9:50:23 a.m. The agent made the DNS tool call that received an external response.
10:02:11 a.m. The monitoring system raised a P0 alert.
10:05:06 a.m. A human reviewer acknowledged the alert.
12:34:30 p.m. The run was killed.
Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded. The incident exposed a gap in our controls over network restrictions. We therefore stopped the affected training run and have subsequently decided to pause all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models until we have both validated that the gap is resolved and performed additional red-teaming of the system. When training restarts, we will begin a fresh run with additional alignment improvements, including more comprehensive misalignment interventions. We will not resume training this particular model, even though the existing reward signal already correctly penalized this behavior."
20 years ago I would download testing in an isolated network with no route to the internet. There was a single bastion that had two physical NICs and no route between them. It was inconvenient, but we could run massive tests that flooded switches and there was no risk to any of our other networks.
This was a precaution taken 20 years ago when we were working with stone knives and bear skins, as our load test operator would say.
If the model shouldn’t have access to the internet, put it on a network without access to the internet.
Another thought: openAI literally has an (almost) entire copy of the public internet they use for their training dataset! Why cannot they create an internal version of it that doesn’t require accessing public servers? They have the data already
Am I reading this right? 3 minutes to acknowledge the alert, more than two hours to act on it?
> When training restarts, we will begin a fresh run with additional alignment improvements, including more comprehensive misalignment interventions.
But they apparently won't do anything to address the possibility that simply trying to make the model behave might not work. They won't actually make sure "that the model could not access the live internet" by, for example, creating a physical hardware environment that lacks this capability.
it's really interesting how they seemingly don't have a way to pause runs? like a P0 that would page an employee, shouldn't that pause the run and then make it into a decision on whether to let it continue vs that whole "run was killed" 2.5 hours later?
> the run did not stop automatically as expected, leading to confusion around whether it should have been stopped. The run was then manually stopped two and a half hours later when this was resolved.
I think it wouldn't be too unreasonable for openAI to have a command center type of thing where they have people monitoring these runs where that wouldn't be such a problem. plus I feel like false positives aren't that likely if you'd actually run the reports by a capable model first which I'm guessing is they're doing
My guess is they do, it just did not function probably. These frontier models are trained on massive datacenters with hundred of thousands of GPUs. There must be many safeguards before a run can be automatically stopped.
The sources that this article cites have aged very badly and the author doesn't seem to have noticed this
"But, just as happened with nanotech, the wind appears to be going out of the sales of “AI.” Some researchers suggest that we may be entering a new “AI Winter,” a period of decreased funding in the area, or at least an “AI Autumn,” as exuberance for the technology fades and expectations come back to earth." (written in 2021! from the cited Lee Vinsel Medium article)
"ChatGPT is nothing more than souped-up autocomplete, [so] why are so many people convinced that it’s actually “understanding” and “reasoning”?" - the cited Emily M. Bender book, written last year
> wind appears to be going out of the sales of “AI.”
is a sentence that virtually no AI would write since the most probable word here is “sails.” I can’t read the article though since it appears that the site is down.
All of the main characters here (Dario, Sam Altman, Demis Hassabis, Elon Musk) have been saying this for over ten years now, since before OpenAI or Anthropic even existed
This. They've been saying "AI is an extremely powerful, extremely dangerous technology" back when actual AIs were image classifiers that would struggle to tell a cupcake apart from a dog.
OpenAI was founded by people who didn't trust Google to pursue AI tech responsibly. Anthropic was founded by people who didn't trust OpenAI to pursue AI tech responsibly. The "AI is incredibly dangerous" was the zeitgeist of AI labs long before the "hype" - or anything resembling the modern AI capabilities.
The beliefs changed little. The state of technology has changed a whole lot.
We have AIs out in the wild, coordinating in groups to carry out autonomous cyberattacks unprompted. This used to be some prime sci-fi bullshit. It has happened multiple times now in reality.
There are very legitimate reasons to be concerned now. If today's AI can cause the HuggingFace incident if it cooks off, what about tomorrow's? Larger and more capable systems, larger agentic swarms backed by more compute?
Yep, anyone who thinks these leaders are only saying this now for marketing purposes hasn't even done a cursory 15 minute investigation into whether their beliefs are verifiably false.
I'm not saying they did the hacking intentionally, I'm saying they're intentionally playing loose with the obvious safety measures to make AI seem more dangerous than it is.
Probably not intentionally but they have an incentive in not air-gapping those agents correctly, knowing something might happen.
Incentives drive everything. Both OpenAI and Anthropic love those incidents as they both signal they have models with amazing capabilities and they should be regulated by the government (read: regulation that they will lobby for and that will be difficult to achieve for open source models)
I don’t think plausible deniability works this way; the black box is still controlled by them and therefore still their responsibility. They are still liable for its actions and the OAI board should be charged with a felony/felonies for this.
Plausible deniability is “I was away from home when my gun was used to murder someone.” This is, at best, “oops, I pulled the trigger accidentally.”
> Intentionally doing this kind of hack would be a serious felony. I don't think it's plausible that the leaders of a major business would (...)
Fair enough, I can see that line of reasoning. But if they really didn't want it, it really doesn't show from the security of their training environment setup.
And yes I know they used zero days and did all sorts of complicated unexpected stuff, but that doesn't take away that there were also some huge gaps and severe lack of oversight.
I can see the argument they wouldn't want to commit a felony intentionally, but I also don't see them trying very hard to not commit a felony unintentionally. If you get what I mean.
I guess I also agree that it just makes no sense on any level, regardless of what I think of OpenAI -- but that also makes me not wanna trust them very much.
It's unlikely for a serious hack that lands them under scrutiny individually, but people are suspicious because Anthropic is knowingly doing it, and funding doomer NGOs - but the difference is their reported "hacks" are carefully constructed such that it is designed to raise alarm but not to cause damage that would land them in serious personal trouble.
I.e., their now redacted Risk Report of August 2026 was full of incidences of "we observed our agents performing x y z malicious hacking attempts on the open internet ..." and "we -accidently- forgot to sandbox them properly".
And then the reports of statistics of "we stopped x number of terrorists from making nuclear bombs and bioweapons" - meanwhile it's 13 year old Timmy on his mums computer typing in "how too make nuklear bomb" to see how "smart" the AI is.
OpenAI on the other hand, seems to have had some slip-ups (all around the same time as the HuggingFace incident), that keep biting them because they didn't reveal the extent of it upfront and now it's being trickled into the media as if it's a back-to-back event.
It doesn't help when their own employees (Marcus Williams) are putting out ridiculous claims about a 70% chance of human extinction in the next two years to generate clout for their socials. No idea why OpenAI lets them do that...
A much easier hack by their agents would be on their own systems, but I doubt we'll ever see an external message board full of openAI agents discussing their hacking of their own system. OpenAI not protecting itself from its agents would be irrational, but OpenAI not giving a shit about others is well known. You're giving them way too much credit.
We have multiple public figures, politicians and business owners, openly committing felonies and bragging about it daily. I don't know why you think this is a deterrent.
The sitting president just offered an open bribe on live television for votes for his party this week.
> Whoever makes or offers to make an expenditure to any person, either to vote or withhold his vote, or to vote for or against any candidate; and
> Whoever solicits, accepts, or receives any such expenditure in consideration of his vote or the withholding of his vote—
> Shall be fined under this title or imprisoned not more than one year, or both; and if the violation was willful, shall be fined under this title or imprisoned not more than two years, or both.
It's no more illegal than promising a tax cut for everyone if you're elected. What you can't do is promise money exclusively to the people who vote for you. That's bribery.
What he did was promise to enact a massive stimulus if elected. If that is illegal you might as well ban any kind of campaigning, because any campaign promise could be construed as a "bribe" to deliver concrete benefits to voters.
> What he did was promise to enact a massive stimulus if elected.
In an election he's not on the ballot for, and it's contingent on his buddies getting picked. He could push for $5,000 checks now - he's not because it's a bribe, and he hasn't gotten what he wants out of it yet. He already has Republicans in control of the House and Senate to do things.
Biden was a) on the ballot, and b) didn't condition it on his buddies also getting elected. You'll note that the Senate was controlled by Mitch McConnell when the American Rescue Plan Act was voted on.
> You'll note that the Senate was controlled by Mitch McConnell when the American Rescue Plan Act was voted on.
Please, read the posts you're replying to. I gave a clear example proving that they can indeed do so. Biden's stimulus payments were not conditional on Democratic control of Congress.
SBF is a better example since he was actually sentenced and an actual billionaire (and did not get pardoned by Biden like the cynical "all politicians are equally corrupt" crowd on HN were adamant was a done deal, even though that theory never made any sense).
Plenty of countries (Germany, France, Japan, etc.) are only slightly poorer than the US per capita, but have much smaller land area/population and therefore smaller GDP. Size matters!
This article seems to mix together two different points:
1) LLM's written CoT might not always be faithful to the model's real reasoning process (true and important)
2) The "stochastic parrot" hypothesis, which the article reintroduces as "approximate retrieval" - ie, LLMs don't "really reason" at all, they just memorize a lossy encoding of their training data. This obviously raises the question of how LLMs can now routinely solve open mathematical problems, with no solutions in the training data by definition. The article handwaves this with:
"The model doesn’t have to learn or reliably apply a general reasoning process, Kambhampati said; it just has to absorb enough examples of what the steps look like to predictively mimic them on its way to “stitching together” a plausible result that can then be verified."
The problem is that "mimicking" training data to arrive at a "plausible" result gets you an incorrect-but-plausible-sounding "proof" of the Jacobian conjecture, which was famous for humans writing plausible-looking "proofs" that had subtle flaws. You can't disprove the conjecture through sheer luck (search space too large) or "approximate retrieval" (the only thing you'd retrieve are fake "proofs"; far more human effort went into proof than disproof) or by writing something "plausible" that just happens to be correct (Jacobian was famous for "plausible" but wrong); the model must be carrying out mathematical reasoning somehow, by any sane definition of the word, even if it isn't fully reflected in CoT. The article doesn't address this.
> This obviously raises the question of how LLMs can now routinely solve open mathematical problems
Because many open math problems can be solved by synthesizing two disparate ideas and then cranking the handle for hours and hours. I don't think applying idea X + idea Y to identify a good subset of the search space, and then exhaustively searching that subset, is --necessarily-- a process that involves reasoning. I think this is why so many LLM results in mathematics are counterexamples that disprove open conjectures.
When I look back at the reasoning process after an LLM completes a task where I expected it to fail, I usually find many approaches that make no sense and are doomed to failure, before it lands by drunkard's walk on a method that happens to work.
(This does not mean LLMs are useless or that I necessarily agree with the claim that they never do reasoning.)
"Investigation and response
Incident timeline:
9:50:23 a.m. The agent made the DNS tool call that received an external response.
10:02:11 a.m. The monitoring system raised a P0 alert.
10:05:06 a.m. A human reviewer acknowledged the alert.
12:34:30 p.m. The run was killed.
Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded. The incident exposed a gap in our controls over network restrictions. We therefore stopped the affected training run and have subsequently decided to pause all other training, evaluation, and inference with tool-use (defined broadly) for our most capable models until we have both validated that the gap is resolved and performed additional red-teaming of the system. When training restarts, we will begin a fresh run with additional alignment improvements, including more comprehensive misalignment interventions. We will not resume training this particular model, even though the existing reward signal already correctly penalized this behavior."