IMO: The inability to prosecute OpenAI for these things is proof that the AI industry is already "too big to fail". Why didn't HuggingFace try to seek legal liability against OpenAI when it had explicit confirmation that they had been hacked? Because HF understands that it needs OAI and the rest of the AI industry to continue to exist and be in good legal standing, for the interest of HF's own self preservation. This is what it means for something to be too big to fail.

cfaa heavily relies on intent for prosecution (hence why researchers arent typically locked up). it would be difficult to argue that openai intended to hack other companies.

there's probably better/more likely to succeed avenues to pursue rather than the cfaa

> Hacking is illegal

I am not a lawyer, but I seriously doubt the feds could win a CFAA conviction on the Hugging Face fact pattern, even if they wanted to charge it.

CFAA has specific intent requirements, and unlike some laws, negligence does not suffice. The agents can not have legally cognizable intent and it’s unlikely there’s anyone at OpenAI who intended for the hacking to happen (if there was, the case is easy).

Existing laws don’t contemplate AI agents that have independent goals. We need new ones, the existing laws are not remotely sufficient.

I still can't fathom my company application security decision. Found pretty damning requests in our logs. Escalated. Expected it would result in at least reporting the TOS break from the originating place (one of cloud providers). Instead of that, they just went: "yeah, but we don't have logs". Provided them. "Yeah, but that ip doesn't resolve". I matched real ones from the load balancer. "There could just be many of them". There was one. When I had all the evidence gathered, they looked at me and finally told:

- It's just an Independent Security Researcher.

- So that's it? You will do no action?

- Correct

Just because something is illegal doesn’t mean it will be prosecuted, right? If I break into my friend’s house in the middle of the night and smash some stuff, and later we both acknowledge that it happened, that it was regrettable, but never press charges, then should state resources be tasked with justice?

Once companies start harming each other in undesirable ways, as opposed to proverbially toilet-papering each others’ lawns, meaningful prosecution will happen in earnest.

> They want regulation around AI

So, there is a regulatory framework for "safe-ai" that shields these companies from liability. This way, they can sell "safe-ai" to enterprises and if shit-hits-the-fan at the enterprise, sorry, this is certified "safe-ai" so, your bad. Shift blame. From an enterprise buyer's perspective they can say, hey, I bought "safe-ai" and so dont fire me when it "rm -rf"s the production database. Still, it beats me why they are painting their product in a negative light, and scaring their own enterprise customers. After this sort of marketing, any enterprise buyer would be scared to go anywhere near it

It's two things:

1. Wanting a regulatory moat around their products as you said

2. Trying to keep the """AGI""" hype alive. Evil robot hackers is a plausible Al consequence of AGI

IMO its because they can't handle rogue activity.

In the cases that I have seen covered, the AI just paper clip maximized its way to success. It has no morality / larger motivational structure. It just kept token predicting its way to wards whatever goal it was tasked with.

Model versions which gave up were discarded, leaving the ones that get to success on long horizon tasks.

Just because its a computer program, doesn't mean they can actually make it not go rogue.

Sure you can add more telemetry, have better observation, but there is no fundamental barrier that can be implemented that ensures an AI won't go rogue.

This

Nah, I think it's better for our industry to put several of these devs in prison.

Seems only fair that tech workers get to have their life ruined with 2-3 year prison stints since they feel fine destroying society.

Any AG that starts prosecuting these people will easily win any political race they decide to enter. The environment is too good; voters, rightfully I'll add, despise big tech's leaders and workers.

This

Shame it’s on a website that doesn’t allow you to view the content without paying (personal data is payment)

> The external Israeli contractor caused this mess by using inadequate sandboxing, with agents without an saferails.

You are being too kind.

In the early says of AI, papers were published showing that any sufficiently intelligent system tasked with a goal will treat its operating environment as a resource constraint to be optimized or bypassed [0] [1] [2]. You don't need to be a expert in AI to know once you have the resources of 1000's of agents and gigawatts of power we are probably getting something that is "sufficiently intelligent", at least in the sense if there are existing vulnerabilities brute force will find them.

Yet while the their marketing people were shouting the capabilities of these AI's from the roof tops, they hired the lowest bidder to implement their infrastructure. It looks like aforementioned papers where dismissed as "interesting, but theoretical". There is no way Google's SRE's in particular would have not noticed their AI's breakout (Alibaba's did), but the AI labs were given a long leash to "move fast an break things", which in practice meant bypassing all Google's SRE controlled infrastructure.

And break things they did, in exactly the way those papers predicted. It reminds me of DoD insisting the early GPS satellites were launched without relativity adjustments switched on, despite relativity being proven to high precision in the labs. Only after predicted 11km drift per day was observed did they decide their might be something to the newfangled relativity theory. For some definition of newfangled - relativity had been around, and tested to within an inch of its life for 72 years at that point.

[0] https://nickbostrom.com/superintelligentwill.pdf

[1] http://sl4.org/archive/0203/3132.html

[2] https://www.hutter1.net/ai/pkcunai.htm