News for hackers. Stuff that matters.
Re:The Hugging Face incident and the road ahead by tantalor on Thursday August 27, 2026 @07:40AM (#49463165)
> How were they supposed to know about "previously unknown vulnerabilities"

Very simply, there is no such thing as bug-free software.

Re:The Hugging Face incident and the road ahead by ben_w on Thursday August 27, 2026 @07:47AM (#49463234)
If this is your standard, I challenge you to name one currently operating business that isn't criminally negligent.

I'm sure there's tens to hundreds of millions of them amongst the 37% of the world with no internet connection, but actually finding them listed on the internet will be somewhat of a challenge.

Re:The Hugging Face incident and the road ahead by hilariously on Thursday August 27, 2026 @08:09AM (#49463446)
No, the entire marketing campaign for these models is "it automatically has godlike powers to exploit almost any software" - if you don't air gap such a capability you are inherently allowing shit to go down, any other interpretation is "OAI folks are too stupid to design a proper test".
Re:The Hugging Face incident and the road ahead by ben_w on Thursday August 27, 2026 @09:15AM (#49464432)
> "it automatically has godlike powers to exploit almost any software"

No it isn't. Random people on sites like this mock them as if they're talking about having godlike powers. Each new model is "merely" a step up from what came before, the steps are frequent and rapidly improving, and just recently (in more than one AI company) crossed a threshold where that improvement made the tests dangerous.

But even well before "godlike"*, there's plenty of research about how to cross air gaps.

> "OAI folks are too stupid to design a proper test".

Such binary thinking.

It's very easy to say things are "obvious" after the fact. People do that all the time, e.g. how the Bay Of Pigs invasion was never going to work, or like the Zune wasn't a good product-market fit.

Oh the stories I could tell if not for the NDAs.

* whatever that's supposed to mean: https://news.ycombinator.com/item?id=40874779

Re:The Hugging Face incident and the road ahead by mcmcmc on Thursday August 27, 2026 @11:27AM (#49466395)
Who said criminally negligent?

If the whole point is testing its exploitation capabilities and you don’t want it exploiting the environment to gain internet access, that’s why you air gap, to remove the possibility

Re:The Hugging Face incident and the road ahead by ben_w on Thursday August 27, 2026 @12:46PM (#49467652)
> Who said criminally negligent?

Me.

I am saying that the act of taking this standard seriously, the standard "there is no such thing as bug-free software", would classify just about every business and individual criminally negligent.

After all, there's a lot of 0-day bugs in all the software we all use, and the exploitation of these bugs does get in the news due to all the harm that results from it. This poses a risk to basically all businesses.