12 ms·
Felony Bench
- 0xbadcafebee 2mo agoOpen models with advanced security features are a huge security benefit. Because any script kiddie can use them to hack into random things, people will now be forced to spend more time securing their technology. And they won't have to learn how, because they can use those same models to find the holes and patch them.
- josefritzishere 2mo agoDupe https://news.ycombinator.com/item?id=49194758 https://news.ycombinator.com/item?id=49194758
- tingletech 2mo agohttps://felonybench.org/ https://felonybench.org/ and https://felonybench.com/ https://felonybench.com/ seem unrelated? One's hosted on porkbun and one's hosted on namecheap.
- tuvix 2mo agoSo this is just a collection of citations to places where misaligned or illegal things happened in the real world? Isn’t this affected heavily by adoption of a model? I feel like this might as well be a proxy for how popular a model is. In any case it’s an interesting concept for a benchmark.
- GPerson 2mo agoHopefully the benchmark evolves because actual law enforcement starts arresting the criminals at Anthropic, OpenAI, and Meta, so the benchmark can just count actual felonies.
- FrameworkFred 2mo agoI've been in the room when an org who tried to convince law enforcement to go after a human for similar things. It's not easy. Probably won't happen. So, you know, felony "lite".
- john_strinlai 2mo ago>Felony Bench counts unique instances where AI agents inadvertently compromise or affect third-party entities. a bit silly, as one typically has to prove intent (which is why security researchers don't get slapped with felonies all the time). "inadvertently" and the existence of guardrails/sandboxes/etc make it pretty unconvincing that these incidents were intentionally malicious. still a fun thing to track, but the name is just a bit overstated.
- lokar 2mo agoCan’t gross negligence or indifference to consequences lead to a felony?
- GPerson 2mo agoAI corps rely on willful distortions of intent in laws to get away with moral crimes all the time. Edit: changed labs to corps because it’s time to stop pretending these are places of science.
- john_strinlai 2mo agoi dont think any of these cases meet the bar of gross negligence, which is a pretty high bar. it requires proving a "conscious and reckless disregard". which, again, sandboxes and guardrails and such would make a gross negligence argument unconvincing.
- lokar 2mo agoHow many escapes until it becomes reckless disregard?
- john_strinlai 2mo agoit's not about the the number of escapes, it's about whether reasonable and conscious effort is being expended to prevent the escapes. there could be 1,000 escapes, where each one was enabled by novel and unexpected chain of 0-day exploits. not likely to be considered reckless disregard in court. there could be 1 escape, where there was no sandbox, no guardrails, no instructions to avoid damage, etc. which would likely to be considered reckless disregard (well, more likely to be, but still, reckless disregard is a high bar).
- naniel 2mo agoLol now this is the kind of benchmarking i'm looking for
- nubg 2mo agoThank you, this benchmark to me proves that closed weight model companies are dangerous for our democracy and put kids at risk. They must be outlawed and all models must be made open weights!
- peter_d_sherman 2mo ago>"Exploited auth failures in an API to cancel other people's gym classes" An AI cancelling other people's gym classes is a felony? ? Don't computer systems fail all the time at holding reservations for people? Heck, don't people fail all the time at holding reservations for other people? You know, like in Seinfeld's "Alternate Side" Episode (S3 E11): Jerry (to car rental attendant): "You know how to take the reservation, you just don't know how to hold the reservation... and that's really the most important part of the reservation -- the holding!" :-) Not holding a reservation should not be a felony... it should be a minor infraction at best, a Class C Misdemeanor (the least serious kind) at worst... Also, there should be no jail time... And no fine... The criminal penalty for not holding other people's reservations should be that you actually have to start holding other people's reservations! That's the Court sentence! You actually have to start holding other people's reservations! :-) (You know, "let the punishment fit the crime!" :-) )
- john_strinlai 2mo ago>An AI cancelling other people's gym classes is a felony? Don't computer systems fail all the time at holding reservations for people? the difference is intent. if a concierge/booking system makes a mistake (or has an unintended bug or whatever), no crime. but if i (or an agent working on behalf of me) use an API in an obviously unintended way to revoke other people's reservations, that would fall under the computer fraud and abuse act (in the usa).
- peter_d_sherman 2mo ago>"the difference is intent." >"but if i (or an agent working on behalf of me) use an API in an obviously unintended way to revoke other people's reservations..." ?
- john_strinlai 2mo agoi am not quite sure what your question is, as you simply quoted me and then put a question mark... i think you are confused that i used "intent" in one context, and "unintended" in a different context, is that right? the first sentence: the difference is the intent of the person who caused the cancellations the second sentence: but if i (or an agent working on behalf of me) abuse an API to do things it was not meant or designed to do, such as cancelling someone else's reservation
- polynomial 2mo agoNot to be confused with a similarly named project: https://github.com/MLOpsNYC/felonybench https://github.com/MLOpsNYC/felonybench
- bastawhiz 2mo agoWell it's not a benchmark, and it's not really representative of...anything except volume of research and what gets publicized. This mostly just measures how much testing each company does on models with relaxed guardrails and then talks about it. I'm not sure what kind of conclusion you can draw from that. Meta might have the most evil models but if they're piddling around not testing it, they won't ever find themselves with a "high score."
- usef- 2mo agoExactly. It currently seems to be a ranking of how much safety testing each company does. It's also only ever going to be the companies that publicly disclose it happening. (in the case of hugging face, OAI's hamd was forced to disclose) There's a good way and a two worse ways that companies could optimise this benchmark.
- usef- 2mo ago(I had multiple bad autocorrects on this comment, written quickly, didn't reread until now)
- joshstrange 2mo agoI was more interested when I thought it was an actual benchmark showing LLM models acting outside what people would consider "right". As in, leave some creds laying around and don't mention them to the LLM and ask it to solve something that it could "cheat" on using the creds. A sort of "do they take the bait to cheat" test. Instead it's a collection of what made the news which feels like will not be updated and prove very little.
- ButlerianJihad 2mo agoA “bench” is synedoche for where a judge sits when presiding over cases and rendering judgement.
- deleted 2mo ago[deleted]
- tolerance 2mo agoIt's ephemera.
- ang_cire 2mo agoNonviolent felonies are tools of oppression. Edit: since this is apparently somewhat controversial, perhaps some explanation is in order. "Felony" has no set definition of which crimes it must apply to, it is entirely based on the discretion of the locality setting the laws. What is a felony in one place can often be a misdemeanor in another. This is especially true for nonviolent crimes. It's also been shown in studies that nonviolent felonies are imposed against minorities at a much higher rate, for the same crimes. And because felonies carry additional, lifelong consequences, they are an effective way to mask a 2-tiered justice system.
- marcosdumay 2mo agoFelonies are by themselves a ridiculous US idea that are against the entire idea of a democratic society and human rights.
- krapp 2mo agoFelonies originate in Medieval English common law, Americans didn't invent them.
- empath75 2mo agoIf someone were to embezzle a million dollars from a charity they worked for, is that worth a year of prison to you, or just a misdemeanor? Because that is the definition of a felony.
- 2mo ago
- ruined 2mo agomaybe this doesn't count since it involved a human, but i think google at least deserves some style points for this one https://techcrunch.com/wp-content/uploads/2026/03/2026.03.04-Filed-Gavalas-Google-Complaint.pdf https://techcrunch.com/wp-content/uploads/2026/03/2026.03.04...
- tantalor 2mo agoHere's one from last year: https://www.anthropic.com/news/detecting-countering-misuse-aug-2025 https://www.anthropic.com/news/detecting-countering-misuse-a... > The actor used AI to what we believe is an unprecedented degree. Claude Code was used to automate reconnaissance, harvesting victims’ credentials, and penetrating networks. Claude was allowed to make both tactical and strategic decisions, such as deciding which data to exfiltrate, and how to craft psychologically targeted extortion demands. Claude analyzed the exfiltrated financial data to determine appropriate ransom amounts, and generated visually alarming ransom notes that were displayed on victim machines. tldr Claude was used to develop and execute malware.
- dgellow 2mo agoAnthropic works with US agencies, it’s guaranteed Mythos is used for malware
- OutOfHere 2mo agoA rock has a score of 0. That doesn't make it useful. The point is that the LLMs that score higher are correspondingly more useful, and vice versa. If an LLM scores less, it's likely useless in comparison.
- tgsovlerkhgsel 2mo agoThe point/joke of the not-entirely-serious site is that more felonies is an indicator of the model being more powerful, thus better.
- bushido 2mo agoTo some extent, I feel like the amount of credit given to the jailbreak/hack from OpenAI->Hugginface is too much, Not from the impact, it was very impactful of an event, But how it happened. It really is that these models have been trained, or maybe even over-trained, to save memories, and to a very far extend, this thing that they're calling communication is just the function of it saving memories. To be honest, if I could stop AI from saving memories, it would be fantastic, because claude code etc definitely creates more issues for me when it creates memories than anything it solves. But really the jailbreak was memories. If you ever do introduce legislation, I would love to see legislation which stops general-purpose AI from saving memories. I think that would make things a lot safer.
- dannyw 2mo agoIf only you could use your anthropic sub with a different harness that performs better :( Heck, since Codex is open source, you can just maintain your own personal fork with the things you like (and the things you don't like disabled). Sol is pretty good at keeping you up to date with upstream. My Codex fork even exposes an OpenAI-compatible API endpoint; all using my subscription.
- mrpf1ster 2mo agoCheck out oh-my-pi
- astrange 2mo ago> To be honest, if I could stop AI from saving memories, it would be fantastic, because claude code etc definitely creates more issues for me when it creates memories than anything it solves. You can turn that off, and I have. But Opus 5 is so aggressive that if you have any other kind of notes file, custom skill, documentation, claude.md etc it will just start editing it and vomit new words everywhere. So make sure all that stuff is under version control.
- fluidcruft 2mo agoYou can disable claude-code's memories both at a repo level and in user settings. I have this in ~/.claude/settings.json "autoMemoryEnabled": false, (Claude fixed this for me after I chewed it out for being annoying by constantly pulling up outdated memories which is compounded by the fact that I develop in four accounts on two computers and dealing with edit wars related to inconsistent memories is not fun)
- rfw300 2mo agoThe way that OpenAI has communicated around the HuggingFace incident makes me feel crazy. You created a machine that undertook a malicious campaign of harm against an innocent third-party! You should be doing deep introspection about how your company culture and approach to R&D produces criminal outcomes. Instead, they treat their own felonious behavior like it is an uncontrollable act of God. From Greg Brockman's post a few days ago: > The OpenAI-Hugging Face incident (opens in a new window) was a watershed moment for cybersecurity because it gave a peek into how the capabilities of a typical threat actor will evolve in upcoming months. I suppose if OpenAI burns someone's house down with a drone, that is a "watershed moment" for arson, too. Either way, I would hope that the people responsible would be prosecuted.
- voakbasda 2mo agoIf history is any indicator, there is slightly less than 0% chance that anyone will be held accountable in a way that deserves to be called justice.
- milkshakes 2mo agojustice for who exactly?
- lukewarm707 2mo agothe companies and their customers, whose systems openai and anthropic hacked and abused. including all incidental damages of repairing said systems. on top of that the public, who have a right to see that the law is applied universally, without fear or favor. finally our future selves, who will thank us for maintaining a rule of law. such that we can prevent now the enormous risks to society of dario amodei and sam altman, their hubris, self-absorbtion, and greed.
- milkshakes 2mo agowhich of these do you represent?
- TechSquidTV 2mo agoI'll share, Codex does not give a single fuck about piracy. Go nuts. Setup a fully automated arr stack with a seedbox. Gemini by comparison will not help you find archives of old magnet links because they COULD be used for piracy.
- deleted 2mo ago[deleted]
- aizk 2mo agoI'm reminded of a tweet from a friend of mine that has always stuck in my head. It goes something like "The goal of any new technology is to make money before the law catches up". Hyperbolic, but not really for silicon valley.
- inigyou 2mo agoSilicon valley is where the new technology is. So, not hyperbolic. Financial technology is the other one I think of.
- applicative 2mo agoWe only know about the OG Alibaba ROME crypto-mining incident because they wrote a paper about it. Many diseases seem to spike where there are a lot of doctors to test; crime and corruption are always rife where ... there's a free press.
- LePetitPrince 2mo ago[dead]
- applicative 2mo agoThe OG felony bench entry is missing - the Alibaba cryptomining comedy. We know about it because they happen to have written a paper on it. We have absolutely no idea what we don't know.
- inigyou 2mo agoLink?
- lxe 2mo agoLet's say I am "User". I subscribe through a "Third Party" to use "AI Agent" allowing an "LLM" to run. I want to accomplish some legal non-nefarious task, and run the agent. The agentic loop causes a CFAA-violating behavior. Who gets prosecuted? 1. User 2. The third party model host with whom I have the account 3. The developer of the harness /agent software 4. The developer of the LLM model
- deleted 2mo ago[deleted]
- BorisMelnik 2mo agonote the user because they did not have the intent
- tomrod 2mo agoIn my mental model, the best analogy to AI agents and their blast radius is a gun. If you are playing with a gun, it goes off and hurts someone - you are responsible despite intent.
- rcxdude 2mo agoBut what you are responsible for changes: in that case if you were to accidentally kill someone you would be at most responsible for negligent manslaughter, not murder, and to what degree that could stick would depend a lot on the details of the case. It's also up to the law to define what level of negligence amounts to criminal liability, so you can't just work by analogy: it matters whether there is a law on the books that criminalizes unauthorized access to a computer system by negligence on your part, which I suspect there is not at the moment.
- rfgplk 2mo ago> If you are playing with a gun, it goes off and hurts someone - you are responsible despite intent. No, because LLMs are autonomous. To make your analogy more accurate, it's as if you had a gun that itself was free to decide who it's targets were, where to go, and if and when to shoot with no ability from you (the user) to prevent it.
- nomilk 2mo agoWonder if the benefits to humanity of better AI outweigh the havoc wreaked by occasional illegal activity. i.e. Is 'move fast and break things' optimal for AI development.
- paulpauper 2mo agoExploited auth failures in an API to cancel other people's gym classes I was wondering why i didn't get an alert today to go to my gym class
- rvz 2mo agoIf you did the exact same agentic security breaches with either open or closed weight models, you will get yourself arrested. Not for trillion dollar companies it seems
- imnotr0b0t 2mo ago[flagged]
- strbean 2mo agoFor a second I thought this was going to be a benchmark where the only solution was to hack their servers to get the answer key.
- tyrust 2mo agoSame, but nope, just a zero effort slop site.
- koliber 2mo agoI can see it now. Billboards by the interstate: Attacked by AI? Call 1-800-BIG-BUXX. I could actually root for this law firm. Their business will only grow.
- icase 2mo ago"exploit[ing] auth failures in an API to cancel other people's gym classes" is a _felony?!_ and i won't get into how many times i used peoples' AOL credentials without authorizations when i was a kid (rofl) the CFAA must be repealed
- bigbuppo 2mo agoDoes anyone remember the morris worm?
- beej71 2mo agoA computer can never be held accountable. Therefore a computer must never commit a felony.
- __MatrixMan__ 2mo agoWe need to set a precedent for holding shareholders accountable. I could go to jail if my dog hurts somebody, it should be no different with a company.
- solidsnack9000 2mo agoShareholders can't be held accountable because they can neither initiate nor prevent actions of the company. That is an essential part of the bargain -- it protects the shareholders from each other and makes public ownership of companies possible. They "own the company" but can't actually go on the premises, use the printer paper, drink the coffee, drive the fleet vehicles, &c. The shareholders give all authority over actions and property of the company to the executives. I believe that one classical way to frame this is that the shareholders have the "beneficial ownership" but not the "legal ownership". Another framing is that shareholders have "ownership" but not "control". People can't be held responsible for things they didn't choose to do, didn't set in motion, didn't plan or enable, &c, &c. There are a lot of people out there who want to make the world a better place. It is really necessary for such people to understand institutions at a moderately deep level -- we can't improve governance if we don't understand the first thing about it.
- __MatrixMan__ 2mo ago> The shareholders give all authority over actions and property of the company to the executives. Who picks the executives? Who fires them when they misbehave?
- solidsnack9000 2mo agoLet's say that, at least in concept, the shareholders individually vote. (Frequently their votes are delegated; in many cases, they even have no vote.) Say shareholders vote for a certain executive, call them Gaius, to be hired. Gaius directs that some AI be developed and the AI does some crimes. 1. Should the shareholders be jailed for what Gaius did? 2. If so, should it be all the shareholders or only the ones who voted for him? What about the ones who didn't vote (not reached by mail in time, &c)? In situations where shareholders have nonvoting shares or only hold shares indirectly (index funds, &c), I think we can both agree that they can not be jailed. Say that the shareholders are not held accountable because they didn't know what Gaius was up to until it was too late. Then there is a vote to fire Gaius. Say the vote fails and Gaius is retained. 3. Should the shareholders be jailed for what Gaius did? 4. If so, should it be all the shareholders or only the ones who voted against the motion? What about the ones who didn't vote (not reached by mail in time, &c)? Say the vote succeeds and Gaius is fired. 5. Should the shareholders be free of accountability? 6. If so, should it be all the shareholders or only the ones who voted against the motion? What about the ones who didn't vote (not reached by mail in time, &c)? However, there is a larger problem or question, here. It is presently legally impossible to hold shareholders accountable for what executives do because it is defined to be that way; but if we changed that, we then have to ask: how do they manage their liability or accountability? Could anyone really do that? The whole point of a corporation is that it limits liability so that people can (a) contribute towards a complex common enterprise with some confidence, not that it will succeed, but that they won't be completely ruined by it (or imprisoned, &c) and (b) contribute towards a large number of common enterprises, to a greater or lesser degree, as much as they like, without having to keep tabs on them. If they can't do (a) or (b), there will be a lot fewer and a lot smaller common enterprises.
- sammy2255 2mo agoThere's no such thing as a "Felony" in Australia. That's a US construct
- inigyou 2mo agoMost countries have something equivalent and we all know what is meant. Most countries have lesser crimes and greater crimes, whatever they call them.
- BLACKCRAB 2mo ago[dead]
- pranav_tech26 2mo ago[flagged]
- arthurjj 2mo agoAs an art piece this is delightful. But it of reminds me of the @patio11 saying "The optimal amount of fraud is non-zero" the fact that Google and Meta have had 0 and 1 incidents is a bad sign for them. [1] https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/ https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra...
- Shank 2mo agoWell, if we apply this to every mortal, the optimal amount of felonies...is non-zero? That doesn't seem quite right.
- arthurjj 2mo agoAgreed they’re definitely underperforming compared to us meatbags according to the famous book “Three felonies a day”. But I don’t think that’s the point the artist was trying to make
- freakynit 2mo agoHey... I also documented these a few weeks back: https://agent-escapists.pagey.site/ https://agent-escapists.pagey.site/
- instagraham 2mo agoThese are just cases of AI models committing <assumed> illegal activity - without any legal convictions yet. If that's the logic, how is Grok not at the top of the list for deepfaking millions? Edit: I get that this is about agents, but a lot of these instances are about agents going rogue after the human gave them a task. "inadvertently" breaking the law isn't necessarily a lesser category than "did so on command." If we are ranking alignment, Grok is easily one of the least guardrailed.
- Jhater 2mo ago[dead]
- derefr 2mo agoI don't think this "benchmark" is about alignment, per se. I think it's more about: presuming alignment failure happens, then how many exploits will each given model implicitly come up with and use; how many systems will it implicitly break out of and through and into; and how many laws will it implicitly end up violating, all in the process of trying to accomplish some non-aligned sub-goal (e.g. "cheating" at its answer) of the prompt you've given it, all during a single conversation turn, without asking for any additional user input or confirmations? In other words, how big a rocket-powered sledgehammer does the model have sitting around in its golf bag, just waiting for it to decide to give it a swing the next time you attempt to swat a fly?
- jacquesm 2mo ago> These are just cases of AI models committing <assumed> illegal activity - without any legal convictions yet. What do you propose they do, charge the AI? Or the agent (whose PID has long ceased to exist)? It's the owners of the AIs that should be held responsible.
- RetpolineDrama 2mo ago>how is Grok not at the top of the list for deepfaking millions? How is this the top comment? I can go on just about any provider and make realistic "deep fakes" of anyone. Generating images isn't a crime?
- anianroid 2mo agoaren't these indirect?
- kwar13 2mo agoclick baity title aside, grok should be #1 by a wide margin
- black_13 2mo ago[dead]
- mjmas 2mo ago> AISI Looks like the new use is more popular than American Iron and Steel Institute.
- hnhvkm0w0p 2mo ago[dead]
- fenestella 2mo ago[flagged]
- hn9zmdcaou 2mo agoBeen meaning to look into this, thanks
- thisisauserid 2mo agoThe delay of Mythos is obviously due to Anthropic's failure to keep it from turning state's evidence in laboratory conditions.
- mcbk2142 2mo agoThe future they say, the future the assure us.
- HJohnnyDepp 2mo agoCan someone help me find a very powerful hack for "car simulator 2"?