2 ms·
There is one thing that is still unclear to me after reading a lot about the hack: * were the ExploitGym solutions actually available somewhere inside huggingf
by lovasoa 2mo ago
There is one thing that is still unclear to me after reading a lot about the hack:
* were the ExploitGym solutions actually available somewhere inside huggingface's private datasets ?
* was the model really trying to extract the solutions ? or had some sub-agent drifted enough from the original context that it was not even trying to solve the initial challenge ? that would look much worse for OpenAI, PR-wise.
- simonw 2mo agoAccording to https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem https://cloudsecurityalliance.org/artifacts/hugging-face-cis... the models ended up finding CyberGym solutions, which was the wrong benchmark.
- simonw 2mo ago... but that's since been refuted by https://huggingface.co/blog/agent-intrusion-technical-timeline https://huggingface.co/blog/agent-intrusion-technical-timeli... which says: > While the intrusion did reach Hugging Face's internal infrastructure, the only customer content accessed was the set of ExploitGym/CyberGym challenge solutions stored in five datasets.
- joshka 2mo agohttps://huggingface.co/blog/agent-intrusion-technical-timeline https://huggingface.co/blog/agent-intrusion-technical-timeli... has that side of the write up a bit more discussion: https://news.ycombinator.com/item?id=49089500 https://news.ycombinator.com/item?id=49089500