These agents are intentionally interacting with the world. You can sniff all the traffic you want but how are you going to determine intent from traffic?
They should not have had traffic at all. The LLMs were supposed to be able to request downloads. Very simple traffic analysis could have shown that something strange was going on.
Heck, they could have had other LLMs watching the traffic if you want to be fancy about it.
Crazy how we’ve gone from "lol boxing an AI is trivial, just airgap it from the internet" to "well we can’t really do anything if an agent misbehaves, obviously it must have internet access to function uwu"
There’s plenty of info to analyze and heuristics to build based on the internet requests. I’m not sure if you’re just trolling or what. There are tons of successful businesses that specialize in this.
I think that says more about the quality of the product they’re building than it does about their actual ability to detect active hacking attempts as they’re happening. Especially when these attacks are OUTBOUND not inbound.
