Post #4148029

2026-07-27 21:07 UTC

We see these issues: anthropomorphization, overreliance on benchmarks, and aspiration-driven thinking all the time as we help clients navigate how to use LLMs in threat modeling, but they are really about LLMs. They extend far beyond threat modeling. That's why we included two (anthropomorphization and over-reliance) in version 1 of the PHANTOM-B model (/resources/whitepapers). Who knows, maybe a future version will need benchmarkmaxxing as a threat? (12/15)

Replies (1)

@adamshostack@infosec.exchange 2026-07-27 21:07

Other commentary: • Neil Wyler (aka Grifter) wrote an excellent article, OpenAI gave its model a test, it broke out of its sandbox and hacked Hugging Face to steal the answers (https://coalfire.com/the-coalfire-blog/openai-gave-its-model-a-test-it-broke-out-of-its-sandbox-and-hacked-hugging-face-to-steal-the-answers) covering speed, the two-sided nature of guardrails, and regulation threats. • Laurie Voss has a philisophically interesting essay, Did OpenAI hack Hugging Face or didn't they? (https://seldo.com/posts/did-openai-hack-hugging-face-or-didnt-they/) on the legal question of “could anyone be held accountable?” • The Cloud Security Alliance and partners released Hugging Face Incident Initial Post-Mortem (https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem). (13/15)

Open ##4148028