llama052

Oh boy.

“malicious actor had access to abliterated models and substantial compute resources which enabled them to perform highly sophisticated exploits against our infrastructure.”

They don’t provide any details but pass it off as an advanced AI attack. I’m going to just read that as what it is. A likely scapegoat for shitty security.

What a weird stance to take on a public forum.

Not OP, for me the issue is nuance of all of your infrastructure, application and outside layers. There's a lot of documentation and such, but often times things don't work as expected to a degree and it requires filling in the blanks correctly. The amount of times I've had an AI Agent misinterpret an alert and assume it was XYZ when it was some random layer it had no idea about is often.

It can certainly get closer but unless your tech stack is a webserver and an application it can get complicated.

I guess I’m not getting paid enough these days…

The evidence is in the blog post explaining how they did it. However seeing at how bad their operations were I doubt they have evidence of anything themselves

I'm already tired, between pushing back on vibe coded internal projects being put onto the internet and then the constant barrage of CVEs that mean nothing.

Then you have real security incidents that you need to tune into constantly.

I’m sure it’s not compliant. We have the same requirement for soc2. However the audits are pretty light and a company big enough can afford to have an auditor who looks past those things.

This seems like a great way to wake up and have your cloud spend skyrocket because an LLM assumed wrong.

Slap on the wrist unless someone is held criminally liable for it.

Sounds like the great firewall of China. Pretty wild how much we are regressing in the states to say this out loud.

Let’s block traffic on the internet blindly just in case someone is looking at an adult website.

I would think that requiring adult websites to essentially block all VPN traffic to be pretty heavy handed and hardly a solution. Especially considering there are many reasons to use a VPN.

You’re likely the exact reason why these things exist. Maintainers have to put up with none stop requests and slop and it’s a tireless job with not a lot of benefit.

At a minimum you can respect their guardrails of a project they maintain.

I’m not sure that it’s addiction, it’s just not feasible for most large organizations to pivot from a core solution like VMware without years involved. Every company I know of is formulating an exit plan away from VMware. They just have to do it in a way that offers the least amount of risk and in stages.