> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice.
I'm not sure "worked properly" and "as intended" accurately describe this situation.
The tool worked correctly and as intended, but due to a bug it did not work correctly nor as intended.
That sounds a lot like the justifications Claude and ChatGPT give when confronted about something they did wrong, or when asked to provide a customer support response about software issues
Read that as "worked as written" and "we disclaim any consequential or incidental damages and do not warrant this software."
I continue to believe we could fix a lot of things in the US if we updated the UCC[1] to disallow 'disclaiming liability on software used in a product.'
[1] Universal Commercial Code -- https://www.law.cornell.edu/ucc
The argument here is that the AI is a glorified input page. The input field asks for your username and email and sends it to a backend function. Such an input page is working as intended.
The problem is when the backend function doesn't verify that the email matches the username.
Oh it was a downstream dependency. The tool worked, it was the downstream dependency. Glory to Arstotszka
I like to dunk on Meta as much as the next guy, but I think this makes sense: deterministic verification like this is not, and should never be, the LLM’s job. The tools it has access to should enforce the permissions layer, ensuring that the LLM can never perform actions the user themselves should not be allowed to perform. In this case, the tool failed to do that.
Maybe they’re communicating exactly what it sounds like and are just owning up to being complete morons?
Having had my 2FA Facebook account banned 3 years ago because a bot signed up under my email for Instagram (which I did not have), I can confidently say the email verification issue has been a problem for a long time at Meta.
They're saying: our AI worked perfectly, we just prompted it wrong.
As you do. All AI failures are caused by bad prompting because AIs are perfect.
No no the tool worked fine, it was the system that failed. They blame society, basically.
Then ‘ The tool itself’ was not appropriate to the job in the first place
so how long was the bug there? was there a way to access it before/without the support agent? it feels like Meta will throw anything under the bus to redirect blame from the AI, because that would be the end of their $600B (depending on “which number you want to go with”) experiment
What was that mantra? Something about broken software is what they aim for?
> The tool itself worked properly and functioned as intended
The author of the post is close to the author of the AI code on the org chart
> however due to a bug in a separate code path, the system did not properly verify
The author of the post is far from the author of this "code path" on the org chart
I'm sure. It was not working properly nor as intended.
Error: Success!
It’s a public release prepped/reviewed by the in house legal counsel.
Don’t read too much into it. Facebook wants to face as little accountability and keep the future class action lawsuit to a minimum.
Our autonomous client-assistance system is managed by a teenager that usually makes good decisions but sometimes makes bad decisions and so all the teenager’s decisions are checked by a minder before being implemented. Unfortunately the minder wasn’t paying attention, so, here we are. However, our teenager is a great kid and did nothing wrong! It’s all the minder’s fault.
P.S. Would you like to have our teenager manage your system too? Terms are reasonable! Of course you accept all liability, so better get a good minder - and no, don’t use an AI as the minder, that just introduces a new failure mode.
How very Wernher von Braun of them.
Isn't that exactly what they said when Cambridge Analytics data gathering happened?
‘Hey Claude, write me a PR statement’
This-is-fine.jpg
Of course.
What I gather is that this internal tool was used by human support agents, and it was their responsibility to verify the email adresses and general validity of a claim.
But when implementing AGI TM that was overseen, maybe the oversight in the separate code path was a 'bug', but the mistake was making the chatbot obviously, if the separate code path had a bug, then it had become ossified into a feature, and it was internal, not exposed to the public.
This is an external communication, to save face sure, but if this is the internal excuse, it would be absolutely the wrong RCA and it reads as if the one who made the mistake is not admitting they made their mistake. Which to be honest, just making the mistake is enough to get fired, but not admitting it is enough to get ultra fired.
There should have been a test case for this. There wasn't because most shops don't actually test their product. They do some test theater such as unit testing.
In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"