alt Hacker News> So far all of these amazing stories have been followed up in a few weeks or months with much quieter revelations like "this was a completely open network...
The incidents are actually considerably more complex than how they appear to those who just read headlines.
In the HuggingFace accident for example, the sandboxes were not providing internet, and the sandbox hosts did not have internet connection either. Internet was reached by hacking an internal service.
In the DNS accident the situation was similar. Internet connection, including public DNS, was not accessible. The agents ended up exploiting, in a similar fashion, the internal DNS resolver.
It's (very) appropriate to push for security, but equating these accidents to putting gasoline in a microwave is stupid and ill-informed. And dangerous, because it minimizes the capabilities of frontier AIs.
Replies
> The incidents are actually considerably more complex than how they appear to those who just read headlines
They are not, because all we get is headlines written by the labs' marketing departments.
It's good that you brought up HuggingFace. As more and more details trickled in in the several weeks after incident, all security researches as one said "nope, it's not a sophisticated attack, you literally don't know anything about cybersecurity, and don't employ anyone who does." The rest was mostly marketing and hype buzz.
On top of that, from Wikipedia, emphasis mine:
--- start quote ---
To find out if AI agents are capable of converting known vulnerabilities into working exploits, academic and industry researchers launched ExploitGym on May 11, 2026.
OpenAI was running an internal evaluation based on this benchmark when the incident occurred
--- end quote ---
Humans to LLM: "Please run these exploits in a poorly secured sandbox"
LLM: runs exploit in a poorly secured sandbox
Humans: surprised Pikachu face
But thoughtfulness and nuance gets in the way of my tirades that it’s all a marketing stunt!
> ...and the sandbox hosts did not have internet connection either.
No, they did.
From [0]
> To gain access, the models identified and exploited a [bug in the Artifactory] registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.
If the sandboxes' network was airgapped, the only thing on the network with Internet access would be the router that sits between them and the Internet... and that router wouldn't have any services that listen on the airgapped network. Instead, they had at least one Internet-connected host on this "airgapped" network running a bigass pile of code, which -like many bigass piles of code- had at least one RCE in it.
If the software running on your machines can use anything other than Sneakernet to get data to and from the Internet, those machines have Internet access and are not airgapped. [1]
[0] <https://openai.com/index/hugging-face-model-evaluation-secur...>
[1] ...and -personally- I'd argue that if data can flow out from the systems to the Internet via Sneakernet, that ruins the airgapping. There are so many ways for a clever adversary to hide their communications. In this specific situation, this communications path isn't really relevant... but for many-to-most of the ones where you're bothering with the huge hassle of setting up airgapped systems it is.