Post

I did a somewhat deep dive into the recent OpenAI and Anthropic "hacks" for an upcoming interview. IMO, the AI companies are better off running with the "rogue AI" story because the real story is actually pretty embarrassing. Like making your Wi-Fi password "wifi" embarrassing. 🧵

Most if not all of the current hacks can be chalked up to security engineers moving too fast and misconfiguring their own testing environments. Like agents accessing libraries that should have been sealed off, Internet access being enabled when it shouldn't have been...

...Hugging Face apparently leaving the default admin access privileges on across database clusters... This is, frankly, amateur hour kind of stuff for run of the mill cyber and infosec teams.

Here's what I actually think these incidents reveal (instead of a rogue AI terminator situation): Much of the infra we expect to be hardened is actually being held together by glue and popsicle sticks.

xkcd.com/2347/