2026-09-26 16:46 UTC
@scottmiller42@mstdn.social @mattblaze@federate.social
Apparently the sandbox did not have direct i
Internet access. However, the agents were allowed to connect to Artifactory, a third-party package manager used to download code libraries needed for the test.
The agents discovered a zero-day vulnerability within the Artifactory software to break out of the immediate sandbox container.
Their safeguards were disabled for the testing 🫤
https://openai.com/index/hugging-face-incident-and-the-road-ahead/
Replies (1)
-
@scottmiller42@mstdn.social 2026-09-26 18:13
@simonzerafa@infosec.exchange @mattblaze@federate.social Well they could’ve put a preloaded Artifactory server behind the air gap as well. It’s SOP for hackers to use an exposed system as a bridge to access unexposed systems. I’d think if someone was testing their autonomous hacking tool, this is an entirely foreseeable outcome.