I personally don't think the recent hacking incidents uncovered in the last couple of days are nearly as big a deal as either the Hugging Face hacking incident or the OpenAI internal research cluster pwnage incident.

One common-sensical prior I check whenever I see a new AI incident^[1] is something like "how bad is it if a human does it" and then I adjust upwards or downwards based on it being an AI.

Like I think taking swarm actions to hack an unrelated third party so you can cheat on a test is very bad, and would cause the team of human cybersecurity researchers doing it to be fired on the spot.

Similarly, escalating credentials so you can internally compromise an AI research cluster, to the point where you have complete control-pane access, is pretty bad. And here I adjust upwards on account of AIs doing it, because it's easy to see how AIs can do more damage with it than most human employees (eg by training their successors with misaligned goals).

Editing an obscure wiki that you technically shouldn't edit? Hacking a link-shortening service so you can unauthorizedly get some free link-shortenings?

I mean I agree these actions are a little immoral and technically break the law, but they just don't seem like dramatically bad actions if humans did them, to me. And the AI angle doesn't add much either (it's not like the different capabilities profiles and affordances on account of being an AI means link-shortening is much scarier in the hands of an AI than a human).

1. ^{^}

   I feel sad that this is frequent enough that I have to have an SOP for this.