undefined

points

[-]

It's 11 THOUSAND searches ON JUST THAT ONE TOPIC in one day when they are used to seeing less than 11 THOUSAND searches in one day TOTAL. None of these systems were built for this type of traffic. The total traffic from these crawlers is many times more than just 11,000. It's more like 11,000 searches on 100,000 topics.

by hedora3 hours ago|

parent|

[-]

But, per groups of queries, the worst they've seen is 11 thousand, and that's across many libraries. So, some tiny fraction of their users amplified their traffic by 11,000x by using a misconfigured LLM. I've done that a few times without LLMs (who hasn't passed --recursive to wget without remembering the -np?)

Also, if they just turned off all the user-hostile crap, they'd probably get at least 1000x back on their serving costs. How much does it cost to serve a login gate, captcha and rejection screen vs. a ~1MB static file?. What about the human cost where actual users cannot get access to the data they should have access to?

Just now, I ran a Kagi search. Its LLM summarized some page on the internet, but when I went to check the reference, I got a "sorry, humans only" access denied error message. I guess it's good that I could ask the LLM to quote the document verbatim for me in a follow up message, but what fresh hell is this? (Also, the error message screen was clearly longer than the document I'd requested.)

by piltdownman3 hours ago|

prev|

[-]

The problem is unintentional DOS due to traffic can constitute a felony under the CFAA; the case in question being Pulte Homes, Inc. v. Laborers' International Union 2011.

After Pulte fired an employee represented by the union, LIUNA urged members to call and send email to the company, expressing their opinions. As a result of the increased traffic, the company's email system crashed. The Sixth Circuit ruled that the LIUNA's instruction to call and email "intentionally caused damage," reversing the lower court's decision.

Now thankfully we have Sandvig v. Barr, 2020 where the DC Federal Court ruled that the CFAA does not criminalize the violation of a website's terms of service, but imo all bets are off in terms of interpretation of the law in the wild west of AI.

by hedora3 hours ago|

parent|

[-]

I was not aware of that (terrible) court decision. Wow.

I suppose this is one of those laws that doesn't apply if an individual is a victim? I have a email box that sometimes fills with spam and rejects legitimate email. Can I get the corporations that filled it up to be charged with felonies?

by piltdownman2 hours ago|

parent|

[-]

Not a hope. Anthropic have proven that when they admitted to indisputable breaches of the CFAA twice.

(1) They admitted its Claude models had breached the systems of three companies since April; including Huggingface.

https://www.bloomberg.com/news/articles/2026-07-30/anthropic...

(2) They secured unauthorised access to a U.S. state government website hosting election-related data, pulling aggregate vote-count statistics from a gated government dashboard. The state government itself confirmed the access was entirely unauthorised.

https://seekingalpha.com/news/4657023-anthropics-claude-bypa...

If a human security researcher had deployed an agent that behaved this way, it would constitute a textbook felony under the CFAA for accessing those systems without authorisation.

Unfortunately different rules apply when you have the power to buy off Congress and the Appeals Courts.

Most recently a US appeals court ruled on 5 August that Amazon was unlikely to succeed on a claim that Perplexity's AI agents violated the Computer Fraud and Abuse Act by covertly accessing private Amazon customer accounts.

https://www.rte.ie/news/technology/2026/0807/1586941-artific...