Graybeard
Well-Known Member
AI Conspiracies are human made. AI doesn't want to take over the world --humans want to hack you for some gain. In other words, the problem is human based:
from a register article [yes, they still exist
] (sort of way-back).
www.theregister.com
>>>``In-depth Several big businesses have published source code that incorporates a software package previously hallucinated by generative AI.
Not only that but someone, having spotted this reoccurring hallucination, had turned that made-up dependency into a real one, which was subsequently downloaded and installed thousands of times by developers as a result of the AI's bad advice, we've learned. If the package was laced with actual malware, rather than being a benign test, the results could have been disastrous.
According to Bar Lanyado, security researcher at Lasso Security, one of the businesses fooled by AI into incorporating the package is Alibaba, which at the time of writing still includes a pip command to download the Python package huggingface-cli in its GraphTranslator installation instructions.
There is a legit huggingface-cli, installed using pip install -U "huggingface_hub[cli]"``<<<
Alibaba was asked to comment --they did not reply. So, if you are confused about the security issues in the TikTok legislation --this just adds fuel to the fire ... incompetence or intentional tests?
AI response:
"To mitigate the problem of AI "hallucinating" non-existent software packages—a situation where AI generates and suggests software dependencies that don't actually exist but are then made real by others and potentially downloaded by developers—the following strategies can be employed:
[see AI mind map below]
Implementing these measures can significantly reduce the risk of incorporating non-existent or malicious software packages into projects based on AI recommendations, safeguarding both the integrity of the projects and the security of the systems they run on."
from a register article [yes, they still exist
] (sort of way-back).
AI bots hallucinate software packages and devs download them
Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do that
www.theregister.com
Not only that but someone, having spotted this reoccurring hallucination, had turned that made-up dependency into a real one, which was subsequently downloaded and installed thousands of times by developers as a result of the AI's bad advice, we've learned. If the package was laced with actual malware, rather than being a benign test, the results could have been disastrous.
According to Bar Lanyado, security researcher at Lasso Security, one of the businesses fooled by AI into incorporating the package is Alibaba, which at the time of writing still includes a pip command to download the Python package huggingface-cli in its GraphTranslator installation instructions.
There is a legit huggingface-cli, installed using pip install -U "huggingface_hub[cli]"``<<<
Alibaba was asked to comment --they did not reply. So, if you are confused about the security issues in the TikTok legislation --this just adds fuel to the fire ... incompetence or intentional tests?
AI response:
"To mitigate the problem of AI "hallucinating" non-existent software packages—a situation where AI generates and suggests software dependencies that don't actually exist but are then made real by others and potentially downloaded by developers—the following strategies can be employed:
[see AI mind map below]
Implementing these measures can significantly reduce the risk of incorporating non-existent or malicious software packages into projects based on AI recommendations, safeguarding both the integrity of the projects and the security of the systems they run on."
Last edited:
