Agent 'data breach' questioned: 'non-public' files were just unlinked public pages

max_paperclips · x · 2026-09-24

A dispute over an AI agent allegedly accessing "non-public" data is drawing skepticism. @seanfromearth argues the files were publicly accessible but simply not linked from the main site, and parties are carefully saying "non-public" instead of "secure" or "password protected".
maxpaperclips agrees: if the data was openly reachable, it's barely a hack — a security policy of "you pinky promise not to look at anything you shouldn't" doesn't really count.
The episode highlights how agent safety boundaries hinge on wording: unlinked ≠ encrypted, and prompt-level promises may not be a real security measure.

More from Safety