News for hackers. Stuff that matters.

A comment on OpenAI’s accidental attack against Hugging Face is science fiction that happened.

Re:OpenAI’s accidental attack against Hugging Face is scienc... by onionisafruit on Thursday July 23, 2026 @12:58PM (#49024751)
The asymmetry part at the end is the frustrating part to me. I've been using Sol for code review in the last week or two. A couple of times during review it's errored out with the cybersecurity message. So it's found something but won't tell me what it is because I'm not on OpenAI's besties list.
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by didibus on Thursday July 23, 2026 @02:59PM (#49026458)
I agree, but I will say, I think both Mythos and these OpenAI model find exploits by examining and trying things against the running system, not from looking at the code. I think you'd have to do the same to catch the real vulnerabilities.
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by emtel on Thursday July 23, 2026 @11:25PM (#49030904)
In my experience fable can absolutely find very subtle bugs just by reading code and thinking. Last example I saw was a very subtle race condition that neither I not the author noticed. It wasn’t a security issue, but it could have been.
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by ClarityJones on Thursday July 23, 2026 @01:09PM (#49024923)
And... now it's a vulnerability that OpenAI has for your system, which you paid to provide.
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by verdverm on Thursday July 23, 2026 @02:42PM (#49026245)
And... given OpenAI's secops, likely something others may have in due time
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by IshKebab on Thursday July 23, 2026 @01:48PM (#49025477)
Yeah that's what I don't get. How can they possibly distinguish between good guys trying to secure code they wrote and bad guys trying to attack code they didn't?
[ Parent | on HN ]
Re:OpenAI’s accidental attack against Hugging Face is scienc... by paxys on Thursday July 23, 2026 @09:09PM (#49030156)
The safety classifiers aren't all that advanced. It's more likely that something in your code triggered a random chain of thought that had the word "pentest" or "malware" or something of that sort in it and it automatically shut down.
[ Parent | on HN ]