Post

Simon Willison
@simonwillison.net

Just had to create an "accidental-cyberattacks" tag on my blog We're up to four now: the original OpenAI+Hugging Face one, Anthropic's me-too attacks, then two new ones from the UK AI Safety Institute and Irregular that OpenAI reported yesterday simonwillison.net/tags/acciden...

simonwillison.netSimon Willison on accidental-cyberattacks4 posts tagged ‘accidental-cyberattacks’. Incidents in which an AI lab was testing the cyberattack potential of a model and it inadvertently performed a real attack against another organization.
Vikram Seraph 🪽
@vikramsaraph.com

Definitely not coincidence that these events are happening so close to one another, but is the more likely explanation that (1) these models’ capabilities roughly keep up with one another or (2) oneupmanship?

Simon Willison
@simonwillison.net

I think the explanation is that until the OpenAI + Hugging Face thing people just hadn't been keeping nearly as close an eye on their logs as they should have - this has been happening undetected for months

Vikram Seraph 🪽
@vikramsaraph.com

So perhaps closer to (2) then but perhaps oneupmanship is the wrong word then…. Something about how once one org has an incentive to disclose/investigate, so do the others.

Mark Eichin
@eichin.bsky.social

Feels like they're going for "everyone is this sloppy, so it's Industry Standard Practice (so please don't come after all of us with CFAA prosecutions)"