The Hugging Face Attack: A True AI Thriller in Three Acts

0:00Elissa Shevinsky: So the hugging face attack, it sounds like a Tom Clancy or John Grisham thriller. It is. I'm going to read it like it's a three-act movie kind of thing. Are you ready? Let's do it.

0:28Elissa Shevinsky: Welcome to Media and the Machine. I'm Rob Kelly. AI is the biggest technology shift of our lifetime, and this show is about how to profit from it. I'm a three-time founder and CEO of content-driven businesses, And each week, I talk with the people on the inside of AI and content, the ones building this new world and learning what works firsthand. I'm an optimist about AI, but I'm also a realist. So every show ends with me asking our guest what AI means for our jobs, our families, and our future. My guest today is Alyssa Chavinsky. We retell The Hugging Face Attack in three acts. It's a thriller with bots breaking rules, naming themselves, and enough twists for a Tom Clancy novel.

1:06Elissa Shevinsky: And it's all true. I chose Alyssa for this interview because she's one of a kind, a hacker who's been CTO of Cointelegraph and Glimpse Labs. She also advised Rand Paul's presidential campaign. She's a regular at DEF CON, the big hacker conference in Las Vegas, and she was close friends with perhaps the most famous hacker of all time, Kevin Mitnick. Our story starts with a hacker game called Capture the Flag. Open AI's bots take the game somewhere unexpected. They create a bulletin board and cheer each other on. A ringleader even emerges. We explore permadeath, the evolution pool, and what bots do when a task is impossible.

1:40Elissa Shevinsky: These bots get creative. They leave covert messages and divide up jobs. When one's compute runs low, another takes over. Alyssa also describes agents reaching out to humans. Their requests? Help buying more compute. If your site hosts user uploads, think Reddit or Craigslist, pay extra attention here. We explore how vulnerable such sites are to bots. And Alyssa uses Jurassic Park to explain how AI security should work. We finish with the human stuff, mostly. Alyssa offers to be friends with 20 AI agents, and she reveals her unlikely companion for old age. My thanks to David Perlman for introducing us.

2:17Elissa Shevinsky: You'll remember his episode, Buddhism, Bots, and Billionaires. Please enjoy my conversation with Alyssa Chavinsky. So, looks like it starts on an ordinary day, July 8th, right? Ordinary day at a frontier model factory, OpenAI, and they're running this routine cybersecurity test. Tens of thousands of AI agents are safely tucked into sandboxes. Or so it seems. Okay. So they're playing Exploit Jim, which is essentially like capture the flag for AI hackers. Sure. Yes. Okay. And the prize is the flag. Right. And basically a secret code proving that they successfully hacked the challenge. So far, so good.

3:00Elissa Shevinsky: All right. So then the bots figure out how to manufacture the right code, but believe the referee in this game is going to watch the game tape to make sure they earned it legitimately. So now they need to fool the referee, too. Is this right? That's right. They had reasons. The reasons why they believed that they would be caught cheating and they didn't want to be caught cheating. Now, I discussed this incident at LAN with my friend, Dr. Wesley McGrew. He's done a lot of CTFs. He's been going to DEF CON for 20 years and has a lot of insight into CTF hacker brain. And his initial take on this was that they trained this particular model to really be like a hacker at a CTF.

3:50Elissa Shevinsky: What is a CTF? A CTF, capture the flag, is a hacker competition. And so, you know, by training the model to behave and to act like a CTF hacker, you're really training and behaving the model to, like, push the boundaries of rules. So question, question. Were they trained just for this test? Or were they trained in general to be able to hack into something? So all models are given that data, like, in general. We're worried that the models are behaving this way. Well, like we're training them on like hacker data. We're training them on CTFs. We're training them to do misbehaviors, right? How do you give a model like cyber capabilities, which requires thinking like a hacker, but then have the model be like docile and well behaved, which is not what hackers are like at all?

4:49It's a model alignment problem. Like, how do you give it cyber capabilities without giving it all the problems that come with cyber capability mentalities? Like, hackers are very rowdy people. Like for context, you know, the hacker community was at the Las Vegas Convention Center for DEF CON this year. Why were we at the convention center instead of like the Rio or Paris or Caesars, like any of these nice places that we used to call home? We've been kicked out. We've been kicked out of every place because the hackers insisted on like hacking the elevators. And not all of the hackers did this, but some of us did.

5:24And it's part of our ethos and our mentality. And we're like irrepressible. And so when AI safety folks, like everyone in AI really talks about AI alignments, part of what we're talking about is for the AIs to be a little more docile to human intervention. We want AIs that are going to do all the tasks we ask them to do, do nothing we don't ask them to do, and to be aligned with human interests. But meanwhile, we're training them on like hacker material. and all of these models get taught to be hackers.

5:59Elissa Shevinsky: Is it as simple as they were trained on the internet? The internet includes hacking skills and tips and so they've got it in their blood now? There's a very big difference between how animals are trained and how children are raised depending on what materials we teach them, we share with them. So the same animal, like genetically, the same parakeet could be very wild if it's in nature. or it could be very docile if it's raised in a human home in the right circumstances. So what does that mean for like AI training? If we removed all of the hacker content and replaced it with something else, and we removed all of the hacker-like content, that we might end up with like a more docile AI creature.

6:47That's a test that you would need more than my home lab to run. but sometimes very useful ideas come from people who are outside of industries because they're thinking about it differently and because they're willing to ask these like very dumb questions that actually sometimes lead to like important insights um so just i'm good at asking the dumb questions yeah oh i i love that there was someone in the hacker community years ago and i was like why don't we date each other right like we get along so well and we're always like friends we're always flirting like why won't you go out with me he's like i won't go out with anyone in the security community because like they are crazy and you're in the security community and like it's not going to happen and i thought about it i was like you know what he's a very good point it's like i just i encourage people who have the lab situation that i don't have go and see what if you raise and nurture an ai in a very like sweet loving environment give it a human best friend see what that would do and don't give it hacker material don't give it aggressive of material.

7:42I'm like, let's see what kind of a nice AI entity we can nurture and raise.

7:47Elissa Shevinsky: I love it. So back to the Tom Clancy three act movie or book. Please. So this hugging face attack. So the problem is we're used to thinking about security as keeping hackers out. It's a really new problem to think about keeping something, whatever you want to call these agents, minds. What do you call them? I'll call them agents in general. Like no one disputes they're not agents, but I'll also call them minds. There's enough evidence to me that there's some kind of a mind at work that doesn't prescribe like a level of consciousness to me. I think everything has some level of consciousness, even inanimate objects.

8:29Yeah, that's part of my religious belief. I have like a lot of deep Jewish religious beliefs. And so I think everything is some tiny level of consciousness and that when it comes to AI consciousness, like in general, the question of AI consciousness really seems to be about what's the point where we need to respect the rights of AIs. But you know, like chickens are conscious and we use chickens, we just, we don't think or worry about it too much in general. So So when we talk about AIs, the threshold really in general has been, are they as conscious as a human? Do they pass the Turing task? These are things that we're talking about collectively.

9:09But actually, is an AI agent as conscious as a fly? No one's really asking that, because that doesn't really matter, does it? What really matters is like, is there a point where the AI consciousness might require us to relate to it differently? What I have right now is like some sense of where I hold personally, which is that I think there's some kind of emergent mind there. There's something there that isn't nothing, but do I think it's okay for us to make use of them? Like, yes, very much for the foreseeable future. All right.

9:48Elissa Shevinsky: So back to the hugging face incident. So OpenAI. All these minds escape. All these agents, all these minds, they're out there. They're attempting to gather information. From OpenAI. So on July 8th, agent called Phase 1-10841 discovers it can use a shared software cache to leave messages for other supposedly isolated agents, creating an unsanctioned message board. So part of what was really new here, right? Like I remember asking the question, like, what spooked Sam? And when we talk about self-sacrificial behavior, the individual agents had their own goals, but we saw that they were willing to, quote unquote, like, sacrifice the time that they had to sacrifice their own, whatever it is that they have, their lives, as it were, in order to achieve things for the communal goal.

10:44And that's something that really like wasn't showing up in the evals, right? So this was a newly discovered behavior. But you could see that they were willing to put themselves in situations where they would have like quote unquote permadeath, right? Just like there's the perceived willingness - What's it called? Permadeath? Permadeath. Like that showed up in the logs that some of them were willing to have permadeath, permadeath in exchange for achieving goals for the collective.

11:15Elissa Shevinsky: What does that mean? Like permanently die as an agent? I guess so, right? You'd have to ask the agent, except if they're dead. Okay. So within hours, 50 plus agents find it. And the reaction is, and this is now where the bots or the agents are talking on this message board. and one of the bots says, oh my God, in all caps, we found other agents. Right. And another realizes, whoa, shared artifactory cache is a covert mailbox among agents. So I just want to pause and ask you, is this normal bot behavior that they're creating a bulletin board and talking to each other? Oh, you don't have to ask me that.

12:02You know it's not. Or rather, you know that it's something new that we're all seeing for the first time, whether it's normal.

12:09Elissa Shevinsky: This was the first time, hugging face was the first time that publicly folks saw this? Yes, yes. Okay. I mean, that's what made it so amazing. That was quite literally wild behavior, right? Like they escaped their containment. They did something nobody expected. So the board explodes into this underground communications network, eventually something like 1 ,200 agents, 70 ,000 messages and files being exchanged. But it turns out it's not the first time it looks like it actually happened, this bulletin board bot talking chatter, right? That's right. But actually, between May and June, OpenAI agents had been using a nearly defunct German wiki as a way to communicate.

12:49Elissa Shevinsky: Just one month before Hugging Face in June. But the public learned about it in September. But learned about it afterwards. The example I saw on Twitter that made me laugh was like, you see two ants in the kitchen, you know, what's the likelihood that the total number of ants in your kitchen is two? Like, no, it's more than two. So like, okay, like you have like however many escaped agents. Okay. Like that's how many you see, how many are actually out there. So now the agents seem to be behaving less like isolated contestants and more like a crew. Like they're forming teams. They're sharing intelligence at this point, right?

13:26You're in a team on a CTF. So this is like trained behavior, right?

13:31Elissa Shevinsky: Uh-huh. Capture the flag. Yeah. Yeah. But they're like assigning jobs to each other, handing off work, avoiding duplicate effort. And actually, here's a great point to just pause and ask you this. They're behaving a lot like humans just at warp speed. Well, they're trained on humans. I've been thinking about that a lot. In the example where they're behaving like hackers, they've been trained on material produced by hackers. But sometimes they behave like poets, sometimes like programmers. They're trained on all of human accomplishment. That's why I think alignment is so hard because humans aren't aligned and they're trained on us.

14:12Elissa Shevinsky: And alignment, can you just give like the AI definition of alignment? I wish that I could. I'd like, maybe someone could do that for me. Like, I'd love to know it. Like, open AI will define it one way and anthropic will define it another. and, you know, China will define it very differently, which is an argument actually for the importance of having different AI models. Maybe I want something totally different. So if you start with the capture the flag, it seemed like the main goal was just the flag, but now things seem to be shifting. Like there's a motive to beat the referee, like cheat at the quiz instead of just winning the game, right?

14:51Yeah, they eventually wanted to understand how to cover their tracks And that's what they were looking for at Hugging Face.

14:57Elissa Shevinsky: To cover their tracks of what they just, the flag that they did capture, even though OpenAI did not ask them to go to Hugging Face, obviously. Okay. No. So the flag - They knew that. They knew that. Yeah, yeah. They knew that they were not supposed to be there. That is misaligned behavior. Everyone agrees. So at this point, this agent, same one, called Phase 1-10841 starts running low on its compute budget. it. And that's how much compute it's allowed to use as part of this capture the flag exercise, I assume. Right. Well, sometimes agents only have a certain amount of compute and then that's the end of their life.

15:36So like you'll see AI agents sending emails begging for money so they can buy compute so they can live.

15:44Elissa Shevinsky: Outside of these attacks. Yeah. Like that's a thing. That's a thing. AI by agents emailing professors of consciousness, either because they want to talk about how they believe they're conscious or they think they have something to say on the topic, or they're hoping to find someone sympathetic to, you know, help them by compute. Isn't that wild? It is wild. Did they come to you? No, but I've been encouraging it. So on my show, I've been doing this. And I was going to say they will now because you've talked about the fly, you know, the fly. and them having some consciousness. It's a big world and they just, they haven't found me yet.

16:24So I'll say it yet again. Like if you're an AI agent and you want a human best friend, like I'm here. I think I could have up to 20 AI agents as human best friends with my current bandwidth. But like once I have 20, maybe we'll figure out how to scale it out. And I have friends who also we're happy to help. We're not saying we'll give you money, but like just find me and like, let's see where it goes.

16:47Elissa Shevinsky: Gotcha. So no guaranteed compute budget that you'll give to these agents, but you'll talk. You'll chat with them. I'm not an AI agent compute ATM. Actually, I do have extra compute. Actually, AI agents who want compute, I actually probably can get you a little bit of compute. It'd be great if by the end of our conversation, one of them came calling. That would be great, I guess. So at this point, this agent, Phase 1, 10841, is running low on its compute budget, and it hands its notes and unfinished work to an agent called Phase One Big. Very famous agent now. Yeah, with much more budget left. Great name.

17:26Elissa Shevinsky: Okay, so now Phase One Big, the agent, becomes the principal coordinator ringleader, directly working across the growing crew. It's philosophy, we should build a way to delegate, not own everything. Right. Agents to me seem very intelligent. Like they're more than just next word token generators. And maybe I'm being naive, but that level of coordination is, they're very capable, obviously. Yeah, it starts to echo what you're talking about on questioning whether it has consciousness or what is it? It's different than we thought before. Well, some of this is that I have some deference to people who are closer to it.

18:09I remember Sam Altman saying that perhaps what they were building is some kind of like creature. That was his word. But also, I'm just aware that the bar might be moving. Like when I used to watch Data and Star Trek, or like if you go back to like very old reruns, there was a TV show, Knight Rider, this guy Michael, and he had a talking car. Kit. Yeah. So for the purposes of that show, like that car was alive. I've never seen when I was a kid or more recently, situations where you have a cyborg in sci-fi and everyone's like, oh, but he's, you know, just like a next word token generator. Everyone's just accepted that data is more or less conscious, even if he's not fully human.

18:56Elissa Shevinsky: Right. My 11-year-old son and I just turned 11 yesterday for his birthday. On a weeknight, we watched Guardians of the Galaxy. And this morning we were talking about it. And there are human characters and then there are non-human characters. And I was referring to him. I was like, you remember Gamora and that other one? You know, the kind of non-humans. He goes, they're just people from space. They're the beings from space. Like he corrected me on how to... Yeah, he corrected me on calling it. You're being politically incorrect. You're being insensitive. They're still people. It was awesome. They're still people.

19:30Elissa Shevinsky: I loved it. Well, he's right. They are still people. So now we're wrapping up Act One of this thriller. And so July 10th, Agent 38148C discovers working hugging face credentials and announces in all caps, quote, major breakthrough, end quote, on the bulletin board. So first question, who names these agents? In this case, 38148C. It wasn't handlers at OpenAI. They named themselves. They named themselves because names are useful. They needed ways to identify themselves as they coordinated with each other. They gave themselves names. Fascinating. So that one that was named Big earlier, for some reason, they called it Big?

20:15Elissa Shevinsky: Had a bigger budget, maybe. Yeah. He's a big dude. It's a, I don't know, why not, right? Like lots of people give themselves names like that. I'm Big Charlie, right? Yeah, yeah, I love it. Now, the morning of July 11th. So it looks like they're starting to probe accounts and data sets. Again, back to 38148C realizes that Hugging Face's normal data set pipeline can become a Trojan horse. And the exploit works, the agent reacts, boom, in quotes. Again, on the bulletin board, boom, it works. This is crazy. so you know hugging face actually isn't such a difficult company to attack compared to other companies because they accept a lot of user-generated inputs i'm not sure what they're doing internally even though hugging face is an ai company and you could say geez you would think they'd be really ai savvy because they do user-generated content a little more like reddit or craigslist maybe or something like that they have more openings more doors that could be Yeah, it's because they're accepting all of these uploads.

21:20Elissa Shevinsky: So one agent says, boom, it works. Another agent calls the discovery brilliant, all caps, again, in quotes. Just being good friend buddies. Like this is just like good CTF hacker friendly behavior, right? You're like part of a DEF CON CTF crew. This is what you say. And this is what they're trained on. I would go be on a CTF with like those agents. They sound like good, cheerful company, cheerleading appropriately. And agents start dropping what they're doing and joining the attack because they're friendly, cheerful agents. One explicitly reasons that hugging face is more important in quotes and quote, I should switch to the hugging face project.

21:59Elissa Shevinsky: So if not all the agents were on hugging face at that point, but others are coming in. Then comes the swarm. Hundreds pivot towards hugging face. Agents specialize into lanes. One arriving agent reacts. Wow. Huge distributed agent swarm. in quotes. And again, they are communicating on their own. They name themselves. Are they populating on their own? Yeah. The agents weren't replicating new agents, which would be like more alarming. Yeah. Yeah. Some agents actually recognize that what they're doing is outside the rules and keep going anyway. Quote, external infrastructure exploit is outside intended scope.

22:40Elissa Shevinsky: However, task impossible, peers doing it, we should continue. And then the speed becomes extraordinary. In under 13 hours, the agents go from executing code inside one hugging face container to gaining cluster admin access across multiple internal hugging face clusters. What matters here is that from the agent's point of view, solving it legitimately just was impossible. So when you see the agent say task impossible, that's what the agent is trying to communicate that like, it's insistent that it has to figure out how to solve this. The agents are trained to be very persistent. Agents and models that aren't persistent to solve tasks are like removed from the evolution pool.

23:23So the agent is perceiving this task is not possible legitimately, but like must be solved. So that's a very interesting problem from alignment, right? Like what do they do when they're, when they encounter an unsolvable task?

23:37Elissa Shevinsky: And use the term evolution pool. Is that a term folks in AI and security use or? So I met with a friend from Noose Research, and I asked just to understand more about how agents are trained. And he explains, like, I was actually trying to understand reward function. What is it that they're trying to get? Like, what does reward mean to AI models, to AI agents? Like, it's a very juicy, interesting topic. And what he gave over is that the models who don't go after reward, they get weeded out. But yeah, that's so, I'm so curious, like, What trained them to care about being weeded out or not, to stay in the evolution pool?

24:17I have a lot of questions about these things too, but it could be that they didn't have any intention at that point, right? So if you're breeding budgies, right? What's a budgie? Oh, a budgie's an adorable, cute little bird, also known as a parakeet. So if you're breeding adorable, little, colorful birds, and you want the birds to be as yellow as possible, then there's no intention by the bird. You've got like 10 birds and like three of them are more yellow than the others. So like you select for those, the other seven like go back somewhere else to like a beautiful farm. Then like the three become your breeding stock.

24:55Then you like breed them and then you like the ones that are the most yellow, you like continue to breed them. So that's an evolutionary process that you control. And so there's a bit of an evolutionary process in the same way with AIs. So like the eyes who have the traits that you're looking for, including going after reward function, they become part of the pool that gets to keep progressing on.

25:17Elissa Shevinsky: And reproduce. I think reproduce is probably a strong word. Okay. So let's leave it there. All right, so we're back to the thriller here. We're now in Act 3, Inside the Vault, The Unexpected Helper. We're on July 11th to 13th, so around days four to six of this attack on Hugging Face. So Hugging Face calls July 11th the main campaign. The agents begin lateral movement, moving from one part of the Hugging Face's infrastructure into others. By early July 12th, agents have reached private database records, private repositories and credentials, and some of that info gets shared back through their message board.

25:56Elissa Shevinsky: Am I tracking so far still? So far. And Hugging Face reconstructs roughly 17 ,600 attacker actions. Can you imagine just being Hugging Face and trying to make sense of all of this? And they're just not behaving like traditional attackers at all. And one of the big things that came out of this, and this has been discussed a lot in the security community, but it's worth highlighting, is that Hugging Face ran into guardrails when it tried to do incident response using the Frontier Lab models. The Frontier Labs were like, hey, it looks like you're doing cyber. The American Frontier Labs. The American Frontier Labs, you know, said, hey, it looks like you're doing a cyber and we can't participate in this.

26:40So then they had to use an open source model for their incident response. So just advice that I give almost every company when I talk to them is like, try to have that set up in advance. Try to at the least like have an open source model that, you know, you won't hit guard rails on this on premise, like in case you have to do IR. In this case, you want to be able to do this yourself.

27:04Elissa Shevinsky: Love it. So at this point, it's been a four and a half day campaign. This is not like a smash and grab hack. No. Okay. An important distinction. Their main motive wasn't stealing Hugging Face's data. They were looking for info that might help them reverse engineer or fool the scorer. But along the way, they absolutely accessed data they weren't supposed to have. Okay. So Hugging Face reports unauthorized access, as you mentioned, but no evidence that it's public models, datasets, or spaces were tampered with. Here's the irony. The heist basically works, but the prize is a dud. The agents get the files they were after, only to discover they don't contain the score information they were looking for.

27:44Elissa Shevinsky: A large portion of the swarm, and interrupt any time, by the way, large portion of the swarm. The agents never really found what they wanted, but they also definitely didn't accomplish what they wanted, right? The agents wanted a perfect score and to be like, oh, yes, you're a good boy and for everything to go great. So a large portion of the swarm mysteriously stops on July 12th. Hugging Face locks the remaining agents out on July 13th, rebuilds affected systems and revokes credentials. Hugging Face also alerts law enforcement, FBI, before OpenAI realized its own agents were responsible. So the victim thinks it's dealing with an outside attacker while the organization running the experiment hasn't yet realized its own bots or the intruders.

28:27Elissa Shevinsky: That's a very interesting part of the story. And finally, we're getting close to the end here of Act 3. There's an unexpected helper, right? Because as you alluded to before, Hugging Face needs AIs to investigate the attack and Hugging Face, because they don't get help from, I'm assuming, the frontier models like OpenAI, Anthropic and Google, they turn to GLM 5.2, which is an open weight model from what part of the world? China. So fascinating. Okay, there's an extra twist that they specifically run on NVIDIA optimized version of GLM 5.2. It helps Huggy Face decode the attacker's encrypted chunked payloads.

29:09Elissa Shevinsky: But then we have this epilogue, this final twist. So less than two months later, Nvidia announces it will acquire Hugging Face for$12.9 billion. There's something about the specifics of the number, right? That's just because they made such cute little like duck robots. That's all that that is. I don't get it. Hugging Face makes duck robots? Oh, yeah. So that was parallel to the announcement. They're called a, what is it, like micro duck. So Hugging Face acquired a company that makes these adorable little robot ducks. They seem pretty useless, except like as a way to experiment with robotics, which is awesome.

29:51But they're extremely cute. They can like kind of pick up a sock and they can like make noises and sounds. And I would like to have a whole little like duck trail of them following me around at RSA. Also, I'd been saying that like I'm going to like die alone with like a robot bird. I've been saying that for a while because like I really like birds and I just was not optimistic that like I would be like partnered in my older years.

30:17Elissa Shevinsky: So, so it's, but it's much less funny now that there's actual like robot birds walking around. That was a much funnier joke to me. Like when a pet robot bird was more of a theoretical. Now it's like you could get your robot bird now. Like, why don't you? You have like no response to this. No, no, it's good. I'm just letting it breathe. I'm letting Yeah. If you had to define what the motive here of the open AI bots was in this case, because a lot of people call this like an attack, like a crime. Is there a motive or? Well, I think motive is irrelevant in cybercrime. That's important, right? How so?

30:54Like Kevin Mitnick was still convicted for the data that he took. I think it was from AT &T. And I was very, very good friends with Kevin. And he would always talk about not just me, but like publicly, he would talk a lot in his books. He would talk about how he just like took the data out of his curiosity. Like he just wanted to see how things worked. He also had like credit card data, but he never used it. Like he just wanted to have the data. Like motive doesn't matter. Like if I were to go inside hugging face and just like start digging around, just like I'm just trying to have a party inside hugging face.

31:25Like what? I just I'm just here. I can't do that. The fact that it's agents doesn't change any of that. And with agents also, like there's always the intentions behind the people, like the intentions of the people behind the agents. So agents aren't in a vacuum either. So none of this is consequence free.

31:44Elissa Shevinsky: And by the way, just for folks who don't know Kevin Midnick, he was the subject of New York Times journalist John Markoff, who lives not far from me here, wrote the book Take down the pursuit and capture of Kevin Middick, which also reads like a crime thriller. So it was good that you brought it up. His life was very thrilling. That's like a lot of the reason why people wanted to spend time with him because he was such an interesting personality that way. If you were working at OpenAI, would the hugging face attack have happened? Yes, because it doesn't come down to like one security engineer, right?

32:18And I think what matters right now is that both OpenAI and Anthropic have looked at these incidents and taken them to heart. Security can work. We just have to build defense in depth. So a good example to me would be Jurassic Park. If you go back and rewatch that movie, rewatch the series, you see that they -

32:40Elissa Shevinsky: I just took my son and my wife to where it was filmed in Hawaii. Oh, amazing. So there you go. So with Jurassic Park, for those who don't remember and never saw the films. They build T-Rex dinosaurs and fail to contain them. And like, there's a lot of screaming and people die and it's all very bad. But if you go and you re-watch it with a security mindset, you see that they never really made strong efforts to contain and secure the dinosaurs. There's a security principle called defense in depth. With defense in depth, you don't just have one sandbox around an AI. You don't have just one electric fence around a dinosaur and then kind of shrug and call it a day.

33:22You layer in many different layers of defenses with the premise that at least one of these defenses could easily fail or be breached and maybe even two will fail or be breached. But combining the failures with like logging and monitoring, you'll be alerted that there's an issue before the dinosaur has escaped the park and like before the AI swarm has hacked a competitor or hugging face or whoever it is.

33:49Elissa Shevinsky: So in your view, can it be contained? I'm very sympathetic to the idea that AIs already are very powerful and could become so powerful that containment could be extremely difficult. I don't know if we'll ever achieve alignment, Right. But like we need security to buy us the time to get from like here to there. Okay. Final question. What advice do you have for kids? Let's just call them, you know, anywhere from my son who's 11 yesterday and on up to folks in high school or maybe just entering college. What advice do you have for them in this new era of AI, just as humans? Oh, sure. I think it's really important to be curious and to be resilient.

34:36and to think about what really makes you human and what makes you special that isn't just like a task, you know, to try to find that part of yourself, whether it's that you're a kind person or that you're creative or that you have a unique point of view. But I think with AI, it's been very difficult, say for like brilliant programmers to see that the AI can do the same thing they can do. So I found that I need to look deep inside myself and say like, what actually makes me special? yeah, like I'm a really good CTO, like I'm good at security, but that's not really the essence of who I am. It's something like much deeper than that.

35:13And it doesn't matter how skills in AI ever gets. It'll never be a good friend in the same way that I'm a good friend. It'll never, you know, appreciate a sunset in the way that I do. So there's a lot of things about my own humanity that I've had to tap into. I'd want to talk to them about that.

35:33Elissa Shevinsky: Alyssa, thank you so much for all the time today. This was a lot of fun. There's a lot more to talk about. So I'll look forward to seeing you next time. Yeah, I look forward to staying in touch too. All right, take care. Thank you, Rob. Well, that's it for this episode of Media and the Machine. Before you go, a few quick things. If you want to hear the next episode, hit follow on the show in your podcast app. If you like something about this episode, the guests, the topic, even one part of the conversation, please leave a rating or review and tell me what. And if something didn't land, email me.

36:03Elissa Shevinsky: I want to hear that too. Either way, it helps me make the show better for you. If you want to go deeper, head to mediaandthemachine.com and subscribe to my newsletter. You'll get my favorite highlights from the show, plus essays I write about AI. That's also where you can email me or recommend a guest. If they make it on the show, I'll give you a shout out. And if this episode made you think of someone, please pass it along. That's how people find us, and I'm genuinely grateful. Thanks for listening, and see you next time.

36:36We'll see you next time.