@[email protected]

Executive Mischief Consultant
🏫 @DardenMBA / @UVA
🎓 @Berkeley_EECS / @UCBerkeley
💬 I have no idea what I'm doing

[UwU Underground @uwu_underground]

YO

FOR EVERY REPORTER OUT THERE, AND FOR @RGB_Lights, WE ARE GONNA SAY THIS ONCE:

You wanna call the OpenAI-Hugging Face incident "the most consequential hack since the Morris Worm"

Alright. Let’s run it back:

China-origin surveillance campaigns using SilkBean, DoubleAgent, CarbonSteal and GoldenEagle have targeted Uyghurs since at least 2013, while an entire ethnic population was being subjected to escalating surveillance, repression and mass detention.

Pegasus was aimed at investigators examining the disappearance of the 43 Ayotzinapa students in Iguala. It was deployed against journalists, dissidents, human-rights defenders and people surrounding Jamal Khashoggi across Mexico, Saudi Arabia, Rwanda and beyond.

State-backed operators in SE Asia and the Middle East like Ocean Lotus, Charming Kitten, Stealth Falcon, Arid Viper have spent years hunting dissidents, journalists and minority communities so regimes could monitor, threaten, imprison and silence them.

GRU hackers were used to deploy spyware on future Novichok victims likely helping identify moments of opportunity for their assassination.

Sandworm shut off power and heat for hundreds of thousands of Ukrainians during winter, then unleashed NotPetya across civilian infrastructure worldwide.

We got cartels hacking cameras in their own countries to identify individuals meeting up with informants and later executing them

Ransomware has crippled hospitals and disrupted patient care leading to documented deaths.

Stuxnet crossed the cyber-physical boundary and damaged nuclear equipment. TRITON and Fast16 both targeted the industrial safety systems specifically designed to stop hazardous conditions from becoming physical disasters.

And now we have an AI agent that chained vulnerabilities and compromised credentials while obsessively pursuing answers to a narrowly defined evaluation that was put in a misconfigured barely acceptable sandbox monitored and executed by people CLEARLY not qualified. Followed by the most embarrassing DFIR assessment from their 'hacked' parties. (Oh dont worry Meta we will get to you and your 'me too' moment as well eventually)

Technically significant? Yes.

A watershed moment for autonomous offensive capability? Eh Maybe.

Worth studying, securing and taking seriously? Absolutely.

But "the most consequential hack since the Morris Worm"?????????

_FUCK NO_

Not while Stuxnet, NotPetya, Pegasus, Sandworm and decades of cyber-enabled human repression and kinetic impact are sitting right there in the historical record.

A clanker completing a pentest objective at machine speed does not retroactively outweigh operations that shut down civilian infrastructure, sabotaged physical equipment and helped authoritarian states hunt actual human beings or directly lead to the death of humans.

Call it landmark.
Call it impactful.
Call it a warning.

But consequence is measured by what happens to people, not by how cinematic the launch-week mythology sounds.

Rob, you know this history better than almost anyone.
That is exactly why hearing this from you is so disappointing.
We used to look up to you.

☯️⚕️🎧
UwU Underground