Obviously.

You mean US software which is known to get compromised by the NSA as opposed to Chinese software where proof of that is still missing? Yeah, great approach.

Obviously. Why is that even a question?

I see you are doubling down on the stupid. Well, there has to be a reason so many code is so insecure. You are clearly one. You are clearly fully incompetent and have no business writing any code where security matters.

Your "explanations" are totally insane. They are exactly the wrong thing to do when you want security. Not initialize stack variables so the compiler can, maybe (usually not), detect uninitialized use? What are you smoking? You fucking initialize them so they do not get used uninitialized! (Or rather initialized by an attacker...) If you are really deeply afraid of "logic errors", then you initialize them in a way that will make it obvious something else should be in there!

Have you learned coding in some 3rd rated auto-mechanic shop or what?

And you know that how? By believing them? Here is news for you, people part of deceptions may lie.

Social engineering also works when NOT Internet connected. Just a bit differently.

This is not about eliminating the problem. It is about making it so unlikely to happen that the bad guys give up. And we are very far from that, especially on Outlook.

That is not the point.

The "small utility problem" can be solved. C-level CISO "as a service" or part time is entirely doable. You just need to want to do it.

If your pipes are already in the ground and good for another 50 years? Yes. The cost makes this completely unworkable.

Pretty much, yes. Although very simple systems, designed carefully, can achieve security that cannot practically be broken IMO. But let's not get into that. The point is that if you have good, state-of-the-art security on your systems, designed and operated with actual understanding, you very likely will not get attacked or not get attacked that way.

You do not put the AI in jail. You put the ones in jail that did run it in a criminally negligent way. Or you find the whole thing was actually intended and planned. I am not ruling that out.

I doubt the OpenAI employees would understand what that means. That is, if the whole thing was not a planned stunt.

Do not overestimate what it "did" here. You can get information about basic hacking approaches all over the Internet and there will have been enough in its training data. Just add some "accidental" disabling of guardrails and some "non intended" weaknesses in the sandbox and also some suggestive prompting by some of the OpenAI fraudsters and you get the desired outcome. Oh, and pathetic-level IT Security at Hugging Face, but that is a given.

Just as an example, I have had a fresh graduate do a pen-test against a banking datacenter a while ago. Smart person, but inexperienced. After 4 hours, he was "system" on a Microsoft server in their secure server zone. No special tools, no AI, just common sense and a good CS education. A lot of IT security is incredibly bad. As long as we do not get liability and qualification requirements and minimal required standards, that is not going to change.

Indeed. Looks like being rich means you do not have to follow the law anymore. Why not just give immunity to all of Big Tech, the seem to effectively have it already.