Comment by dkoy
15 hours ago
> We aim to issue an alert within 30 minutes after concerning activity is surfaced through our monitoring system. If the monitoring system identifies a likely violation of a critical security boundary, it generates a highest-priority alert. In our current implementation, the safety, security, and research teams are paged. If they cannot conclusively determine within 30 minutes that the flag is a false positive, those teams are expected to pause the activity.
Can't a lot happen within ~60 minutes?
> Can't a lot happen within ~60 minutes?
60 minutes is a long time for a human attacker to do damage. With an LLM attacker it is an eternity.
The HuggingFace breach took place over two-and-a-half days [1], so 60 minutes is certainly better than nothing.
[1]: https://huggingface.co/blog/agent-intrusion-technical-timeli...
> Can't a lot happen within ~60 minutes?
Spawn a ton of unpausable processes, I'd say.