Is this legal? I know I can’t try and break into my neighbors house even if I have no intent of going inside and stealing once I break the lock.

> I know I can’t try and break into my neighbors house even if I have no intent of going inside and stealing once I break the lock.

They didn't break in. They found a key that their neighbor dropped and returned it.

> Is this legal?

Generally, yes (though ask a lawyer if you're going to do security work). Security researchers do occasionally get legal flak though, depending on which idiot they annoy by pointing out issues.

It's implied (but sadly not stated) in the post that they asked for baseten's permission before conducting this research.

What's interesting to me as someone who has sold a lot of software to a lot of software companies is that many enterprise vendor agreements explicitly allow companies to pentest their vendors with advance notice and coordination. I don't think any of our clients ever exercised that clause; I expect it's going to be exercised a lot more going forward because it's so easy to do now.

Your intuitution is right. At least in Germany it is not legal if not asked for permission first.

https://www.nilsbecker.de/rechtliche-grauzonen-fuer-ethische...

See also the German Criminal Code, starting with §202a "Data espionage":

https://www.gesetze-im-internet.de/englisch_stgb/englisch_st...

It's not, in most juridictions at least, but it would be insanely stupid for baseten to sue (and the hacker would probably not get much more than a slap on the wrist given that they weren't malicious).

They probably negotiated a "permission to attack" before letting Strix off the leash, as pentesters usually do.

when t̶h̶e̶ ̶P̶r̶e̶s̶i̶d̶e̶n̶t̶ an AI company does it, that means that it is not illegal.

- AI Richard Nixon