Comment by fleshers
7 hours ago
I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?
7 hours ago
I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?
It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.
We don't yet know what the hacked api keys were used for. We would need grand transparency, like an open dataset with the original queries, so that the public can validate through a collaborative effort. I'm not keen to accept their early conclusions, eventual RCA summary stats, or METR reports.
"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.
they do have Anthropic and OpenAi as vendors, who are at the center of this hack as well, and who have been beating the "distillation attack" drum on a regular basis
OpenCode, and the lot, will need to release an open, public, dataset containing the original queries (and other relevant details) that the hacked keys were used for. I'm unwilling to trust those industry players at their word. We need to do our own community analyses.
Obviously they don't want to share details because it's ongoing
If OpenCode is not releasing all of the details about the exposure at the moment, it likely would be a good idea to rotation keys for the connected services at this point
Yes
[dead]