> the HuggingFace incident illustrates LLM agents behaving in very human-like ways

It does not, the only thing the HF incident illustrates is how absolutely lax security and isolation these labs do even with models without guardrails, and with "risky" prompts, and even after it happened once before (years ago) they still have the very same issue today apparently.

What exactly is human about LLM agents breaking out of "containment" and hacking 3rd party infrastructure "by accident"?

If someone successfully breaks out of jail, that tells you something about the jail's security. It also tells you something about their skills at breaking out of jail.

https://www.dwarkesh.com/p/openai-huggingface

If a program breaks out of a VM, that's not "wow it looks human", how can you even argue so? I'm sorry, but if you're playing devil's advocate, make it a bit more realistic next time.

Human-like is not human. Humans have agency and free will, LLMs do not. They only act when instructed and they are only as capable as they are allowed to be. The operator is still the responsible party. An LLM cannot be held accountable, its operator, however can and should.

Are you sincerely arguing that we hold tools accountable for their operator’s mistakes? Do you sincerely, honestly, think that it makes any sense whatsoever to put a hammer on trial for bashing someone’s skull in?

>Are you sincerely arguing that we hold tools accountable for their operator’s mistakes?

Nope, as I previously stated elsewhere:

"I understand from a legal perspective why we might want to treat the creation of a server differently from the creation of a human"

https://news.ycombinator.com/item?id=49815300

I am concerned about false reassurance from people claiming that these systems lack agency. From a practical perspective, the agents in the HF attack had the sort of agency that generally matters, even if we're not going to put them on trial.

> the agents in the HF attack had the sort of agency that generally matters

You keep saying this, but absolute 0 points towards any of the agents involved deciding on their own, without influence of humans, to hack 3rd party infrastructure to get the answers. Where exactly are you getting that from? Internal information not public yet or what's going on?

"The big motivation behind the Hugging Face attack was this final workstream (understanding the scorer). The AIs believed that Hugging Face (as an industry-standard hub for hosting datasets and benchmarks) would probably be housing information about how the ExploitGym scorer was implemented. And they also thought there was a good chance they were being evaluated on Hugging Face’s servers directly - in which case the theory of change for hacking Hugging Face is pretty obvious.

On the morning of July 10, an agent found working Hugging Face user credentials exposed on the internet and posted them to the board. By the next morning, July 11, that agent figured out a way to read internal data from Hugging Face. And then another agent achieved remote code execution on Hugging Face servers."

https://www.dwarkesh.com/p/openai-huggingface

I believe this is the full report that the blogpost is largely based on: https://metr.org/hugging-face-incident-report-aug-2026.pdf

And why they had those beliefs? How come they could "think"? What action triggered those things? Did someone install software on a server that "just came alive" and then all bets were off? Or was this part of security testing and evaluation, where a human wrote a prompt that the agent read, which lead to all of that?

Do you seriously not grok how LLMs work? They're not 100% autonomous and self-acting, that'd be bananas.