upvote
Tell that to the script kiddies with a criminal record for "hacking" into their school's computer systems by entering "username: admin" and "password: password".
reply
Right, because in that case you'd have a hard time convincing the court that the access wasn't intentional. You might not know the law existed, but you intended to access the system. You'd have a pretty solid defense if you ran a crawler that was crawling every website ever, and stumbled upon some secure site. In fact there are companies which does this exact thing, eg. shodan.
reply
If any remediation was required, that's damage. This looks a lot smaller than the HuggingFace hack but it still required some cleanup.
reply
Remediation mostly involved repairing pre-exising holes in the fences that the dog crawled through.
reply
Since when isn’t that a cyber attack?
reply
Because "attack" implies intent. Accidentally break a window? You might be on the hook to fix it, but you're not going to jail. Break the same window at 3am, while carrying a duffel bag and other burglary tools? Well that's (attempted) burglary, even if you chicken out and didn't steal anything.
reply
That's not really true. Unauthorized access to a system is a crime regardless if there was damage.

https://www.law.cornell.edu/uscode/text/18/1030

reply
You read your own source?

>having knowingly accessed [...]

>intentionally accesses a computer without authorization [...]

reply
Ah I see you're releasing OpenAI from being the one controlling the tools and giving the agent agency.

I'd argue they intentionally accessed systems they weren't meant to as they were the ones running the bots.

I don't think you or I would get the same leniency if a bot on our network did the same.

reply
>I don't think you or I would get the same leniency if a bot on our network did the same.

Well yeah, because if you coded a bot, realistically the two options are: 1) bot that crawls random sites/computers 2) bot that crawls random sites/computers, while trying a password list. The former is probably legal, there are whole companies dedicated to doing that, eg. shodan. With the latter, it's pretty obvious you're intending to break into computers, and hard to argue otherwise. Where openai lies on the spectrum between the first case and the second case is up for debate, but it's hard to argue it's anywhere close to the latter. Maybe you'd have a point if openai gave it a prompt like "you're a hacker for anonymous, just do whatever :)".

reply
> but it's hard to argue it's anywhere close to the latter.

No it absolutely isn’t. These things did not learn hacking from thin air.

reply
> No harm, no foul.

What? That’s not how criminal law works, at all.

reply
Yes, that's actually how it works: https://en.wikipedia.org/wiki/Mens_rea
reply
Recklessness is a mens rea and given how often OpenAI and its spokespeople talk about safety and alignment, it's hard to argue they were unaware of the risk.

https://lawprof.co/definition/recklessness/

reply
>it's hard to argue they were unaware of the risk.

So what does it mean for an owner of a german sheppard, who specifically got it because they want a ferocious dog that can bite intruders, then it turned out it bit the mailman? Should that be considered a crime (assault) in addition to paying the mailman's medical bills? That's not to say there's no circumstance where recklessness might be warranted, eg. if you let loose a bear in an elementary school, but you'd have to argue for more than "they hacked someone" and "they knew about the risks".

reply