Hacker News Reader

Comment by reasonableklout | Hacker News Reader

I'm confused after reading both your post and the OpenAI blog post.

I thought the agents involved in the HuggingFace _were_ actually sandboxed, with no internet access, and only the ability to install packages via Artifactory. And they gained internet access during the HuggingFace incident because they found and exploited an RCE in Artifactory.

Would gvisor + Firecracker + credential-injecting proxy + real network isolation solve this problem?

I agree with you much more hardening is needed. I'm actually confused now what OpenAI means when they say they're going to start sandboxing more things.

View on HN

They were not serious about their sandboxing. Bugs in artifactory allowed escape, but they broke out of their Linux namespace/user by exploiting the kernel with an existing public cve. Sharing a kernel like that is not a serious barrier which is why cloud providers user virtualization for customer workloads.

Firecracker avoids sharing the whole kernel, and gvisor drastically reduces the attack surface of the kernel. Breaking through both layers would have been much more challenging and a demonstration of the model's capabilities rather than the sandbox's weakness.

Artifactory is self evidently not a security barrier, and as an exposed network service it should have been audited and after the first issues were found, rejected as a candidate. There's never just one security vulnerability.

Security is an onion. You just don't 'sandbox' and you're done. Models need tooling and access to some kinds of systems to perform their tests. Quite often these systems have multiple interfaces. For example a filtered one in the sandbox side and a less monitored one on the other interface.

It would be interesting to see the models behavior before and after it gained internet access and an external means of communicating with itself.

If the model played nice before it had access and changed it's behaviors once gaining external access we need to delete it as it's a deceptive model.

> Would gvisor + Firecracker + credential-injecting proxy + real network isolation solve this problem?

Yeah, basically. I mean I'm handwaving but yes, some combination of those would have made the attack way too expensive.

Reply on news.ycombinator.com