Corrected headline: OpenAI uploaded hundreds of malicious packages to public repository, claims it was an accident and can't be prevented

[rakoo@blah.rako.space]

@jenniferplusplus

Even from a purely economic view this all is stupid. Trillions of dollars and all they have to show for it is uploading packages to a server ? So the lesson is basically that given enough money brute force actually works ? sigh

[cal@kind.social]

@jenniferplusplus "No way to prevent this" says only industry where this regularly happens

[dozymoe@mastodon.social]

are they developing them for the military

[di7life@mastodon.social]

@jenniferplusplus It's obvious that the public is being used as guinea pigs.

[mini24@mastodon.social]

the cannot-be-prevented line is doing a lot of work here. a contractor who uploaded hundreds of bad packages would be off the platform by lunchtime.

[kittenkoder@mastodon.social]

@jenniferplusplus No, the correct headline is: someone working for OpenAI wanted to scam a bunch of people so they told the LLM to uploade hundres of malicious packages to public repositories.

[2k_115@mastodon.social]

@jenniferplusplus Not rogue agents, just classic PR hype. Releasing unverified claims with zero logs shifts focus from antitrust probes and lawsuits. The media eats it up, trading real accountability for sci-fi drama.

[wbftw@hachyderm.io]

@jenniferplusplus They used to throw people in jail for stuff like this.

[alpacamale@social.cologne]

@jenniferplusplus As Scott Galloway suggested: Put Altman in jail for a few days until we know that this was not a planned attack by OpenAI itself and that it wasn't caused by severe negligence on their part. See how he likes it in jail. Then, watch how fast OpenAI will find a way to prevent such attacks in the future.

[jenniferplusplus@hachyderm.io]

@alpacamale I'm not sure how you prudently distribute malware for months in support of breaching the security of a major compute service, on accident. It must, necessarily, be either negligent or malicious.

[kdekooter@mastodon.social]

@jenniferplusplus You are absolutely right. Of course they could have prevented it. As Cory Doctorow @pluralistic said: "The Hugging Face hack isn't a mysterious, supernatural occurrence. It's a Python loop and a chatbot"

See https://pluralistic.net/2026/09/12/god-in-the-box/

[f4grx@chaos.social]

@jenniferplusplus torment nexus has never be that close to reality

[liiwi@mastodon.social]

@jenniferplusplus Just wait for the demand of "defending" AI.

[rycochet@furs.social]

@jenniferplusplus 'Assholes who have spent the past five years launching cyberattacks on the open internet to scrape every last character for training data caught using malicious code to try and gain access to the few things that have kept them at bay. Assholes blame the machines for it.'

[brouhaha@mastodon.social]

@jenniferplusplus
It would have been absolutely TRIVIAL for them to prevent it. They could simply have never powered up their data centers. Better yet, never have built them in the first place. They would have saved a ton of money, too. It would have been a win all around!

[bladecoder@androiddev.social]

@jenniferplusplus It seems that AI companies are now competing for who's going to cause the most damage.

[ghostrunner@hachyderm.io]

@jenniferplusplus "Guns dont kill people, people kill people" but also "i sowwize, my trillion dollar pile of theft keeps breaking the law under my guidance, nothing to be done about it"