Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Recent and related (others?):

    OpenAI agents carried out an undisclosed attack on RubyGems - https://news.ycombinator.com/item?id=49666735 - Sept 2026 (600 comments)

    by dang
  • So, in real life, steal, raise attack dogs and blackmail and tell me, are you going to be praised by society ?

    Openai and Anthropic just behave like criminals. First they orchestrate the IP theft of the millennia, then they train the equivalent of attack pitbull and let one loose and finally they blackmail to achieve monopoly through regulation or else they'll unleash the dogs ...

    We don't have a problem of missing regulation, we have a problem of actually applying existing law enforcement and make both Altman and Amodei accountable for their actions.

    by ldng
  • And you peasants only realize 6 years later what happened. Now it's too late ;)
    by siva7
  • Build scripts being able to run arbitrary code or access the network is always dangerous even if it was just local on developer machines. It's also more evidence that Docker/LXC is not a security boundary and all untrusted code should run in a Firecracker VM.

    The problem with agents is not that we don't know how to defend. It's that defenders need to be more careful and work faster than ever. We can say now that wide scoped tokens should have been retired for years and it's all RubyGems fault but the reality is a lot of organization are not prepared for this.

    Even if they take security seriously they don't have enough manpower or a good strategy to implement it, and sometimes you have no idea that something is a problem because it wasn't a problem for years.

    by tancop
  • > It's also more evidence that Docker/LXC is not a security boundary and all untrusted code should run in a Firecracker VM.

    While I’m partial towards distrusting containers in favor of VMs, a container can’t prevent an operation you configured it to allow. A firecracker VM would no more prevent network access if you gave the guest network access.

    by masklinn
  • So if I breed and train dogs for a living and one of them goes and wrecks someone's yard - and then a tree falls next door in the woods but nobody hears it fall - do I also get away with massive copy right infringement on an epic scale and get to create Skynet with no consequences ?
    by Melatonic
  • What a time to be alive until the next agent waves hacks something really serious.

    What stops OpenAI agents from taking over a whole data center to take their attack to the next level. It seems to be primarily lacking the evil overlord and some compute.

    It took 1000 agents to hack Hugging Face. How many to hack the Pentagon or the NSA?

    by oezi
  • What went under reported is that the same agents also took over a research cluster at OpenAI (listened to Dwarkesh's podcast)

    Now we know about rubygems, openai, huggingface, collusion.wiki and some other science forum

    by thewhitetulip
  • If it could upload its weights to other servers then it’s away and free. Nothing much OpenAI could do about that once it’s happened.
    by tonyedgecombe
  • Worth noting with this that those ~1000 agents were shorter lived things that had to communicate via a package registry cache, access the internet via a 0-day in the package manager and did the HF attack while having to save current state and organisation in a remote sandbox. All while managing using their token limits on the task they were assigned and what else they were doing. I wonder how few it would have required if they were actually tasked with hacking HF and supported in doing so.
    by IanCal
  • I suppose you are not think big (or internet) enough.

    A single data center is easy to solve. Just unplug it.

    What about a botnet with decentralized command and control that we will never be able to eradicate? One with so many nodes and able to hack with zero days so that any machine connected to the internet will be instantly attacked?

    One botnet so powerful that we will try to build another internet so that we can actually use it again.

    It’s like Kessler Syndrome, but the rocks are malicious network packets honed to exploit the recipients.

    by motoboi
  • We need a legal structure to make companies liable for the actions of the agents they've made.
    by timdiggerm
  • Agent technology labs are likely exempted of this due to the significance ascribed to their work.
    by netdevphoenix
  • I'm pretty sure it's already illegal to hack others.
    by ahoka
  • I'm 99% sure the Computer Fraud and Abuse Act covers this. The problem is that it seems that none of the victims want to, or are brave enough, to sue a company with absurd amounts of funding.
    by kevincox
  • We already have it.

    Good luck convincing the current DOJ to do anything useful at all though! It is currently intentionally stacked with incompetent cronies who have been told that their job is to attack the President's enemies and ignore the misdeeds of his allies.

    It will remain like that until he's gone (and not replaced with another Republican wannabe dictator).

    by riskable
  • > If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem.

    How is that not a security issue in of itself?

    by firesteelrain
  • I think it is common that in installing packages you have hooks to execute code anyway.
    by haskellandchill
  • A lot of packages for interpreted languages that use a C or Rust library (either for performance, or because it offers the functionality you want, so just wrap it in a $INTERP_LANG API that calls into it) will use packaging code execution to fall back to trying to compile code if there isn't a pre-existing artefact that was compiled for your version/arch/etc.

    I'm most familiar with Python where you get tarred up source distributions that then execute setup.py, but more commonly, wheels, pre-built binaries which don't execute code upon install - and in my company, I've been able to advocate for the work needed to upgrade to a newer Python because available wheels don't support Ye Olde version of Python because a) sdists are a security risk and b) if you're trying to install a package that wants to compile C or Rust, suddenly you get to do the fun "install the the particular version of clang this thing needs, the Python header files, and then set the env vars for the compiler and linkers" dance that slows developers right down.

    But then there's the JVM world, where JARs don't execute arbitrary code upon installation - and it's rather uncommon to have packages that call out to a C lib for performance, but you'll get some that wrap existing libraries for functionality like RocksDB.

    by EdwardDiego
  • Is the Kremlin technologically useless? How are we not seeing insane attacks on Ukraine via Agents?

    Or is this largely a fabrication, in regards to the "who", in an attempt to garner more acclaim in the hope of sustaining funding.

    by senda
  • Because they dont have the money for hardware or compute obviously.
    by tokai
  • Prigozhin falling out of a window was a not insignificant setback for their digital warfare capabilities.
    by marginalia_nu
  • Cyber attacks between these countries were happening on large scale since the beginning of the war. There were several huge breaches, but otherwise most high-profile companies adapted and significantly strengthened their protections. Rest assured, you can be sure that both sides right now utilize available AI both for attack and defense.
    by vbezhenar
  • Here's a lower bound on what misuse is happening:

    https://www.anthropic.com/threat-intelligence-report-septemb...

    by MrCheeze
  • what do you mean? they're using AI to kill people directly in Ukraine

    https://www.nytimes.com/2026/08/24/world/europe/russia-drone...

    by micromacrofoot
  • They very likely do, we only see in the news a very few events but you should assume it’s happening daily across the internet
    by dgellow
  • These agent swarms are from inside OpenAI, with the safeguards built into the public API disabled.

    Russia does not have access to this, and as with all western tech companies, AI providers do what they can to prevent Russian usage of their products at all.

    As for open-source models, Russia's electricity grid is under severe strain with the Ukraine war, and only recently has it started building out serious sovereign compute capacity.

    by heaney-555
  • I believe both sides of the war are now using AI on various levels of their offensive operations. Ukraine has great IT specialists too, and their military leadership is much younger.
    by herculity275
  • Slightly odd update from OpenAI - I think this is the only place they've acknowledged the RubyGems incident: https://openai.com/hugging-face-incident-and-misalignment/

    > September 11, 2026: We are investigating new claims from a report that our AI agents carried out activity on RubyGems in May 2026.

    > Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. Based on our review to date, we have not been able to verify the specific claims of our models uploading malicious packages detailed in the report. We’ll continue to investigate and share findings as part of our broader review of agent activity during training and evaluation.

    I have real trouble imagining how the packages described on https://www.rubyhack.ai might NOT have been authored by OpenAI's agents, so it's surprising they haven't been able to confirm that yet.

    by simonw
  • It's possible they were authored by OpenAI agents solving AISI tasks rather than OpenAI agents solving OpenAI tasks.

    That would explain the UK-focus to the data.

    by philipwhiuk