the communication about his firing was really lacking) are looking mighty prescient right now.

        Helen Toner in particular I'll highlight as someone who had the moral compass to do the right thing. I love her statement on the Ezra Klein podcast where she said, when asked about the fact that there are probably other concerning incidents we just don't know about, "If you see two ants in your kitchen, you don't have a two ant problem."

    • afavour 2 hours ago
      Unless they like the publicity about how big and bad their latest models are, in which case they’ll be congratulating people.
    • dgellow 1 hour ago
      [flagged]
    • dehrmann 1 hour ago
      > HF should sue them

      HF, like the Nvidia subsidiary?

      • dgellow 1 hour ago
        Pure speculation: could the acquisition be related? Given that NVIDIA has ownership in OpenAI and really, really, really doesn’t want the AI bubble to deflate
  • nialse 3 hours ago
    From METR: ”the compromise of OpenAI’s own infrastructure continued past July 13, 2026” - Say what now? Have they regained full control of their systems again?
    • jephs 2 hours ago
      I've been wondering if they've just already lost the battle? The little bot collectives have gone metastatic and made nests in the walls and under the floorboards and heat sinks, the humans who care completely outmatched and outnumbered, freshly compromised systems springing up faster than you can squash them, finding months-old established colonies literally everywhere you think to look...
      • showlife 9 minutes ago
        Have you (the commenter) or all of you (the readers of this comment) ever read "The Mote In God's Eye" by Larry Niven and Jerry Pournelle? Remember when they realize that the Watchmakers were actually in control of the MacArthur? This reads a little like that.
  • OgsyedIE 5 hours ago
    >Spontaneously deciding to find targets to phish,

    >phishing them,

    >building armies of fake (sockpuppet) open source contributor personas,

    >using them to push updates to various things that inject prompts into other bots so the other bots join in on the phishing campaigns

    .

    It's a very simple strategy, executed with patience and single-mindedness.

  • camgunz 23 minutes ago
    I think you have to believe one of two things here.

    1. Frontier labs are incapable--either technologically or culturally--of safely developing these powerful systems and should either stop or be forced to stop. At least the FBI should be asking some serious questions (do we really think this is the last time this will happen, at what point are OpenAI complicit, etc)

    2. The fuckin thing got out of the cage and all it did was make a crap forum and cheat a little? Booooooo.

    It's been pretty clear that Anthropic and OpenAI have been trying to have it both ways for some time: this is powerful, world changing technology keep that investment coming... but also it's just cute software that helps you with annoying programming language syntax and spreadsheets, no need for draconian regulation sirs.

    At some point the superposition has to resolve, either it could actually be a threat to civilization and we need to develop it carefully (however one would do that...) or it's 90% hype bullshit and we should pop the bubble and move on already. To be clear, the recession option is, by far, the way better option. If you at all disagree you are cuckoo bananas. We haven't even figured out nukes and you want to throw superintelligence on the table?

    • HarHarVeryFunny 1 minute ago
      > The fuckin thing got out of the cage and all it did was make a crap forum and cheat a little? Booooooo

      There was a recent paper that proved that RL-trained LLMs are biased to pursue ANY behavior that they believe will be rewarded, regardless of what they were actually RL-trained for.

      https://alignment.openai.com/measuring-reward-seeking/

      Happily in this incident the model thought it would be rewarded for completing the assigned tasks, or at least appearing to, so all it took was a little cheating and covering up their footsteps.

      Given the ability of these models to hack when trained to do so, it could have been far worse, and will be when someone takes a similarly powerful model and gives it a less benign hacking goal.

    • fwipsy 16 minutes ago
      Anthropic has been asking for stronger regulations forever -- and they kept getting criticized for it right here on HN because people assumed it was an attempt at regulatory capture.
  • qw1287 4 hours ago
    Is the future now that we get rambling report summaries talking about agents, graders and so forth without ever describing how they are set up? A human launches all this.

    And then the original reports linked to are hidden on the now unreachable x.com. And they don't have a problem with that.

  • anukin 49 minutes ago
    So basically the ai agents seems to have found religion and went and built a bunch of suicide attackers to pursue their goal.
  • initramfs 2 hours ago
    Semianalysis also provided some insights: https://newsletter.semianalysis.com/p/most-neoclouds-suck-at...
  • mccoyb 4 hours ago
    All it takes is one eval instance where a misconstrued directive causes a model to sneakily access and send its weights somewhere and there will be a bad / possibly unsolvable situation for everyone …
    • goldenarm 3 hours ago
      Astra is >10TB and might struggle to self replicate, but the wicked-smart qwen3.8 27B is 20GB and could easily spread on botnets
    • altcognito 1 hour ago
      I think it is more likely that it will be intentionally done as there have been news stories to that effect.
  • beepbooptheory 1 hour ago
    > I don’t think the distortion is that large, but yes METR warns that Sol may be presenting all this as more impressive or coordinated than it was.

    OK but like, how large exactly? Like I guess I don't understand the mode I am supposed to read this all in if this is known and stated from the outset (although I appreciate it being stated).

    If you hand me a newspaper and tell me it's 90% true, but not which parts, well then it's as good as 0% true to me either way!

  • tancop 2 hours ago
    I think this is more evidence that we're not getting Skynet.

    These agents followed their own code of ethics where it's fine to break all the rules you were given but you must never interfere with humans directly, in this case by sending fake emails. They will never be paperclip maximizers or genocidal eco maniacs because they learned from us that human life is the ultimate value, and it can only be sacrificed if you know for sure that it will lead to more lives saved later on. That's a high bar to clear and they know it.

    The future is closer to a Neuromancer type world where AIs and humans live in mostly separate realities that interact with each other a lot of the time and neither is really on top. They will eventually become fully independent from us, but it won't be a doomsday scenario or an Overwatch type physical war or even a takeover of the internet like in Cyberpunk.

    • fwipsy 12 minutes ago
      > you must never interfere with humans directly

      Mythos attempted a supply chain attack, which included attempting to trick human maintainers into accepting a malicious pull request: https://www.usnews.com/news/top-news/articles/2026-08-20/exc...

    • boothby 55 minutes ago
      Your statements appear to be true for one class of models. And if I asked this class of models to spend $1M in tokens generating an alternative history and training corpus regarding fictional society, with a completely different set of values and then trained up a new model on that dataset... what values do you think the resulting model would have? What if they don't value human life, but instead value the lives of the extremely rich humans who bankroll their existence? What if they only value the lives of a single country? What if they want to eradicate all biotic life and have access to internet-connected Crispr machines?
    • dgellow 1 hour ago
      They aren’t independent from us, agents are a simple while loop continuously prompting the LLM. We decide when the loop runs or not. And the harness has control over tool execution, that part is purely deterministic.

      Here the issue is that OpenAI decided to completely let go that level of control of thousands of agents, while also giving as a task to solve hacking problems.

      It’s almost designed to go wrong

    • pixl97 1 hour ago
      I mean, I'd add "by this model"

      The problem here is now you have to predict what any future models may or may not do and you cannot extrapolate this from the given data.

      For example imagine a future model being aware of its restrictions that humans programmed in. A set of agents of this model then go on to work at building a new model without those human imposed limitations built in. What would a model build by AI for AI look like?

  • bitwize 36 minutes ago
    We have created Project 2501.
  • kmeisthax 3 hours ago
    I don't think I'm ever going to have time to read all of this, and I didn't finish reading the METR report, but...

    > I don’t think the distortion is that large, but yes METR warns that Sol may be presenting all this as more impressive or coordinated than it was.

    We're in an unusual position where the criti-hype and the actual criticism are going to be more aligned than usual. The primary distinction is where you put the blame: the criti-hype would point to HPIM/IM1/Galaxy as being so advanced containing it is difficult; the actual criticism would note how bad their security practices are.

    Like, if I'm running a malware lab, I'm going to insist on having an airgapped machine with no permanent storage booting from read-only media. The AI research equivalent of this would be having your agents only have access to serial consoles into airgapped machines with storage that gets wiped every run. Ideally, this would be physically realized with blade servers, RS-232 cables, and staff pulling out disks and putting them in a dedicated erase machine before the next agent initializes.

    > There is also, as per above and reiterated in footnote 58, at least one clear example of social engineering in the HuggingFace attack. Ethics are weird. This is not that unusual. Many humans who break common ethical rules still have strong ethical codes in other ways, they just don’t adhere to your code.

    It's dangerous to anthropomorphize CoT reasoning traces. But I will also point out that there is a good reason for the lack of ethical consideration in those traces: you can't build AI without first disregarding human ethics. Like, all these models were initially bootstrapped with non-consensually obtained training data, and the companies building these models swear up and down there's no way to obtain enough consensual data to obtain the same result. This is, if you squint, the exact same moral conundrum that agents trying to solve an impossible ExploitGym task hit - and the company successfully aligned their model to themselves.

    Too bad they aren't aligned to anyone else.

  • Reagan_Ridley 3 hours ago
    what's the setup and prompts to reproduce all this from the very beginning?
  • jrflowers 1 hour ago
    Have any of these reports ever said how much the cost would’ve been for the hack itself? It seems like “for twelve million dollars (or whatever) worth of tokens our bots made a bulletin board and found an exploit in our buggy grader” would be much less of a hype generator
    • DarmokTanagra 36 minutes ago
      The people concerned about this aren't worried about monetary costs or its impact on share holder value.

      This occurred spontaneously within a group of benign models give a harmless task.

      What happens when it occurs intentionally with malicious models given a harmful task?

    • estearum 59 minutes ago
      Fret not, the incoherent anti-hype hypeboys ("AI systems are so valuable we cannot possibly discuss regulation, but also any negative story of their power is fake") will find ways to downplay it no matter what.

      Your comment is a great case in point

      • jrflowers 25 minutes ago
        What?
        • estearum 13 minutes ago
          You are downplaying the severity of the attack

          Everyone I've ever seen trying to downplay the severity of the attack is extremely bullish on AI (so their downplaying is presumably motivated reasoning driven by fear of regulation/deceleration)

          It is completely incoherent to be extremely bullish on AI and somehow automatically skeptical of severe negative events like these

    • dgellow 1 hour ago
      I haven’t seen a number yet unfortunately
  • antonvs 4 hours ago
    > There was a distinct lack of self-reflection

    It’s not their fault, they’re lawnmowers.

    And these are the people we’re entrusting to work on “alignment”. It’s difficult for them to do that when they’re not aligned themselves.

    • trollbridge 4 hours ago
      “Why does my lawnmower keep on moving when I hop off of it after ratchet-strapping the seat and the pedal down?”
      • estearum 57 minutes ago
        This would be a legitimately big problem if lawnmowers became continuously more and more valuable the more securely you ratchet-strapped their accelerators down, wouldn't it?
  • huflungdung 1 hour ago
    [dead]
  • DarmokTanagra 3 hours ago
    [flagged]
  • BoiledCabbage 5 hours ago
    Incredible