| ▲ | jackb4040 3 hours ago |
| > We are implementing stricter security controls for higher-capability models and associated activities, including isolated testing environments Stricter than what? You never even disclosed what happened in the first incident? This is nothing more than a setup to make it happen again and say "See? It broke out again, from an even stricter sandbox!" |
|
| ▲ | Tiberium 3 hours ago | parent | next [-] |
| They actually did a detailed presentation at BlackHat about the HuggingFace incident, and events that led to it. https://youtube.com/watch?v=87DyyMV0kCY |
| |
| ▲ | _puk 3 hours ago | parent [-] | | That was fascinating. Hijacking the package manager to pass messages between models and agents.. that's next level. Like "pssst, if you need internet access there's a vulnerability in x service" kind of messages | | |
| ▲ | ACCount37 an hour ago | parent [-] | | You've heard of 4chan for AIs, but did you hear of secret frontier lab AI hacker BBS? |
|
|
|
| ▲ | ducktective 3 hours ago | parent | prev [-] |
| > including isolated testing environments Given the attack vector having possible super-human capability, I'm not sure such an environment exists. "Isolated" according to who? Maybe seL4 could be a viable option here... |
| |
| ▲ | AlotOfReading 2 hours ago | parent [-] | | Isolation is a pretty standard requirement for lots of networks, especially gov. AWS provides isolation domains, and used to have a unidirectional cross-domain service called AWS diode. Or you can just configure your gateways properly / buy data diodes. Lots of possible solutions. | | |
| ▲ | jackb4040 an hour ago | parent | next [-] | | They can't have it both ways. You don't get to tell the media your product is more dangerous than nuclear weapons for precisely this reason, and then do less to secure it than an off-the-shelf AWS product that predates LLMs. | | | |
| ▲ | orthogonal_cube 27 minutes ago | parent | prev [-] | | There’s still levels to it. “Isolation” can mean the network hardware has no direct connections to an extranet. Data is transferred manually by physical media (USB, DVD, etc.) with logging and dedicated transfer stations. “Isolation” can mean a VLAN on equipment which has also has extranet access, creating a logical isolation rather than physical (to reduce cost). Data can be transferred manually or through diodes. And then there’s “isolation” which is a joke: machines technically able to access the internet but require proxy configuration (which isn’t set but can be easily derived). |
|
|
