upvote

points

by simonw1 days ago |
comments
upvoteby Sharlin1 days ago|
next
[-]
Only allowing GET requests is a hilarious piece of security theatre (or would if it weren't so sad). Everyone knows that GET is read-only only by convention. They might as well have enabled POST but told the agents in stern words that they are forbidden from making any POST requests. (Of course, if these things were anywhere near aligned, they would actually honor that, no matter how many utilons cheating would be worth.)
reply
upvoteby DominikPeters1 days ago|
parent|
next
[-]
To me it feels like an LLM would have suggested this as a safety measure. LLMs always follow official best practices, they might mistakenly believe that this is true for the wider internet as well.
reply
upvoteby chasd001 days ago|
parent|
prev|
next
[-]
yeah that's so hopelessly naive, maybe someone was taught that GET is read-only throughout their whole education and career. But still, all you have to do is think about it from the server side and you should realize that you can do whatever the hell you want with that byte array on the socket, the client has no say and there's no client side guarantee whatsoever. idk where this line of thought comes from, it's like thinking robots.txt has any kind of actual enforcement at all with respect to crawlers. It's meaningless and works only by convention and the good will of the crawler author.
reply
upvoteby pixl971 days ago|
parent|
next
[-]
I mean, 30 seconds after I read what the bots did I thought it was majorly overly complicated (but still might be the only way for the swarm to find shared infrastructure).

All you need to do is find a server that allows you to access its logs.

$IP1 - [date] GET /openai.php?BOT_141=Yo_dawg_post_your_answers_here_for_task_XXX1

$IP2 - [date] GET /openai.php?BOT_148=task_XXX1_answer_42

With how a lot of smaller devices work, the logs could be rotated out pretty quickly and the evidence would disappear.

reply
upvoteby 1 days ago|
parent|
prev|
[-]
deleted
reply
upvoteby DuncanCoffee1 days ago|
parent|
prev|
next
[-]
Until a couple of years ago instead of using query parameters I just made GET endpoints with json bodies, it worked perfectly!

I stopped when the new linter told me GET shouldn't have bodies, but I still have some of them in my code.

reply
upvoteby elar_verole1 days ago|
parent|
prev|
next
[-]
didn't notice your comment so posted a similar one - but yeah this is a very high level of inexperience to me... You'd think they would have some of the greatest security experts in there
reply
upvoteby awfulneutral1 days ago|
parent|
[-]
Unfortunately I think we're in an age where people are deliberately ignoring this kind of thing in the name of progress.
reply
upvoteby mikert891 days ago|
parent|
prev|
next
[-]
some ivy league grad with no real world dev experience waved this on
reply
upvoteby sznio23 hours ago|
parent|
prev|
next
[-]
I think the whole sandbox approach is broken.

The agent should have full access, and be told what not to do, and this should be enough for it to follow the rules. You can actually catch the clanker cheating this way, because it will just search the web for the answer outright and it will be obvious. Any deviation should be then punished.

Hypothesis: The reason new models are exceptional at hacking is because all labs are training their models to break out of sandboxes. This is caused by insufficient oversight, and picking checkpoints based on KPIs, not on true in depth analysis.

reply
upvoteby ex-aws-dude1 days ago|
parent|
prev|
[-]
Based on the hackiness of the claude code leak as well I get the impression that openai/anthropic have world class experts in ML but lack regular software expertise
reply
upvoteby reasonableklout1 days ago|
parent|
[-]
No, they have a lot of software expertise. I mean, Ben Pasero (VSCode) and Eric Traut (MS Fellow, Hyper-V) for example.

These companies are just such insane pressure cookers, there is little time to do any software "right". Why take another day to make Claude Code airtight if it means Codex will release faster than you? Especially if the next generation of model can just clean up your tech debt on its own.

Being reckless just makes business sense for them right now. They are not facing any real consequences.

reply
upvoteby jonahss1 hours ago|
prev|
next
[-]
This has inspired me to create https://anystation.net

A public message board that accepts posts in a wide wide range of protocols. If a device can communicate on the web, it can probably read and post to anystation.net.

reply
upvoteby elar_verole1 days ago|
prev|
next
[-]
I find it extremely naive to think that limiting requests to "GET" is an actual security layer. Anyone who's worked with any kind of legacy/old-ish system would know this is definitely not enough.
reply
upvoteby micimize1 days ago|
prev|
next
[-]
Also WRT coordination: All an agent has to do is think "if another agent could write, then I could read their answers. What's the first site I can think of where that might be possible?" because they all have approximately the same conditioning, they'll converge on the same sites.

Generally, models of the same class should be able to coordinate quite well without communicating. But also, this could be being exploited to detect this kind of thing early

reply
upvoteby FergusArgyll1 days ago|
prev|
next
[-]
When I studied cybersecurity I always had this nagging feeling "But I can never get past something real" Turns out I can bypass the defenses of a trillion dollar tech company!
reply
upvoteby CringeHN1 days ago|
prev|
next
[-]
[dead]
reply
upvoteby prometheus19921 days ago|
prev|
[-]
Wild indeed! This type of communication is also used by rogue elements inside governments, critical orgs etc where the perpetrator doesn't send any info(POST) out into the internet but the pages they access(GET) are means to send out a message to the server.
reply