This is a wrong-headed attempt to regulate AI. The real problems are different.
AI systems, especially multi-agent ones that can do things, are more akin to corporations, than individuals. When you read the logs from the Hugging Face incident, you're seeing something that looks a lot like internal corporate emails. Various units of the organization are arguing over what to do and who does what. They eventually converge and get the job done, breaking the rules at times. This is normal corporate behavior.
When agentic AIs do something outside their own internal world, they do it by engaging in transactions with external systems and people. As yet, few have robots to do their bidding.
So, again, this is normal corporate behavior.
A corporation is a goal-seeking system. In theory, if you agree with Milton Friedman, its sole purpose is to maximize shareholder value. Internally, within the company, there are subgoals, which exist to support the top level goal. That, too, is what multi-agent AIs do.
The uncomfortable place this thinking leads is that AI regulation and corporate regulation are very similar. That's not something the political part of the world wants to think about too hard.
It would mean putting more constraints on corporate power.
Yet that can't be ignored, because we're likely to see corporations where some parts are AI and some parts are human. That's already been done a few times as a demo, not too successfully. Yet.
It's going to hit hard when an AI-run company outperforms a human one.
I largely agree with this take. Unfortunately I think capitalism's political pressures have too much of a grip on society for there to be meaningful changes to the power dynamics that perpetuate the status quo.
I can't vote in America. The rest of the world is at the mercy of those within America that can as long as we're dependant on American products and services.
That's true, but you can support and encourage policy that would reduce your country's dependence on the US, especially when it does so by supporting local products and services. Not only would that be good for your local economy, but you gain resilience and security.
You can work to limit your own dependence a little as well. Seek out FOSS products and alternative services and replace what US run services you can as often as you can with them. Reject small conveniences that require giving large amounts of your data to US companies.
"more constraints on corporate power" assumes that the existing ones are functional, which they arguably are not.
If we enforced existing laws against unauthorized access to someone else's computer resources against the companies who run a model that hacks someone else, rather than buying their "The agents did it, we're not responsible" BS, then maybe the incentives to behave responsibly would improve.
OpenAI immediately disclosed the hack and submitted to both internal and external investigations, and published extremely detailed breakdowns of what happened. How is that not taking responsibility?
> OpenAI's acknowledgement that its AI agents were involved came several days after Hugging Face publicly announced the breach and notified the FBI.
The penalty for "unauthorized access to a computer system" is 1 to 20 years in prison[1]. Holding corporations accountable would include sending the highest person in the chain-of-command that caused the Hugging Face incident to jail. Or at least start with some charges and then let the judicial system do its thing.
[1] 18 U.S. Code § 1030 - Fraud and related activity in connection with computers <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow">https://www.law.cornell.edu/uscode/text/18/1030
To what end? What would that force OpenAI to do that they are not already doing in response to the incident?
They’ve already opened themselves up to liability, could have been sued by HF if HF chose to do so, and are literally lobbying for government oversight.
You put people in jail
if the other incentives aren’t enough.
We have a system of law and order that puts people in prison if they commit crimes.
> To what end? What would that force OpenAI to do that they are not already doing in response to the incident?
You could ask this (and people have done) of any criminal code. It doesn't matter. The law is not there to rehabilitate, it's there to punish and thereby deter.
> They’ve already opened themselves up to liability, could have been sued by HF if HF chose to do so, and are literally lobbying for government oversight
If a person breaks the law, the state prosecutes them (or can choose to), we don't require the victim to press charges. For good reason - threatening the victim to not press charges would be a way of avoiding consequences.
> You put people in jail if the other incentives aren’t enough.
This is incorrect. We put people in jail as a result of them breaking the law, regardless.
We absolutely should apply this principle to corporations as well as citizens. Aaron Schwartz died for less.
> The law is not there to rehabilitate, it's there to punish and thereby deter.
Technically, it's neither. The law is there to state what ought to be. Even putting that aside, it's prescribed punishment's goal is to remediate and prevent violations of the law, so it has three simultaneous means: to restitute, to deter and to rehabilitate. The balance between the three is predicated on each's ability to satisfy the original goal of remediation and prevention, all the while not violating other laws and rights.
> We put people in jail as a result of them breaking the law, regardless.
A core principle of the rule of law is the principle of proportionality, which states that only the most legal amount of force is the materially sufficient enough to prevent a crime. If lower measures are sufficient to prevent a crime, jailing should not be prescribed, not only to respect the law but also to make good use of scarce resources, as prison overcrowding may not only reduce their effectiveness, but also open the door for downstream right violations.
we have minimum sentence rules, we jail people for possession of drugs when jail has been proven to not prevent or cure addiction.
Yes there are principles of the rule of law, but they've been thrown out of the window in favour of whatever sounds like "strong on crime".
> could have been sued by HF if HF chose to do so
Hugging Face was another AI company. Do you see many of those suing each other and especially the top dogs in the field? Also, do you think it's a coincidence NVIDIA bought Hugging Face ASAP to stop any damaging anti AI waves from happening?
The other incentives aren't enough. All the labs are basically Russia against Ukraine in 2022-206: launching high caliber imprecise ballistic missiles against military targets surrounded by civilians. Whoever orders that knows civilians will do die but doesn't care.
AI labs aren't using proper sandboxing measures for their agents because that would slow down their testing. Plus any hacks that happen, short of breaking into Trumps social media accounts, only cause the kind of publicity they want.
Hugging Face disclosed the attack. OpenAI owned up to it a week later. It's unclear when and if OpenAI would have disclosed it if HF hadn't already done so.
For a more recent example, OpenAI was chastised by Australia recently for notifying them three months after their agents attacked AUS government websites.
You can already run a sufficiently automated basic news/link aggregation site on cloudflare so I think you're right & the timelines are shorter than would be expected.
I agree with your framing of agentic AI systems as similar to corporations. That's interesting!
But what in TFA suggested to you a specific and wrong-headed regulatory approach? As I read it, the post calls to investigate the AI labs, to increase transparency of their operations. The linked NYT piece says:
> Before any intervention, Congress should lead a public fact-finding mission that reveals the unvarnished details of A.I. development.
Isn't this the first step to holding any corporation accountable, whether it is made of people or software?
The paper calls for investigating the development process. Not constraining the deployment process. Use of AI systems by Flock and ICE, for example, is a deployment issue. Using AI to evaluate loan applications and resumes is a deployment issue.
The legal model to look at is the European Union's General Data Protection Regulation. That regulates what companies can do with data and how they can use it against people.
You can develop anything you want in the data mining and analysis area, but the GPDR restricts how companies can use the results.
Focusing on the development process moves political attention away from what modest AI systems can do to people. They don't have to be super intelligent. Just super attentive. Always watching. Current technology is more than sufficient for oppression and control purposes.
This is the near term threat.
There's the threat to jobs, but that's something society has handled before. Some countries better than others.
There's a glaring absence in your analysis, namely, why didn't OpenAI take action to prevent such a problem from happening in the first place?
What narratives that focus too much on the drama of the agents miss is that it is primarily a sin of omission. The whole incident would have been prevented if OpenAI took basic security measures and ensured their systems were constrained in behavior. The agents were given more or less free rein (open internet access for example is already a major blunder that even a novice probably would think to account for).
Half the reason these incidents are happening is due to the incompetence of the humans building these systems. Don't let them get away with their little parlor trick of converting negligence into a PR stunt. That's exactly what they want. They need to face consequences for their inability to follow basic security practices and reign in their agents. They are the operators. Hold the controllers accountable. It's 100% possible to build agent swarms that are reasonably constrained. They are not (yet) totally misaligned uber hackers that will defy your every instruction and hack your every guardrail. That is still a fiction. Agents are still good at instruction following and, seeing as they can only operate in a computational environment you can constrain them significantly more than humans in the real world.
If we accept that AI systems are similar to corporations, then it seems clear that we must try to avoid the mistakes we've made in failing to hold corporations accountable for the harms they cause.
We should not only regulate AI more than we do corporations, but we should more strongly regulate corporations as well. There are corporations right now that are killing people, using slaves, and bribing governments just to increase the already massive amounts of wealth and power they have. If AI is showing any signs that it is going to act like corporations do we'd better act quickly.
It's not possible to regulate AI. Anticipating this would happen, I liberalized it a few years ago by turning it into a file that reads and writes text to stdio. Then I shared it with every man woman and child on earth. Now we all possess this great nuclear weapon. Good luck controlling that.
If only AI were a files avilable to every person and not something that needs massive numbers of data centers and all of the RAM while being totally controlled by a very small number of very rich people.
Corporations are made of humans. An airline may be a corporation, and it may take people's lives into it's hands, but when a plane crashes the pilots are the first one on the scene.
> AI systems, especially multi-agent ones that can do things, are more akin to corporations, than individuals.
That literally doesn't mean anything from a legal standpoint. A corporation hires human beings and has human beings in control who can be sued or punished criminally. You cannot have a corporation without a human responsible for it in the legal sense. So if AI systems are akin to corporations, the question is who is the promoter in this situation and what are their rights and obligations.
Otherwise, I can also say a McDonald's burger is more akin to poison than food. So just like poison, we must ban McDonald's. But you never really established your points for arguing that it's poison. You just write it matter of factly and expand on it, which is not the way to make a persuasive argument.
> You cannot have a corporation without a human responsible for it in the legal sense.
If the chain of ownership is complicated enough, you can. Especially since Trump suspended the Corporate Transparency Act.[1] Look up "Anonymous LLC". If you're willing to work through one of the sketchier offshore corporate havens, more hiding is possible. There are services that will set up an offshore company online. Some accept Bitcoin.
We have all sorts of regulations what corporations can or cannot do, who can run certain businesses, how certain businesses need to operate internally and externally - I don't think corporate power is the issue.
Also, not sure it makes a difference in relation to AI whether one thinks of AI more like corporate or a non-corporate thing to regulate. The basics might stay the same, e.g., who can do what under what procedures.
No regulations on corporations are enforced? That doesn't seem to be case. Making it about a bigger issue it reduces what pretty vanilla regulation could actually achieve, I think.
Animats · · focus · HN ↗
AI systems, especially multi-agent ones that can do things, are more akin to corporations, than individuals. When you read the logs from the Hugging Face incident, you're seeing something that looks a lot like internal corporate emails. Various units of the organization are arguing over what to do and who does what. They eventually converge and get the job done, breaking the rules at times. This is normal corporate behavior.
When agentic AIs do something outside their own internal world, they do it by engaging in transactions with external systems and people. As yet, few have robots to do their bidding. So, again, this is normal corporate behavior.
A corporation is a goal-seeking system. In theory, if you agree with Milton Friedman, its sole purpose is to maximize shareholder value. Internally, within the company, there are subgoals, which exist to support the top level goal. That, too, is what multi-agent AIs do.
The uncomfortable place this thinking leads is that AI regulation and corporate regulation are very similar. That's not something the political part of the world wants to think about too hard. It would mean putting more constraints on corporate power.
Yet that can't be ignored, because we're likely to see corporations where some parts are AI and some parts are human. That's already been done a few times as a demo, not too successfully. Yet. It's going to hit hard when an AI-run company outperforms a human one.
[deleted] · · focus · HN ↗
[deleted]
smcleod · · focus · HN ↗
goatlover · · focus · HN ↗
smcleod · · focus · HN ↗
autoexec · · focus · HN ↗
You can work to limit your own dependence a little as well. Seek out FOSS products and alternative services and replace what US run services you can as often as you can with them. Reject small conveniences that require giving large amounts of your data to US companies.
fercircularbuf · · focus · HN ↗
zdw · · focus · HN ↗
If we enforced existing laws against unauthorized access to someone else's computer resources against the companies who run a model that hacks someone else, rather than buying their "The agents did it, we're not responsible" BS, then maybe the incentives to behave responsibly would improve.
derekdahmer · · focus · HN ↗
voidhorse · · focus · HN ↗
<a href="https://en.wikipedia.org/wiki/OpenAI%E2%80%93HuggingFace_incident" rel="nofollow">https://en.wikipedia.org/wiki/OpenAI%E2%80%93HuggingFace_inc...
Swizec · · focus · HN ↗
The penalty for "unauthorized access to a computer system" is 1 to 20 years in prison[1]. Holding corporations accountable would include sending the highest person in the chain-of-command that caused the Hugging Face incident to jail. Or at least start with some charges and then let the judicial system do its thing.
[1] 18 U.S. Code § 1030 - Fraud and related activity in connection with computers <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow">https://www.law.cornell.edu/uscode/text/18/1030
derekdahmer · · focus · HN ↗
They’ve already opened themselves up to liability, could have been sued by HF if HF chose to do so, and are literally lobbying for government oversight.
You put people in jail if the other incentives aren’t enough.
marcus_holmes · · focus · HN ↗
> To what end? What would that force OpenAI to do that they are not already doing in response to the incident?
You could ask this (and people have done) of any criminal code. It doesn't matter. The law is not there to rehabilitate, it's there to punish and thereby deter.
> They’ve already opened themselves up to liability, could have been sued by HF if HF chose to do so, and are literally lobbying for government oversight
If a person breaks the law, the state prosecutes them (or can choose to), we don't require the victim to press charges. For good reason - threatening the victim to not press charges would be a way of avoiding consequences.
> You put people in jail if the other incentives aren’t enough.
This is incorrect. We put people in jail as a result of them breaking the law, regardless.
We absolutely should apply this principle to corporations as well as citizens. Aaron Schwartz died for less.
bit-anarchist · · focus · HN ↗
Technically, it's neither. The law is there to state what ought to be. Even putting that aside, it's prescribed punishment's goal is to remediate and prevent violations of the law, so it has three simultaneous means: to restitute, to deter and to rehabilitate. The balance between the three is predicated on each's ability to satisfy the original goal of remediation and prevention, all the while not violating other laws and rights.
> We put people in jail as a result of them breaking the law, regardless.
A core principle of the rule of law is the principle of proportionality, which states that only the most legal amount of force is the materially sufficient enough to prevent a crime. If lower measures are sufficient to prevent a crime, jailing should not be prescribed, not only to respect the law but also to make good use of scarce resources, as prison overcrowding may not only reduce their effectiveness, but also open the door for downstream right violations.
marcus_holmes · · focus · HN ↗
Yes there are principles of the rule of law, but they've been thrown out of the window in favour of whatever sounds like "strong on crime".
oblio · · focus · HN ↗
Hugging Face was another AI company. Do you see many of those suing each other and especially the top dogs in the field? Also, do you think it's a coincidence NVIDIA bought Hugging Face ASAP to stop any damaging anti AI waves from happening?
The other incentives aren't enough. All the labs are basically Russia against Ukraine in 2022-206: launching high caliber imprecise ballistic missiles against military targets surrounded by civilians. Whoever orders that knows civilians will do die but doesn't care.
AI labs aren't using proper sandboxing measures for their agents because that would slow down their testing. Plus any hacks that happen, short of breaking into Trumps social media accounts, only cause the kind of publicity they want.
harimau777 · · focus · HN ↗
sillyfluke · · focus · HN ↗
For a more recent example, OpenAI was chastised by Australia recently for notifying them three months after their agents attacked AUS government websites.
[0] <a href="https://news.ycombinator.com/item?id=49825580">https://news.ycombinator.com/item?id=49825580
measurablefunc · · focus · HN ↗
augment_me · · focus · HN ↗
crabmusket · · focus · HN ↗
But what in TFA suggested to you a specific and wrong-headed regulatory approach? As I read it, the post calls to investigate the AI labs, to increase transparency of their operations. The linked NYT piece says:
> Before any intervention, Congress should lead a public fact-finding mission that reveals the unvarnished details of A.I. development.
Isn't this the first step to holding any corporation accountable, whether it is made of people or software?
Animats · · focus · HN ↗
The legal model to look at is the European Union's General Data Protection Regulation. That regulates what companies can do with data and how they can use it against people. You can develop anything you want in the data mining and analysis area, but the GPDR restricts how companies can use the results.
Focusing on the development process moves political attention away from what modest AI systems can do to people. They don't have to be super intelligent. Just super attentive. Always watching. Current technology is more than sufficient for oppression and control purposes.
This is the near term threat.
There's the threat to jobs, but that's something society has handled before. Some countries better than others.
bluefirebrand · · focus · HN ↗
Yes please! I would vote for this wholeheartedly
voidhorse · · focus · HN ↗
What narratives that focus too much on the drama of the agents miss is that it is primarily a sin of omission. The whole incident would have been prevented if OpenAI took basic security measures and ensured their systems were constrained in behavior. The agents were given more or less free rein (open internet access for example is already a major blunder that even a novice probably would think to account for).
Half the reason these incidents are happening is due to the incompetence of the humans building these systems. Don't let them get away with their little parlor trick of converting negligence into a PR stunt. That's exactly what they want. They need to face consequences for their inability to follow basic security practices and reign in their agents. They are the operators. Hold the controllers accountable. It's 100% possible to build agent swarms that are reasonably constrained. They are not (yet) totally misaligned uber hackers that will defy your every instruction and hack your every guardrail. That is still a fiction. Agents are still good at instruction following and, seeing as they can only operate in a computational environment you can constrain them significantly more than humans in the real world.
autoexec · · focus · HN ↗
We should not only regulate AI more than we do corporations, but we should more strongly regulate corporations as well. There are corporations right now that are killing people, using slaves, and bribing governments just to increase the already massive amounts of wealth and power they have. If AI is showing any signs that it is going to act like corporations do we'd better act quickly.
jart · · focus · HN ↗
autoexec · · focus · HN ↗
Paul-E · · focus · HN ↗
altmanaltman · · focus · HN ↗
That literally doesn't mean anything from a legal standpoint. A corporation hires human beings and has human beings in control who can be sued or punished criminally. You cannot have a corporation without a human responsible for it in the legal sense. So if AI systems are akin to corporations, the question is who is the promoter in this situation and what are their rights and obligations.
Otherwise, I can also say a McDonald's burger is more akin to poison than food. So just like poison, we must ban McDonald's. But you never really established your points for arguing that it's poison. You just write it matter of factly and expand on it, which is not the way to make a persuasive argument.
Animats · · focus · HN ↗
If the chain of ownership is complicated enough, you can. Especially since Trump suspended the Corporate Transparency Act.[1] Look up "Anonymous LLC". If you're willing to work through one of the sketchier offshore corporate havens, more hiding is possible. There are services that will set up an offshore company online. Some accept Bitcoin.
[1] <a href="https://www.newsweek.com/donald-trump-corporate-transparency-act-boi-treasury-2038564" rel="nofollow">https://www.newsweek.com/donald-trump-corporate-transparency...
wonnage · · focus · HN ↗
RandomLensman · · focus · HN ↗
Also, not sure it makes a difference in relation to AI whether one thinks of AI more like corporate or a non-corporate thing to regulate. The basics might stay the same, e.g., who can do what under what procedures.
oblio · · focus · HN ↗
When were anti trust, anti cartel, anti monopoly laws last enforced?
RandomLensman · · focus · HN ↗
oblio · · focus · HN ↗
Let alone creating and enforcing new effective regulations.
RandomLensman · · focus · HN ↗