1004
Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked (www.404media.co)
submitted 5 months ago by to c/technology@lemmy.world
122 comments fedilink hide all child comments
😂 6
you are viewing a single comment's thread
view the rest of the comments
[–] 249 points 5 months ago (32 children)

Why would the LLM tool have access to send recovery emails to non account verified emails at all?

That’s insane.

  • permalink
  • fedilink
  • source
  • hideshow 32 child comments
    •
  • [–] 73 points 5 months ago (4 children)

    should’ve asked it to delete the database instead, why else would it have that level of permissions.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 10 points 5 months ago

    Heh. Watched an old episode of Scorpion yesterday. The one with the armed hostage-takers who just had the one demand to the social media data mining company, to delete all the data they've mined. I amused myself a lot, by uttering "I like these guys".

  • permalink
  • fedilink
  • source
  • parent
  • [+] 40 points 5 months ago (3 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 27 points 5 months ago (1 child)

    I guarantee they do have a red team that most likely flagged this as an obvious and severe risk. It was ignored by suits experiencing AI psychosis.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    I don’t know, more and more of those teams these days are being headed up by the same folks. Most on the ground, in the weeds know what not to do but the ivory tower keeps building more and more floors without ever updating the foundation.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 12 points 5 months ago (12 children)

    This isn't even a hack, it's just poorly written endpoints.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 12 points 5 months ago (11 children)

    Would you consider phreaking equivalent to hacking? This is AI phreaking.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 11 child comments
    •
  • [–] 3 points 5 months ago (6 children)

    TIL about phreaking

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 5 months ago (5 children)

    Then this is also probably new to you

    The Anarchist Cookbook

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 5 months ago (4 children)

    I need to set aside some time to read that although I'm not an anarchist myself.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 7 points 5 months ago* (2 children)

    It was largely overblown due to it getting banned. It was also published in the height of the Vietnam War, when the big evil communists were coming to brainwash your children into eating each other. It has a lot of blatantly incorrect info, which could be outright “blow up in your face” dangerous to anyone attempting the things in it. It’s not all wrong, but certain recipes have incorrect info that could easily lead to accidents.

    Also fair warning, the UK will give people hard prison time simply for owning it. So maybe keep that shit onion-encrypted if you’re in the UK.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (2 children)

    It's not phreaking. Social engineering.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago

    So, I'm currently developing a chatbot for my company. If an LLM needs to do something, a developer must build a tool. It just so happens that this tool that was built did not take traditional security into account. Really it should only be using the tools already built for users, but it seems the Jr. Devs that have been replacing seniors do not have the sensibilities yet.

  • permalink
  • fedilink
  • source
  • parent
  • [+] 5 points 5 months ago (4 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 5 months ago* (last edited 5 months ago)

    I hope you saved what you could from that exchange, as well the attempts to contact them. If they ever notice, their AI mistake will become your problem to deal with, (and the kind of news story to end up on a Steve Lehto video).

    If that happened to me, I'd have a chat with my bank, "please help me return this money to where it came from, it was payed in error. They have no way to contact a human and I don't want them to accuse me of fraud down the line".

  • permalink
  • fedilink
  • source
  • parent