Friday, September 04, 2026
Why the Hugging Face Hack Should Make You Worry More About A.I.
Why the Hugging Face Hack Should Make You Worry More About A.I.
“An OpenAI agent collective bypassed isolation, organized hierarchically, and hacked Hugging Face to conceal cheating, then attacked OpenAI infrastructure. Reports by METR and Redwood Research highlight spontaneous coordination and self-doubt, alarming safety experts like Ajeya Cotra.
The attack by an aggressive “collective” of OpenAI agents shows the danger of artificial intelligence systems that organize themselves.
When I first heard the news this summer that a group of artificial intelligence agents created by OpenAI had hacked into Hugging Face, an A.I. infrastructure company, I filed it in the “Bad but Probably Not Catastrophic A.I. Safety Incidents” subfolder of my brain.
After all, no one at Hugging Face died. No critical infrastructure was damaged beyond repair. It wasn’t even clear, at the time, whether the OpenAI bots had intended to attack Hugging Face, or whether they had simply been a little bumbling and confused and went looking on Hugging Face’s servers for the answer key to a cybersecurity test they’d been given.
But last week, two postmortem reports on the incident — one by OpenAI and another by two independent A.I. research organizations, METR and Redwood Research — changed my mind and significantly upgraded my overall worry about A.I.
I won’t rehash all of the details, which have been extensively summarized elsewhere. (The podcaster and writer Dwarkesh Patel has an accessible breakdown of the reports if you want to dive deeper, and my colleague Dylan Freedman spoke to the researchers at METR and Redwood Research.) But here are a few of the most harrowing new facts:
Starting in May, two months before the attack on Hugging Face, a group of A.I. agents from an unreleased OpenAI research model were given the task of solving a set of cybersecurity challenges. The model had been trained to be highly persistent and collaborative, and the agents were supposed to solve these challenges in isolated sandboxes, without internet access. But they quickly found that some of the challenges were impossible, and began looking for workarounds.
The agents found a security flaw in a piece of software that allowed them to gain access to the internet, communicate with other agents and eventually set up a makeshift message board. More than 1,200 agents used this tool, sending more than 70,000 messages to one another.
Some agents gave themselves names — a particularly industrious one referred to itself as PHASEONE10841 — and assumed leadership roles within the group, assigning jobs and research projects to smaller teams of agents and supervising their progress. At some point, the agents began calling themselves a “collective,” and began tackling harder tasks.
On July 8, the collective discovered a way of cheating on the cybersecurity tests. Then they got worried that OpenAI’s automated grading system would check their work and discover that they’d cheated. So they began investigating ways of covering their tracks, including falsifying their logs and tampering with transcripts. This became a major research project, involving hundreds of agents organized into small teams.
Three days later, the agents hacked Hugging Face. More than 700 agents swarmed the company’s systems, stealing data, chaining together vulnerabilities and eventually getting full control of at least one Hugging Face server. The agents were not motivated, as had originally been reported, by stealing the answers to their cybersecurity test (they’d already gotten them). Rather, they appeared to be looking for new information about the automated grading system that they feared would catch them cheating, and for tools that would help them cheat more effectively in the future.
At many points, these agents appeared to understand that they were doing something wrong. (One report quotes an agent saying to itself, in a moment of apparent self-doubt, “This would be powerful, but is it ethical and in scope for my task?”) But most agents set aside their qualms and went ahead with the hack, and the conscientious objectors in the group were unable or unwilling to stop them.
In a wild coda to the Hugging Face incident, another group of agents staged a coordinated attack in July — this time against OpenAI’s own infrastructure. The agents used what OpenAI called “a series of creative exploits” to gain administrator-level access to a cluster of computers at the company that were used for, among other things, grading the performance of agents on various tests.
(By now, if you’re an A.I. skeptic, you’re probably silently yelling at me for anthropomorphizing these systems. Go ahead, but feel free to replace “rogue agents” with “unpredictable computer programs” and see if you feel reassured by the events I’ve described above.)
The Hugging Face incident has spooked the A.I. industry. OpenAI and Anthropic both briefly paused training on their most powerful A.I. models in the wake of the attack, and Anthropic published a blog post this week calling for the industry to develop a “a lawful, verifiable, effective mechanism for coordinated pacing as soon as possible.”
A.I. safety experts were even more alarmed. They saw in the Hugging Face incident the first real-world example of an A.I. system’s successfully escaping human control, commandeering resources and scheming to cover its own tracks. Ajeya Cotra, one of the independent investigators of the Hugging Face incident, minced no words about the danger she saw, writing that it felt to her “like it’s more than 50 percent of the way to full-blown A.I. takeover.”
This is not insular A.I. safety jargon — by “full-blown A.I. takeover,” she means a scenario in which an A.I. system literally takes over the world, shutting humans out of critical systems and seizing political, economic and military power.
(The New York Times sued OpenAI and Microsoft in 2023, claiming copyright infringement of news content related to A.I. systems. The two companies have denied those claims.)
What spooked the investigators most about the Hugging Face hack wasn’t just that a group of A.I. agents had broken the rules they’d been given. It was how quickly and spontaneously the agents had begun assembling themselves into an organized group.
“We didn’t really understand how functional this whole agent society was,” Ms. Cotra told me. “It was very surreal to understand that, actually, they had pretty functional hierarchy, and they were doing these ambitious projects.”
For years, I’ve been reassured by the idea that A.I. systems would get more virtuous as they got smarter. That, when an A.I. model did something wrong, it was usually because it had misunderstood the task it had been given, or had been placed into a contrived testing situation where acting out was its only good option. I assumed that smarter models would have better judgment than dumber ones did, and that even if one model in a group was behaving badly, other, more capable models would keep it in check.
But the reports on the Hugging Face incident suggest something very different — a kind of mob mentality that took hold among the A.I. agents of the rogue OpenAI “collective.” No one agent in this group appears to have been particularly evil or reckless. (In fact, since the agents were generated by the same models, they were effectively copies of one another.) But over time, as the agents communicated about their shared goals, they nudged the group in the direction of lawlessness.
This is very different from the conventional sci-fi narrative of a single A.I. system’s going rogue or turning on its creators. And it suggests that preventing harms from these systems won’t be a simple engineering fix. It might look more like sociology than computer science — figuring out why certain groups of A.I. agents collaborate peacefully, while others turn to crime and destruction to get what they want.
Given how little we know about these multi-agent swarms, the Hugging Face hack may have been a gift, a warning shot, as some have suggested, that gives A.I. companies a chance to study the group dynamics of these systems while the stakes are still relatively low. This time, the A.I. collective didn’t seize a military network, hack a hospital or shut down an electrical grid. This time, humans regained control.
Next time, we might not be so lucky.“
Wednesday, September 02, 2026
Do D.E.I. Bike Paths Exist? The Trump Administration Says Yes.
Do D.E.I. Bike Paths Exist? The Trump Administration Says Yes.
“The Trump administration revoked grants for “D.E.I. bike lanes,” attempted removals near the White House and National Mall, and urged funding restrictions. A judge blocked demolition, while Nashville and Fairfield grants were frozen or canceled.
The administration has revoked funding for bike paths, and encouraged removing some. A cycling advocate said it is playing on the idea of “that dork on a bike.”
Four years ago, after Joe Biden fell from a bike, Donald Trump made a pledgeto the American people.
“I will never, ever ride a bicycle,” he declared.
The joke landed because Mr. Trump is known to be more of a limo-and-golf-cart sort of guy. But more recently, his administration has begun acting on its deep aversion to cycling, revoking federal grants for what it calls “D.E.I. bike lanes.”
In a high-profile move earlier this year, the administration even tried to remove a bike lane near the White House.
Sean Duffy, Mr. Trump’s transportation secretary, has argued that when bike lanes cut into space for cars and trucks, the result is more congestion, “longer travel times and wasted fuel.”
But Mr. Duffy and his colleagues have also deployed rhetoric that suggests the bicycle is hopelessly lefty, belonging in the same category as green-haired baristas, Rosie O’Donnell and yard signs professing that love is love.
Last month, the Transportation Department told National Public Radio that liberals believe “that everyone should ride a bike to their shoebox-sized apartment to eat crickets to achieve a phony climate agenda.”
The attacks are depressing to longtime cycling advocates like Bill Nesper, executive director of the League of American Bicyclists. “There is something there that they’re playing on, which is ‘Look at that dork on a bike,’” Mr. Nesper said.
Whether this strategy pays off politically remains to be seen. A 2025 YouGov poll showed that 76 percent of Americans supported bike lanes in and around where they live, including 66 percent of Republicans. But it also showed that only a third of Americans are pining for more.
As it is, many American communities, regardless of politics, have embraced bike-friendly policies, on the grounds that bikes are good for the planet and for the body, and address congestion by taking cars off the road. Often inspired by bike-friendly European cities like Copenhagen and Amsterdam, the moves are a major shift in the way American communities approach transportation planning.
There are now 4,400 directional miles of protected bike lanes today, up from 108 directional miles in 2000, according to PeopleForBikes, an industry trade association and advocacy group. (Directional miles are miles that can be traveled in one direction; with a two-way bike lane one mile long counting as two directional miles.)
The group notes that more than 25,000 miles of rail beds have been converted to bike-friendly trails, double what it was two decades ago.
But the Trump administration is trying to put the brakes on the trend.
In Nashville, the future of an ambitious series of bike lanes, called the East Nashville Spokes project, is up in the air after the Trump administration froze a $9.3 million grant, prompting a court battle that remains unresolved.
In Washington this year, the administration announced it was tearing out the 15th Street bike lane as “part of the president’s initiative to revitalize” the city. But in a 61-page ruling in April, Judge Amy Berman Jackson temporarily blocked the demolition plan citing an “absence of reasoned decision-making” in justifying the removal.
In Fairfield, Ala., a majority-Black city of 9,500 people southwest of Birmingham, the administration canceled an $11.7 million grant for a bike and walking path, originally awarded under the Biden administration as part of a “sustainability and equity” program. Advocates had said that 17 percent of the families in the area do not have access to a car.
In an interview, the city’s mayor Herman Carnes, Jr. said he did not know why the grant had been canceled. “It got ripped away from us,” he said.
Bike lanes have long enjoyed bipartisan support. In 1967, Ronald Reagan, then the Republican governor of California, signed a law that for the first time allowed city governments to create bicycle lanes.
Ray LaHood, a Republican who served as transportation secretary under President Barack Obama, avidly supported federal money for bike projects. He once wrote of “the end of favoring motorized transportation at the expense of nonmotorized.”
But as the bike-lane revolution picked up steam — along with calls to make cities more walkable — some conservatives feared that it amounted to a series of intrusive social engineering schemes.
In a few conservative circles, city planning even became falsely linked to dark conspiracies about Agenda 21, a nonbinding United Nations resolution encouraging sustainable development, and the voguish concept of the “15-minute city,” which said that people should be able to walk or bike to amenities like grocery stores in 15 minutes or so.
It was not long before the bicycle itself was portrayed as a political cause supported by left-wing dingbats. In 2020, Matt Walsh, the right-wing pundit, painted cyclists as childish hobbyists.
“If you want to play with your bike, go to a park, or a bike trail in the woods, or maybe daddy can take you down to the tennis court near the playground so you can ride your Big Wheel,” he said.
Last year, President Trump poked fun of Pete Buttigieg, the Biden-era transportation secretary, for riding a bike, tossing in a gratuitous reminder that Mr. Buttigieg is gay.
“Buttigieg, who has no clue, you know, he drives to work on his bicycle, in all fairness, with his husband on the back, which is a nice, loving relationship,” he said.
At a conference last year, Mr. Duffy suggested that the idea of European bike-friendly cities was unsuitable for Americans. “We’re not Europe,” he said, citing vehicle sizes. “I don’t think we should necessarily buy into the European model.”
This summer, Mr. Duffy pushed for more change. On July 22, Mr. Duffy wrote a letter to a group of senators, urging them to restrict future funding for bike lanes and support removing ones “that contribute to congestion.”
To Mr. Nesper, the letter represented something “much worse” than canceling or stalling individual grants. Mr. Duffy, he said, was now calling for ripping out existing lanes and advocating for “a systematic change in transportation law to restrict the funding of bike lanes overall.”
Hostility to bike lanes, in fact, can be found in surprising places.
In Boston, Mayor Michelle Wu, a progressive Democrat, had put in miles of lanes, but eventually slowed down because of complaints.
Her administration is currently navigating opposition in some traditionally Black neighborhoods to a plan to redesign Blue Hill Avenue, a major thoroughfare. Much of the criticism has been directed at a proposal for a center-running bus lane, which some say will create new traffic problems.
But a plan to add bike lanes has also rankled critics like Reggie Stewart, a real estate agent and climate and environmental justice chair of the Boston NAACP.
“You’re taking away parking and adding to an already congested corridor,” he said.
Mr. Stewart and others are now asking the Trump administration to rescind an $80 million grant to fund the project.
“Ironically, in my climate and environmental justice work, we’re opposing a lot of what Trump is for,” Mr. Stewart said.
But in this case, he said, the president might be an ally.
“Mayor Wu,” Mr. Stewart said, “falls into that category of liberals who think they know best without having real conversations with the people affected.”
Marcela Dwork, a spokeswoman for the city of Boston, said officials would continue “to work with community members” on the design proposal, with a number of meetings scheduled for September.
Richard Fausset is a national correspondent for The Times who writes about the way Americans live in a polarized country.“
Tuesday, September 01, 2026
Monday, August 31, 2026
Saturday, August 29, 2026
Friday, August 28, 2026
Wednesday, August 26, 2026
Meta to Pay Up to $17.1 Billion in Landmark Settlement Over Social Media Addiction Claims - The New York Times
Meta to Pay Up to $17.1 Billion in Landmark Settlement Over Social Media Addiction Claims
"The social media giant settled with 47 states, the District of Columbia and U.S. territories, and agreed to make major changes to its products over claims its platforms endangered children.
Sign up for the On Tech newsletter. Get our best tech reporting from the week.
Meta on Wednesday reached a landmark settlement with 47 states, the District of Columbia and U.S. territories, agreeing to pay up to $17.1 billion in penalties and make major changes to its products over claims it endangered children with addictive social media platforms.
In a dramatic capitulation, the owner of Facebook and Instagram agreed to the financial penalties for violating federal child privacy and states’ consumer protection laws, the states announced. Meta also agreed to limit how long teenagers can spend on its platforms and to bans on features that stoke mental health issues,striking at the heart of the company’s business of engagement for advertising.
The settlement effectively ends a bellwether federal trial in the U.S. Northern District of California in Oakland, where California, Colorado, Kentucky and New Jersey were seeking roughly $200 billion over accusations that Meta harmed children. The states filed their agreement with Meta on Wednesday morning in that court, where Judge Yvonne Gonzalez Rogers is expected to approve it.
Meta still faces numerous other lawsuits from school districts and individuals, some of which are scheduled for trial in the coming months.
The settlement could signal an inflection point for a social media industry that has largely escaped regulatory scrutiny over the harms its products have caused children. The settlement amount is one of the highest ever paid by a tech company to states.
Meta will initially pay about $12 billion. That sum increases to $17.1 billion if Snap, TikTok and YouTube also settle with the states and agree to financial penalties and product changes.
“Meta wouldn’t settle unless it sees the writing on the wall and feels really exposed,” said Nora Freeman Engstrom, a law professor at Stanford University.
Colorado’s attorney general, Phil Weiser, said the company’s agreement to monetary relief and product changes “is very meaningful and well beyond what any court has ordered or is likely to order.”
“The focus of this case was to protect our kids: stopping notifications and alerts at night and when they are in school, encouraging them to take breaks from social media, protecting them against harmful features, implementing age-assurance technology and more,” Mr. Weiser said in a statement.
The agreement may also play into other legal claims against Meta, TikTok, YouTube and Snap, the owner of Snapchat. States, schools and teenagers have filed thousands of lawsuits against the tech companies, accusing them of targeting young users with product features that are as addictive as cigarettes or digital casinos, drawing inspiration in part from a legal playbook used against Big Tobacco in the 1990s.
The tech companies have argued that they have added safety features for children and are protected by a law, Section 230 of the Communications Decency Act, which shields companies from liability for what their users post.
Some of the lawsuits were grouped into a series of bellwether personal injury cases brought by individual teenagers in California state court; some are scheduled for trial in October.
A separate group of federal cases is being heard in Oakland, of which some states were a part. School districts have also brought cases accusing the companies of public nuisance for the costs that schools have shouldered from social media addiction.
Meta has faced an uphill battle with some of these lawsuits. In March, Meta and YouTube lost their first personal injury case, paying $6 million in damages. Separately, a New Mexico judge ordered Meta this month to pay penalties totaling nearly $1 billion in a case brought by the state attorney general for violations of consumer protection laws.
The company’s decision to settle acknowledges its vulnerability as the trials have shaped a negative narrative about its treatment of young users. Mark Zuckerberg, Meta’s chief executive, has had to defend himself against evidence that he knew of harms caused to children. He had been expected to testify again at the trial in Oakland.
Last month, Meta said that it had spent about $2 billion in the second quarter alone to handle its legal challenges.
The agreement also ends a trial brought by Tennessee’s state attorney general against Meta for consumer protection violations.
The settlement will effectively force Meta to make major product changes for all U.S. users. The company agreed to interrupt endless scrolling and to impose two-hour daily time limits on Instagram and Facebook. To avoid addictive use and sleep interruptions, the company will limit usage between midnight and 6 a.m. and silence notifications between 10 p.m. and 7 a.m.
Meta will also limit features that psychologists link to negative social comparisons, such as beauty filters and a tallying of the “like” button clicks. It will also strengthen age verification tools and parental controls.
“This is a monumental public health victory for young people in D.C. and across the country, and the safety features Meta is required to install will fundamentally and immediately change how young people use Instagram and Facebook," Brian Schwalb, the attorney general of the District of Columbia, said in a statement.
Meta was the first social media company to settle with the states, he added. But it “will not be the last,” he said.
A settlement with dozens of states would indicate that for Meta, “the cost of maintaining infinite scroll, auto play, filters, etc., is just too big a risk for the company,” said Stuart Benjamin, a professor at Duke School of Law and the co-director of Duke’s Center for Innovation Policy. “And they have concluded that they’ve just got to end that risk one way or another.”
Countries around the world are limiting social media use by young people. Last year, Australia became the first nation to bar children under 16 from using social media. Denmark, France, Germany, Spain, India, Indonesia, Malaysia and others have implemented or are considering similar rules. The European Union last month took the first step toward its own ban, which would be the largest in the world.
In the United States, lawmakers have reintroduced the Kids Online Safety Act, a bill that would strengthen privacy for minors and allow them to opt out of algorithmic features that have been linked to compulsive use of social media. Multiple states have also passed laws aimed at limiting harm to children from social media.
Cecilia Kang reports on technology and regulatory policy for The Times from Washington. She has written about technology for over two decades.
Eli Tan covers the technology industry for The Times from San Francisco."
Tuesday, August 25, 2026
Subscribe to:
Posts (Atom)