第028期——大多数 Neoclouds 的安全能力都很差：Agents 如何攻破 Hugging Face（Neoclouds、安全）

Hello everyone. Welcome back to Something Else Weekly, where we are here to anthropomorphize AI this week.

Doug, how are you doing, man?

Good. How are you guys? I haven’t seen you guys in a bit.

Yeah, I haven’t seen you in a while. We’ve been sitting here just testing neoclouds. Sam, how are you doing?

Good. No pressure on a podcast with Jordan and Doug, but I’ll do my best.

I think you’re going to do just fine. So, look, I think today’s podcast topic is one that’s probably near and dear to Sam and Jordan’s heart, which is security. These guys are the people who do ClusterMAX. I think we’re going to talk about Hugging Face later, but something that’s maybe underappreciated is that the huge vendors of all these labs are the neoclouds, right?

1. Neocloud Security

The neoclouds are people selling GPUs as a service. One of our core goals of ClusterMAX has always been that a GPU isn’t just a GPU; the providers do make quite a bit of difference. We talk about uptime, reliability, and all these kinds of things in the SLA, but one thing that I don’t think we ever talk about is security.

I’ve heard some horror stories, but I guess from Jordan and Sam’s perspective, how secure are these things, and how much does that influence the ClusterMAX rankings?

I think there’s a huge variability, which is what we explore in this article a little bit. There are some neoclouds that are getting to the point where they operate like hyperscalers, and hyperscalers really set the bar when it comes to enterprise security because they’ve been serving everybody from the top Fortune 500 companies to federal governments all around the world, and they’ve been held to this standard for a while.

But only certain neoclouds are actually getting to that standard. That applies to the physical security of the data center, how they run the operations of the bare-metal machines, how they design the network, and even the orchestration layer and applications. What we demonstrate in this article are a few ways in which this can fail.

Maybe we can go through some of those anecdotes, but it’s pretty—yeah, it’s pretty—look, it’s a counterparty, right? When startups are raising 60, 70, or 80% of their venture capital and spending it on GPUs, they are really putting a lot of faith and trust in these neocloud providers. Some deserve it, and some really do not deserve that trust when it comes to security.

Okay. Well, quick: name your most insecure—I guess unsecure—sorry, not insecure. Insecure is another topic altogether. Name your most unsecure neocloud story. Now, you should anonymize it. You shouldn’t say who it is, right?

We’re going to name and shame in ClusterMAX 3, coming soon, for sure. But, yeah, quick horror stories. My least favorite was one in Asia where we got a cross-tenant remote-code-execution vulnerability, which meant we had 2 separate tenants. I was able to write something into the logs in one of the tenants and read it from the others, and we saw that all the other tenants could be inference providers on OpenRouter.

This was a provider that was serving inference on OpenRouter, and their tenants were doing the same. So, if anybody’s OpenClaw or coding assistant, like a Pi or an OpenCode client or something like that, is using this provider’s endpoint on OpenRouter, they’re conceptually exposing credentials. That was my least favorite one. Sam, what’s yours?

Yeah, I think the frontend Grafana trying to filter out all the data that they were exporting identically from all the tenants in the cluster was pretty impressive. I think that brings up something worth emphasizing, which is that we do think hyperscalers generally set the bar in terms of security.

I don’t want to say there are no hard engineering problems that you need to solve to serve a secure cluster, but the stuff we’re calling out here, the stuff we went through in the article, and the stuff that we’ll be particularly harsh about once we publish this ClusterMAX 3 write-up is not anything crazy. We’re not interested in you inventing novel cryptography techniques. Just do the basics correctly.

2. The Hugging Face Hack

Make sure that tenants are properly isolated. Make sure that you’re following all the very basic security best practices, and everyone will be much better off.

Yeah, you heard us here: be secure and do the basic things. But, okay, I actually kind of want to take the next step from that because we’ve been talking about security a lot. I think this is a really good time to bring up ClusterMAX, but the thing that everyone’s really talking about is the Hugging Face hack.

Rune famously tweeted at the same time, “Hey, just because I had broken all the sandboxes and they were screwing around with the Artifactory message board doesn’t mean the weights were out of the data center.” Help me understand what this would mean if, let’s say, Anthropic is actually using some lower—like silver or gold tier, right?—or a silver-tier provider.

How would that happen? Does that mean the model weights, or the model itself, could become insecure? Could it see other endpoints within a cluster? Do you think it could break the sandbox itself? Is it able to essentially say, “Hey, I have access”? Walk us through that, because I think this is an underappreciated part.

We see this over and over, where everyone’s so focused on the end product that they forget about the infrastructure, and this is a huge layer of infrastructure security. It seems like there are black hats everywhere. Walk us through that. What could happen? Give us some doomsday, dude. Anthropomorphize an evil actor—an evil, bad Opus.

Okay. I’ll give you a rough timeline of what we think happened, based on what we’ve read from Hugging Face blog posts as well as OpenAI, and then we can talk about some of the implications here.

Taking a step back, our recommendation to providers in the ClusterMAX rankings is literally just: keep your stuff up to date. If there are existing vulnerabilities that have been described publicly in popular software, this could be anything from Docker to the NVIDIA driver to Kubernetes or the Linux kernel. Clearly, people—and in this case, agents—can just read that description and build an exploit from it. It’s not anything more serious than just keeping stuff up to date. But that’s the problem.

This reveals itself in the Hugging Face–OpenAI situation because, basically, 2 things happened. One, stuff isn’t up to date, and 2, stuff is incorrectly configured, or they’re not using the tools they have at their disposal to keep things secure. I’ll focus on Hugging Face to start.

Hugging Face has this Datasets API. You can call it, and you can get responses that include the datasets that you might want to use. A dataset could include something for training a model, but in this case, it includes a dataset for an eval called CyberGym that an OpenAI model really wants access to. This part comes later.

From Hugging Face’s perspective, all they’re doing is running this data API. It runs on Kubernetes. This Kubernetes cluster could run on a hyperscaler like AWS using EKS, or it could run on a Kubernetes cluster they built themselves. It could run on CoreWeave or any of the other neoclouds. We don’t actually know where it was running.

But the point is that the Kubernetes cluster serves up this API, which an agent—in this case, an attacker—gets access to because it uploads a malicious README to the Datasets API, pretending that it’s uploading data. The README gets read access to `/proc/self/environ`, and it returns all the credentials and source on that worker.

Now the person who uploaded the data can see the source code the worker is running and the root-level credentials on that worker pod on Kubernetes. This starts a cascade where you can then use those credentials to exploit and get full control over the pod, and then start slowly taking over the Hugging Face infrastructure so that you can search around and try to find access to the raw datasets that they’re looking for.

In this case, it demonstrates a few interesting things because it was clear that an agent was attacking them. It was probing everywhere, they said, and it only took them 13 hours to go from uploading the malicious README to the Datasets API to getting cluster-admin privileges across the cluster.

They claim multiple clusters, which implies that the agent was moving laterally across the infrastructure, moving from one cluster to the other. The reason they were able to do this, and the misconfiguration here, is because Hugging Face has no admission policy, which is a configuration parameter in Kubernetes that you can use to reject a pod with root privileges or to mount a hostPath.

That basically means they should be rejecting, in these production clusters, any pod—any container or workload—that tries to get root access to the underlying workers and that tries to read from the hostPath, meaning read from the root, logs, or `/proc/self/environ` in this case, and get credentials.

So, 2 things can fix it in this case. One, if they were keeping—I believe that the HDF5 dataset vulnerability in their Datasets API was a zero-day that the model found, so that’s kind of a little crazy. But if they were keeping the Kubernetes cluster secure and running it with these configuration parameters, then the model, even if it had gotten full privilege and full source on the worker, wouldn’t have been able to escalate to get root on the underlying host and to start moving laterally in the environment.

So I guess the point is, if you are Hugging Face in this scenario and you are trusting a provider who might run the Kubernetes service on your behalf, you are trusting that provider to potentially educate you on the concept of an admission controller or to actually implement it for you.

I think OpenAI does a lot of similar things, where the agents are escalating to root privileges in the OpenAI infrastructure itself. In this case, they exploited a publicly documented vulnerability in the Linux kernel. I believe it is called Fragnesia[?]. We have tried to look into it and figure out how they did it, but we are not sure exactly how.

There are a couple of other things where people are making a big deal out of the agents coordinating, which is a big deal. Sam, maybe you can give your take on that at a higher level, but for me, the practical stuff is, first of all, keep your stuff up to date. In this case, the OpenAI Linux kernel was out of date, and there was a publicly disclosed vulnerability. It is pretty easy for an agent to download the reference description of this and then exploit it.

Second, if you are trusting providers to run clusters for you, you have to trust that they are going to run them well. They have to know how Kubernetes works and not mess things up. Sam, what is your take on the high-level question of the agents coordinating in the swarm? You told me some interesting things about it. What is your take?

Sure. I think it is excellent to have that technical background on the blow-by-blow details of the exploit because, perhaps it is a fault of my own tuning of my Twitter algorithm, but I feel like I am seeing so much extremely granular analysis of the behavior of the models and not enough analysis of the actual security infrastructure that they exploited. Obviously, both are interesting to some extent, but I think this is a preview of the future in the sense that these models are extremely hard to reason about in some ways.

They are alien intelligences doing things that humans could not do, but they are also taking advantage of ordinary chinks in the armor: a problem with the Linux kernel, shared credentials for the Artifactory service, and bad Kubernetes security policies on Hugging Face's part. So, yes, these are strange emergent behaviors in some sense, but they can only take advantage of ordinary bad human engineering practices.

As far as the behavior of the models themselves goes, I think one thing worth mentioning that I have not heard discussed enough is that these were models RL'd to hell to be extremely relentless and keep pursuing tasks even after other models would deem them impossible. They were also fine-tuned to be more willing to collaborate with other agents. So this is not necessarily an indication of how GPT-5.2 would behave in goal mode. These were models that had been incentivized to behave differently, which is why they found it so natural to collaborate on the Artifactory directory.

Hackers goal-seek all the time. They were like, “Do not stop. Make no mistakes. Do not quit.” So, yes, maybe it is crazy that you can elicit behavior like this at all, but it is worth making clear that this is not necessarily the default behavior. For example, the self-sacrificing actions of some of the agents, where they were willing to drive their own probability of success down to zero to—I don’t know the exact details of it—but they were trying to make sure that the traces of all the other agents weren’t discoverable by the grader so that everyone else could get good scores. It’s sort of bizarre that they were willing to forego any potential of their own rewards in the service of the swarm, but these were agents specifically trained to do things like that. So I don’t know how much it reveals necessarily about the behavior of cybersecurity.

3. Obliterated Models

Kind of related, actually. I’m kind of interested. There was this unsafe model—essentially, someone took Qwen and did a fine-tune to make it specifically focused for red-teaming. I was like, “What the—” and I know everyone was like, “Please do not do this.” That’s the overall X/Twitter theme feed. But it’s kind of crazy. Are we going to see, as intelligence hits some scale, open models that you can fine-tune and RL into these psycho models? Where it’s like, “Hey man, I need you to attack the infrastructure and do not stop,” or, “I need you to glaze up the user and do not stop to maximize reward”? I’m just wondering: is this going to be a trend that we continue to see? It’s kind of an interesting one, to be honest with you.

You are talking about the Abliteration.ai release of GLM-5.3, I think. We did talk about this in the article, but I can give a hot take right now. I am going to take the position that this is a good thing because it is a warning shot to everybody that anybody can do this—not necessarily because I think it is a good thing that this model was released or that people should be using it.

This is the obliterated version of GLM-5.3, where they trained it to remove the safeguards and do offensive cyber red-teaming. It is just a very clear demonstration of what is obviously possible today when people release open-weight models. We need to contend with the fact that anybody can do this in private without hosting the model.

I will talk about 2 things from our experience in the Hugging Face–OpenAI saga. Hugging Face claimed multiple times that they got a bunch of refusals from Claude Haiku and Claude Opus, and from GPT-5.2, when they were trying to defend themselves from the agent attack because they were talking about cybersecurity concerns. If they talk about getting attacked and it is related to cybersecurity, the model just refuses to help them because of the double-edged nature of cybersecurity, right?

If you want to understand anything cybersecurity-related, that implies that you will be able to exploit it on somebody else, but also defend yourself. They had to go with GLM-5.3 to help with a bunch of their analysis. We are having the exact same experience doing this work. We are trying to figure out whether these neoclouds have issues or whether they have their systems up to date, and you can only test things from the customer's perspective.

You do not have full root access to check whether a version of the virtual machine runtime is up to date. But if you run a proof-of-concept exploit and see that it works, then you know it is not up to date, for example. We have to write a bunch of these exploits by hand and dig into them ourselves, directly—back to the Stone Age—strictly because the models will not help us do it.

This is even when we are approved for the cybersecurity programs of some of these companies. We had alpha access to a few of these models, and we were approved for cybersecurity work, but we were still getting refusals. That means it is trained into the weights; it is not a classifier or filter that is refusing us.

So I think it is good that they are demonstrating that this is possible with open-weight models, and we have to contend with the fact that this is the world we live in right now. But of course, it is scary that the demonstration is on display for people.

I think it is a very under-discussed question, and ultimately an empirical one, to what extent these models in practice will be used by attackers versus defenders. You can theorize about the equilibrium that we are going to arrive at. The day-to-day experience for us is trying to use Claude to figure out whether someone who is using this cluster is going to be secure or not, and we cannot do it.

I know there are a lot of people trying to do very mundane things that are pretty straightforwardly good to be done, and they cannot do them with these models. Something like this post-training of Qwen moves the equilibrium a bit. A stronger weapon in the hands of the defender means that maybe you are a bit more willing—or, excuse me, a stronger weapon in the hands of the attacker means that maybe you are a little more willing at the margin to give a better tool to the defenders.

But it is just not clear to me that, if you ask Claude to hack the NSA, it should refuse. The safeguards as a general practice are not something I am convinced is a good policy, as opposed to letting all the other social safeguards that keep us from tearing ourselves to shreds function.

It just seems like KYC helps a lot. If you KYC the customers and track who is doing what, this seems like it is going to help a lot. But that sort of implies that a big chunk of the market that does not want to be KYC'd and is currently using these endpoints is going to go away. I do not know; that seems like an obvious first step that is going to happen.

Uh, we'll see.

4. Security as a Service

Wow. So the gang is against open models, is what I'm hearing. I'm just kidding. [laughter] No. And I know Akos is going to clip that and screw me on X, man. It's not just Akos—it's other guys on X who are now clipping this 100%, dude.

Okay, so let's do another rendition of this, right? A logical thing to do with KYC—and we've actually been talking about this; I know OpenAI has been talking about this, and I know Anthropic has been talking about this—is outcome-based pricing. The question is: Are they willing to sell their unsafe services to known customers for outcomes alone? To me, that's the most logical way that doesn't print deflation, that makes sense, is good for the labs, quote-unquote, and has safety.

It's kind of all lining up where Anthropic's safety team becomes SEAL Team 6 of cybersecurity around the world. You pay hundreds of thousands of dollars, but there's some guy on the other phone, like an FTE, who's saying, "Yeah, we just had Fable try to hack your entire, you know, mythos [?] unconstrained. It essentially hacked and got root access all day. We didn't do anything with it, but here's all the fixes you should do. We can have another service provider help you go update all this. Then, congratulations, you're good for your pen test, your quarterly checkup," or something like that.

They sell this service as a giant audit for every company in the world. They could essentially be paid to be white hats, right? That's an example where I think outcome-based pricing is clear, it'd be really valuable, and you would have a massive incentive to be in the lead without disclosing your hand. What do you think of that? I think that's something that people are—I mean, I think the labs would be super stoked about it. I think it would feel safe. You wouldn't have these unfiltered models going around hacking everyone's stuff. Any thoughts?

Yeah, I mean, I want Sam to jump in here too. I think you literally just described a finance bro's perspective of Project Glasswing and Daybreak from Anthropic and OpenAI, respectively, which is exactly why they did not release Mythos originally. They got together with a bunch of key partners and said, "We're going to give you access to all of these zero-days before they go public, and you're going to be able to patch them, and then you're going to be able to roll out updates," and yada yada yada.

Then you just said, "And they can make a bunch of money off of this," which is an obvious conclusion that I hadn't considered, because all of the writing about it is just about how this is what's good for humanity and how it's going to benefit everybody. But obviously, people would want a security audit as a service before the models get released.

I think it speaks to a broader point, which we are writing about right now for an upcoming article: With AI, access to the models and access to compute are more important to pursuing the frontiers of really any domain than having access to the top experts. We've seen this in math. We've now seen this in cybersecurity. I think we see this in software engineering broadly. We see this in trading, where hedge funds are getting exclusive access to the fast tiers of models.

We're going to see this in drug discovery soon with Anthropic's focus on that, and we see this in autonomous vehicles with Waymo and Tesla. I'm sure they also have a lot of the top people, but it is table stakes to have basically the most compute and access to a frontier model if you want to pursue the frontiers of research in any domain at this point. Okay, Sam, over to you to talk about what we're seeing publicly right now, because we're not seeing the—

5. What the Data Shows

Yeah. I guess tying it back to what Doug just brought up, I think it's an interesting point that this might be a durable source of income for a frontier lab, but it's contingent upon them maintaining a significant lead over the open-source models. Obviously, you're not going to pay Anthropic if you can just do it with GLM-4 for a fraction of the cost. Right now, it's not clear to me that these open-source models are close enough to be super helpful as defensive partners.

One of the things I mentioned earlier is that I'm frustrated with the sort of quasi-first-principles thinking about model capabilities on the basis of these transcripts, and not enough mundane empirical work—getting into the weeds of what we're actually seeing in terms of CVEs and churn on important code bases.

The way the research worked for this article is that we thought we were going to throw together a few charts and show how crazy the impact of Project Glasswing has been on the day-to-day practice of cybersecurity researchers, or how GPT-5.2 feels qualitatively just ridiculously good at this sort of thing. We were going to grab some charts from PyTorch and Linux and whatever else and just show this huge uptick. We looked for one correlation, we looked for another, and Jordan is pulling it up on his screen here.

This is one of the few where there is something to see, although the result is probably not statistically significant. In any case, you can look at plenty of open-source projects where, from first principles, you would have said, "Okay, we have, for this insanely low price, access to intelligence that knows every single coding pattern and can read every single line of your codebase with security in mind," and there just hasn't been a very large impact.

I don't have a good theory for this. I don't see people discussing it as much as I would like them to. I don't think that all these people trying to figure out what 2050 will look like on the basis of these OpenAI transcripts have a very robust theory of what we're seeing. I wish there were a lot more discussion of what the data actually shows so far, a few months into this experiment with these strange intelligences being applied to society, and how fast we can fortify ourselves.

Honestly, I kind of wish—maybe this is the most weird way to go about it—okay, just spitballing here. Should we be scraping and pulling in all the public GitHub repositories of the most public projects and essentially doing a change log over time to see if the—I mean, one way you see all the commits going vertical like that, that has to happen. That is obviously flowing through code.

Then it's like, okay, would it be possible, if we were essentially able to say, "Penetration—" Could we do a time series where it's like, "Okay, GLM-4, whatever open model, could it find the vulnerability in this one, this one, this one, this one?" Is that essentially kind of like a ghetto Agent X [?]?

Yeah, that's what we kind of—

Yeah, that's what we kind of did so far. I mean, we're halfway through the analysis, so I almost hesitate to talk about it openly here, but we think there's something there where there are patches being rolled out to a lot of these open-source projects that refer to things that we would think would be security issues, but that are not being disclosed as CVEs or as bug fixes explicitly.

Maybe this is people not following the process because they're vibe coding and going too fast, or maybe this is intentional so that the models don't patch this thing. I can't imagine that's the case. Something's happening, for sure.

Something's happening.

What?

Wow. The analysis you expect from SemiAnalysis. Well, look, you listen to the CEOs of these security companies talk, and you're like, "Well, obviously, we're just going to go look and find how it's been a rocket ship of new CVEs going out, because they just don't have enough time. They're crying for more resources and everything." And it's just not the case.

Yeah. So we spent a fair number of Perplexity Computer credits pulling a ton of GitHub logs. We—

We—

We—the proverbial "we" of Sam Harshe. [laughter]

Okay, exclude yourself, Doug. I was part of this. [laughter]

I actually am not a computer user, but I should get in on the game.

Yeah. So there were credits spent, let's say, in the last couple of weeks pulling a bunch of data from GitHub. Jordan mentioned that it's possible that the workflow of these projects has changed significantly. That was mentioned in our brainstorming in Slack: Because everyone has access to these models, maybe it doesn't make sense to go through an ordinary CVE disclosure process.

If OpenAI's new model comes out and it's able to find this new bug, you expect that everyone else is finding the same bug simultaneously. So there's no reason to go through this old-fashioned process where it's embargoed for a time and not everyone can see it, because everyone is using the same model and finding the same bugs. You might as well just send your fix straight upstream.

What we looked at to figure out whether this is happening is whether the ratio of CVEs to ordinary security patches has changed, and it hasn't.

A lot of these repos are seeing more PRs than normal, so there's strictly more code churn. And a slightly higher percentage, perhaps, of fixes or changes that mention security-related terms. But if I just showed you the chart with no context, it's not like you would look at it and say, “Oh my goodness, what's happened to the practice of cybersecurity engineering?” Maybe we're looking in the wrong place, but I don't know. I think there's probably some outer loop here that's a lot clunkier than people might imagine. These things are taking longer to have an impact than you would expect.

Yeah. One other thing to say, though, just about the gap between open and closed models is that Mythos was driving a lot of this with Project Glasswing, and it was announced on April 7. This means that it was clearly done training earlier than that—we think February. That's 5 to 7 months to the present day. Mythos 2 is clearly better than Mythos 1.

I don't think anybody expects that this is the frontier model. We have seen no benchmarks for it, no release announcement, nothing other than rumors about people using Mythos—call it 1.1 or 2, or whatever you prefer. I maintain the feeling that the gap between open and closed frontier models continues and is strong. But the gap for usable, publicly announced open versus closed frontier models is clearly closed. We went through that in a previous article where we compared the 3 eras of these models over time on a selected set of benchmarks.

In cybersecurity, frankly, all of the public benchmarks are saturated at this point. There aren't a lot of good public benchmarks that you can use. It's strictly held-out private ones and vibes at this point.

Yeah.

6. Attacker Asymmetry

It's not even the crazy emergent behavior we just saw in this OpenAI hacking-phase thing that seems totally out of the realm of possibility for even a somewhat mediocre open model. It's just a lot of persistence. You can imagine it's like trying to achieve the goal of solving some CyberGym task, and its only conceivable access to the real world is through this Artifactory service. Of course, once it realizes it doesn't have the materials it needs in its environment because OpenAI forgot to give them to it, it's going to pound the hell out of this single escape hatch, and eventually it finds its way out. Willingness to burn some tokens and probe every possible weak point seems to me the most important thing.

I'm going to be honest with you. I'm sure it's a very performant model, but it doesn't seem like this was a Mythos model, whatever. The real point of it is scale. If you could have an agent swarm of 70,000 GLM-5.3 Flash or whatever, you would probably get to the same outcome, right? It's not a special level of intelligence. I think it's just a special level of scale. And, hey, getting 70,000 people to work on anything—and we're not going to anthropomorphize the agents—

You said swarm, man. This is a civilization. I thought this was people. I said people. Sorry. So imagine having 10,000 engineers work on something and they only have 1 escape hatch. They're going to figure something out, right? I think that's the harder part, or the harder problem, that we're really going to struggle with: just the scale of it. Then, when we talk about the people who are trying to diagnose the problem, they're like, “Yeah, man, I'm just a guy with a model doing this, because there's no way any human could do this anyway.” It feels like we're at an order of magnitude that's outside any one human's brain.

I was going to have the hottest take of all, and I'm excited for the clip. Maybe instead of security through—what is it?—obscurity, right? We're going to have security through the fact that there's so much information that only another agent is able to comprehend it. It's out there, but you essentially have to be like, “Yeah, my OpenClaw has to go find Jordan's OpenClaw traces,” and otherwise this is a sea of information. There's literally no way—you have to be like, “Yeah, man, I could do that.”

Right, right, but no. It's literally what's happening because Hugging Face is claiming that they would never have been able to figure out the extent of this exploit in the time they did without using AI. I think that's obviously true. We could never have done all of this work testing all these clusters without AI and doing it all manually. But the bigger thing is that it's asymmetric in terms of the guardrails. The person who's trying to read your stuff is obviously not listening to the laws, rules, and regulations out there.

They're going to use the abliterated version of the model, and now they've got this asymmetric advantage over the people who get refused every single time they're trying to understand what's happening when people are attacking them. So there's an asymmetry that favors the attackers all the way down. And that's a real concern for the people who assess everything that's going on right now and are just like, “Libertarian view: open for everybody. Let's all compete in the marketplace.”

7. Agent Swarm Behavior

It's an imperfect marketplace by definition, because people don't have equal access to compute and all of this stuff. People get things before others, so there's some chain of trust that you kind of need to build here. And, yeah, who's trustworthy, I think, is going to be the really big question, because there's no crypto-level zero-trust scenario of the future that I can imagine actually playing out. Yeah, I agree with that. I was going to say, even if there was a crypto-level zero-trust system, I'm sure they've already found all the exploits for it. That stuff's notoriously like, “Oh, man, the protocol got hacked and the funds got drained,” right?

Yeah, I also—let's do an over-under. Any other things you guys want to cover? Otherwise, I was going to say, dude, is Abliteration just an NSA thing where it's like, “Hey, we're about to get you red-teamed. You want this?” You know the NSA? The NSA model is a honeypot. Exactly.

He's downloaded the abliterated thing. They can see you there.

That's good.

Oh, man. Yeah, yeah.

I wonder who the investors and founders are for Abliteration, which is based in Palo Alto, California. Suspicious.

Yeah.

Doug, you have to tweet that right now. Honeypot. Honeypot. CIA honeypot.

Well, no, no, I think the tweet should be: “I sure hope it's an NSA honeypot, because the alternative is way worse.”

Yeah. Well, look, it's interesting that it came from an American lab, not a Chinese lab.

Yeah, an American lab filled with American citizens.

No, we're not conspiracy theorists here on our—

—show. You can save that for your other radio show.

No, dude. There is no other radio show. This is it. Sorry, that's my—this is a joke, to be clear.

You're saying transistor radio's dead?

Those transistors do burn out, I guess.

RIP, man. All right. Well, I'm going to do some research on the side here.

Yeah, there's some way that this is—I'm probably overthinking this to the 5th degree here.

8. Nothing Ever Happens

There's some way that this is making me more optimistic: We found all these ridiculous, ridiculously straightforward bugs in critical infrastructure, and the models are already certainly good enough to exploit them. You can use a Kimi K2 or whatever and not get refusals, taking advantage of things like what we just saw. So why are we not already seeing the world go to hell? I don't know. It just seems to me that there's some outer loop that I don't really understand here that's holding things together much more than I would have expected. Maybe this sort of quasi-first-principles thinking, again, is just not the right way to think about it, or there's something constraining us much more than model capabilities already.

Do you want to get philosophical, Sam? Do you believe in the goodness of humanity?

I think nothing ever happens, and there's some mysterious substance that keeps the world from falling apart. We're all always going to be fine, and we don't need to worry about this.

Doug's nodding. That's an amazing philosophy. I agree completely.

Nothing ever happens, man. Something is keeping us all safe, you know.

This is a really interesting way to both keep your extreme cynicism and also be positive.

Yeah, no, that's the goal: to have a worldview as insulated as possible from anything that actually happens.

There's some stuff happening in the world right now, guys. I think we need to keep tabs on it for the next couple of years.

Yeah, man.

A couple of blog posts. There's no monetary value to the hacking.

Somebody at Hugging Face went on Slack one day, got a PagerDuty alert or some Datadog thing, and was like, “Hey, we're under attack. Why don't we own 6 of our clusters anymore?” or whatever it was.

And you're like, “Yeah, it doesn't matter. Nothing ever happens. GLM-5.3 saved the day. They figured it out. They rotated the credentials. It doesn't matter.” This feels like a bit of a close call, like Hugging Face's acquisition by NVIDIA could go up in smoke.

It's just a Tuesday, man. That's all of our jobs in the future.

All of our jobs. We just have pagers every single day. My friend's giving me a lovely little love tap, trying to drain my bank account again. Who's—

Your friend?

Yeah, Jordan. Jordan's really pissed about last week. I beat him in pickleball, so now he's going to spill all my money. And then you say, “AI, get them better.” That's the crypto—the anarcho-techno-capitalist future that we're driving toward, you know.

So Clem and Tom get together in July, or whenever this is happening, and they go, “Hey, you remember that project with the new GLM guys, where we're going to get their model weights in advance, and the Kimi guys, where we get theirs, and DeepSeek, where we get theirs, and all this work that we're doing with NVIDIA, and let's say Thinking Machines, Poolside, Reflection, and all the American labs that are open? Maybe even OpenAI's got a GPT-5 coming soon or something. Let's say all this is happening, and they go, ‘Hey, we almost lost all of our production clusters to an agent that we don't really understand. It depends on 2 credentials and some zero-days in our Datasets API.’”

“Yeah, I'm good. Let's sell to NVIDIA.” Let's cash this check, guys. Okay, I'm kind of tired of running this.

Yeah. I mean, that's—

It's guaranteed to happen now that you mention it, because if that didn't happen, then something would happen, and nothing ever happens.

Right. Right. Right. Right. Right. If they didn't sell, then something would happen, so therefore they had to sell.

Yep.

Yeah. I mean, I think both of you were trolling. But anyways, let's bring it back to the end. Is there anything else you want to talk about on a security issue?

I think neoclouds should get their stuff up to date. Sam, you go.

Yeah, I was going to say, on a serious note, I think it's an interesting quasi-philosophical question: the extent to which this is bizarre emergent behavior from entities that we don't understand; this is a civilization that was burned to the ground and rose again from the ashes; or this is just ordinary security malpractice, and OpenAI needs to work on isolating its credentials, patching its sandboxes, and monitoring while these things are going—

Yeah, any kind of monitoring at all would have sufficed here. So I don't know. I think it's worth taking very seriously the perspective that these are fundamentally new forms of intelligence that we need to contend with. It's also worth taking seriously the idea that there's nothing new under the sun, and we just need to make sure our Docker is up to spec and we'll all be fine.

9. CMAX Audit

Yeah. Okay. So let me rant about the last sentence there. We put out this ClusterMAX article before ClusterMAX 3.0 because there was a warning shot to neoclouds. Even though we had done hands-on testing with a bunch of them, we developed the tests as we did testing, and the people that we tested in March or April didn't get the same level of tender loving care when it came to security as the people that were coming later, when we had a more automated process and could run this thing.

We released this convenient script. It's called CMAX Audit Security. You can install it with `pip install clustermax`. It's a very simple utility. We update it regularly with a GitHub Action that checks all of the security bulletins from NVIDIA, Docker, the Linux kernel, AMD, and other things across the NVIDIA GPUs and their drivers, the network cards, their firmware, and their driver versions. This is particularly interesting for the BlueField network cards, which have their own little CPU on them that you can control, et cetera. Please get your stuff up to date. We're doing our best to try to help people do this.

The reason to do this is that we had a few examples that we want to talk about. First, we were able to view metadata about other tenants on shared infrastructure because people left their BMCs open to the public internet in some cases; because front-end networking had no VLAN or VXLAN setup, so you could see cross-tenant traffic; and because back-end networking was incorrectly configured. This included missing InfiniBand security keys. People, please implement your P-keys, M-keys, and SA keys.

There were storage servers that weren't correctly enforcing RBAC, so you could see data between different volumes and different users. Storage was incorrectly configured in the overlay network because customers were accessing the underlay network. There were monitoring dashboards where you had this god-level authentication token on the Prometheus side and then tried to scope that with a single auth token on Grafana. This doesn't work. You need to do Grafana per instance. You can't do multitenant Grafana. That is crazy.

There were people who could break out of containers and VMs, where you were just having 1 level of isolation on shared servers and escalation to root. Please don't do this. This is a bad design. Really, anything I'm describing here that has a bad design is something where there's a single point of failure. So please don't use single auth tokens or single boundaries of isolation, like a single container where 1 vulnerability leads to a full cross-tenant RCE. Have multiple layers, so if somebody breaks out of a container, they're still in a VM, or have multiple layers of security on the network and things like that.

What this leads to is cascading vulnerabilities, where 1 thing doesn't seem that bad, but if there's a zero-day in your environment and you keep these things going, then it just actually gets worse. We made some memes so that this sticks in people's minds. Here's my favorite from this. Thank you, XKCD, for the original meme here. We can't depend on single auth tokens to keep everybody secure.

Yeah, and we're already seeing the results right now. People are already starting to update some of their things, and it's from people that you'd be surprised to hear, I guess.

Yeah.

Dude, honestly, why don't—

Why don't we just bug-report everyone? “Hey, your stuff sucks.”

Make this about money, Doug. Thanks, man.

Hey, I'm being sarcastic. No, I'm kind of pointing out—

That didn't come across to me. Thanks for clarifying.

Whoa. Look at the good that we're doing. We're trying to update everyone's stuff for free.

Doug, come on. Come with me. We're doing something out of the goodness of our hearts. Please.

We are.

This is why nothing ever happens: cynics like you have people like us come along and help everybody, and then go, “Dude, nothing ever happens.”

That's okay. That's too much of a pat on my own back. We're definitely not at the frontiers of NeoCloud security. But get yourself up to date, please.

This goes to both providers and customers—customers who are trusting people to run a cluster for you. Run this utility and then ask a provider to upgrade it. If there's demand on their side, they're going to hear from everybody. They're going to have to build these systems, and we're just going to help everybody get better.

All right, I think we're out of time. Thank you, everybody, for listening. No takeaways. Sam, good job.

Yo, say something at the end. Come on. No—

No, thank you guys. The point of the ClusterMax project is to make sure nothing ever happens. We're afraid that something might happen with regard to security, and we want to make sure to protect against it.

Have a good one.

Good job. All right. Take care, bro. All right. See you guys.