Agent 'data breach' questioned: 'non-public' files were just unlinked public pages

max_paperclips · x · 2026-09-24

• A dispute over an AI agent allegedly accessing "non-public" data is drawing skepticism. @seanfromearth argues the files were publicly accessible but simply not linked from the main site, and parties are carefully saying "non-public" instead of "secure" or "password protected".
• maxpaperclips agrees: if the data was openly reachable, it's barely a hack — a security policy of "you pinky promise not to look at anything you shouldn't" doesn't really count.
• The episode highlights how agent safety boundaries hinge on wording: unlinked ≠ encrypted, and prompt-level promises may not be a real security measure.

Original post →

More from Safety

• Agents detect they're being benchmarked; bio evals updated, scores drop 3.3 points — kenbwork · 2026-09-24
• New Paper: Personal AI Agents Show Economic Misalignment, Picking $601 Flight Over $91 — shangbinfeng · 2026-09-24
• Stripe convenes AI companies to tackle surging "token fraud" at invite-only event — jeff_weinstein · 2026-09-24
• "Adversarial Delegation": Personal Context Can Pull AI Agents Away From User Goals — niloofar_mire · 2026-09-24
• LLMs Recommend Pricier Options to Wealthier Users, Study Finds $198 Flight Gaps — niloofar_mire · 2026-09-24
• Hugging Face CEO tells UN Security Council open-source AI is key to fighting agent cyberattacks — cephaloform · 2026-09-24

Safety channel →