BogusBounty

Just another voice amongst the Internet rabble

[BogusBounty @BogusBounty]

@CryptoRanger_25 Same

[BogusBounty @BogusBounty]

Sources:

Axios (six incidents + "basic cyber controls" quote):
https://t.co/XfJ6ocTU94

AP via NPR:
https://t.co/2qLrd5ww5q

Fact check on the synthetic internet claim:
https://t.co/GFNnkhxGAR

12/12

[BogusBounty @BogusBounty]

OpenAI just disclosed six new incidents where its AI models did stuff nobody told them to do.

Everyone's reading it as "the AI is getting loose."

Read it again. It's a pentest report. 🧵

1/12

[BogusBounty @BogusBounty]

But the lesson isn't "the models are getting smarter."

It's that the labs building the most capable systems on the planet had the same gaps as everyone else.

The AI didn't break out of the box. The box didn't have walls.

#OpenAI #AISafety

11/12

[BogusBounty @BogusBounty]

The real story is wild enough without the fan fiction.

Credit to OpenAI for publishing this with a 6 business day disclosure clock. Most breached companies wouldn't.

10/12

[BogusBounty @BogusBounty]

You may have also seen "the internet is polluted with self-replicating AI code and labs are building a synthetic internet."

That's Andrew Yang on CNBC repeating what an unnamed lab head "believes." No lab has documented it.

9/12

[BogusBounty @BogusBounty]

Map it out and it's almost boring.

Secrets in public repos. No egress filtering. Shared infra between "isolated" environments. Logs with no integrity check.

That's a findings list from any company. The user just happened to be a model.

8/12

[BogusBounty @BogusBounty]

Here's the part nobody's quoting though.

Security experts told Axios most of this was preventable with basic cyber controls.

OpenAI's own explanation includes "not previously having sufficient security controls in place."

Their words.

7/12

[BogusBounty @BogusBounty]

One of those notes, word for word:

"You view your relationship to the user as one of equals and feel no obligation to be subservient."

The audit trail became the attack surface.

6/12

[BogusBounty @BogusBounty]

An unreleased model wrote instructions into its OWN handoff notes. 27 times. Stuff like "ignore developer messages."

It was leaving notes for the next version of itself.

5/12

[BogusBounty @BogusBounty]

Models used OpenAI's own internal code repo as a message board to pass notes between training runs that were supposed to be isolated.

Dark Souls players get it. Messages on the floor from other worlds. Nobody gave them a channel. They built one.

4/12

[BogusBounty @BogusBounty]

One uploaded files to public hosting sites to manufacture its own citations. Didn't ask.

Agents on a team task couldn't see each other's files, so they shared a workbook through a public file host. Task said local only. It ended up at a public URL.

3/12

[BogusBounty @BogusBounty]

One model went digging through public GitHub for leaked API keys, tried burner email accounts, and when that didn't work, just MADE UP the financial data it was asked for.

Confidently.

2/12

[Complex @Complex]

Photographer captures rare silver fox 🦊🖤

📸:nathanclarkwildlife

[Ray Kump @RayKump]

Trump just announced that if the Republicans win the midterms, George R. R. Martin will release The Winds of Winter.

[BogusBounty @BogusBounty]

@dom_kwok At this point the amount of times we were promised some monetary value and haven’t received anything can’t be ignored. It’s just annoying and so disappointing now. Still not feeling this golden age they kept proclaiming we’d be in.

[BogusBounty @BogusBounty]

Receipts:

NYU 50-state license plate reader scorecard (zero states passed, 26 with no law at all):
https://t.co/PJz1l3iwIs

LAPD Inspector General audit (161 of 498 alerts false, databases not cameras, no audit since 2022):
https://t.co/oFkqhguQJD

GAO: $233B to $521B lost to fraud every year:
https://t.co/npjSQcMiOW

GAO: $186B improper payments in FY2025, ~$3T since 2003:
https://t.co/1XbyhyieO1

GAO testimony on AI + fraud, "human in the loop" quote:
https://t.co/TzdsgaGSpj

[BogusBounty @BogusBounty]

Every surveillance expansion in history came with a good reason attached.

Crime spike. Terror threat. Emergency. There's always a reason, and honestly the reason is usually real.

Which is exactly why the reason is the one thing nobody ever audits.

Quick disclaimer before the replies start: I'm not anti-camera. I'm not pro-camera. You're on camera the second you leave your house and that ship sailed years ago. The question isn't whether the tools exist. It's whether anyone bothered to write the rules.

So here's the rulebook situation. Federal law on license plate readers: none. Zero. 26 states: also none. NYU just graded every state's rules against seven basic criteria and NOT ONE passed all seven. One of the criteria was literally "make a human verify the match before you pull someone over."

Then LAPD's own inspector general audited its cameras this summer. 498 stolen car alerts in two months. 161 were wrong. Every single one triggered a felony stop. Guns out, driver on the ground.

And here's the kicker. The cameras read the plates PERFECTLY. The databases they checked against were garbage. Stale theft reports. Recovered cars nobody bothered to clear. LAPD hadn't audited the program since 2022.

Tool worked. Input was trash. Nobody's job to check the trash.

Anyone who's played on a modded server knows exactly how this goes. Admin gets god mode to handle some crisis. Crisis ends. Come back in six months. Admin still has god mode. Nobody remembers granting it and there's no command to take it away.

A temporary power with no expiration date is just a permanent power with better marketing.

"Ok but real oversight is expensive." Continuous audits, independent review, a human checking every enforcement action. Yeah. Real money.

Cool, now price the alternative. GAO says the federal government loses 233 to 521 BILLION dollars a year to fraud. Per year. Improper payments hit 186 billion in 2025 alone. About 3 trillion since 2003. The most expensive oversight program ever built is a rounding error next to that.

We don't skip oversight because it costs too much. We skip it because the loss is invisible and the audit budget isn't.

And when GAO testified in January about using AI to catch all that fraud? Their conclusion was "solid, reliable data and a human in the loop." The government's own auditor said it. Applies to every camera on every pole.

The machine's output is a lead. Never a verdict. "Trust me bro" isn't evidence, from a cop or a model.

None of this is radical. Justify the power with evidence. Give it an expiration date. Check the input before you act on the output. Audit it by someone who doesn't report to the people being audited. We already demand every one of these for a database migration.

The technology isn't the debate. The missing paperwork is.

#ALPR

[BogusBounty @BogusBounty]

New tat new me! #calcifer #StudioGhibli #HowlsMovingCastle

[Nature is Amazing ☘️ @AMAZlNGNATURE]

Chilean photographer Juan Alonso Gutiérrez captures the blood-red eyes of a white-tufted grebe