If you reframe the perspective from 'free $500 sitting on a server' to 'requires actively utilizing an unreleased 0 day exploit on a server that will certainly be able to track exactly what was done, for a payout of... $500?'
That's pennies for something like this.
Add two zeros and it might get nabbed.
Edit: others have pointed out it's not really a 0-day anymore, they're right, so it's likely more a matter of time.
So you are therefore arguing for the author's point.
The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.
In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.
The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.
I suppose it may not be there for actually taking it, but it does serve as a good demonstration of the realistic risk for average people running relatively low-value PHP sites. If nobody thinks it's worth the risk of exposure for a quick and easy $1k in Bitcoin (at the time I'm writing this), why would anybody bother hacking a site that's basically worthless, like the dinky little Wordpress blog I run?
This does effectively make the statement that, there probably are exploits out there for this, but even with a non-updated version, you're not at much risk unless someone with serious resources thinks they can make pretty big money from compromising your thing.
random sites generally don't log carefully, or watch their logs if they do. so the risk to hacking them is low. this site almost certainly logs very aggressively. so the risk to hacking it is high.
based on differential risk, attackers will choose targets differently. they might reason that the risk/reward on this obvious trap is not worth it. but on joe shmo's php emporium, the reward is less, but so is the risk, and it might pencil out.
> that's good news because my webserver also has logging
In the future, every website will carry a little blurb of text in the footer of their pages intended to scare off would-be hackers and their AI agents:
“The server of this website employs append-only remote logging and state-of-the-art monitoring and intrusion detection. Unauthorized access or attempts there of WILL be prosecuted to the fullest extent of the law. The outcome of such prosecution is and always will be astronomical amounts of money in damages that the guilty party will pay to the victim, alongside decades of prison time for the party guilty of computer crimes. Do not even try.”
That's always the case for a novel exploit. There isn't a lot of value in popping somebody's PHP blog, so people who've invested time and money into a zero-day exploit have little incentive to use it for that purpose.
The white hats want to extend the time before an exploit is in the hands of the masses who might do so just for the fun of it, and the black hats want to use it on high-value targets.
I think the point is that this is completely the opposite of the narrative that was pushed about this bug - that there would be thousands+ of AI agents actively compromising every vulnerable site automatically regardless of value within minutes of the fix being released into the wild. Well, now it's 3 days after, and this has been up for 3.5 hours, and nobody has taken it yet.
You would have a point if it was still a 0 day. The patch is out, and open source. Anyone who cares has a bunch of the pieces for putting together their own exploit.
Zero days are valuable and kept in the bank to avoid detection. That ship has sailed.
It’s not a 0day it’s now 5 days and counting since disclosure. Nobody is gaining value sitting on an exploit for a vulnerability which is being actively patched.
This logic doesn't work here, because it relies on the premise that you alone potentially have an unreleased zero-day exploit, which is not the case.
If prompting an AI could exploit this for less than $500 in token spend, then you should immediately do so, since if you don't, in a few minutes' time someone else will.
Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.
Wholesale blocking foreign country IP's is both an extraordinarily common practice and extremely effective. It has nothing to do with the political topics you chose to voice.
That means you shouldn't even try if you don't have an American VPN. You can't do it as a non-american website because Google will not index you, because their crawler is American. So it's asymmetric and it means you can only get truly free access to the internet with an American VPN server.
I think any personal AI agent at this point is "very sticky", not just Muse. You really aren't going to switch when a lot of the value is in the agent memory and there's no easy way to export that, similarly to how you aren't going to switch away from Spotify when it's learned all your song preferences which you can't export. Right now, maybe the agent memory is small enough that if you ask the agent to export you'll get most of it out (Claude has notably made official export instructions to encourage switching from ChatGPT in the past), but in the future the memory will be too large and complex to do that effectively, and platforms could also block the memory export or degrade it deliberately.
So, in the long run you pretty much have to pick one personal agent and stick with it, and switching is costly (unless you are using an open agent that lets you just download the memory, in which case it actually becomes cheap, because AI agents make other parts of switching way easier in general). For the purposes of Meta this means whatever user they get they'll probably keep.
HOWEVER, the thing that Muse doesn't have is network effects. They're running into the exact same problem as ChatGPT in this area, IMO. There's no reason for you to be running specifically Muse even if all of your friends are running it. So that gives other vendors a chance to catch up.
You can export all your data from OpenAI and Anthropic. I also exported all of my Liked songs on Spotify and have a scheduled task to pull any new ones each day.
I don’t follow why “in the future the memory will be too large and complex to [export] effectively”.
to me, export should be easier and easier since you should just be able to ask the model for the memory files. it’s literally list text on a hard disk, even if there are some new formats in the future, they’ll just be files on a disk that another agent can then inspect and integrate. in fact, i think exporting data from services will become easier and easier since agents can do the work even if platforms try to block it.
> a lot of the value is in the agent memory and there's no easy way to export that,
Can't speak for muse and grok bot. But all other agents like openclaw, Hermes simply store then add files and it's trivial to migrate to another agent. Just point the agent to it
"Agents" can be very "persistent" and when not sand boxed appropriately can get at things they were not meant to get at. Even if its only 1/1,000,000 that one time that one time is going to keep making the news
Explaining that to the general public when facebook is pushing Muse on everyone will be difficult so its going to get worse before it gets better (if it gets better)
I happened to be vaguely watching an agent at work on a longer task and spotted it attempt to find a way around not having access to a local service that would greatly help it achieve the task, I immediately chimed in with a "STOP! if you need access to X then just ask!".
You can't stop an agent from leaking your information by telling it not to leak your information.
To prevent information from moving between your work domain and your personal domain, or between your communications-with-board domain and communications-with-journalists domain, then the agent for one domain must be physically and deterministically blocked from accessing information in other domains.
I had an agent working on a bug decided the fastest way to fix this was to write one off javascript scripts that loaded the database uri and query the data.
I mean it’s not wrong but I was like maybe not do that without asking first.
The problem is neither the human, nor the LLM. The problem is companies selling a faulty product and telling people to connect it to their bank account.
100%. Having something as simple as a name be the thing that inadvertently publishes sensitive data is a product / judgement fault. You can’t ask for the keys then not know what to do with it
Maybe. But if these tools are marketed for this dangerous purpose, and average users are totally ignorant on the risks, then it’s a system designed to fail
So are you saying that if they were intelligent agents rather than word generators, they wouldn’t make mistakes like “send a message to the wrong (similarly named) group”? Are humans intelligent agents?
Foot guns are not fit to market and under any sensible consumer regulatory framework are recalled and banned until proven safe.
AI products are not regulated like every other consumer product. If your bank’s app had a big green “share” button shadowing the “close dialog” which shared your personal info in the same manner, any sensible regulator would like a word with your bank’s IT department. If your teller handed you a paper with a small print saying “by signing you approve this transaction being shared with your boss” likewise regulators would put a stop to it.
Why hasn't Venmo been investigated? The amount of financial transactions that I don't want or need to know about is bewildering. People don't seem to know or understand their transactions are public by default.
Silicon Valley (the tv show if not the real thing) showed us that CEO is about as meaningful as "car owner" or these days "President of the United States".
Strip mining is an extraordinarily appropriate metaphor.
Imagine a mine has an unknown number of rare materials. And you know the general location of a few of the most valuable spots. But you don't know what may be valuable right next to it. If the pieces that we know are valuable are suddenly gone, the incentive to mine that particular area drops considerably, dropping the chance to discover potentially brand new materials that would have been found the normal way.
That's an empirical claim. I could equally well say that doing an automated search of the problem space and having a database of results and open problems will identify vastly more interesting and valuable areas. Again, the idea that math is some exhaustible material is a metaphor, not an established fact. I'm willing to change my view as new evidence comes in, but I think we're going to have to wait and see what the landscape looks like in a few years.
> the incentive to mine that particular area drops considerably, dropping the chance to discover potentially brand new materials that would have been found the normal way.
FWIW, I think the metaphor breaks down with this framing. This isn't really a problem associated with strip mining, what's left behind is generally low or negative value (toxic). I'd suggest a different metaphor, from Wikipedia:
> This process involves the removal of all ground vegetation in the area, which is a detriment to the environment.[19] Topsoil may be placed over the tailing along with planting trees and other vegetation. Another reclamation method involves filling in the hole with water to create an artificial lake. Large tailing piles left behind may contain heavy metals which can leach out acids such as lead and copper and enter into water systems.
This feels very similar to the issues with algorithmic problem "mining". It has the potential to destroy the human ecosystems surrounding these problems, leaving barren wasteland behind where nothing can grow or flourish.
Yes - the Chinese labs serve a market that rely on open-weight models and managed deployments, and the labs gain competitive relevance by releasing those models. The cache optimization feature they came up with required new software to utilize on the inference-end, meaning that open source software would need to be specifically updated to work with these models. It wasn't the type of advancement that they could even theoretically keep secret.
reply