Hugging Face incident, AgentBaiting, RubyGems, CrashStealer, and new PolinRider research

In no particular order, the first thing on my list is the disclosure from Hugging Face that came through, I don't know, three, four days ago.

They said that, and I'll quote here, a data set uploaded to its platform abused a security vulnerability to run malicious code on its servers.

And I took a look up there um disclosure a lot of other people in the community did it was a lot of like we can't really tell what you're saying happened here um a lot of people said it was very obviously written by ai which i can concur which i i will say is you know not always the greatest thing in your your ir reports but then What, yesterday we saw a follow-up, OpenAI came out and claimed that one of its models did the exploit, that it broke itself out and, whoops, sorry, we hacked Hugging Face.

They said it was an internal cybersecurity test that went awry.

They claimed that it escaped an isolated testing environment, reached into Hugging Face's system from there.

We're seeing two reactions to this news.

One reaction is kind of just the news being put out there is true, that, oh my gosh, this thing happened, OpenAI did this thing.

And then the other side, which is mostly hanging out in the cybersecurity community, cybersecurity community, that's a lot of words, is people calling BS on this claim.

And there's various reasons for why people are calling BS on the claim, but ultimately it kind of comes down to a lot of the community thinks that's a marketing stunt and that this did not really happen or didn't happen in the way that maybe they're saying it did.

They're not providing very much information.

So Paul, you've been looking into it.

What's your hot take?

Oh, man.

Well, I'm definitely in that other camp, the skeptical camp.

I wouldn't say that I'm like, I don't think, you know, I think it's I think there's some nuance to my position in the sense that.

All right.

So I would say the first group is the singularity group, right? Like, oh,

my God, this is this is

evidence that AI is AGI and all this other bullpucky.

And I think the other group that I fall squarely in is the much more skeptical group.

um so the details are light which is always concerning right and you see this kind of theme coming out of the the ai labs where they like to make these big splashy things they call incident response you know publications or whatever but they really are lacking they weren't written by people that do ir or anything right so um short story long Just the details are missing.

The idea that like a lot of people in the skeptical side think like, oh, how could open AIs security be so lax? Sorry, be so poor that that, you know, it could find this way the whole out from the isolation and out to the Internet, blah, blah, blah.

I don't see that as being that, you know, that's not a deal breaker for me.

But what is a deal breaker for me is that they just haven't talked about, you know, what happened.

And so just my immediate flags go up.