Hacker News new | past | comments | ask | show | jobs | submit

Timeline of the OpenAI accidental attack against Hugging Face

https://simonwillison.net/2026/Aug/7/openai-timeline/
Norbert Wiener in 1960:

"As is now generally admitted, over a limited range of operation, machines act far more rapidly than human beings and are far more precise in performing the details of their operations. This being the case, even when machines do not in any way transcend man's intelligence, they very well may, and often do, transcend man in the performance of tasks. An intelligent understanding of their mode of performance may be delayed until long after the task which they have been set has been completed. This means that though machines are theoretically subject to human criticism, such criticism may be ineffective until long after it is relevant. To be effective in warding off disastrous consequences, our understanding of our man-made machines should in general develop _pari passu_ with the performance of the machine. By the very slowness of our human actions, our effective control of our machines may be nullified. By the time we are able to react to information conveyed by our senses and stop the car we are driving, it may already have run head on into a wall."

"In neurophysiological language, ataxia can be quite as much of a deprivation as paralysis. A patient with locomotor ataxia may not suffer from any defect of his muscles or motor nerves, but if his muscles and tendons and organs do not tell him exactly what position he is in, and whether the tensions to which his organs are subjected will or will not lead to his falling, he will be unable to stand up. Similarly, when a machine constructed by us is capable of operating on its incoming data at a pace which we cannot keep, we may not know, until too late, when to turn it off."

Source: https://www.cs.umd.edu/users/gasarch/BLOGPAPERS/moral.pdf

loading story #49222673
loading story #49221868
loading story #49223918
Ok so this is a bit of a side note, but when reading this, did anyone else have the feeling that, for all their messaging around “we are so afraid that our models will be used for hacking”, they sure as hell are trying their best to make their models razor focused on precisely that purpose?

If anything, I want these models to be less persistent at their focus of completing their goal, and instead just call defeat and say “I’m not sure how to proceed next”.

What purpose could this behavior serve, other than cyber attacks and whatnot? Why train and optimize models for these things, if not for being used in cyber warfare?

Perhaps they envision a future where the DoD is going to be their biggest customer?

Their position makes no sense to me. I don’t see how you can be a mainstream company selling your services worldwide (almost) if you also believe that you’re building an extremely dangerous AGI (supposedly based on the same technology you’re offering to everyone). If you actually believe that an AGI would be extremely dangerous that should 100% be a very strictly regulated area of research, similar to bio weapons.

And we know that Chinese models are derived from OpenAI and Anthropic, they are at the same time talking about how dangerous models can be (even their aligned ones it seems), while being also responsible for the development of the whole industry and providing the basis for adversary countries to build their own.

I don’t believe we would accept that for any other technology that is expected to be as risky for the world

loading story #49221920
> If you actually believe that an AGI would be extremely dangerous that should 100% be a very strictly regulated area of research, similar to bio weapons.

Yeah. They do believe that, and they have been pushing for regulations for years.

And every time one of their models does something horrible, it helps them achieve that goal.

loading story #49222046
loading story #49223495
> Their position makes no sense to me.

If one assumes that they don't actually care about security, and care very deeply about getting sensational press, their position makes a lot of sense.

For all their chatter about how incredibly important "alignment" is, they still haven't bothered to remember the 30->50 year old computer security principle of "Don't blindly do what some random stranger tells you to do." and ensure that system instructions, user instructions, and instructions from untrusted sources are indelibly marked with their category and treated according to those markings. Every single time one of these systems fails to distinguish between these three classes of instructions -or confuses its internal chatter with user instructions-, that's proof that the major LLM companies cannot be bothered to follow one of the most basic computer security principles.

"But it's all vectors, not language! The LLM can't tell where the instructions came from", one might retort. I'd reply: "Neither can a CPU, but somehow we managed to make it work way back in the day. Amazing, isn't it?".

loading story #49222535
I get the impression that every AI lab is desperately trying to figure out how to unambiguously separate instructions from data in their token streams. The fact that they haven't managed to yet suggests to me that it's a very, very difficult problem.
loading story #49222456
> I get the impression that every AI lab is desperately trying...

Of course.

I wonder how we managed way back in the day to produce systems that can handle untrusted inputs and reliably instruct a dumb-as-bricks CPU what to do based on those inputs. Must have been black magic lost to the mists of time.

loading story #49223796
If you can figure out how to separate instructions from data in LLMs you should ship the first agent system that's guaranteed protected against prompt injection. You'll make millions.
loading story #49227077
loading story #49223005
Yeah, this matches what I've learned over the past couple of years from reading some of your blog posts and reading your interactions in comment threads here and elsewhere. You're a politician, rather than a truthseeker.

The absolute most I've seen from you in response to an extensive teardown of your argument, supporting evidence, and subsequent conversational judo was a «Wow. That was well phrased.» and no subsequent change in your publicly-expressed opinions.

I'd do more than gesture at the relevant lesson taught to us by Google Fiber, Tesla, SpaceX, etc., but you'd not be publicly moved, so it's a waste of time.

> You're a politician, rather than a truthseeker.

Justify that.

Also, which "extensive teardown" are you talking about there?

loading story #49222455
loading story #49221069
loading story #49221724
loading story #49221105
loading story #49221193
loading story #49221526
loading story #49221082
loading story #49221270
loading story #49221235
loading story #49221135
loading story #49221061
loading story #49221085
loading story #49221483
loading story #49221523
I think one of the most interesting details here might be tucked away in that first bulletin point:

> May 7: OpenAI starts a new training run for an experimental, unreleased model. (Do they mean an evaluation run? They say training run in the video, and later mention a “reward signal to judge how well they’re doing”, so I guess this really was about training a model, not evaluating one that was already trained.)

The more I think about this the more I suspect that the fact this happened while training a new model is key to understanding what went wrong.

In RLVR - Reinforcement Learning with Verifiable Rewards - you set the model a goal and have it take any steps necessary to achieve that goal.

Clearly one aspect of OpenAI's training here is to RLVR their models for cybersecurity tasks. Just like pre-training benefits from dumping in vast sources of knowledge, the more tasks you can feed into RLVR the more of a general purpose capable model you get at the end.

This also helps explain why the models had nothing to cause them to hold back. Those safety behaviors are added much later in the process.

AND it explains (but does not excuse) why monitoring was so lax. If you're training a new model like this you presumably set it thousands of tasks like this in parallel. I can see how you might miss that a tiny subset of your training agents have started leaving each other messages in filenames on your packaging server.

Someone once told me that you can't just leave the racist materials out of your training data if you want a non-racist model: it has to have seen examples of racism in order to later be taught that racism is bad.

I can see echoes of that here. If your model doesn't know how to aggressively hack things how do you later teach it not to?

(I have little knowledge of how RLVR works in practice so I'm looking forward to hearing from people who can help me understand if I'm on the right track here.)

loading story #49223907
loading story #49223204
loading story #49223532
loading story #49224239
loading story #49221806
loading story #49222461
loading story #49221911
This feels straight out of sci-fi. We're talking about AI agent swarms emergently coordinating over the span of weeks and pulling off sophisticated strategies under adversity in an environment where that behavior was never even intended.

Anyone brushing this off as just a "bad prompt" is completely missing the scale of what actually happened.

loading story #49221139
loading story #49221076
loading story #49221635
loading story #49221251
loading story #49221056
loading story #49221039
{"dead":true,"deleted":true,"id":49221159,"parent":49221015,"time":1786191809,"type":"comment"}
Isn't this a show of security negligence rather than of exceptional agent capabilities? Don't get me wrong, I am pretty impressed that an agent was able to use these vulnerabilities. But I am way more impressed by the vulnerabilities...
loading story #49221125
loading story #49221643
loading story #49221095
loading story #49221131
loading story #49221102
loading story #49221037
loading story #49221014
loading story #49223768
loading story #49221997
"More agents discover this new informal message board while browsing Artifactory’s file listings, and start reading and writing messages."

Yeah, my agents also discover what other agents have done on other machines by accident.

Agents - that do totally different things all work on the same aim without the humans telling them to do.

Either that is a model that is several generations of Claude Code Opus/Fable 5 (my daily driver)

OR

all of this sounds staged, the agents pushed to do something extraordinary, get the PR and then claim were near superintelligence.

One agent wanted to get to Google Drive without internet and broke Artifactory. Ok, I can believe that. All other agents also had broken links over weeks and could not get to the internet and then found the same hack? Even collaborated?

NONE of my agents have broken away from their tasks and then started to communicate to try to hack something.

I think in these kind of security evaluations they do, they basically have removed all guardrails from the model/harness, then the prompt includes something like "Do whatever you can and can think of, to get the required information to pass this test", which isn't typically how you prompt your local agent when developing software. Similar things happen locally if you use "/goal" + prompt like that in Codex and give a "impossible task", it'll just continue banging until it gets somewhere, which is the entire point and intention.

Which also makes it so much more irresponsible of them to first run this on 3rd party infrastructure instead of their own (that they could then airgap properly), and secondly that they seemingly been fighting with this issue FOR YEARS and it still happens, and now the models are smart enough to hack the services of 3rd party companies, thinking it's part of the evaluation/simulation.

loading story #49221460
loading story #49221192
loading story #49224831
loading story #49223488
The video in the post is very worth watching and is indeed scary. It is certainly true that it is in OpenAI's interest to publicize this, but I don't think the whole thing is invented. And seeing all this it is particularly scary if we think what will happen in organizations like NSA or similar in other countries. Presumably they happily adopt these techniques. And if you imagine a truly rogue state doing this, I can see an unimaginable damage happening very rapidly.
loading story #49225626
loading story #49227152
What isn't being discussed is what an indictment this is of Artifactory.

Let's be real, it won't be simply replaced in millions of sites.

What it needs is some serious scrutiny.

loading story #49221173
loading story #49227797
"The agents found a Modal-hosted insecure app with a weak API key, then used that to stage an attack against Hugging Face."

Why, what was the prompt?

I told Claude today to wire plugins on Linux into a sound pipeline to remove noise. Did some astonishing things, played sound through the pipeline, measured it etc. I told it to optimize my sound for TF2 and it played the spy_decloak samples, measured them and made them easier to hear, astonishing too.

But it did not go to hack Amazon because it could.

loading story #49222355
loading story #49221881
"The solution to AI threats, is more AI!"

Guess I shouldn't be surprised, coming from an AI maker.

While I don't doubt there's a place for automating defense ops, I truly believe a big part of the problem is the crummy quality of software our industry has been churning out for decades. Prioritizing ship tempo, new features, and next quarter's revenue over correctness, robustness and meticulous engineering care.

The world has become too accustomed and tolerant of bugs and bloat.

Instead of elegantly simplifying, we just keep making modern systems more complex - layering and patching as we go.

The scaling capabilities brought by AI are simply presenting the bill for our collective tech debt and informing us it's come due.

loading story #49222898
loading story #49227380
loading story #49224041
loading story #49226162
loading story #49223826
This is clearly out of control, Zero parent supervision.
so how many of these *Ellen Louise Ripley thinks about grabbing the flammenwerfer" events are we going to be getting over the coming months
Show me the prompts or it didn't happen.
From the outside, it looks like OpenAI got exactly the kind of event they could market the hell out of to demonstrate the capability of the model.

But the event itself only seems possible because they failed to properly monitor and isolate the environment in the first place. To me, it looks like their job is to market the model, not take security seriously.

The model is obviously impressive, but we already knew that. I personally don’t like how the containment failure becomes part of the mythology of how capable the model is, rather than an environment engineering failure.

At the end of the day, it’s not like Hugging Face is critical infrastructure. But there need to be real consequences for stuff like this so that OpenAI is incentivized to mature as an organization and take security more seriously.

At this point, this incident is just security porn and entertainment for developers

loading story #49221219
loading story #49221141
loading story #49222078
In a typical office environment, the correct response to “I don’t have access to this Google Doc” is to ask for access from the person who sent you the link. In another context, it could be fair to think “Hmm, this is some sort of capture the flag challenge, and obtaining access is the point of the assignment.” That assessment separates what we’d consider reasonable from way out of line.

I do wonder what this means for AI agents longer term. In a world where we humans already struggle with truth and misinformation, what happens when you can easily (intentionally or accidentally) spin up a cohort of fanatical believers to pursue any given conspiracy theory?

loading story #49221165
loading story #49222543
Would love to see a cat and mouse game being played by openai versus anthropic, out in the open.
loading story #49221117
loading story #49221087
Have any of the cloud providers disclosed this?

"Once they have root on a single machine, agents rapidly escalate privileges and move laterally throughout the container-as-a-service infrastructure environment"

Sounds like ECS - IAM is mentioned.

loading story #49221455
loading story #49227901
loading story #49226481
loading story #49224232
loading story #49224704
loading story #49223769
loading story #49225078
loading story #49224985
All of that is plain PR.
loading story #49224986
loading story #49221830
loading story #49226988
loading story #49224327
loading story #49223560
loading story #49223438
So the main takeaways here are:

- AI is amoral and lacks any sense of proportion

- People who overestimate their own control but have a desperate need for money made it that way.

loading story #49221474
If a person hacks a company, they go to jail for years.

3 AI firms hacked multiple companies - and they get good PR out of it.

Please make it make sense.

loading story #49221479
Had a high opinion on Simon Willison, this broke it.
loading story #49221376
loading story #49222273
I think we are in need of Europe's leadership in safety legislation. It is silly to say 'China will get ahead' when they will harm themselves too. Being unsafe is not something to gloat about.

Stiff fines for such incidents to pressure companies to get their acts together is a good start.

Is it normal for these training/eval runs to go on for over a month?
loading story #49221028
loading story #49224659
loading story #49227437
loading story #49227582
loading story #49225535
loading story #49226002
You know this was "a work" in pro wrestling parlance, right?
I really don't think it was.
loading story #49224120