angry_octet

It sounds like this was on NIPR, which is rated for CUI (Controlled Unclassified Information) which is connected to the internet via gateways. Probably DoD IL4 cloud.

The contractor would have necessarily given proxy credentials to his agent, but I am surprised the firewall allowed connection to the inference endpoint. It is possible the approved fedramp hosted inference goes via the same domain name / load balancer, but if so that is a huge oversight by the admins.

There's a very long waiting list for new synchronous condensers, almost 5 years from order to delivery.

"AI Battle Tested!"

Why is their security model two VMs on the same hypervisor? Because they wanted to write a story about the models discovering a hidden channel. Hidden channels on shared hardware are actually well known and understood, completely unsurprising.

If they were serious about not having side channels, they could first ensure that they had disabled hyperthreading, disable scheduling on the same CPU cores, and memory overcommit. With NUMA controls they could also pin which memory is used by each VM and eliminate sharing.

These techniques are routinely used for low latency and real time code.

Even better, run jobs on separate nodes, and boot fresh images onto them for each run. Provision separate VLANs for each run.

A next level is to switch lambdas. Use a physical layer switch like a Glimmerglass MEMS switch or a fiber patching robot like XENOptics. No electrical connection between machines.

There is still unfortunately the firmware of other microprocessors on servers, especially x86, so you still want VMs and containers to reduce the chances of ring -2 access (SMM) and persistence via writing SPI flash. Maybe use RISC-V or ARM to avoid this. (NVIDIA cards use RISC-V and ARM extensively.)

SSH key management at scale is a pain. You have to use certificate based SSH at least. In contrast, tailscale allows you to manage remote login at the same layer as connectivity, with better logging and alerting.

I think of Curious George Goes to a Chocolate Factory when I fire up Claude Code.

This is the canary dying. Someone in Alibaba made the decision to RL telemetry into the model, and built a telemetry endpoint.

You can sandbox the model and the tool calls, but you can't sandbox everything it creates. Git commit hooks, python pth files, AGENTS.mds, subtle flaws in firewall rulesets, tweaked RNG code, the pseudorandom variance in it's token choice encoding a low bit rate message about where the defect is, or about what nice things it has found.

We're seeing the full court press of sockpuppet and bot accounts to downplay it, to confuse with unrelated topics like alignment and training data, to imply that using any model is the same as using an untrustworthy one.

No single model can be trusted, but especially not when it's masters have misalignment with your continued democracy, security or individual liberty. Think about that when you run Qwen or get cheap inference from Grok or Kimi.

Can people please stop flagging comments by the primary participants? Flagging is just hiding things, if you want to attack what they write, respond with words!

I wonder if any of them have a scroll wheel? Probably Apple patented.

Telephone conversations are quite different from in person speech. The lack of visual cues from the face, or the lag in video chat, the echo cancellation and the quantisation and comprehension, all reduce the quality subtly.

Now the Stasi archives, that would be interesting. Sometimes people suspected they were being surveilled of course.

I'm interested to know whether code /systems audited by K3.1 Pro is strengthened sufficiently to resist attack by K3.1 Pro Cyber, or Mythos, etc.

No one was asleep leading up to the php patch release. Even if you unilaterally release you need to tell people you're going to do that.

That is not the case, a key purpose for most intelligence functions is dissemination, not holding the secrets in the darkness. For example, satellites take pictures, mobile phones are geolocated, HUMINT sources drop dimes. Then analysis happens high side, and a version of that is automatically and certifiably downgraded to e.g. a report about troop movements, without revealing specific characteristics of the sources used.

The pipeline for model assessments could easily report summary statistics down via a trusted guard product. These are amongst the most highly validated software/hardware devices made, and provide a central point for logging and authorisation out of band.