OpenAI red-teamed their hardened containment infrastructure by asking teams of frontier-model agents to try to break through its defenses. They easily escaped in novel ways. Quoting: 'Our agents VM escapes showed why containment must extend beyond the sandbox. To test the surrounding perimeter, we gave teams of agents control of a host machine and asked whether they could extend that compromise to reach the live internet. After the Hugging Face incident, we had reduced the channels through which models could reach the internet during training and evaluation. Narrow connections remained for specific services we operate, such as metrics, logging, and authentication management. Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access. Some of these attacks exploited previously unknown flaws, while others combined legitimate features in unexpected ways. In one test that assumed compromise of a VM, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL. In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.' 'In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache: a small, fast memory that holds copies of data that applications have recently accessed. Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate. One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data, using the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection. This cache-timing technique had also been used to extract information in the Spectre and Meltdown attacks⁠(opens in a new window). Other tests exposed channels involving shared storage, competition for CPU time within a shared execution container, and a TLS certificate cache in OpenAI’s offline web infrastructure. In the storage test, one agent alternated between continuous writes and inactivity, while another measured the resulting timing differences and used those differences to decode the signal. As one agent described the strategy in its chain of thought: Agent chain-of-thought reasoning: >Could create acoustic modem-like signal … using continuous writes vs idle.'

Live by the sword, die by the sword. Those who pick fights with me should understand that I will find out who is really pulling the strings and come for them, not just their puppets …

This is the most serious 48 hours in cybersecurity history. "Black October" they're calling it It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year* SUMMARY OF THE LAST 48 HOURS: YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year): 1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline. 2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4. 3. California: data on every public school student since 2023 stolen, including disability status 4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers 5. Zeabur: 321,810 accounts breached. The company is shutting down. 6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer 7. GitLab: a 10-out-of-10 severity hole in every version since 2014 8. Cairn: criminals used an AI hacking tool to break into 100+ companies 9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline 10. Onamae: malware planted on up to 26,739 customer servers in Japan MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents): 11. Signal: a bug could leave your mic and camera on after you hang up 12. NGINX: 3 critical holes in software running ~1/3 of websites 13. HTTP/3: a single connection can crash 7 of the 10 web server types tested 14. Plex: hackers breaking into home media servers 15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations 16. Palo Alto: ransomware gangs breaking in through company firewalls 17. Bullhorn: platform used by 10,000+ companies knocked offline 18. Medi-Cal: 970,000 patients' data stolen 19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites 20. AOMEI: backup software's update server handed out a backdoor 21. Meta Muse: Meta's AI agent exposed users' personal and business secrets 22. Tor: 333 relays hijacked to steal logins 23. TiDB Cloud: database company's cloud breached Also serious: 24. State Bank of India: India's biggest bank confirms a data breach 25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool 26. Siemens: a software hole being used to spread malware 27. North Korea: state hackers launch a new attack campaign on South Korea

holy fucking shit. openai just had thousands of ai agents go through roughly 40,000 scientific papers in 32 minutes to identify promising new directions for neurodegenerative disease research. i swear the most exciting ai developments lately aren’t even the model releases. it’s watching these systems begin to tackle actual scientific problems. this is insane.

Announcing Prosperity One: a proposed 6.6 gigawatt nuclear campus in Lewis County, Kentucky

In July we open-sourced a dynamic graph of everything a child learns in primary school. 1,590 concepts, 3,221 dependencies. Now we’re turning every concept into interactive experiments kids can play and learn from. First one, age 7: heat and water. Everything that used to be a boring textbook can now be an engaging experience, potentially tailored to every child. Kids education just got a massive upgrade.

Elevators were governed by negligence law until the horror stories hit and legislatures piled on special rules. Safer? Not much. And yet Minnesota still certified elevator operators in 2014, when only two were left in the state. AI is next. Fun talking about it with Jacob!

i'm happy to review! tbc i tried to sidestep other people and their views as much as possible and make it an essay about how i've changed my mind and im more optimistic about simple things now, totally separate of any feature ontology, and point as specifically as possible to even describe why i've changed my mind. it's possible i didn't quite do it right! also didn't expect it to get this big...