6 ms·
I can't believe we're finding out about this from 3p researchers again (but nice job on the investigation!). OpenAI had two great opportunities to disclose this
by jsnell 5d ago
I can't believe we're finding out about this from 3p researchers again (but nice job on the investigation!). OpenAI had two great opportunities to disclose this. The HF incident report, and in response to the German Wiki issue.
It seems impossible to believe they didn't know. This must be the same training run the HF incident was about, and this should have lit up like a Christmas tree in the investigation. How many more incidents do they know about and didn't disclose?
- qnleigh 3d agoIt's possible that they didn't notice.
- sho_hn 5d agoConsidering RubyGems was part of the HF story, seems likely to be connected.
- XenophileJKO 5d agoThat was my reaction. I assumed this was the compromised organization that allowed escalation on the artifactory server.
- oceansky 5d agoAlso, why there's no accountability? Even if there's no intent, it's still a cyber attack.
- matthewdgreen 5d agoBecause right now the Department of Justice is shut down for causes that the administration supports, which includes OpenAI, and none of the victims want to sue over it.
- parineum 5d agoState government exists, contrary to popular belief.
- sethammons 5d agoAnd the republicans in the states are being shitty too. They tried to block their own state attorneys general from protecting the state and opposing Trump in NC.
- gruez 5d agoNo harm, no foul. Dog owners are on the hook for damages resulting from their dogs, but there must be some damage in the first place. If the dog gets loose and goes in your fenced backyard, disregarding your "no trespassing" sign, you can't punish the dog owner just because. Hacking into a server is closer to the latter. At best rubygems can claim some cleanup costs.
- wmf 5d agoIf any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup.
- scotty79 5d agoRemediation mostly involved repairing pre-exising holes in the fences that the dog crawled through.
- sdf4j 5d agoSince when isn’t that a cyber attack?
- gruez 5d agoBecause "attack" implies intent. Accidentally break a window? You might be on the hook to fix it, but you're not going to jail. Break the same window at 3am, while carrying a duffel bag and other burglary tools? Well that's (attempted) burglary, even if you chicken out and didn't steal anything.
- none2585 5d agoThat's not really true. Unauthorized access to a system is a crime regardless if there was damage. https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030
- gruez 5d ago
- cameldrv 5d agoIt’s interesting that a lot of U.S. law requires intent. If you just give AI your objective without specifying the means, and the AI violates a bunch of laws requiring intent, but neither the AI nor the person can be prosecuted, this is very convenient.
- deleted 5d ago[deleted]
- lukewarm707 5d agothe charges here would depend on negligence and acting recklessly. we might get something if they tried to cover it up.
- Sanzig 5d agoThey can still be held civilly liable for negligence, though.
- croes 5d agoAt some point that recklessness looks like intent
- elmer2 5d agoI don't think this true. If I throw a brick out my window and it hurts someone, I can still be held criminially liable, even if I didn't mean to do it. Do drunk drivers intionally kill people on the road?
- CGamesPlay 5d agoIntent is the difference between murder and manslaughter, in that case. Drunk driving is common enough that prosecutors will argue that getting drunk in a situation where you have to drive is intent. Get OpenAI convicted of unintentional CFAA first, then say that the negligence qualifies as intent, I suppose.
- dghlsakjg 5d agoNot a lawyer, but the other responder definitely isn’t either. Whether intent is required is down to how the law is written. For many offenses “strict liability” applies, where intent is not required, they only have to prove you did it, not what your intent was. DUI is typically a strict liability crime. They don’t need to prove that you intended to drive drunk, only that you did drive drunk.
- scotty79 5d agoWe have a word for attack with no intent. It's accident.
- nkrisc 4d agoSomething being an accident does not necessarily preclude negligence.
- DrewADesign 5d ago> We have a word for attack with no intent. It's accident. And we have a word for an accident caused by people that failed to implement proper risk mitigation, were not paying attention, and should have known better. It’s negligence.
- scotty79 4d agoYes. But for someone to be negligent they have to violate known and/or obvious rules. There are no established rules about how to handle AI isolation. The fact that something had undesirable outcome doesn't automatically make it negligence or attack.
- DrewADesign 4d agoSpecifically what legal type of negligence are you referring to and how does that known or obvious rule fit into the standard legal tests? Does that known of obvious rule have to be a law? There were no ‘rules’ about attaching strings from your doorknob to the trigger of a shotgun and pointing the gun at your door, but when someone died from just that, it was pretty famously determined to be negligent.
- scotty79 4d agoI'm sure that when someone dies as a result of mishandling of AI, some rules are going to be established. At the latest. We are just very soon. Shotguns and strings and concept of booby trapping were well understood before the rules were established. We are only scraping the surface of what AI is and what it can be capable of. Besides, booby traps are more than negligent, at least in some countries. If you are seeking analogy, radioactivity might be a better one. The rules about handling radioactive materials in the first few decades after its discovery were lax when compared to modern ones and things now considered criminally negligent weren't back then. Maybe in 2050 soemthing what OpenAI did would be considered negligent, but it might have been for the reasons you might not expect. For example it might be mandatory to test new containment dedicated for further tests you should first spend at least 10 million dollars of compute for AI to try to break out of it. Or it might be illegal to use closed source software as any part of containment. Rules that we end up with might be compeltely different from what we imagine them today. Acusing openai of attack or of criminal negligence at this point is like accusing Skłodowska-Curie that your wine didin't come out great because her exepriments killed some yeast.
- alexfortin 5d agoExactly. Think what would happen if it was a Chinese LLM company behind such an attack...
- thewhitetulip 4d agoOr a human for that matter
- DerArzt 4d agoBelieve it or not, straight to jail.
- thewhitetulip 4d agoIt's not about belief! It's about history. There are countless examples
- root_axis 5d agoWho could possibly hold them accountable?
- throwaway89864 5d agoA district attorney that would want to make themselves a name, perhaps?
- lalalanananana 5d agoGood luck getting any form of punishment even if found guilty. It's a department of war contractor... People who disrupt things like that end up committing suicide.
- parineum 5d ago> People who disrupt things like that end up committing suicide. Care to cite some examples?
- lalalanananana 4d agoBoeing and openai whistleblowers
- parineum 4d ago2 of how many? Was there evidence of foul play or just innuendo?
- reasonableklout 5d agoOpenAI is currently under investigation by a coalition of state attorney generals: https://www.nytimes.com/2026/06/13/technology/states-investigating-openai.html?unlocked_article_code=1.AlE.JWC7.r5pzEZzTHIPZ&smid=url-share https://www.nytimes.com/2026/06/13/technology/states-investi... A state coalition extracted $17B from Meta earlier this year, so consequences can happen, although our legal system moves very slowly.
- deleted 5d ago[deleted]
- talon8635 5d agoAnd yet HF was just a marketing ploy, right everyone? So why not get that awesome street cred promoting the RubyGems incident?
- emsign 5d agoOpenAI won't make their illegal activities public by themselves.
- nickcosta 3d ago[flagged]