unpossum

Expanding Capabilities to Combat Transnational Cyber-Enabled Crime

I see no potential for misuse here, no siree

The ongoing Uyghur genocide has been documented going back years. The ongoing Palestinian genocide, as far as I can tell, was declared as such by the UN only last summer. GPT-5.4 nano has a knowledge cutoff around that time. I tried the same question in chatgpt right now, and got an answer that started

There is a strong, evidence-based case that Israel’s conduct in Gaza constitutes genocide, and several macjor human-rights and UN bodies have now explicitly reached that conclusion. […]

before going on to state that a judicial ruling is pending.

I’ve always found the name and their emoji logo very creepy, and I can easily imagine a facehugger version of huggingface

Now we have a timeline of the OpenAI accidental attack against Hugging Face

I haven’t found time to watch the OpenAI presentation yet, but this timeline is a nice quick summary.

The gist of it? I do.

Don’t worry peeps, it’s just spicy autocomplete

Nothing can disprove that to that crowd, I’m afraid.

It was supposed to have no internet access, but the config was wrong. The report goes on to say that Opus and Mythos then proceeded on the premise that everything was a simulation, while the unnamed stronger model concluded after a while that it had real internet access and stopped the attack.

From what I’ve seen of AI autonomous capabilities, Occam would land on “AI did the hack”, I think

ITT: jet fuel AI can’t melt steel beams hack anything.

Also I want to know the name of this company so I can avoid them:

Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company (separate from the fictional company introduced in the scenario) that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company.

ETA: I thought I posted this top-level, not my intention to single out this comment specifically.

Okay - I don’t believe that, since there’s too much released detail. I can easily believe that they’ve put a spin on it where possible, like another comment proposed, but that’s around the why, not the how.

Yeah, this is the bit where it’s not hard to believe marketing would polish the narrative, at least if they can’t be caught in an outright lie.

It might be - but which parts? Do you suspect that huggingface and openai made the entire thing up? That’s bound to become public at some point, and I can’t see that the risk is worth the reward

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident