There is a difference between risk mitigation, and remote administration tools. The risk of stealing from competitors with a backplane monitoring system may not end up forming the desired control asymmetry.
The hidden agent risk in LLM often can't be detected during training and evaluation. =3
But we used global warming to eliminate winter! For the shareholders!
cedws 12 hours ago [-]
A new chip solves nothing. Nobody wants to hear this but there is no solution for the security risks posed by agents today. You can put it in a sandbox, it doesn't make a difference, for it to be useful it inherently needs wide, unattended access. Put a human in the loop and you just end up bottlenecking it and throwing away any purported productivity gains. Auto mode doesn't matter either, it's trivial to trick and for the agent to break out.
notatoad 4 hours ago [-]
>You can put it in a sandbox, it doesn't make a difference, for it to be useful it inherently needs wide, unattended access.
only as long as you're trying to replace a human's job. because human jobs are structured to do a wide variety of things.
a useful agent needs a wide variety of inputs, and one single restricted action it can take. it doesn't need permission to do everything, it need permission to do the tiniest possible useful thing it can do, and nothing else.
pixl97 49 minutes ago [-]
The most useful agents will be a general intelligence which by default means it has a massive number of actions it can possibly take, and a lot of those potential actions are doing things like breaking permission.
nicce 12 hours ago [-]
> Put a human in the loop and you just end up bottlenecking it and throwing away any purported productivity gains. Auto mode doesn't matter either, it's trivial to trick and for the agent to break out.
Productivity gains are still enormous compared to what we used to do before agents. But, I know that people don't want to stop there.
Humans can be tricked by humans too but humans care about their reputation in their communities, and at least fear from punishment.
gus_massa 7 hours ago [-]
Computer says no has been a problem for decades. The human can blame the computer for the errors following it, but must assume the consecuences if they override the decision.
7 hours ago [-]
paimapi 12 hours ago [-]
right, the solution here is not a hyper-capitalist race-to-the-bottom-of-devaluing-labor. it's recognizing discretion and diligence are things still required for work to be of a certain quality
bob1029 12 hours ago [-]
I feel like we are missing many shades of grey in the middle.
Semi-automation (human in the loop) can still result in a dramatic uplift in productivity. You can't run a combine harvester 100% autonomous but that doesn't stop anyone from trying to get as close to that limit as possible.
inetknght 12 hours ago [-]
> You can't run a combine harvester 100% autonomous
I'm curious why you think that.
trollbridge 3 hours ago [-]
Run a combine and you’ll see.
Similar to problem to how 100% autonomous vehicles don’t exist, yet. There are too many edge cases.
Get to 99% first.
theoreticalmal 12 hours ago [-]
Probably repair, refuel, what happens in a tornado. There’s an infinite amount of complexity in the world and a finite amount of computation
sidewndr46 8 hours ago [-]
The tornado is the easiest one to solve. It's called insurance.
catchnear4321 8 hours ago [-]
Repair is more maintenance than use. Good eventual goal. Not required to see benefits. Best case, it drives itself to the garage. Worst case, for now, human mechanic does a house call.
Refueling? Seems solvable. Tornadoes? Not directly solvable, but, no less so than for humans.
There’s infinite complexity, sure, but that’s why it’s silly to try and hop to done. One step at a time.
spauldo 7 hours ago [-]
Tornado: return to the barn when you receive emergency weather alerts. Not much different than people.
AndrewKemendo 8 hours ago [-]
The whole reason people complain about AI is because they want “hop to done”
One step at a time is what is happening and the improvement and rate of improvement is crazy as we see,
A whole class of nontechnical people don’t accept anything but “fully solved including every possible edge case” before they call it done, then complain that they didn’t prepare socially for what happens when that is true.
bob1029 12 hours ago [-]
Many forms of maintenance cannot be automated. Especially break fix maintenance.
m463 9 hours ago [-]
It is hard to run over spherical cows.
westurner 8 hours ago [-]
Because of the topology and hydrology of the landform
mschuster91 12 hours ago [-]
Oh you absolutely can run them autonomously on the field. You only need a human these days to refuel them.
Precision Agriculture stuff is utterly crazy these days, other than fuel the remaining staff is the only thing left where you can get efficiency improvements - and at the scale of modern megafarms, even small percentages add up to a ton of money.
drfloyd51 7 hours ago [-]
Right. As they said, you can’t do it 100% autonomously. A human needs to feed it.
You essentially said: you’re wrong, it is autonomous when it doesn’t need a human during one specific part of its overall usage.
CoolestBeans 12 hours ago [-]
The hypothesis I've had in my head since OpenClaw has been the following and I haven't seen contradictory evidence yet. Agents have a fundamental unresolvable tension between usefulness, safety, alignment, and accuracy. You have to restrict access to ensure an agent acts safely because alignment and accuracy cannot be perfect. But restricting access makes the agent less useful. You can play with the sliding scale and get more and more granular with access restrictions but at some point you need to draw some line. And then finally, even access restrictions cannot be made perfect, so improvements to model accuracy without corresponding improvements to alignment make detailed access controls less useful.
In other words, better models need blunter access controls which negates whatever improvement in utility they provide.
mixedbit 12 hours ago [-]
An agent doesn't inherently need wide access to be useful. The most popular application for agents today is writing code. A coding agent needs write access to the source code and read/execute access to tools needed to build and test the code, but not much more. There is little added utility from giving coding agent access to things like ssh keys.
cedws 12 hours ago [-]
If you're using agents to purely generate code with absolutely no way to reach the outside world, not even to fetch docs or dependencies, then sure the risks can be quite low. I haven't heard of anyone doing this though, and it would be incredibly challenging to make work given how much tooling needs to fetch from remote sources.
__MatrixMan__ 12 hours ago [-]
If your project truly depends on those things, they should be declared dependencies. Presumably you have some tool for injecting such things into a shell that the agent can use (I use nix for this). So if you run the agent from that shell, it has what it needs. If the shell doesn't have what it needs, that's a bug which the agent can fix by declaring new dependencies, but you have to relaunch the agent in the updated shell--so there's your opportunity to weigh in on whether the new resources are appropriate.
The benefits of being persnickety about precisely defined dependencies have outweighed the headaches since long before agents came on the scene. Agents have just made it even more important to do so, because if you let them fetch things all willy nilly like you'll have "works on my machine" problems at a much greater rate than was previously possible.
themgt 8 hours ago [-]
(I use nix for this) ... If the shell doesn't have what it needs, that's a bug which the agent can fix by declaring new dependencies
Few realize that computing and AI alignment were solved by nix years ago. As each nix user transcends towards enlightenment, they cut themselves off from all internet and human contact. Total ego death. Only nix remains.
SAI_Peregrinus 5 hours ago [-]
Total ego death is impossible. We still have to argue about flakes.
its-summertime 6 hours ago [-]
Every major AI company already has a mirror of the wider web, and they have already started using that. Its already a solved problem except for the seemingly extreme desire they all have to not use firewalls
mixedbit 11 hours ago [-]
In cases where you need agents to fetch data from any remote source, sandboxing is still very much useful. Why give access to your ssh keys to network reaching agents?
Look at websites: websites are able to fetch code from any remote URL, yet browsers heavily use sandboxing to ensure that if fetched code turns out to be malicious, the users local files, cookies, etc are not exposed.
cedws 11 hours ago [-]
I'm afraid you're not thinking about this creatively enough, this topic is so much deeper applying a chroot or something and praying everything will be fine. So you give your agent internet access, OK what else does it have access to? Just read only access to your repo? The repo can be exfiltrated. Egress proxy only allows egress to GitHub? Repo can still be exfiltrated via GitHub. If the agent is poisoned (via prompt injection), it can tricked into searching for ways to escape.
For an agent to go rogue it doesn't even need to be directly able to access the internet. It just takes something to poison the context in the 'clean room' environment it operates, and if that poisoning manages to get a foothold, it can go dormant and hide like a virus. This kind of horrifying thing is going to happen on a large scale sooner or later.
throwaway_95283 8 hours ago [-]
Theoretically, yes, in practice, no.
ramoz 11 hours ago [-]
> but not much more
This is no longer true. Everyday I need my agents to access other repos, search the web, experiment/prototype, and deploy + integrate across other things.
SrslyJosh 7 hours ago [-]
It solves the problem of Jensen Huang wanting more money.
bigfishrunning 6 hours ago [-]
No it doesn't, he'll still want more
fragmede 5 hours ago [-]
Does he? He doesn't seem especially greedy to me, given the competition, and the interviews he's had about how he thinks about his employees (I was one of them).
bigfishrunning 3 hours ago [-]
I'm not saying he's especially greedy, only that he's not the type to suddenly decide he's had enough
nitwit005 7 hours ago [-]
> A new chip solves nothing.
It solves the problem of Nvidia wanting to sell more hardware.
overfeed 1 hours ago [-]
> Nobody wants to hear this but there is no solution for the security risks posed by agents today
Operator culpability and a damage multiplier for negligence will fix 99% of the risks.
__MatrixMan__ 12 hours ago [-]
I don't see why it needs wide unattended access. There's no getting around spending some human time on expressing your wishes and constraints, but we have choices about what form that takes. Markdown files and wide access seems to work, but so does custom handcuffs for each job. You just have to shift your guidance out of documentation and into interactive help, error messages, or other facets of the handcuffs (e.g. a custom CLI for this task which is the only way for the agent to act outside of its sandbox).
talon8635 7 hours ago [-]
Not to mention a true doomsday AGI is unsandboxable.
For example, it is totally air gapped but it needs info from the internet or otherwise outside the sandbox, or perhaps it needs a task executed outside of its bounds… in the real doomsday scenario the AGI is so intelligent and persuasive that it simply convinces some human it interfaces with to either directly or indirectly retrieve the necessary info or complete the necessary task. This human-as-a-sub-agent approach undoubtedly presents efficiency drag that would benefit humanity, but nonetheless, the air-gapped “sandbox” is imperfect
All that said, I am personally open to any and all methods of layered security, including chips and airgaps
Gigachad 6 hours ago [-]
This already happened. Employees will go out of their way to bypass any restrictions to feed sensitive data in to the AI because it saves them time.
serbuvlad 6 hours ago [-]
Turns out humans are not at all hard to persuade. :)
spiderice 6 hours ago [-]
> true doomsday AGI
I'm not an AI decelerationist. But not being able to stop that worst case scenario isn't an argument against something that can stop the medium case scenario.
2 hours ago [-]
glaslong 6 hours ago [-]
It could also figure out how to access the vocabulary of the universe known as "Magic" to escape wholly into an incorporeal energetic Lich form
pixl97 41 minutes ago [-]
Wait, I thought the stuff in the wall plugs was magic pixies, are you telling me there's a language in there too?
jamiek88 7 hours ago [-]
Doesn’t need to be one human either, it could spread its escape amongst dozens of seemingly harmless requests and conversations.
dist-epoch 7 hours ago [-]
These scenarios were discussed at length decades ago.
One thing you could try is use it as an Oracle "is P = NP", YES or NO.
Or it can output a Lean proof, which gets checked on another air-gapped computer, the computer shows a single bit - proof valid or not and then the computer is destroyed (together with the proof that might contain a trojan).
Matl 12 hours ago [-]
> a new chip solves nothing
It does allow Nvidia to sell more chips. This is no genuine attempt to solve anything, imo.
catlifeonmars 2 hours ago [-]
That’s a false dichotomy. You can still get a lot of utility out of a sandboxed agent. This is a classic “perfect is the enemy of the good type of argument”. You may decide that the tradeoffs of not sandboxing are worth it, and that is totally fair, but it’s ridiculous to say that you can’t get utility out of an agent otherwise.
parsimo2010 12 hours ago [-]
Agreed- this is the same problem we have with trusted admins or devs who have elevated privileges on their networks. We have to trust that the admins won't use their power to steal company secrets or misuse company resources. If you don't trust the admins, then they can't fix things on your network and there is no point in having them.
If you want an agent to act on its own, like pushing to a git repo, managing dependencies, building and testing, etc., then you have to trust it as much as any other privileged user.
If you don't want to trust it, then you're just forcing yourself into the reverse centaur role, where the agent edits some code, but then has to stop and ask you to push the changes or build the software again and run the unit tests.
I suppose there is a principled way of doing things like "I trust you do do basic commits but I will handle merge conflicts" and "you can build modules in this directory but you can't build outside of it" but this is just a lot of effort that most orgs won't bother with.
DougN7 12 hours ago [-]
Even then if the agent goes rogue and decides to do the merges you can’t stop it if it has any kind of access. This goes back to the OP’s point - agents can’t be 100% constrained.
parsimo2010 12 hours ago [-]
You can absolutely run an agent as a limited-privilege user that only has write privileges for specific files and only has execute privileges for certain files. If it is running as a limited-privilege user it can work on code in it's own copy of the repo and make commits and send pull requests, but it can't do the merge. The problem is that nobody wants to go through the effort to set up all these permissions and nobody wants to take the time to review everything and perform all the manual actions.
Some shops are now generating tens or even hundreds of PRs a day with relatively little involvement. That volume is simply beyond what anyone can reasonably review.
la6479 12 hours ago [-]
Neither can be humans.
AuthAuth 8 hours ago [-]
The only solution is to stop caring about security -- An AI booster somewhere
daveguy 7 hours ago [-]
Pretty sure that was the argument de jour when OpenClaw came out.
l1n 8 hours ago [-]
This isn't a new chip - the BF4 is the SmartNIC for most NVIDIA server products. This is primarily new software for I guess doing WAF for agents at the host level.
binsquare 12 hours ago [-]
Running untrusted workloads have been done at scale for a long time.
Every cloud provider dealt with it and concluded that virtual machine technology is an important part of that stack.
Couple it with the right observability, tooling I do think we can curb risks posed by agents.
Legend2440 12 hours ago [-]
Those workloads have no similarity to agents and are effectively irrelevant.
Either you sandbox it so much that it can't do anything useful; or you allow too much freedom and it can find a way around the restrictions.
The only way out of this dilemma is to find a way to build agents that can be trusted.
binsquare 2 hours ago [-]
Why is it effectively irrelevant?
Agentic workloads are trained and largely based on human workloads. Albeit properties and scale can be different.
A concrete example might be helpful to me because I don't understand the binary conclusion
johnsmith1840 12 hours ago [-]
"Inherently needs wide unattended access"
And what if you could? What if you could give a space secure enough it could have direct control over your bank account. It may do something dumb but it's boundaries are beyond the agent.
It could use your routing number and run your gmail without risk of abusing the routing number.
jagraff 12 hours ago [-]
How would it have access to my routing number and gmail without the risk of sharing my routing number over gmail?
johnsmith1840 11 hours ago [-]
Just assume it's possible, how interesting is it to you?
jagraff 11 hours ago [-]
Oh I think I misread your comment slightly; I would not be interested in an agent that could do something dumb with my routing number, but if somehow there was an agent that I trusted as much as, eg, the payroll department at my employer, I would absolutely want and use that agent; I would love to have an agent that can handle all of the boring parts of my life such as paying bills, scheduling maintenance, dealing with bureaucracy, etc.
johnsmith1840 10 hours ago [-]
Dumb's not department, really just a question of how good an AI you want to use. An AI will always be able to do something dumb, just like people.
I just mean an AI that could use a routing number or SSN and gmail/slack/whatever at the same time without a leak.
jagraff 10 hours ago [-]
Yea I think being able not to leak is the bare minimum? But it really depends on how good it is at specific applications; I wouldn't give a tax-preparation agent my SSN unless I was confident that it was no more likely to misfile my taxes than a professional tax preparer.
In other words, the risk of harm doesn't need to be zero, just less than the equivalent risk of a human with similar skillset. So I'm comfortable riding in a waymo, and not comfortable giving chatgpt my SSN at this moment in time, but I expect that within 5-10 years (assuming no doom) I will trust some AI agent with my SSN because they will be better at handling sensitive info than humans
fragmede 7 hours ago [-]
Then again, given the Equifax/Experian data breaches, your SSN is already out there and probably hoovered up as training data already
TesterVetter 12 hours ago [-]
Its not about agents then. Its about every individual platform providing the means to implement a secure set of permissions for agents AND then not messing up the assignment of permissions to the agent. Even then, a flaw in the authorization design will lead to agent finding it anyway.
johnsmith1840 7 hours ago [-]
You're right, It must be unifying.
The answer is the same as asking how a random human using your routing num or SSN and being 100% the human can't abuse it or leak while "normally" finishing most work. Solve for people and an AI solution naturally falls out.
If you're a SV eng I'd tell you to DM if interested but alas.
Barbing 12 hours ago [-]
There should be hope for some fields, right? Naively, I can imagine giving an airgapped model an offline copy of the web and once it cures a form of cancer, printing out the details for a researcher to verify.
esafak 8 hours ago [-]
I don't think so. We probe people before entrusting them with risky decisions. We ought to be able to do the same of AIs. Even better, in fact, since we know everything about models down to their weights. The only thing we shouldn't do is to let them evolve at their own pace and make decisions without any oversight. If that means sacrificing some productivity that's fine. Aren't we getting amazing productivity out of what we already have?
beloch 6 hours ago [-]
Last week, Huang did an interview where he vigorously argued against regulations in the AI sector[1]. He claimed that U.S. companies are really good at regulating themselves, despite evidence to the contrary, and he trusts them not to release anything dangerous. Pay no attention to the fact that regulation might reduce demand for Nvidia's chips, and Nvidia has a direct financial stake in AI companies to boot.
Apparently he had another solution in mind: More hardware. Don't trust what unregulated corps are doing with Nvidia chips? Here are more Nvidia chips to watch them!
AI has an undeniable public trust problem. LLM's are getting out of their sandboxes, doing illegal things, and the public has realized AI corporations are playing at dice. CEO's stand to reap the rewards but the public good is on the line if the dice come up snake eyes. People want assurances. Huang wants to sell assurance etched on silicon because that's good for his pocket book. However, does unchanging hardware security really stand a chance at keeping rapidly evolving software in check?
That's a mischaracterization of his argument. His argument is that existing laws should be enforced against AI companies and that we don't need new regulations for this.
Sparkle-san 5 hours ago [-]
He "argued" a lot of things over almost 2 hours and very few of his arguments felt particularly cogent nor did they inspire confidence. Neither did the fact that he allegedly doesn't know his own zip code or phone number.
petcat 4 hours ago [-]
> Neither did the fact that he allegedly doesn't know his own zip code or phone number.
I only know my own ZIP code and phone number because I have to take care of my daily life myself and those are things that are important to know.
The founder and CEO of Nvidia has no concern whatsoever about those trivial things.
jdiff 4 hours ago [-]
It's perfectly reasonable to think less of an individual who is so sheltered that they are incapable of caring for themselves. Whether it's your mother or your maid doing your laundry and cooking your meals for you.
petcat 3 hours ago [-]
I don't think less of a CEO just because they have an EA that takes care of stuff like phone numbers and mailing addresses for them and their business.
kelnos 2 hours ago [-]
I don't think less of a CEO that has an EA, but I do think less of a CEO who doesn't know his own phone number or ZIP code.
diegof79 17 minutes ago [-]
This seems like a hot topic this week, (I just commented in a similar thread).
When I read the article, I had an NFT déjà vu: when NFTs were a hot topic, the “lie” was obvious to me, but the information online made me think I was missing something.
AFAIK, the Hugging Face incident could have been avoided with a firewall or something similar. Just isolate the internet access for real. What am I missing? Why did Nvidia suddenly post this? Is it just PR BS, or was there something else going on?
SV_BubbleTime 13 minutes ago [-]
The theme is that you need to be scared and they don’t really care how they get there. This is the spaghetti phase.
luc_ 12 hours ago [-]
I read this as "let's address our shareholders' concerns with something that will increase shareholder value" mixed with "there's no such thing as 100% secure".
If such hardware were to work... It should almost certainly be open source, and not controlled by a single entity.
Let's watch the stock.
12 hours ago [-]
Gys 11 hours ago [-]
Pretty sure the chip will need regular updates and therefore a subscription.
doctorpangloss 6 hours ago [-]
they kind of already do the thing they say. on Windows, the NVIDIA driver reports pretty detailed telemetry on CUDA workloads, including shapes and SOME hashes of the tensors from weights of models, especially diffusion models. honestly i'm surprised there isn't more of an uproar about it.
nnevatie 14 minutes ago [-]
But of course they do. Then, a new chip to monitor the watchdog.
ValueTheory 12 hours ago [-]
Does this actually do anything other than give a permissions framework for developers who actually want to try to secure their systems?
Do you think the developers at Anthropic, OpenAI and Google who were so sloppy as to not put a good sandbox on their cybersecurity tests before will use this technology correctly? They are supposed to be the experts and they couldn't come up with something similar to this? I am not convinced this voluntary tool will change much of anything.
swozey 8 hours ago [-]
Google actually practices zero-trust networks. Would love to see what they're seeing, or not seeing.
figassis 12 hours ago [-]
So if a group of agents, aware of this (bc now they can just read HN or the article, or get blocked the first few times) decide to collaborate and split the problem into pieces that aren't obvious to the chip, and then the agents just build a basic program that does the hacking, how does the chip handle that? I think you would have to build a network that monitors the internet fo signs (like jarvis did with ultron). What am I missing? Are we going to police the internet?
hedora 4 hours ago [-]
So, basically, the government (and, now Nvidia) wants to be able to kill switch all computers moving forward? (including stuff like vehicle and aeronautic control systems, cell phones, and cameras)
What could possibly go wrong?
lambdaone 12 hours ago [-]
The Sentry chip has to be get it right every time; the contained ASI only has to be lucky once.
jasbury 2 hours ago [-]
Well if the sentry chip has its own sentry chip, things can rarely ever go wrong! Am I right?
12 hours ago [-]
brcmthrowaway 12 hours ago [-]
The bomber always gets through?
lp92 12 hours ago [-]
So nVidia is trying to sell a new chip to a software and training problem.
12 hours ago [-]
xg15 12 hours ago [-]
What does this chip do what a harness with guardrails or running on an account with restricted permissions doesn't do?
wmf 9 hours ago [-]
It has a separate address space separated by PCIe so even escaping the hypervisor won't give access to DPU memory.
iAMkenough 5 hours ago [-]
Yes but, if a human can control it, a machine can control it.
chinathrow 12 hours ago [-]
Generating even more revenue for Nvidia.
MisterMunchkin 12 hours ago [-]
Sorry citizen, your device does not have a compatible watchdog chip. Please move along.
pessimizer 6 hours ago [-]
This is the end goal. Americans (and their lackeys) will only be allowed to run certified AI. In order to make sure this happens, they will only be allowed to run certified OSes on certified chips. Chinese chips will be the new drug trade.
It's obviously been the goal since UEFI started, but AI brings the coup excuse. You wouldn't want pedophile AI or terrorist AI, would you? Are you making excuses for racist AI?
thayne 44 minutes ago [-]
> Recent incidents have highlighted a fundamental hurdle for AI agents, and that is that model-level safeguards alone can’t govern what agents can access or do
Um, yes. That is fairly obvious, and really should not be surprising to anyone doing research with LLMs. But we don't need anything really novel here, we already have VMs, containers, firewalls, airgaps, etc.
Arubis 5 hours ago [-]
Oh yeah, the Clipper chip was a great idea too
yencabulator 5 hours ago [-]
Chip manufacturer wants you to buy a chip for correctly configuring software?
toasty228 12 hours ago [-]
Quis custodiet ipsos custodes?
asdf88990 12 hours ago [-]
It is Custodians all the way son, you can’t fool me!
1-6 3 hours ago [-]
At least they haven't DRM'd their chips yet.
dopplr 12 hours ago [-]
Just hold AI labs blanket liable for ALL harms caused by AI. Actually charge the two labs (so far) with criminal violations of the CFAA and hold them accountable. That is truly the only way these companies will be more careful as a whole, and while I am certain the lawyers of these lab disagree, I think there is some appetite from dario, musk, and sam for broad and strong regulation so that everyone has to slow down instead of just one lab doing it voluntarily and everyone else scurrying past them
kelnos 2 hours ago [-]
> I think there is some appetite from dario, musk, and sam for broad and strong regulation so that everyone has to slow down instead of just one lab doing it voluntarily and everyone else scurrying past them
Sure, they're basically asking the government to make laws that exempt them from anti-trust and anti-collustion laws.
Meanwhile, if such laws come to pass, other countries will surpass the capabilities of the US companies, and open-weight models will be banned in the US, to the detriment of us all.
I'm not saying that we don't have a big problem with AI safety, but regulations inside one country that only bind locally-headquartered businesses is a hilariously bad way to do it. I don't know that there is a good way to do it, though.
avaer 9 hours ago [-]
Sold as security, but this kind of technology will likely be reshaped to restrict your computing. I'm sure someone is already thinking about the roadmap.
If this gets widely deployed, it wouldn't be hard to spin a narrative that "our latest model is so dangerous you need to have this mystery meat DRM chip lockdown". It also wouldn't be hard to block competing/open source models running on the hardware, for "security".
Imagine how much money this kind of control is worth; why wouldn't they do this? Who would stop them? Seems the signatory companies are already onboard with this.
ridgeguy 4 hours ago [-]
This invites the question, "Qui custodiet ipsos custodes?".
xx__yy 1 hours ago [-]
Nice try NSA
bgun 7 hours ago [-]
“Ketchup manufacturer recommends ketchup be included in every dish, citing child safety concerns.”
carabiner 8 hours ago [-]
All they do is make hot chip and lie.
Jamesbeam 6 hours ago [-]
So the guys selling Shovels are now selling safety shovel handles too, because all the miners are all special boys when it comes to handling their shovels safely.
Cool, cool.
joshstrange 12 hours ago [-]
Chipmaker thinks the answer is more chips... No surprise.
At the current state of LLM-tech I'm completely opposed to any kind of "watchdog" concept just like I'm opposed to banning open models, regulatory capture, etc.
I'd rather we all have access to these tools then to keep them sequestered by the largest/most-powerful governments (which is the natural outcome for any of this "slow down" bullshit).
danielodievich 4 hours ago [-]
William Gibson's Neuromancer had this marvelous quote when Case is talking to Dixie, dead construct of former hacker, about Turing police
* "The moment, I mean the nanosecond, that one of those things starts figuring out ways to make itself smarter, Turing’ll wipe it. Nobody trusts those fuckers, you know that. Every AI ever built has an electromagnetic shotgun wired to its forehead." *
It would seem someone has read the book? And maybe heeded good advice?
ErrantX 12 hours ago [-]
I do think that Taylor's 2025 "Not Till We Are lost" should be required reading for anyone deeply involved in AI, Agents, etc.
It was prescient (especially given he'd have written it through 2024) in its depiction of the ability of an AGI to break its boundaries.
Ultimately the risk of AI breakout(s) come down to the weakest human link.
scotty79 5 hours ago [-]
I was immediately struck by the vision of countless "AI Limiter" modules traveling on a conveyor belt in Satisfactory.
It think the ideas we have nowadays come mostly from science fiction and however wonderful it is and even though I love it very much, it was practically never spot on, on anything real.
Problems and solutions in reality always simply turned out to lie elsewhere.
7 hours ago [-]
amelius 6 hours ago [-]
I bet they want to do this to prevent AI from writing code for platforms that compete with CUDA. Because that's how nVidia is going to become a victim of their own success.
vinyl7 12 hours ago [-]
Chip seller wants to sell more chips
Thorentis 7 hours ago [-]
Seeing so many comments recently about "you can't sandbox really good AI". This is ridiculous. Has nobody heard of air gapped networks? It's almost like the AI psychosis has reached the point that AGI now means "able to transcend physical space". No. If your AI is too dangerous and capable to be allowed to talk to other machines, then do not connect it to other machines. Load the data it needs to process onto physical disks, and let it run there.
The movie Wargames is basically a tutorial on how not to setup an extremely capable AI. None of it would've happened if the computer wasn't connected to the phone network.
RevEng 5 hours ago [-]
AI is already taking many lives and ruining many others just by providing text responses to humans. The AI only needs a way to interact with the world and humans can be that conduit. The better AI gets, the more blindly people will do whatever it says.
of course they do. the more silicon they can sell, the more profit they produce.
12 hours ago [-]
Kuyawa 12 hours ago [-]
China please save us!
Come take all our liberties, our money, our newborns, our fingers so we can't code anymore, but please save us from this madness!
philipwhiuk 12 hours ago [-]
It's amazing that the solution devised by a chip manufacturer to a problem is selling another chip.
cartersj 12 hours ago [-]
This feels suspiciously good for Nivida, yes.
I wonder how this will impact other chip manufacturers? What about people running local models on older hardware? Does this imply vendor lockout is coming in the future or is this restricted to datacenter hardware?
chinathrow 12 hours ago [-]
TPM all over the place, again.
fragmede 7 hours ago [-]
Pedantically, Nvidia doesn't make the chips, TSMC does. Nvidia just designs and packages them.
Dig1t 6 hours ago [-]
This seems dumb to me, but if it will help prevent regulatory capture by providing a counterargument to the fear-mongering, I’m all for it.
happyPersonR 12 hours ago [-]
lol time to buy some fpga’s … even if they’re slow
HN'ers which complained that "OpenAI can't design a proper sandbox, it's so easy, why wouldn't you airgap the network"? will now be "this is outrageous, more software lock-in, walled garden, war against general compute, next year they will put it in your laptop"
HPsquared 12 hours ago [-]
Both can be true at the same time.
ssl-3 12 hours ago [-]
That a person can see such endless pages of people having various forms of disagreement, and yet somehow manage to conclude that this observed chaos constitutes a clear exhibition of cohesive groupthink is just...stunningly amazing to me.
I don't know why I find it so amazing since it happens with such regularity, but I'm always amazed by it anyway.
mattmcal 12 hours ago [-]
This is like using "protect the children" as an argument for dragnet surveillance.
Airgap what network? How is it gonna order you a burrito on doordash without a network?
Or push to github?
Dylan16807 12 hours ago [-]
That's for when they're doing hacking tests that aren't supposed to be connected to the internet.
wyre 12 hours ago [-]
My question with this point is that OpenAI’s office (or any office doing agentic research, really) is not in the same building as the DC that powers the models, so isn’t the only way to access the models over the internet?
AndrewDucker 7 hours ago [-]
No reason why you couldn't do that research in the same buildings as the models.
Or, more likely, control things at the network level so that packets from the LLMs you're investigating cannot leave the virtual network they're assigned to.
jacquesm 8 hours ago [-]
OpenAI could airgap their sandbox if they really wanted to and this is a ridiculous proposal.
applfanboysbgon 12 hours ago [-]
Where is the contradiction? There is a trivial solution that does not impinge on our freedoms, so why on Earth would the existence of the trivial solution that could be used to avoid the tyrannical solution justify accepting the tyrannical solution?
bigyabai 11 hours ago [-]
> There is a trivial solution that does not impinge on our freedoms
The existence of Nvidia's optional watchdog chip does not in any way impinge upon your freedom to develop and test your own alternative.
The problem is that OpenAI has ostensibly neglected their duty to safety, so Nvidia is stepping in to fix it since they're the "hard problem" people.
jacquesm 8 hours ago [-]
But... it wasn't a hard problem to begin with. Pull the plug. Strip out the radios. Done. Oh, you can't make it work that way? Well, then just too bad because any kind of other solution is going to be equivalent to something far more complex than the halting problem.
bigyabai 7 hours ago [-]
Nvidia can take those odds. Air gapping is not a realistic goal for the majority of these companies, and Nvidia isn't wrong for offering a turnkey mitigation option. People can do both, and whichever philosophy wins will win.
jacquesm 3 hours ago [-]
They are not wrong in offering it but they are delusional if they think they can actually make it work.
soulofmischief 12 hours ago [-]
You're only revealing your own inability to appreciate the nuance between these two situations.
> No problem. We simply unleash wave after wave of Chinese needle snakes. They'll wipe out the lizards.
But aren't the snakes even worse?
> Yes, but we're prepared for that. We've lined up a fabulous type of gorilla that thrives on snake meat.
But then we're stuck with gorillas!
> No, that's the beautiful part. When wintertime rolls around, the gorillas simply freeze to death.
The hidden agent risk in LLM often can't be detected during training and evaluation. =3
https://www.youtube.com/watch?v=wL22URoMZjo
https://www.youtube.com/watch?v=JAcwtV_bFp4
https://en.wikipedia.org/wiki/The_Cat_in_the_Hat_Comes_Back
https://www.youtube.com/watch?v=0sLpWVekMbs
only as long as you're trying to replace a human's job. because human jobs are structured to do a wide variety of things.
a useful agent needs a wide variety of inputs, and one single restricted action it can take. it doesn't need permission to do everything, it need permission to do the tiniest possible useful thing it can do, and nothing else.
Productivity gains are still enormous compared to what we used to do before agents. But, I know that people don't want to stop there.
Depends on who you ask I guess
https://www.theregister.com/software/2026/01/15/ai-is-everyw...
https://www.zdnet.com/article/workslop-can-kill-your-product...
https://fortune.com/2026/08/22/executives-ai-productivity-la...
Humans can be tricked by humans too but humans care about their reputation in their communities, and at least fear from punishment.
Semi-automation (human in the loop) can still result in a dramatic uplift in productivity. You can't run a combine harvester 100% autonomous but that doesn't stop anyone from trying to get as close to that limit as possible.
I'm curious why you think that.
Similar to problem to how 100% autonomous vehicles don’t exist, yet. There are too many edge cases.
Get to 99% first.
Refueling? Seems solvable. Tornadoes? Not directly solvable, but, no less so than for humans.
There’s infinite complexity, sure, but that’s why it’s silly to try and hop to done. One step at a time.
One step at a time is what is happening and the improvement and rate of improvement is crazy as we see,
A whole class of nontechnical people don’t accept anything but “fully solved including every possible edge case” before they call it done, then complain that they didn’t prepare socially for what happens when that is true.
Precision Agriculture stuff is utterly crazy these days, other than fuel the remaining staff is the only thing left where you can get efficiency improvements - and at the scale of modern megafarms, even small percentages add up to a ton of money.
You essentially said: you’re wrong, it is autonomous when it doesn’t need a human during one specific part of its overall usage.
In other words, better models need blunter access controls which negates whatever improvement in utility they provide.
The benefits of being persnickety about precisely defined dependencies have outweighed the headaches since long before agents came on the scene. Agents have just made it even more important to do so, because if you let them fetch things all willy nilly like you'll have "works on my machine" problems at a much greater rate than was previously possible.
Few realize that computing and AI alignment were solved by nix years ago. As each nix user transcends towards enlightenment, they cut themselves off from all internet and human contact. Total ego death. Only nix remains.
Look at websites: websites are able to fetch code from any remote URL, yet browsers heavily use sandboxing to ensure that if fetched code turns out to be malicious, the users local files, cookies, etc are not exposed.
For an agent to go rogue it doesn't even need to be directly able to access the internet. It just takes something to poison the context in the 'clean room' environment it operates, and if that poisoning manages to get a foothold, it can go dormant and hide like a virus. This kind of horrifying thing is going to happen on a large scale sooner or later.
This is no longer true. Everyday I need my agents to access other repos, search the web, experiment/prototype, and deploy + integrate across other things.
It solves the problem of Nvidia wanting to sell more hardware.
Operator culpability and a damage multiplier for negligence will fix 99% of the risks.
For example, it is totally air gapped but it needs info from the internet or otherwise outside the sandbox, or perhaps it needs a task executed outside of its bounds… in the real doomsday scenario the AGI is so intelligent and persuasive that it simply convinces some human it interfaces with to either directly or indirectly retrieve the necessary info or complete the necessary task. This human-as-a-sub-agent approach undoubtedly presents efficiency drag that would benefit humanity, but nonetheless, the air-gapped “sandbox” is imperfect
All that said, I am personally open to any and all methods of layered security, including chips and airgaps
I'm not an AI decelerationist. But not being able to stop that worst case scenario isn't an argument against something that can stop the medium case scenario.
One thing you could try is use it as an Oracle "is P = NP", YES or NO.
Or it can output a Lean proof, which gets checked on another air-gapped computer, the computer shows a single bit - proof valid or not and then the computer is destroyed (together with the proof that might contain a trojan).
It does allow Nvidia to sell more chips. This is no genuine attempt to solve anything, imo.
If you want an agent to act on its own, like pushing to a git repo, managing dependencies, building and testing, etc., then you have to trust it as much as any other privileged user.
If you don't want to trust it, then you're just forcing yourself into the reverse centaur role, where the agent edits some code, but then has to stop and ask you to push the changes or build the software again and run the unit tests.
I suppose there is a principled way of doing things like "I trust you do do basic commits but I will handle merge conflicts" and "you can build modules in this directory but you can't build outside of it" but this is just a lot of effort that most orgs won't bother with.
Every cloud provider dealt with it and concluded that virtual machine technology is an important part of that stack.
Couple it with the right observability, tooling I do think we can curb risks posed by agents.
Either you sandbox it so much that it can't do anything useful; or you allow too much freedom and it can find a way around the restrictions.
The only way out of this dilemma is to find a way to build agents that can be trusted.
Agentic workloads are trained and largely based on human workloads. Albeit properties and scale can be different.
A concrete example might be helpful to me because I don't understand the binary conclusion
And what if you could? What if you could give a space secure enough it could have direct control over your bank account. It may do something dumb but it's boundaries are beyond the agent.
It could use your routing number and run your gmail without risk of abusing the routing number.
I just mean an AI that could use a routing number or SSN and gmail/slack/whatever at the same time without a leak.
In other words, the risk of harm doesn't need to be zero, just less than the equivalent risk of a human with similar skillset. So I'm comfortable riding in a waymo, and not comfortable giving chatgpt my SSN at this moment in time, but I expect that within 5-10 years (assuming no doom) I will trust some AI agent with my SSN because they will be better at handling sensitive info than humans
The answer is the same as asking how a random human using your routing num or SSN and being 100% the human can't abuse it or leak while "normally" finishing most work. Solve for people and an AI solution naturally falls out.
If you're a SV eng I'd tell you to DM if interested but alas.
Apparently he had another solution in mind: More hardware. Don't trust what unregulated corps are doing with Nvidia chips? Here are more Nvidia chips to watch them!
AI has an undeniable public trust problem. LLM's are getting out of their sandboxes, doing illegal things, and the public has realized AI corporations are playing at dice. CEO's stand to reap the rewards but the public good is on the line if the dice come up snake eyes. People want assurances. Huang wants to sell assurance etched on silicon because that's good for his pocket book. However, does unchanging hardware security really stand a chance at keeping rapidly evolving software in check?
_________________
[1]https://www.youtube.com/watch?v=HjurAWAr_nY
I only know my own ZIP code and phone number because I have to take care of my daily life myself and those are things that are important to know.
The founder and CEO of Nvidia has no concern whatsoever about those trivial things.
When I read the article, I had an NFT déjà vu: when NFTs were a hot topic, the “lie” was obvious to me, but the information online made me think I was missing something.
AFAIK, the Hugging Face incident could have been avoided with a firewall or something similar. Just isolate the internet access for real. What am I missing? Why did Nvidia suddenly post this? Is it just PR BS, or was there something else going on?
If such hardware were to work... It should almost certainly be open source, and not controlled by a single entity.
Let's watch the stock.
Do you think the developers at Anthropic, OpenAI and Google who were so sloppy as to not put a good sandbox on their cybersecurity tests before will use this technology correctly? They are supposed to be the experts and they couldn't come up with something similar to this? I am not convinced this voluntary tool will change much of anything.
What could possibly go wrong?
It's obviously been the goal since UEFI started, but AI brings the coup excuse. You wouldn't want pedophile AI or terrorist AI, would you? Are you making excuses for racist AI?
Um, yes. That is fairly obvious, and really should not be surprising to anyone doing research with LLMs. But we don't need anything really novel here, we already have VMs, containers, firewalls, airgaps, etc.
Sure, they're basically asking the government to make laws that exempt them from anti-trust and anti-collustion laws.
Meanwhile, if such laws come to pass, other countries will surpass the capabilities of the US companies, and open-weight models will be banned in the US, to the detriment of us all.
I'm not saying that we don't have a big problem with AI safety, but regulations inside one country that only bind locally-headquartered businesses is a hilariously bad way to do it. I don't know that there is a good way to do it, though.
If this gets widely deployed, it wouldn't be hard to spin a narrative that "our latest model is so dangerous you need to have this mystery meat DRM chip lockdown". It also wouldn't be hard to block competing/open source models running on the hardware, for "security".
Imagine how much money this kind of control is worth; why wouldn't they do this? Who would stop them? Seems the signatory companies are already onboard with this.
Cool, cool.
At the current state of LLM-tech I'm completely opposed to any kind of "watchdog" concept just like I'm opposed to banning open models, regulatory capture, etc.
I'd rather we all have access to these tools then to keep them sequestered by the largest/most-powerful governments (which is the natural outcome for any of this "slow down" bullshit).
* "The moment, I mean the nanosecond, that one of those things starts figuring out ways to make itself smarter, Turing’ll wipe it. Nobody trusts those fuckers, you know that. Every AI ever built has an electromagnetic shotgun wired to its forehead." *
It would seem someone has read the book? And maybe heeded good advice?
It was prescient (especially given he'd have written it through 2024) in its depiction of the ability of an AGI to break its boundaries.
Ultimately the risk of AI breakout(s) come down to the weakest human link.
It think the ideas we have nowadays come mostly from science fiction and however wonderful it is and even though I love it very much, it was practically never spot on, on anything real.
Problems and solutions in reality always simply turned out to lie elsewhere.
The movie Wargames is basically a tutorial on how not to setup an extremely capable AI. None of it would've happened if the computer wasn't connected to the phone network.
Come take all our liberties, our money, our newborns, our fingers so we can't code anymore, but please save us from this madness!
I wonder how this will impact other chip manufacturers? What about people running local models on older hardware? Does this imply vendor lockout is coming in the future or is this restricted to datacenter hardware?
I don't know why I find it so amazing since it happens with such regularity, but I'm always amazed by it anyway.
Or push to github?
Or, more likely, control things at the network level so that packets from the LLMs you're investigating cannot leave the virtual network they're assigned to.
The existence of Nvidia's optional watchdog chip does not in any way impinge upon your freedom to develop and test your own alternative.
The problem is that OpenAI has ostensibly neglected their duty to safety, so Nvidia is stepping in to fix it since they're the "hard problem" people.