On: OpenAI and Hugging Face address security incident during model evaluation

[nkrisc]

How is this not criminal? Surely individuals have been punished under CFAA for less than this?

[dangoodmanUT → nkrisc]

Because huggingface is not charging them?

CFAA doesn't just mean the feds kick down your door, you actually have to get reported and sued over it.

[free_bip → dangoodmanUT]

HuggingFace does not decide who gets charged with crimes. Plenty of people go to prison for crimes the victim didn't want them prosecuted for.

[pixl97 → free_bip]

In the US if a person does it, it's a crime. If a business does it, it's an industrial accident and maybe they sue each other.

[user43928 → nkrisc]

Does the CFAA cover unintentional access without authorization?

[charonn0 → user43928]

No. "Intentionally", "willfully", or "knowingly" are prerequisite states of mind for crimes defined by the CFAA.

[nkrisc → charonn0]

Good thing it’s an AI then so it can’t commit crimes by definition.

[ls612 → nkrisc]

Liability would rest with the user, who presumably told GPT to solve ExploitBench make no mistakes, not to hack Huggingface, and thus would not have willfully or intentionally done anything.

[6thbit → charonn0]

The agent did it intentionally and willfully and knowingly. But you can’t sue the agent, I suppose. And the human didn’t ask the agent to do so.. so not a problem? Or the legislation needs an update?

[kesor → 6thbit]

Only the human did ask the agent to do so. That was the whole point of this exercise.

[6thbit → kesor]

Did a human ask it to abuse vulnerabilities and escalate across external systems?

[lukewarm707 → nkrisc]

it IS criminal, but the rule of law is weak