Post

I did a somewhat deep dive into the recent OpenAI and Anthropic "hacks" for an upcoming interview. IMO, the AI companies are better off running with the "rogue AI" story because the real story is actually pretty embarrassing. Like making your Wi-Fi password "wifi" embarrassing. 🧵

Most if not all of the current hacks can be chalked up to security engineers moving too fast and misconfiguring their own testing environments. Like agents accessing libraries that should have been sealed off, Internet access being enabled when it shouldn't have been...

...Hugging Face apparently leaving the default admin access privileges on across database clusters... This is, frankly, amateur hour kind of stuff for run of the mill cyber and infosec teams.

Here's what I actually think these incidents reveal (instead of a rogue AI terminator situation): Much of the infra we expect to be hardened is actually being held together by glue and popsicle sticks.

2026 edition

Don't forget the Greater North American Cable Seeking Backhoe!

I'm spacing on the name of AT&T's auto-reroute-T3s-around-failures system that I worked with in the early 90s; iirc Hussein Eslambolchi designed it. The first version of it was in place just before a farmer used a backhoe to bury a dead cow, so we lucked out.