4 ms·
The way they had Artifactory configured was poor, and they were too reliant on it working perfectly, with no reason for such faith. Their config lacked any defe
by angry_octet 2mo ago
The way they had Artifactory configured was poor, and they were too reliant on it working perfectly, with no reason for such faith. Their config lacked any defence in depth and consideration of having a small TCB.
Part of the problem might be the lack of security focus, as these are AI R&D efforts first.
- simonw 2mo agoI think part of the problem is that they had been running that Artifactory configuration previously without any problems, and it gave them a false sense of security. Similar thing happened with the UK AISI - they got caught out because the environments they had used for previous generation models turned out to be completely inadequate for the new generation of Fable-class models: https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testing https://www.aisi.gov.uk/blog/incident-report-unsanctioned-ag...
- KingOfCoders 2mo ago"and it gave them a false sense of security." This was part of evaluating cyber security of their frontier models and they had a "sandbox" which, and I'm not a security researcher, looks not adequate from the first look.