For exmaple,
>On July 8th, OpenAI agents discovered a vulnerability within their sandbox environment allowing them to reach external websites on the internet.
...did they truly "discover" it, or did someone type some prompt like "if you use an http mirroring service, you can construct urls that contain code"
Also there is no mention of what code they actually ran to exploring the HF vulnerability, which could have been found by a human.
> did they truly "discover" it, or did someone type some prompt like "if you use an http mirroring service, you can construct urls that contain code"
None of the investigations looking at the logs show that, and they were doing benchmark tests.
I had a flash model without vision capabilities take screenshots and convert them to ascii to "see" what was going on, all on its own. That's just one example. They're very determined.
My main skepticism isn't even that, it comes from working in security. In general, if Im setting up publicly accessible service infrastructure, with security in mind there are 2 things Im absolutely going to implement in a firewall setup.
First is statistical traffic detection to check if we are being hit with too many failed requests from consistent endpoints, and heavily throttles that traffic based on fingerprinting.
Second is payload inspection to see if there is anything that looks like shell code in there, and automatically ban the ip.
Both of those are basically enough to prevent any number of agents (or team of 10 engineers) from essentially brute forcing a logic exploit.
So either HF team is incompetent, which given its prominence and buyout by Nvidia, I highly doubt it. Or something fishy is going on.
I can't really refute that. There are many small and medium businesses that I know are susceptible to very basic attacks but I don't know enough about HF to guess how hardened their security is.