these AI companies, I think what's really hard to figure out when we're doing
coverage for this, and when I say we, I mean, just as a society is what is hype
and what is reality.
And I think these AI companies, even when negative things happened,
they're still incentivized to paint them in a positive way.
So, you know, that's kind of the hidden dark side here.
When open AI says, oops, we hacked someone.
It's like, wait, like we hacked someone.
Like that's how good our models are, right?
Like that's pretty cool.
So it makes it really hard to actually analyze the coverage.
And in this case specifically, both companies were actually
incentivized by the same thing when you think about it from a PR
perspective, open AI is incentivized to say, wow, like our
model is just so good.
Look at what it did.
And it was just so out of control.
It was so good that it wasn't even our fault.
And then you have also hugging face who actually made a lot
of very simple mistakes that could have prevented this attack,
which also a human could have exploited now that we know more
of the details and hugging face is also incentivized to say,
oh, yeah, dude, this is like some novel crazy thing.
Couldn't have been prevented.
They tried to spin the entire incident as a success story at
hugging face because the security team treated open
AI as report with the urgency it deserved as a genuine zero
day unknown to the world and moved accordingly.
Left out of the post is that five days passed until open
AI revealed its role on the breach hugging face disclosed and
that at least another five days passed from the time open AI
reported the zero days and JFrog released patches for them.