Hacker News Reader

Comment by betterunix2 | Hacker News Reader

...why not just pull the cable?

Seriously, if these systems are so good at finding exploits, why not just run these experiments on machines and networks that are not physically connected to the Internet? That seems obvious, robust, and simple. They would have to set up their own web servers etc., but they claim to already be doing so within their software-secured environment anyway so I fail to see the problem.

It's what the military does, and they use color-coded cables to avoid accidental interconnections between classified and unclassified networks. Maybe someone working at a frontier lab can explain why this is not the first choice?

View on HN

They address this in the article:

> it’s also important that they learn how to browse, search for information, and work with web applications

Also, keep in mind that isolating complex systems is not simple. Agents need to be in sandboxes, but for example, the sandboxes themselves may need to be kept up to date, or may need to be monitored, or the sandboxes may need to updated, or they may be connected to specific services etc. Not saying that it's impossible, but it's complex.

In the HuggingFace incident for example, the hosts themselves were not connected to the internet. But a service they were using was, indirectly, and that's what the agents attacked.

> It's what the military does, and they use color-coded cables to avoid accidental interconnections between classified and unclassified networks.

Requirements are very likely different. I presume that handling thousands of agents is enormously more complex than secret documents or "static" applications.

In the OpenAI case, agents even hacked the internal OpenAI network. Isolating networks (which was probaly done to an extent at OpenAI) can still result in one network being "infected", and that is... interesting, to say the least.

>the sandboxes themselves may need to be kept up to date

The sandboxes don't need internet access to be kept up to date. They just need to be writable by something with internet access. There's a million ways of doing this. Run things under a hypervisor. Have a PXE boot server in your data center that serves an "updater" boot image, after performing host attestation. Or if you really want them to "update themselves", physically plug em in for the update, physically unplug them the rest of the time, and don't run updates during agentic testing.

>or may need to be monitored

The sandboxes don't need internet access to be monitored, they just need to be readable by something with internet access. Like a hypervisor, KVM. or a webcam pointed at the screen, in roughly ascending order of paranoia.

>or the sandboxes may need to updated

Did this one already! See above

>or they may be connected to specific services

That's just "not airgapped" rephrased.

This is just off the top of my head and I'm no infrastructure engineer. OpenAI saying "it's too hard" is a major cop out. The real reason is that they show no signs of actually giving a shit about AI "safety".

So add web servers to the airgapped network and install web browsers on the machines the models are running on.

> the hosts themselves were not connected to the internet. But a service they were using was

So they were physically connected to the Internet -- via the service they were using.

Operating air gapped networks is probably a new area of expertise for most people. It’s not hard to unplug cables, but people need access, updates need to be installed, results need to be extracted.

Also threat actors being on the inside breaking out is a bit new.

There may come a point where they decide they need to do that. As it stands, it appears that they believe they can get the necessary level of security without physical air-gapping, which is likely substantially more costly (especially in terms of iteration speed).

Well heaven forbid their iteration speed takes a hit!

I do not have much faith in what they believe about their ability to enforce a security boundary given their track record so far, not to mention their grossly inflated sense of importance (both about their work and about themselves).

Reply on news.ycombinator.com