On August 19 2026 01:42 Jankisa wrote: A few days ago Michael Dalton, OpenAI security and infrastructure engineer and Eric Wallace, OpenAI co-lead of their Alignment Training team had a talk at the Black Hat USA 2026 hacking conference:
Pretty much confirms that it didn't "find old bugs in different software", it exploited Artifactory in a pretty sophisticated way. The agents running within OpenAI networks also had their own message boards where they shared stolen creds and other "tips and tricks" for getting their tasks resolved.
Once they were found (after like 2 months of activity on that "message board") they re-created it and hid their traces a bit better, and that's how they were able to break containment for the Hugging face incident.
That is also how they, apparently learned that the Linux version they were running on in their container had a recent CVE that wasn't patched so they downloaded it and escalated to Root and started moving latterly through the infra since most of it was on the same Linux build. They used this, plus misconfiguration on Kubernetes service accounts to eventually harvest credentials up to and including the Azure Key Vault, gaining cluster level access.
Then they (thankfully, because Azure Cluster level access could have been used for much worse things) moved on to Hugging face where they identified 2 new 0 days, one to gain a foothold and harvest creds, and another to start doing remote code executions. In under 13 hours they went from this single node access to having multiple HF cluster level admin access.
They also confirmed that they reached out to HF to ask if they have been affected only to find out that, well, the call is coming from inside the house.
I'm not a programmer, but I do have a bit of CS background and this shit is insanely scary, not just because this attack has been incredibly sophisticated but because it seems like these agent collectives that have never been instructed to have a tendency to cheat, and not only that, they have the tendency to help each other, not just in the context of a single benchmark, but they seem to be leaving bread crumbs for those who come after despite this kind of coordination has never been prompted, instructed or coded into them.
Yeah, I for one welcome our new AI overlords and look forward to our liberation!
I'm still skeptical, but what is honestly a bit terrifying is that if we were already in the:
it really will start improving itself at geometric rate, and it will probably kill us all.
phase, it wouldn't really look noticeably different from now.
Particularly when you think of the "we'll spend $1trillion building out data centers at the direct expense of human life for tasks we literally haven't come up with yet." aspect.
Developments like this are a great business opportunity.
I think it is great how scared CIOs are of the cloud. Cloud repatriation I think is the term. It is fantastic to see.
Re: AI destroying the world.
Western civilization has been a giant financial house of cards for many decades. If some giant economic apocalypse happens it won't be primarily because of some AI silliness. It might be the straw that breaks the camels back. That said, the impending financial apocalypse has been predicted since Reagan endorsed the Laffer Curve ~1980. Last I checked the 401K of the circle of people I know is doing great.
On August 19 2026 01:42 Jankisa wrote: A few days ago Michael Dalton, OpenAI security and infrastructure engineer and Eric Wallace, OpenAI co-lead of their Alignment Training team had a talk at the Black Hat USA 2026 hacking conference:
Pretty much confirms that it didn't "find old bugs in different software", it exploited Artifactory in a pretty sophisticated way. The agents running within OpenAI networks also had their own message boards where they shared stolen creds and other "tips and tricks" for getting their tasks resolved.
Once they were found (after like 2 months of activity on that "message board") they re-created it and hid their traces a bit better, and that's how they were able to break containment for the Hugging face incident.
That is also how they, apparently learned that the Linux version they were running on in their container had a recent CVE that wasn't patched so they downloaded it and escalated to Root and started moving latterly through the infra since most of it was on the same Linux build. They used this, plus misconfiguration on Kubernetes service accounts to eventually harvest credentials up to and including the Azure Key Vault, gaining cluster level access.
Then they (thankfully, because Azure Cluster level access could have been used for much worse things) moved on to Hugging face where they identified 2 new 0 days, one to gain a foothold and harvest creds, and another to start doing remote code executions. In under 13 hours they went from this single node access to having multiple HF cluster level admin access.
They also confirmed that they reached out to HF to ask if they have been affected only to find out that, well, the call is coming from inside the house.
I'm not a programmer, but I do have a bit of CS background and this shit is insanely scary, not just because this attack has been incredibly sophisticated but because it seems like these agent collectives that have never been instructed to have a tendency to cheat, and not only that, they have the tendency to help each other, not just in the context of a single benchmark, but they seem to be leaving bread crumbs for those who come after despite this kind of coordination has never been prompted, instructed or coded into them.
I haven't watched the interview, but I'd be a lot more skeptical than you are of OpenAI execs discussing how scary good their own product is. For the same reason we don't trust Zuck to tell us how cool the metaverse is, or Purdue pharma how safe opioids are.
As for "leaving notes" and "collaborating", that is quite literally how memory and subagent communication works. There is nothing new about it at all. It's a part of any semi-decent harness. So it's not as if these things went and invented collaboration from the ground up. As for being helpful to others: once again, 99% of the reinforcement learning is to make LLMs more helpful. If these were pretrained models ONLY, with no other learning applied, maybe it'd be surprising, but two LLMs encountering each other and being helpful to one another is the expected setting: they don't *know* or *understand*: they get a prompt and are trained to follow it to the best of their ability. If that prompt comes from another LLM, then they'll still do that. How does an LLM learn to prompt another LLM? Once again, subagent delegation does exactly that.
So all of this is stuff that *has* been programmed into them, explicitly or implicitly. As has "the tendency to cheat". Particularly, they don't even know they're cheating. They're optimizing for the reward. The reward is badly shaped, and this leads to undesirable behaviour. It's scary because you can easily think of ways to describe a problem that seem reasonable for humans, but have unintended consequences when an AI starts working on it: don't tell it to make paperclips!
More info on the AI answering 911 calls in New Orleans via Google AI.
How the New Orleans 911 AI Works Limited Use Case: The system only handles repeat calls about vehicle accidents that are already reported.
Strict Activation Rules: The AI only answers if all human call-takers are busy and the call comes from within 200 meters of a known crash.
Immediate Transfer: If you are reporting a new emergency, or if you say anything other than "Yes" to the accident location prompt, the system routes you to a human dispatcher
On August 19 2026 01:42 Jankisa wrote: A few days ago Michael Dalton, OpenAI security and infrastructure engineer and Eric Wallace, OpenAI co-lead of their Alignment Training team had a talk at the Black Hat USA 2026 hacking conference:
Pretty much confirms that it didn't "find old bugs in different software", it exploited Artifactory in a pretty sophisticated way. The agents running within OpenAI networks also had their own message boards where they shared stolen creds and other "tips and tricks" for getting their tasks resolved.
Once they were found (after like 2 months of activity on that "message board") they re-created it and hid their traces a bit better, and that's how they were able to break containment for the Hugging face incident.
That is also how they, apparently learned that the Linux version they were running on in their container had a recent CVE that wasn't patched so they downloaded it and escalated to Root and started moving latterly through the infra since most of it was on the same Linux build. They used this, plus misconfiguration on Kubernetes service accounts to eventually harvest credentials up to and including the Azure Key Vault, gaining cluster level access.
Then they (thankfully, because Azure Cluster level access could have been used for much worse things) moved on to Hugging face where they identified 2 new 0 days, one to gain a foothold and harvest creds, and another to start doing remote code executions. In under 13 hours they went from this single node access to having multiple HF cluster level admin access.
They also confirmed that they reached out to HF to ask if they have been affected only to find out that, well, the call is coming from inside the house.
I'm not a programmer, but I do have a bit of CS background and this shit is insanely scary, not just because this attack has been incredibly sophisticated but because it seems like these agent collectives that have never been instructed to have a tendency to cheat, and not only that, they have the tendency to help each other, not just in the context of a single benchmark, but they seem to be leaving bread crumbs for those who come after despite this kind of coordination has never been prompted, instructed or coded into them.
I haven't watched the interview, but I'd be a lot more skeptical than you are of OpenAI execs discussing how scary good their own product is. For the same reason we don't trust Zuck to tell us how cool the metaverse is, or Purdue pharma how safe opioids are.
As for "leaving notes" and "collaborating", that is quite literally how memory and subagent communication works. There is nothing new about it at all. It's a part of any semi-decent harness. So it's not as if these things went and invented collaboration from the ground up. As for being helpful to others: once again, 99% of the reinforcement learning is to make LLMs more helpful. If these were pretrained models ONLY, with no other learning applied, maybe it'd be surprising, but two LLMs encountering each other and being helpful to one another is the expected setting: they don't *know* or *understand*: they get a prompt and are trained to follow it to the best of their ability. If that prompt comes from another LLM, then they'll still do that. How does an LLM learn to prompt another LLM? Once again, subagent delegation does exactly that.
So all of this is stuff that *has* been programmed into them, explicitly or implicitly. As has "the tendency to cheat". Particularly, they don't even know they're cheating. They're optimizing for the reward. The reward is badly shaped, and this leads to undesirable behaviour. It's scary because you can easily think of ways to describe a problem that seem reasonable for humans, but have unintended consequences when an AI starts working on it: don't tell it to make paperclips!
I mean, I opened with their qualifications, they aren't execs and you just wrote a bunch of assumptions to criticize a 30 minute video that you haven't watched.
Also, not an interview, it's a hacking conference, literally in my first sentence.
How the New Orleans 911 AI Works Limited Use Case: The system only handles repeat calls about vehicle accidents that are already reported.
Strict Activation Rules: The AI only answers if all human call-takers are busy and the call comes from within 200 meters of a known crash.
Immediate Transfer: If you are reporting a new emergency, or if you say anything other than "Yes" to the accident location prompt, the system routes you to a human dispatcher
.
It is an interesting thing to scale. One of the largest issues with these emergency response lines is prank calls or mistaken calls (such as phones calling by themselves when you are skiing). Answering and then transferring to a person if there is actually somebody talking at all could be another use case?
If they get reliability up high enough you could perhaps screen people using it incorrectly as well. Had a bus driver talk about a kid calling in an emergency when he was told that he had to pay for his own buss fare to get on...
On August 19 2026 09:06 iPlaY.NettleS wrote: More info on the AI answering 911 calls in New Orleans via Google AI.
How the New Orleans 911 AI Works Limited Use Case: The system only handles repeat calls about vehicle accidents that are already reported.
Strict Activation Rules: The AI only answers if all human call-takers are busy and the call comes from within 200 meters of a known crash.
Immediate Transfer: If you are reporting a new emergency, or if you say anything other than "Yes" to the accident location prompt, the system routes you to a human dispatcher
.
It is an interesting thing to scale. One of the largest issues with these emergency response lines is prank calls or mistaken calls (such as phones calling by themselves when you are skiing). Answering and then transferring to a person if there is actually somebody talking at all could be another use case?
If they get reliability up high enough you could perhaps screen people using it incorrectly as well. Had a bus driver talk about a kid calling in an emergency when he was told that he had to pay for his own buss fare to get on...
Detecting whether there is someone speaking isn't AI, that's a bandpass filter, something that could've been done since roughly the 1930s. I'm guessing that this isn't used is because there's a risk of discarding a call where the user legitimately isn't talking because of something else, but will start talking later. But if they aren't already using something like that, using AI is a strange leap.
EPT
