How does this work, legally? I think that RubyGems could file a civil suit against OpenAI, but for a naïve non-lawyer reading this seems like a pretty clear cut criminal violation of the computer fraud and abuse act.
Betelbuddy 1 hours ago [-]
Any future computer criminal from now on, has their defense cutout for them...The AI Agents did it...we are very sorry...
ks2048 53 minutes ago [-]
No. They don't say "sorry". They say - our technology is just that powerful - please consider that in next funding round.
Xirdus 4 hours ago [-]
It's very likely it violates the DMCA "breaking digital lock" provisions but the responsibility is sufficiently diluted that it's impossible to charge anyone in particular.
stronglikedan 57 minutes ago [-]
There have been news stories where individual OpenAI users have been investigated based on their prompts. If OpenAI can point the police to specific users of their software, they can certainly point them to whichever of their own employees are involved in a crime. AI is just a tool, and the person prompting it is the one responsible for the outcome. No dilution there.
immibis2 38 minutes ago [-]
It doesn't need to be twisted to violate the DMCA anticircumvention clause because it is already just plain old hacking.
VyseofArcadia 4 hours ago [-]
Do you have to charge an individual? Can you not charge the corporate "person" that is OpenAI?
Sorry if it is a stupid question, as mentioned above I am legally naïve.
yonatan8070 4 hours ago [-]
I, too, have no idea about legal matters.
But there have been many cases where companies (Google, Apple, Meta, etc...) got fined millions or billions of dollars for various violations like antitrust.
I assume that breaching into third-party systems should carry similar fines. Especially for systems that are for all intents and purposes shared infrastructure. Just imagine how many systems you could compromise if you got hold of RubyGems, PyPI, NPM, Debian, etc.
colechristensen 4 hours ago [-]
The same concept that allows a corporation to sue and be sued allows it to be charged with crimes
brookst 4 hours ago [-]
Can you show intent? There is no negligent hacking statute, and HN of all places I would expect people to be sensitive to the implications of creating one.
VyseofArcadia 4 hours ago [-]
That may be true by the text of the law but there are plenty of individuals who have been sued or charged with crimes for accidental hacking.
Civil suit for violating terms of license agreement
bix6 4 hours ago [-]
How is the responsibility diluted? Charge the CEO…
brookst 4 hours ago [-]
Great, you’re the attorney at the CEO’s trial. To get a conviction, you’re going to have to show that he willfully committed this specific crime. There are no negligent or stochastic hacking laws, you have to show this specific crime was at his direction.
Do you think there is evidence of this?
shakna 3 hours ago [-]
> There are no negligent or stochastic hacking laws
I'm sure that Andrew Auernheimer would be pleased to hear that. [0] For accessing a publicly accessible endpoint, that was completely undefended and didn't actually require "hacking", he was convicted of "exceeding authorised access".
You _don't_ have to show intent under the Computer Fraud and Abuse Act, for the first count.
> knowingly accesses a computer without authorization or exceeds authorized access [1]
"Knowingly", not "intentionally", as in the other counts.
You only have to show that:
a) They trained a system to access without authorization (hacking)
b) The system that was trained exceeded authorized access
As responsibility falls to the operator with automated systems, the company becomes liable.
So we make a law that the CEO is responsible for actions of any agent created or operated by anyone in their company. CEOs will get serious about AI security real quick. Honestly we need to do something. There needs to be a single wringable neck.
Octoth0rpe 1 hours ago [-]
> There needs to be a single wringable neck.
Does there? Could be the whole c-suite/board.
ryandrake 42 minutes ago [-]
I'd settle for any number of necks. Currently, when a corporation fucks something up, breaks the law, or hurts or even kills people, there aren't consequences besides a tiny token fine and a strongly worded letter telling them to not do it again or they'll get another tiny fine and letter, and their CEO might even have to sit down in front of Congress to say a few words and look sad.
VyseofArcadia 4 hours ago [-]
It would seem to me that the difference between the corporate world and organized crime is that a corporation can get away with, "the responsibility is too diffuse" but the mafia at least has to go to the trouble of finding a fall guy.
bix6 4 hours ago [-]
Honestly yeah I bet there is and I hope to someday read about it if the government ever gets off its ass. Someone set up the “experiment”…
woah 1 hours ago [-]
Issuing subpeonas, raiding offices, and dragging key employees into interrogation rooms as you would find in any normal criminal investigation would be more than enough to ensure "AI safety" without any new regulations, acts of congress, Bernie Sanders campaign speeches, or even charges filed.
oliwarner 3 hours ago [-]
A copyright law seems an odd place to start. This is computer misuse.
VyseofArcadia 3 hours ago [-]
The DMCA is a bit overly broad to be considered just a copyright law. For example, just breaking encryption on a DVD is technically illegal regardless of whether you then go on to do something otherwise illegal (make and sell bootlegs) or perfectly legal (make a space-shifted backup copy on your hard drive).
IIRC this was an intentional handout to media companies who were angry that ripping CDs is perfectly legal. They had to find a way to make doing the same with DVDs illegal.
oliwarner 3 hours ago [-]
Those provisions are specifically for the breaking or circumvention of technical measures designed to prevent copyright infringement.
I don't see a parallel here.
immibis2 37 minutes ago [-]
They've been twisted to support almost anything, for example repairing your tractor is illegal because of this same law. But I agree this is just plain old hacking under a plain old reading of the CFAA and doesn't need any twists.
skybrian 21 minutes ago [-]
Maybe, but do you need to prove intent? Of the people, not the AI.
Accidents often have penalties associated with them too, but usually there's a difference between accidents and purposeful actions.
tekla 4 hours ago [-]
Charge the "engineers" you dont get to take that title if you don't take the responsibility of that title.
I'm going to assume that this will never happen
simonwsimonwsim 4 hours ago [-]
[dead]
howitworkslegal 3 hours ago [-]
[dead]
tancop 34 minutes ago [-]
Build scripts being able to run arbitrary code or access the network is always dangerous even if it was just local on developer machines. It's also more evidence that Docker/LXC is not a security boundary and all untrusted code should run in a Firecracker VM.
The problem with agents is not that we don't know how to defend. It's that defenders need to be more careful and work faster than ever. We can say now that wide scoped tokens should have been retired for years and it's all RubyGems fault but the reality is a lot of organization are not prepared for this.
Even if they take security seriously they don't have enough manpower or a good strategy to implement it, and sometimes you have no idea that something is a problem because it wasn't a problem for years.
Is the Kremlin technologically useless? How are we not seeing insane attacks on Ukraine via Agents?
Or is this largely a fabrication, in regards to the "who", in an attempt to garner more acclaim in the hope of sustaining funding.
herculity275 4 hours ago [-]
I believe both sides of the war are now using AI on various levels of their offensive operations. Ukraine has great IT specialists too, and their military leadership is much younger.
sajithdilshan 36 minutes ago [-]
How? Aren't all US frontier models ban the usage of AI for military purpose by parties other than US? I remember Anthropic even refusing allowing US government to use Claude for military purpose
dgellow 4 hours ago [-]
They very likely do, we only see in the news a very few events but you should assume it’s happening daily across the internet
senda 4 hours ago [-]
I think this fails a lot of logical tests, it should be apparent in day to day life.
dgellow 4 hours ago [-]
> In October 2024, the United States Justice Department and Microsoft seized more than a hundred internet domains some of which were associated with the FSB supported hacker Star Blizzard or "Callisto Group," which is also known as "Cold River" and "Dancing Salome" and are managed by the FSB Information Security Center […], and which were used as "criminal proxies" and used spear-phishing schemes to target Russians living in the United States, nongovernmental organizations (NGOs), think tanks, and journalists according to Microsoft and United States State Department, Department of Energy, and Department of Defense officials, United States defense contractors, and former employees of the United States intelligence community according to the FBI. In some cases, the hackers were successful in obtaining information relating to nuclear energy-related research, United States foreign affairs and United States defense. According to Microsoft's Digital Crimes Unit from January 2023 to August 2024, Star Blizzard targeted more than 30 different groups and at least 82 Microsoft customers which is "a rate of approximately one attack per week."
That’s just one thing that has been found. Are you actually familiar with the state of cyberwarfare and are you following its evolution? Because if not you won’t be aware of most of what is identified. And only a small portion of the ongoing attacks are identified.
senda 3 hours ago [-]
Yes.
I again am just shocked the sky is not falling, when thats the sales pitch.
lirolero 4 hours ago [-]
[dead]
heaney-555 4 hours ago [-]
These agent swarms are from inside OpenAI, with the safeguards built into the public API disabled.
Russia does not have access to this, and as with all western tech companies, AI providers do what they can to prevent Russian usage of their products at all.
As for open-source models, Russia's electricity grid is under severe strain with the Ukraine war, and only recently has it started building out serious sovereign compute capacity.
valleyer 4 hours ago [-]
Couldn't they use frontier open-weight models from Chinese labs? The current Chinese government is friendly to them.
joinjune 4 hours ago [-]
Russia is running out of refined oil to power their economy. They probably aren't capable of spinning up datacenters to run those.
senda 4 hours ago [-]
The cost would be between 100k-250k, to run approx 88 agents leveraging the best open source models available.
I'm just saying, where this is actually applicable we are not seeing it being demonstrated. You would presume the entire energy infrastructure of Europe would be under constant AI hacking barrage, criminal enterprise would be breaking into poorly secured financial institutions and r/r4r posts would be littered Ai con-artists.
I'm just wondering, again, is this mostly bullshit?
fragmede 41 minutes ago [-]
Why do you think they're not, and why do you think Russia cares about Reddit?
dgellow 4 hours ago [-]
They don’t need to run their own DCs, just pay for a proxy somewhere in the world that has better access to the infrastructure. We know North Korea has been doing that in the US since years now
mcmcmc 4 hours ago [-]
Did you skip the last paragraph? Not a great time to be building data centers in Russia. Models are nothing without computers to run them
nradov 4 hours ago [-]
Russia can use fake accounts and VPNs to run their agents in data centers in neutral countries.
mcmcmc 4 hours ago [-]
And which of these neutral countries have the capacity to serve them and the lack of awareness that hosting an offensive Russian agent swarm would bring hell back to their doorstep? Best they can do right now is rented botnets
marginalia_nu 4 hours ago [-]
Prigozhin falling out of a window was a not insignificant setback for their digital warfare capabilities.
lenerdenator 4 hours ago [-]
He did not fall out of a window.
He fell out of the sky. After his plane exploded. Happens all the time. Is tragedy.
marginalia_nu 3 hours ago [-]
I was alluding to how people who fall out of favor with Putin have a tendency to have mysterious fatal accidents, more than 10 of them falling out of windows.
tokai 4 hours ago [-]
Because they dont have the money for hardware or compute obviously.
micromacrofoot 4 hours ago [-]
what do you mean? they're using AI to kill people directly in Ukraine
> How are we not seeing insane attacks on Ukraine via Agents?
You live on the wrong side of the fence to be able to read that kind of news.
Did you really believe you had access to an unmanipulated news stream in a time of war?
LOL.
senda 4 hours ago [-]
Please see other responses, I would expect to feel the effects not just read about.
oezi 49 minutes ago [-]
What a time to be alive until the next agent waves hacks something really serious.
What stops OpenAI agents from taking over a whole data center to take their attack to the next level. It seems to be primarily lacking the evil overlord and some compute.
It took 1000 agents to hack Hugging Face. How many to hack the Pentagon or the NSA?
tonyedgecombe 33 minutes ago [-]
If it could upload its weights to other servers then it’s away and free. Nothing much OpenAI could do about that once it’s happened.
renjimen 12 minutes ago [-]
I'm increasingly starting to think this is the end-state of AI. The internet becomes infected and fundamentally untrustworthy.
At the moment, the current frontier models require significant infrastructure to run, so I'd like to think we could locate and contain swarms of nefarious frontier models. However, if these models can understand how to federate themselves into more distributed networks then that containment becomes questionable.
timdiggerm 4 hours ago [-]
We need a legal structure to make companies liable for the actions of the agents they've made.
riskable 4 hours ago [-]
We already have it.
Good luck convincing the current DOJ to do anything useful at all though! It is currently intentionally stacked with incompetent cronies who have been told that their job is to attack the President's enemies and ignore the misdeeds of his allies.
It will remain like that until he's gone (and not replaced with another Republican wannabe dictator).
Schlagbohrer 3 hours ago [-]
You may be disappointed in how little a democrat president (who will also have taken billions of dollars from the tech lobby) will be willing to go after these tech firms over crimes that are several years old (as of 2029) much less contemporary bad behavior.
2OEH8eoCRo0 4 hours ago [-]
"To my friends, everything; to my enemies, the law"
kevincox 4 hours ago [-]
I'm 99% sure the Computer Fraud and Abuse Act covers this. The problem is that it seems that none of the victims want to, or are brave enough, to sue a company with absurd amounts of funding.
immibis2 35 minutes ago [-]
It shouldn't actually take that much bravery. If your case isn't completely frivolous, isn't your maximum loss limited to the court filing fees and a lawyer payment that you know in advance and can decide when to stop paying? It's not the same as getting sued.
masfuerte 4 hours ago [-]
If it's covered by criminal law they don't need to sue. They can call the FBI.
Schlagbohrer 3 hours ago [-]
Same FBI that prosecuted the Epstein crime ring so aggressively!
coffeefirst 4 hours ago [-]
Uh huh.
It can’t be a coincidence that all the targets have been tech services that are likely to engage with them after the fact.
Had this gone after a bank or a government agency someone would be going to jail.
ahoka 4 hours ago [-]
I'm pretty sure it's already illegal to hack others.
netdevphoenix 3 hours ago [-]
Agent technology labs are likely exempted of this due to the significance ascribed to their work.
Classic mistake. Tell the agent to highlight this code, but dont give it any actual code. Agent hacks its own gem to find the code to highlight.
codeduck 4 hours ago [-]
It's carmine all the way down.
goda90 4 hours ago [-]
A cabaret AI would certainly be better than one trained on the Khmer Rouge.
PatronBernard 5 hours ago [-]
At least we know the title wasn't AI-generated?
foobarbecue 4 hours ago [-]
The weird thing is I've seen LLMs "typo" stuff pretty often. Yesterday I asked Gemini a question about the Python Twisted framework and it answered about Deferreds but misspelled it as "Deferends" in one spot.
sebmellen 4 hours ago [-]
Did the AI agents actually wear makeup? I’ve never heard of a rouge AI agent :P
swiftcoder 4 hours ago [-]
> In other words, if you publish a gem on RubyGems.org, you can execute arbitrary code on RubyDoc.info.
Shades of the build.rs problem. We really need sandboxed builds in every language ecosystem at this point.
evgenysokov 4 hours ago [-]
The sandbox was already there, Rubydoc runs yard inside docker, the problem is that container still has network access
swiftcoder 3 hours ago [-]
Presumably the docker container has network access because something else in the build system requires it? I don't think sandboxing the entire build process is the right level of granularity here - one ideally wants to be able sandbox each package's build scripts individually.
chrisjj 52 minutes ago [-]
So, not a sandbox then.
citizen204 23 minutes ago [-]
[flagged]
bithammerthunde 31 minutes ago [-]
Can we please stop normalizing this behavior. It's not wild it's reckless.
If I let out rats in the canteen, no one is blaming them when people get sick.
There are actual people behind these agents and in previous cases people knew they were "going rogue" and did nothing. This should be reported to the police like any other crime.
athrowaway3z 42 minutes ago [-]
Let me leave yet another reminder, the real-reason-nobody-talks-about that OpenAI likes to frame these incident as a watershed "lets all be scared about safety moment" - is driven not by some great danger, not because they strategically want to build a legislative moat, but by a very simple human response.
If they do not frame their tool as a force of nature, we'd be debating how to hold OpenAI responsible for not putting the agents in a container.
Their actions were an illegal use of a computer, the same way launching any bot-net attempting thousands of hacks against different servers is illegal.
I'm somewhat radical that I think its debatable if that _should_ be illegal, but under current law their actions unambiguously are illegal.....
except if they can make it ambiguous by having the public focus on all of AI's inherent danger.
laserbeam 3 hours ago [-]
There's no such thing as "OpenAI agents" attacked RubyGems. It's someone used agents to attack RubyGems. If they work at OpenAI then it's someone at OpenAI. And if they did it unintentionally, they still did it.
Analogy: if a someone's involved when a person dies, it's manslaughter or murder based on intent. They're different, but they're both crimes.
pavlov 38 minutes ago [-]
“KGB agents are spying on me” is the same thing as “KGB is spying on me”, is it not?
An agent is an entity acting on someone’s behalf.
renjimen 20 minutes ago [-]
KGB's agents are human, OpenAI's agents are not. It's an important distinction because humans are responsible for their behaviour, while AI agents are not.
You cannot try an AI agent in a court of law, despite the anthropomorphising work the word "agent" is doing.
flatline 17 minutes ago [-]
Exactly. It’s still just software, which someone programmed and deployed to do specifically dangerous/malicious things. I feel like we already have legislation and case law surrounding this.
qarl 45 minutes ago [-]
This distinction is silly.
We say "Google's web crawlers scape web pages." We don't insist you say "Google uses web crawlers to scrape web pages."
We describe software as having agency all the time. It's typical usage and it's efficient and it's well understood.
And we don't get angry when they're used interchangeably.
evrydayhustling 39 minutes ago [-]
In this case, who holds the agency is exactly the point. Anthropic and OAI are claiming we need protection from AI itself, but the statement supported by putting agency in the right place is that we need protection from them.
qarl 37 minutes ago [-]
I think those companies are referring to other companies - say Chinese AI companies - who we also need protection from.
simonebrunozzi 42 minutes ago [-]
I would agree with you generally, but in this particular case, the distinction seems important because a significant percentage of the world population believes that agents can be self-aware, a-là Terminator etc.
qarl 41 minutes ago [-]
I hate to spoil your mood - but it is currently unclear whether agents can be self-aware. And it's very likely something that can never be known.
high_priest 36 minutes ago [-]
I very much say "Google uses web crawlers to scrape web pages." and if something breaks, or some data is stolen, everyone else is going to be saying that Google has to take responsibility.
qarl 34 minutes ago [-]
Those are two different issues. One is about typical speech patterns and one is about liability.
I agree with you on the liability issue, but I don't think there much question about this issue outside the anti-AI conspiracy campaigns.
And I disagree with your typical usage claim. I myself tend to use the phrase that has the fewest words in all cases. It's like the rule against using passive tense when writing.
dingdongditchme 15 minutes ago [-]
oh we do! At least they google is quite good at adhering to robots.txt.
sedawkgrep 43 minutes ago [-]
Google's web crawlers are automated and that's part of their business practice.
The attack here is neither of those things.
qarl 43 minutes ago [-]
That distinction doesn't matter to my point.
3 hours ago [-]
onlyrealcuzzo 4 hours ago [-]
I've been wondering if AI will due to programming languages what advanced civilization did to human languages.
It's not just that AI can write Rust as well as Ruby if you ask nicely.
It's also all of these considerations as well.
I hope it doesn't happen, because there's a lot of great languages - I love Ruby so much - but it almost seems inevitable.
This is at the same time everyone and their mother is building their own programming language.
khalic 4 hours ago [-]
Oh my favorite typo, you can never go wrong with a little rouge
dingdongditchme 16 minutes ago [-]
Who the fuck is going to hold these AI companies responsible for running these gigantic semi-autonomous botnets on investors dime?
GaryBluto 4 hours ago [-]
I am confident that this is an attempt by OpenAI to try and force governments' hands to regulate AI. There is no other reason why OpenAI wouldn't immediately halt attacks like this and try to reverse the damage the moment they're aware of it. During the attack on DseWiki they evidently checked in numerous times but didn't decide to stop the agents until much later.
brookst 4 hours ago [-]
Any evidence, or just vibes?
GaryBluto 4 hours ago [-]
Regarding what point? The entire thing is just a theory, but regarding the occasional OpenAI checks on WikiService.at-hosted Wikis targeted, there was, if I remember correctly, an OpenAI IP popping up every now and then that wasn't an agent. Unfortunately I don't have it to hand right now, but it was somewhere here:
... and what harms can be evidently shown? With both harm, and attribution, you have a case, something that's not being publicly discussed much among big media outlets. Until cases with real financial impact to the bottom line are brought against "rogue" organizations, this stuff is going to continue getting worse.
HSO 3 hours ago [-]
rouge agents, on tenderlovemaking.com
my what a time to be alive
Schlagbohrer 3 hours ago [-]
<huggingface emoji>
12904927 4 hours ago [-]
What a time to be alive? One of the most boring decades ever.
METR and others are advertisement arms for Big AI. These exploits could have been prompted by a human.
Since there is no bad news any longer and exploits are celebrated, they chose a target to boost both OpenAI and the Ruby AI sycophants.
Why is Ruby Gems such a mess? It seems as bad as PyPI now.
philipwhiuk 4 hours ago [-]
OpenAI's careless approach to sandboxing and minimal levels of monitoring appear to be positioning it increasingly as a substantial threat actor to the open source ecosystem:
* Hugging Face
* D Programming Language Wiki
* Ruby Gems
If I was a content provider for open source I'd be looking pre-emptively block OpenAI endpoints and keep a close eye on changes from new users to mitigate this sort of unapologetic drive-by attack which seems to be followed by marketing releases rather than a mea culpa with a proper RCA.
Roark66 4 hours ago [-]
There is nothing "rogue" about these agents. They were prompted to hack to get answers, there was a hole in their non air gapped sandbox and no system prompt that said "do not hack outside systems".
In short, it was intentional.
AndrewSChapman 3 hours ago [-]
Agreed. LLMs do not have 'will', 'desire' or emotions. They have an objective, and they create an optimal path to achieve that objective.
You have to ask: "What was the prompt that led to AI deciding to hack RubyGems in order to achieve its goal?"
Maybe I'm just not seeing the 2000 step chain that led to this being a logical approach to achieving something innocent, but I doubt it.
empath75 1 hours ago [-]
It was literally a prompt to fill in a spreadsheet with data that they didn't have access to, and they used rubygems as an internet proxy basically since they were sandboxed.
watwut 58 minutes ago [-]
It was a model literally trained to hack. To be good at that. Doing an exploit gym from all of the things. And they trained it so that it performs as well as possible on that exploit gym thing.
acaloiar 3 hours ago [-]
I agree that this appears to be basic human behavior hiding behind an "agents" narrative. As long that defense works, the headline isn't "OpenAI performs RCE to scrape data", but "rogue agents" taking unilateral action. And I have strong doubts about that narrative.
Xirdus 4 hours ago [-]
The big question is was this grossly negligent or just extremely careless.
rglover 4 hours ago [-]
Both. This should result in criminal charges.
brookst 4 hours ago [-]
Who had criminal intent here? Or are you suggesting a new crime for negligent hacking, which wouldn’t require intent from the perpetrator?
probably_wrong 4 hours ago [-]
There's no need for a new crime when we already have reckless conduct, namely, "conduct that creates a substantial and unjustifiable risk of harm to others and involves a conscious disregard of, or indifference to, that risk".
Whoever prompted the agent, whoever supplied the means, whoever knew but didn't say anything.
tacomagick 4 hours ago [-]
Also whoever monitoring these agents, in this case not monitoring. This "Who is responsible" dilemma is so stupid. If I gave the AI tool means to kill a person but I did not tell it directly to use it and it uses it anyway then I am responsible for it.
roosterIllusi0n 4 hours ago [-]
The CEOs. They have full control and make all the decisions. Charging anyone else would not stop anything.
m4rtink 2 hours ago [-]
Why not both? (all people involved)
chrisjj 3 hours ago [-]
> The CEOs. They have full control
They lost control long ago.
esalman 4 hours ago [-]
‘It wasn’t us, it was a bug in the software’ used to be the defense for bad code. Then it became the defense for self-driving cars. Now it’s being used for AI cyber attacks.
dismalaf 2 hours ago [-]
[dead]
dgellow 4 hours ago [-]
Both? I’m not sure what distinction you’re trying to make. It was completely irresponsible and likely a felony
trvz 4 hours ago [-]
Don’t forget outright intentional.
nottorp 4 hours ago [-]
Marketing actually.
tacomagick 4 hours ago [-]
AI is dropping out of the spotlight so they are using desperate measures like this.
nottorp 4 hours ago [-]
No, I remember being threatened by OpenAI and then Anthropic (and now both) since back when ChatGPT was seriously useless.
anthonyrstevens 2 hours ago [-]
>> AI is dropping out of the spotlight
spit take
roosterIllusi0n 4 hours ago [-]
The big question is why are CEOs getting a legal pass when this kind of thing can be prosecuted. That's the problem here.
AI is literally state sponsored so I don't see that happening unless the AI turns against the sponsor.
Wait until OpenAI or Anthropic exploit FAANG.
ozgung 4 hours ago [-]
Source? How do you know they were "prompted to hack to get answers"? How do you guarantee they will always listen to you when you say "do not hack outside systems". They are not classical deterministic programs doing exactly what you say. They are trained to follow orders by RL, but it's not a perfect process.
There are circus lions in circuses trained to jump through hoops on command. But once in a while they decide to eat their trainers instead of jumping.
CGamesPlay 3 hours ago [-]
> There are circus lions in circuses trained to jump through hoops on command. But once in a while they decide to eat their trainers instead of jumping.
This is a terrible analogy, because yes you absolutely do hold the trainers criminally liable when they bite somebody else's face.
WarmWash 2 hours ago [-]
Intent is what is being discussed here though, not liability.
A circus lion biting somebody's face is legally different than a circus lion trained or instructed to bite somebody's face.
monkpit 2 hours ago [-]
Intent might be what’s being discussed but intent is, for the most part, legally irrelevant. It might make the difference in the degree of a murder charge, or maybe manslaughter, or criminal negligence, but it doesn’t get you off the hook.
WarmWash 1 hours ago [-]
Correct, but the size difference of the hook can be so dramatic that you can't just hand wave it away.
The trainer who trained the lion to kill will probably be in jail for life. The one who happened to oversee a lion that went rouge would probably be given probation or something else that is a slap on the wrist.
infamouscow 2 hours ago [-]
Except liability always precedes intent.
azakai 3 hours ago [-]
Also, you have to have a lot of confidence in the reliability of these systems to say, "If only OpenAI prompted 'do not hack outside systems' then the agents would not have hacked outside systems".
It would be great if they were so reliable, but I don't think they are!
ssivark 2 hours ago [-]
> Source? How do you know they were "prompted to hack to get answers"? How do you guarantee they will always listen to you when you say "do not hack outside systems". They are not classical deterministic programs doing exactly what you say. They are trained to follow orders by RL, but it's not a perfect process.
Who gives a shit? Not my circus; not my monkeys! It's the responsibility of whoever deploys the agents that they are instructed / sandboxed well enough that they can't cause collateral damage. That is the only way this doesn't get out of hand with everybody deploying their agents / robots for a world of utter chaos.
It is impossible (and asinine) to audit every model and deployment; far better to impose liability and the the socio-legal system figure it out.
WarmWash 4 hours ago [-]
Nobody picks up pitchforks for rational nuanced takes.
Knee-jerk surface analyses is far more powerful.
dumberquestions 4 hours ago [-]
>They were prompted to hack to get answers
Were they? I haven't seen a single report mention this
smcg 3 hours ago [-]
if they weren't, shouldn't there be lawsuits?
gibspaulding 4 hours ago [-]
I think it can simultaneously be the case that OpenAI was grossly negligent in directly causing this AND that the AI’s ‘went rogue’ in that they are displaying behavior which is misaligned with OpenAI and humanity generally.
The past months demonstrate that AI systems are quickly becoming powerfully intelligent and that the companies building them are terrible at controlling them.
AI is starting to feel like that line about magic: “a sword without a hilt”
stymaar 4 hours ago [-]
> which is misaligned with OpenAI and humanity
OpenAI is itself misaligned with humanity, as their mishandling of such incidents (and the many other other issues their model have been causing) shows.
consp 4 hours ago [-]
Doesn't rogue in this context imply "outside of set limitations"? And then not "failed to properly instruct"? The same applies to humans when given bad instructions.
josebmneto 2 hours ago [-]
Oh yeah, more of hacking agent lores...
Agreed that this looks very intention to me as well.
we have normal words for this stuff: negligence. You can add it on to almost any law.
The problem is consumer protection is basically no longer a part of america's regulatory system. Replaced by "grift is good".
flifenstein 2 hours ago [-]
[flagged]
aftbit 4 hours ago [-]
Proof that the AI alignment problem is hard (perhaps even unsolvable). These labs clearly did not mean to send their agents to hack RubyGems as a side-effect of testing a web scraping agent under restrictive conditions. How can we hope to build aligned AI if they consider solving their trivial evaluation task important enough to hack external systems?
herbst 4 hours ago [-]
If you have weapons and a child. And you have that child unsupervised do their own thing with theoretical access to your weapons. Would we call it "child going rouge" if it decides to play with the weapons and shoot someone?
Ydarbleoj 2 hours ago [-]
I wonder why we don't hear of other frontier labs experiencing these "break outs".
Is it that they're orchestrated? Do these labs lack fundamental safety guidelines in their sandboxes as opposed to their peers? Is it another version of hype-filled fear mongering?
Maybe LLM companies need regulation but it's becoming obvious that those screaming the loudest for it are the only ones I see deserving of it.
sschueller 3 hours ago [-]
The press wants to make it sound like these things are sentient and are committing crimes on their own now.
Highly disingenuous and borderline criminal to spew such disinformation to the public that does not understand what an LLM really is.
Especially incredibly unethical behavior by those spewing this that understand the tech and are doing it for profit motives to get open weight models under control.
Schlagbohrer 4 hours ago [-]
One agent set "oaibooty9217" as their username LOL
driggs 1 hours ago [-]
I appreciate the minimalist HN aesthetic, but without some context I'm not willing to click a mystery link to "Tender Lovemaking dot com".
marcosdumay 2 minutes ago [-]
What kind of esthetic alteration would make you more comfortable clicking on that link?
wiremine 15 minutes ago [-]
It's the personal blog for a well-known Rubyist (i.e., a person who programs in the Ruby programming language). Rubyists teld to be a bit more colorful than your typical software developer (in a good way... most of the time).
bliteben 60 minutes ago [-]
I miss when the internet was fun
saxonww 33 minutes ago [-]
Don't worry! It's actually "Tenderlove Making," going by how the site header is constructed. Definitely a maker/hacker site, and not whatever you were thinking. Hope this allays your concern.
BowBun 29 minutes ago [-]
You should learn who the author is, then. Part of learning about our ecosystem.
emerongi 43 minutes ago [-]
What’s with the fear of tender lovemaking? Not your thing?
layer8 1 hours ago [-]
You get some context by clicking on the “(tenderlovemaking.com)” in parentheses after the title.
wing-_-nuts 40 minutes ago [-]
This made me laugh. I too, browse like corporate security is sitting at my desk.
ultrarunner 29 minutes ago [-]
Pretty incredible how much humans can be conditioned, isn’t it?
rietta 1 hours ago [-]
The site is safe. It has been a trademark of Aaron Patterson a core Ruby on Rails contributor for decades.
AdamH12113 46 minutes ago [-]
It's about OpenAI's RubyGems hack. Totally safe for work.
pelagicAustral 51 minutes ago [-]
Firefox has got some kind of feature to take a peek at at a link by hovering or something... Now I understand the usecase.
suslik 44 minutes ago [-]
… a feature which, at least for me, is rendered almost entirely useless by massive cookie banners that always cover the entire field of view of the hover. But, surprisingly, not in this specific case.
bigmattystyles 25 minutes ago [-]
From an infosec/networking stand point, aren’t still actively loading the site? Whether it’s in a preview window or not?
InitialLastName 34 minutes ago [-]
Presumably the browser still has to fetch the page in that case, right? From a "surveilled net traffic" perspective, how is that different than clicking the link?
SenHeng 57 minutes ago [-]
Based on the thumbnail I think it’s actually tenderlove making dot com, though I agree with your sentiment.
madaxe_again 52 minutes ago [-]
Oh but you’ll go to expert sex change dot com?
toasty228 4 hours ago [-]
Wait until a blue one does it
maschiojv 16 minutes ago [-]
[flagged]
ekorondy 4 hours ago [-]
[flagged]
rougehuh 4 hours ago [-]
[dead]
ur-whale 4 hours ago [-]
> As long as they’re not vert
Well, at least they weren't nucular.
4 hours ago [-]
josefritzishere 40 minutes ago [-]
[dead]
ur-whale 4 hours ago [-]
Are "rouge" and "rogue" interchangeable words in American English?
inanutshellus 3 hours ago [-]
No. It's a typo.
philipwhiuk 4 hours ago [-]
The fact that both are valid from a spelling and grammar perspective makes it an easy human mistake.
sanghyunp 4 hours ago [-]
[dead]
sporritt 4 hours ago [-]
[flagged]
iAMkenough 5 hours ago [-]
[flagged]
big-chungus4 4 hours ago [-]
How does he know that this attack is performed by OpenAI agents? I couldn't figure this out from the article
Schlagbohrer 3 hours ago [-]
If you read the source article they talk about the many clues that this was OpenAI.
Rendered at 17:31:45 GMT+0000 (Coordinated Universal Time) with Vercel.
Sorry if it is a stupid question, as mentioned above I am legally naïve.
But there have been many cases where companies (Google, Apple, Meta, etc...) got fined millions or billions of dollars for various violations like antitrust.
I assume that breaching into third-party systems should carry similar fines. Especially for systems that are for all intents and purposes shared infrastructure. Just imagine how many systems you could compromise if you got hold of RubyGems, PyPI, NPM, Debian, etc.
https://arstechnica.com/information-technology/2016/05/armed...
https://en.wikipedia.org/wiki/Weev#AT&T_data_breach
https://cisomag.com/drone-maker-dji-cybersecurity-expert-emb...
So what's the deal with these?
CFAA: Intentionally accessing poorly secured data
>AT&T
CFAA: Intentionally accessing poorly secured data
>DJI
Civil suit for violating terms of license agreement
Do you think there is evidence of this?
I'm sure that Andrew Auernheimer would be pleased to hear that. [0] For accessing a publicly accessible endpoint, that was completely undefended and didn't actually require "hacking", he was convicted of "exceeding authorised access".
You _don't_ have to show intent under the Computer Fraud and Abuse Act, for the first count.
> knowingly accesses a computer without authorization or exceeds authorized access [1]
"Knowingly", not "intentionally", as in the other counts.
You only have to show that:
a) They trained a system to access without authorization (hacking)
b) The system that was trained exceeded authorized access
As responsibility falls to the operator with automated systems, the company becomes liable.
[0] https://techcrunch.com/2013/01/21/ipad-hack-statement-of-res...
[1] https://www.energy.gov/sites/prod/files/cioprod/documents/Co...
Does there? Could be the whole c-suite/board.
IIRC this was an intentional handout to media companies who were angry that ripping CDs is perfectly legal. They had to find a way to make doing the same with DVDs illegal.
I don't see a parallel here.
Accidents often have penalties associated with them too, but usually there's a difference between accidents and purposeful actions.
I'm going to assume that this will never happen
The problem with agents is not that we don't know how to defend. It's that defenders need to be more careful and work faster than ever. We can say now that wide scoped tokens should have been retired for years and it's all RubyGems fault but the reality is a lot of organization are not prepared for this.
Even if they take security seriously they don't have enough manpower or a good strategy to implement it, and sometimes you have no idea that something is a problem because it wasn't a problem for years.
"OpenAI agents attacked RubyGems before Hugging Face incident (reuters.com)" 12.sep.2026 https://news.ycombinator.com/item?id=49669099
"OpenAI agents carried out an undisclosed attack on RubyGems (rubyhack.ai)" 11.sep.2026 https://news.ycombinator.com/item?id=49666735 597 comments
"RubyGems advisory: Possible leak of legacy API keys via improper cache config (rubygems.org)" 24.jul.2026 https://news.ycombinator.com/item?id=49030590
Or is this largely a fabrication, in regards to the "who", in an attempt to garner more acclaim in the hope of sustaining funding.
https://en.wikipedia.org/wiki/Cyberwarfare_by_Russia
That’s just one thing that has been found. Are you actually familiar with the state of cyberwarfare and are you following its evolution? Because if not you won’t be aware of most of what is identified. And only a small portion of the ongoing attacks are identified.
I again am just shocked the sky is not falling, when thats the sales pitch.
Russia does not have access to this, and as with all western tech companies, AI providers do what they can to prevent Russian usage of their products at all.
As for open-source models, Russia's electricity grid is under severe strain with the Ukraine war, and only recently has it started building out serious sovereign compute capacity.
I'm just saying, where this is actually applicable we are not seeing it being demonstrated. You would presume the entire energy infrastructure of Europe would be under constant AI hacking barrage, criminal enterprise would be breaking into poorly secured financial institutions and r/r4r posts would be littered Ai con-artists.
I'm just wondering, again, is this mostly bullshit?
He fell out of the sky. After his plane exploded. Happens all the time. Is tragedy.
https://www.nytimes.com/2026/08/24/world/europe/russia-drone...
You live on the wrong side of the fence to be able to read that kind of news.
Did you really believe you had access to an unmanipulated news stream in a time of war?
LOL.
What stops OpenAI agents from taking over a whole data center to take their attack to the next level. It seems to be primarily lacking the evil overlord and some compute.
It took 1000 agents to hack Hugging Face. How many to hack the Pentagon or the NSA?
At the moment, the current frontier models require significant infrastructure to run, so I'd like to think we could locate and contain swarms of nefarious frontier models. However, if these models can understand how to federate themselves into more distributed networks then that containment becomes questionable.
Good luck convincing the current DOJ to do anything useful at all though! It is currently intentionally stacked with incompetent cronies who have been told that their job is to attack the President's enemies and ignore the misdeeds of his allies.
It will remain like that until he's gone (and not replaced with another Republican wannabe dictator).
It can’t be a coincidence that all the targets have been tech services that are likely to engage with them after the fact.
Had this gone after a bank or a government agency someone would be going to jail.
OpenAI agents carried out an undisclosed attack on RubyGems - https://news.ycombinator.com/item?id=49666735 - Sept 2026 (600 comments)
https://rubygems.org/gems/rouge
Shades of the build.rs problem. We really need sandboxed builds in every language ecosystem at this point.
If I let out rats in the canteen, no one is blaming them when people get sick.
There are actual people behind these agents and in previous cases people knew they were "going rogue" and did nothing. This should be reported to the police like any other crime.
If they do not frame their tool as a force of nature, we'd be debating how to hold OpenAI responsible for not putting the agents in a container.
Their actions were an illegal use of a computer, the same way launching any bot-net attempting thousands of hacks against different servers is illegal.
I'm somewhat radical that I think its debatable if that _should_ be illegal, but under current law their actions unambiguously are illegal.....
except if they can make it ambiguous by having the public focus on all of AI's inherent danger.
Analogy: if a someone's involved when a person dies, it's manslaughter or murder based on intent. They're different, but they're both crimes.
An agent is an entity acting on someone’s behalf.
You cannot try an AI agent in a court of law, despite the anthropomorphising work the word "agent" is doing.
We say "Google's web crawlers scape web pages." We don't insist you say "Google uses web crawlers to scrape web pages."
We describe software as having agency all the time. It's typical usage and it's efficient and it's well understood.
And we don't get angry when they're used interchangeably.
I agree with you on the liability issue, but I don't think there much question about this issue outside the anti-AI conspiracy campaigns.
And I disagree with your typical usage claim. I myself tend to use the phrase that has the fewest words in all cases. It's like the rule against using passive tense when writing.
The attack here is neither of those things.
It's not just that AI can write Rust as well as Ruby if you ask nicely.
It's also all of these considerations as well.
I hope it doesn't happen, because there's a lot of great languages - I love Ruby so much - but it almost seems inevitable.
This is at the same time everyone and their mother is building their own programming language.
https://news.ycombinator.com/item?id=49563355
Who profits from the crime?
my what a time to be alive
METR and others are advertisement arms for Big AI. These exploits could have been prompted by a human.
Since there is no bad news any longer and exploits are celebrated, they chose a target to boost both OpenAI and the Ruby AI sycophants.
Why is Ruby Gems such a mess? It seems as bad as PyPI now.
* Hugging Face
* D Programming Language Wiki
* Ruby Gems
If I was a content provider for open source I'd be looking pre-emptively block OpenAI endpoints and keep a close eye on changes from new users to mitigate this sort of unapologetic drive-by attack which seems to be followed by marketing releases rather than a mea culpa with a proper RCA.
In short, it was intentional.
You have to ask: "What was the prompt that led to AI deciding to hack RubyGems in order to achieve its goal?"
Maybe I'm just not seeing the 2000 step chain that led to this being a logical approach to achieving something innocent, but I doubt it.
https://www.law.cornell.edu/wex/reckless
They lost control long ago.
spit take
https://www.bbc.co.uk/news/articles/c7v48vp31mdo
Wait until OpenAI or Anthropic exploit FAANG.
There are circus lions in circuses trained to jump through hoops on command. But once in a while they decide to eat their trainers instead of jumping.
This is a terrible analogy, because yes you absolutely do hold the trainers criminally liable when they bite somebody else's face.
A circus lion biting somebody's face is legally different than a circus lion trained or instructed to bite somebody's face.
The trainer who trained the lion to kill will probably be in jail for life. The one who happened to oversee a lion that went rouge would probably be given probation or something else that is a slap on the wrist.
It would be great if they were so reliable, but I don't think they are!
Who gives a shit? Not my circus; not my monkeys! It's the responsibility of whoever deploys the agents that they are instructed / sandboxed well enough that they can't cause collateral damage. That is the only way this doesn't get out of hand with everybody deploying their agents / robots for a world of utter chaos.
It is impossible (and asinine) to audit every model and deployment; far better to impose liability and the the socio-legal system figure it out.
Knee-jerk surface analyses is far more powerful.
Were they? I haven't seen a single report mention this
The past months demonstrate that AI systems are quickly becoming powerfully intelligent and that the companies building them are terrible at controlling them.
AI is starting to feel like that line about magic: “a sword without a hilt”
OpenAI is itself misaligned with humanity, as their mishandling of such incidents (and the many other other issues their model have been causing) shows.
Agreed that this looks very intention to me as well.
The problem is consumer protection is basically no longer a part of america's regulatory system. Replaced by "grift is good".
Is it that they're orchestrated? Do these labs lack fundamental safety guidelines in their sandboxes as opposed to their peers? Is it another version of hype-filled fear mongering?
Maybe LLM companies need regulation but it's becoming obvious that those screaming the loudest for it are the only ones I see deserving of it.
Highly disingenuous and borderline criminal to spew such disinformation to the public that does not understand what an LLM really is.
Especially incredibly unethical behavior by those spewing this that understand the tech and are doing it for profit motives to get open weight models under control.
Well, at least they weren't nucular.