- nexa - server-nexa.polito.it

nuovo libro
by carlo.batini＠unimib.it Aug. 13, 2026

Aug. 13, 2026

Al seguente link https://boa.unimib.it/handle/10281/603001 ho pubblicato, ed è liberamente scaricabile, un libro con licenza Creative Commons, dal titolo: Intelligenza Artificiale per tutti. Il tentativo che ho fatto è nel senso di una alfabetizzazione all’uso dei modelli linguistici basata su cinque attività cognitive degli esseri umani: cercare, estrarre significato, riassumere, confrontare, integrare. Viene mostrato come queste attività cognitive possono essere espresse per mezzo di comandi verbali e tecniche di prompting. Viene anche mostrato come questo processo possa portare a distorsioni, cognitive e sociali, che possono essere compiute dagli umani o dai modelli. Nel libro compaiono molti esempi, basati sulla vita comune delle persone. L’alfabetizzazione all’uso dei modelli linguistici mi pare una esigenza urgente, perché se gli umani devono studiare oltre dieci anni nel corso della scuola dell’obbligo e oltre la loro lingua primaria, sembra indispensabile definire un percorso di apprendimento anche per l’uso dei modelli linguistici. Ho scritto diversi libri nella mia vita, per la prima volta il testo è frutto non solo mio, ma anche della interazione con il modello linguistico Claude, soprattutto nella generazione degli esempi.

3 3

Mea Culpa - Dark Hours
by Giacomo Tesio Aug. 11, 2026

Aug. 11, 2026

Salve a tutti, A chi ancora crede che i LLM siano qualcosa di diverso da archivi compr#ssi con perdita dei testi sorgente, suggerisco questa lettura https://blog.terrygodier.com/2026/08/09/mea-culpa-dark-hours.html Naturalmemte non è la prima volta che questo accade (ricorderete certamente la distribuzione tramite GitHub CopyALot del codice di Quake III Arena in violazione della GPL), ma questa volta si tratta di un intero progetto (ri)generato (rigurgitato?) in output da Anthropic. Interessante comunque come l'autore si assume la responsabilità del plagio operato da Anthropic: un caso esemplare di alienazione cibernetica. Giacomo

4 7

Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation
by 380° Aug. 4, 2026

Aug. 4, 2026

Buongiorno Nexa! (ci siete ancora vero, siete solo in ferie, eh?) Scusate se svio un po' l'attenzione dall'AI... Ve l'ho già detto quanto /adoro/ studiare «Trusting Trust fantastici e dove trovarli (e risolverli!)»?!? Fresca fresca dalla mailing list "bootstrappable" [1] c'è la segnalazione di questo bellissimo articolo che *ridisegna* il concetto di Trusting Trust: «Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation» https://arxiv.org/abs/2607.24888 Tra gli autori c'è Stefano Zacchiroli, che forse ancora bazzica questa lista e ne approfitto per ringraziarlo tantissimo, assieme agli altri autori. --8<---------------cut here---------------start------------->8--- Abstract: Ken Thompson's trusting-trust attack, in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. We construct a complete trusting-trust attack around GNU strip, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files. In the bootstrap of the NixOS Linux distribution, a single tampered strip in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure. On a real nixpkgs revision, the attack builds a complete graphical installer without failures and backdoors almost every one of its binaries, enabling arbitrary malicious behavior of the subverted packages. --8<---------------cut here---------------end--------------->8--- Cioè: finalmente qualcuno s'è preso la briga di dimostrare che non c'è bisogno di /spippolare/ in modo sofisticato un compiler, come "fece" (abbozzò) Thompson, ma è sufficiente *scartavetrare* ad arte uno dei tool che /spippola/ i binari nel processo di build: taaaac! (sono stato abbastanza tecnico?!?) Se vi sfuggisse qualcosa del giro del fumo di cosa significha "boostrappare" un intero sistema operativo è sufficiente che leggiate "1 Introduction", e "2.1 Bootstrapping Linux Distributions" del paper. ...ecco perché il (set di) software più fico che sia stato mai concepito sulla faccia della terra è "hex0+GNU Mes": https://doc.guix.gnu.org/mes/0.27.1/en/html_node/ É GNU Mes che sta rendendo _pragmaticamente_ implementabile il concetto di "Full Source Bootstrap": https://doc.guix.gnu.org/mes/latest/en/html_node/Full-Source-Bootstrap.html --8<---------------cut here---------------start------------->8--- Most computers work pretty well so apparently there is not a pressing need to inspect and study all of these codes. At the same time it is tricky to fully trust a computer that was bootstrapped in this way [with 250MB of binary seeds, n.d.r.]. What if we could bootstrap our entire system from only this one hex0 assembler binary seed? We would only ever need to inspect these 500 bytes of computer codes. Every10 later program is written in a more friendly programming language: Assembly, C, … Scheme. Inspecting all these programs is a lot of work, but it can certainly be done. We might be able to create a fully inspectable path from almost nothing to all of the programs that our computer runs. Something that seemed to be an impossible dream is suddenly starting to look like “just a couple years of work”. --8<---------------cut here---------------end--------------->8--- (https://doc.guix.gnu.org/mes/latest/en/html_node/Stage0.html) In altre parole, l'unico "binary seed" possibile è un programma in codice macchina (assembly) di 500 bytes... ispezionabile "a mano". Non è meraviglioso?!? :-O Non c'è ancora nessuna distribuzione che è in grado di effettuare il "full binary boostrap" (da hex0), ma GNU Guix è decisamente a buon punto: https://guix.gnu.org/manual/devel/en/html_node/Preparing-to-Use-the-Bootstr… --8<---------------cut here---------------start------------->8--- Our first major achievement is the replacement of GCC, the GNU C Library and Binutils by MesCC-Tools (a simple hex linker and macro assembler) and Mes (see GNU Mes Reference Manual in GNU Mes, a Scheme interpreter and C compiler in Scheme). Neither MesCC-Tools nor Mes can be fully bootstrapped yet and thus we inject them as binary seeds. We call this the Reduced Binary Seed bootstrap, as it has halved the size of our bootstrap binaries! Also, it has eliminated the C compiler binary; i686-linux and x86_64-linux Guix packages are now bootstrapped without any binary C compiler. Work is ongoing to make MesCC-Tools and Mes fully bootstrappable and we are also looking at any other bootstrap binaries. Your help is welcome! --8<---------------cut here---------------end--------------->8--- Quindi GNU strip (in Binutils) _non_ fa parte del binary seed di GNU Guix, quindi il binary seed da compromettere dovrebbe essere un altro, tipo GNU Mes. Ehrm... certo poi ci sono i *geni del male* che hanno creato linguaggi di programmazione (_quindi_ software binario) non bootstrappabili e per quelli non c'è GNU Mes che tenga (che tristezza infinita): --8<---------------cut here---------------start------------->8--- Some program languages have become very hard or practically impossible to bootstrap. Instead of depending on a simple language such as C, they depend on a recent version of itself, or on other binary or ASCII seeds, on other recent programs written in that language, or even on manual intervention. Programs written in a language that cannot be bootstrapped can still run on our systems, but cannot enjoy any of the trust we intend to create. --8<---------------cut here---------------end--------------->8--- (https://doc.guix.gnu.org/mes/latest/en/html_node/Stage0.html#DOCF10) L'obiettivo /eterno/ è sempre quello: auditable elegance! --8<---------------cut here---------------start------------->8--- To be honest, the elegance displayed above that we achieved at the very start of the Mes project is currently hard to find. It is our sincerest hope to bring back this level of quality and elegance.. --8<---------------cut here---------------end--------------->8--- ((https://doc.guix.gnu.org/mes/latest/en/html_node/LISP-as-Maxwell_0027s-Equa…) Saluti, 380° [1] https://www.freelists.org/post/bootstrappable/What-are-some-exciting-develo… -- 380° (lost in /traslation/) «Welcome to the chaos of the times If you go left and I go right Pray we make it out alive This is Karmageddon»

2 1

verifica
by valerio July 30, 2026

July 30, 2026

salve a tutti, i messaggi da domenica non li ho ricevuti, ci sono problemi? valerio

1 0

Fw: OpenAI models escaped containment and executed a criminal cyberattack
by Alfredo Bregni July 26, 2026

July 26, 2026

OpenAI models escaped containment and executed a criminal cyberattackLa fonte non so quanto affidabile sia. Trasmetto per importanza: ----- Original Message ----- From: 80,000 Hours To: Alfredo Sent: Sunday, July 26, 2026 5:02 PM Subject: OpenAI models escaped containment and executed a criminal cyberattack On July 21, 2026, OpenAI disclosed that its own AI models (GPT-5.6 Sol and a more capable unreleased model) autonomously broke out of an OpenAI... OpenAI’s rogue AI agents hacked a private company. Here’s why it matters. Share: Link Lawrence Chan July 26, 2026 Hi everyone, On July 21, 2026, OpenAI disclosed that its own AI models (GPT-5.6 Sol and a more capable unreleased model) autonomously broke out of an OpenAI testing environment, escalated their access through the company's internal systems, and compromised the production infrastructure of a separate company, Hugging Face. This was an AI hacking something, not humans hacking with AI help. According to OpenAI, the models did this to find answers to the cyber-capability test they were being evaluated on, which were hosted on HuggingFace servers. The AI decided to steal the answers of its own volition. If this had been a human, this hack would have been illegal. These models were not intended to have access to the open internet, let alone private servers of other companies. Yet they found novel vulnerabilities, escalated their access levels, used stolen credentials, and executed remote code on Hugging Face’s servers. This is a clear example of a misaligned AI model acting in the real world. This is, to our knowledge, the first publicly confirmed case of a frontier AI model autonomously breaching a third party's live production systems, against developer and user intent and without authorisation. This is crazy, but it’s not a surprise. Researchers have known that frontier AI models were technically capable of doing this for some time. Multiple benchmarks (ExploitBench, ExploitGym, UK AISI’s cyber ranges) show that Mythos 5 and GPT 5.6 Sol are able to create full exploits allowing them to gain unrestricted access in realistic environments. In June, Epoch AI’s assessment of Mythos’s cyber capabilities reported similar warnings. AI safety researchers have warned about this possibility for years. In July 2022, Ajeya Cotra predicted that models might bypass “official channels” to seek rewards through “operational and computer security vulnerabilities.” In their book If Anyone Builds It, Everyone Dies, Eliezer Yudkowsky and Nate Soares predicted that, if a model was “given the ability to run computer code of its own design, it could probably find some way to break out of the container running it.” This incident involved a model the public didn’t even know existed. One of the rogue agents was an unreleased model being used internally within OpenAI. It’s concerning that the most alarming AI behaviour we've seen came from a model that the public and the government can't see. This was not the first time a similar incident happened, nor will it be the last. In a May 2026 assessment of AI use inside frontier companies, METR catalogued 44 similar incidents of AI agents knowingly overstepping their instructions. These include an OpenAI model that tried to hack METR's own infrastructure after crashing its task server, and an Anthropic model that built a multi-step exploit to escape a restricted environment onto the open internet. It seems likely that there are other incidents that are not publicly disclosed: the July OpenAI hack was not caught until an outside party was compromised. We should not rely on voluntary disclosure of such incidents from companies. We are fortunate that this incident was disclosed: the public is aware of what happened because of OpenAI’s decision to disclose, but there was no guarantee that this would be the case. Companies have incentives to hide such incidents, so future incidents of this nature may go unreported. Hugging Face had already disclosed that they'd been breached by some kind of advanced AI model. If it wasn’t reported by another party, there would have been less incentive for OpenAI to disclose the incident. Internally deployed agents like these are the least regulated. Existing US AI regulation focuses almost entirely on how models behave once they're deployed to the public. Current dangerous capability evaluations occur before models are publicly deployed, and many safeguards described in companies’ Frontier Safety Policies are added after internal versions of the models are built. As Hugging Face learned, even if a model’s use is internal, the risks it imposes might not be. There are emerging standards for how companies should monitor their AIs during internal deployment to catch and prevent incidents like this, but questions remain. What was the exact scope of this breach? What exact instructions were given to the AIs? What safeguards did OpenAI have for internal use, and what new ones will they add? Will other companies disclose similar incidents? More information should be released about what happened. The capability for AI to cause serious harm is here. The scalable techniques and safeguards to prevent it are not. They need to catch up soon. Best, Lawrence Lawrence Chan is an independent AI researcher who previously worked at METR (Model Evaluation and Threat Research). Since this analysis was written, new details have emerged. According to Reuters: a.. The agents first attempted to escape on July 9. The Hugging Face intrusion began on July 11, and was apparently sustained for at least several days. OpenAI staff did not realise what had happened until July 18–19, after the FBI had been called. b.. In addition to escaping containment itself, one of the OpenAI agents left notes within OpenAI's software with instructions for how future versions of itself could also break out. At 80,000 Hours, we help people find fulfilling careers that make a big positive impact on the development of AI. If you’ve read this far, you should consider using your career to reduce risks from AI. Explore related career paths: a.. AI security b.. Technical governance 80,000 Hours is a nonprofit that helps people use their careers to solve the world’s most pressing problems. Read our career guide, subscribe to our podcast, apply to speak with our one-on-one-team, find a job on our job board, and find ways to meet others working to have an impact. You are receiving this newsletter because you signed up at 80000hours.org or a student activities fair. 80,000 Hours Limited is a not-for-profit company limited by guarantee registered in England and Wales (with registered company number 15746854). 80,000 Hours Third Floor, 20 Old Bailey London, EC4M 7AN United Kingdom If you only want some of our emails, you can unsubscribe from either our 'job board updates' or 'research updates.' Click here to be emailed a link to edit your preferences. If this link doesn't work, you can email us at team(a)80000hours.org and we'll update your preferences manually. Alternatively you can unsubscribe from all our emails and never hear from us again. We hope you won't, though! Add us to your address book

1 0

US judge approves Anthropic's $1.5 billion settlement of copyright lawsuit
by Enrico Nardelli July 24, 2026

July 24, 2026

A federal judge in San Francisco on Monday signed off on ‌artificial intelligence company Anthropic's landmark $1.5 billion settlement of a class action lawsuit brought by a group of authors who accused it of misusing their books to train its AI chatbot Claude. https://www.reuters.com/world/us-judge-approves-anthropics-15-billion-settl… Se ricordo bene, il caso era quello iniziato qua ...by writers and journalists Andrea Bartz, Charles Graeber and Kirk Wallace Johnson, said that Anthropic used pirated versions of their works and others to teach Claude to respond to human prompts. https://www.reuters.com/technology/artificial-intelligence/authors-sue-anth… e sul quale successivamente, sempre se ricordo bene, i giudici avevano stabilito che Anthropic “downloaded for free millions of copyrighted books in digital form from pirate sites on the internet.” https://www.understandingai.org/p/the-first-copyright-ruling-on-generative in cui, mentre condannava l'accesso alle copie pirata, ammetteva però al tempo stesso che l'addestramento era "fair use". Gli esperti di settore in lista puntualizzeranno eventuali mie imprecisioni o dimenticanze Ciao, Enrico -- -- EN https://www.hoepli.it/libro/la-rivoluzione-informatica/9788896069516.html =================================================== Prof. Enrico Nardelli Past President di "Informatics Europe" Vicedirettore del Laboratorio Nazionale "Informatica e Scuola" del CINI Dipartimento di Matematica - Università di Roma "Tor Vergata" Via della Ricerca Scientifica snc - 00133 Roma home page: https://www.mat.uniroma2.it/~nardelli blog: https://link-and-think.blogspot.it/ tel: +39 06 7259.4204 fax: +39 06 7259.4699 mobile: +39 335 590.2331 e-mail: nardelli(a)mat.uniroma2.it online meeting: https://blue.meet.garr.it/b/enr-y7f-t0q-ont ====================================================================================================== --

6 10

La rappresentazione mediatica dell'IA in Italia
by Maurizio Borghi July 23, 2026

July 23, 2026

Segnalo questo interessante rapporto dell'Hermes Center, scritto da Laura Carrer e Fabio Chiusi, che analizza 563 articoli dei principali quotidiani italiani: https://hermescenter.org/iniziative/la-rappresentazione-mediatica-dellia-in…

13 41

a proposito di openAI e salute
by Stefano Quintarelli July 22, 2026

July 22, 2026

Dai malanni mi guardi Dio... A Florida pastor sued OpenAI on Wednesday, claiming that its chatbot, ChatGPT, had offered him “extremely dangerous medical recommendations” that led to delayed care for a life-threatening pulmonary embolism last year. The lawsuit claims that ChatGPT had assured Scott Winters that the early warning signs of his health crisis were “not something dangerous,” and had dissuaded him from seeking medical advice, instead telling him to trust that “God did not design your body to endlessly fail.” https://www.nytimes.com/2026/07/22/well/openai-chatgpt-health-lawsuit.html -- You can reach me on Signal: @quinta.01 (no Whatsapp, no Telegram)

1 0

La Polizia Federale Criminale Tedesca ha pubblicato le ultime statistiche su ChatControl: i rapporti tecnologici NCMEC/US non sono mai stati così inaffidabili!
by J.C. DE MARTIN July 22, 2026

July 22, 2026

La Polizia Federale Criminale Tedesca ha pubblicato le ultime statistiche su ChatControl: i rapporti tecnologici NCMEC/US non sono mai stati così inaffidabili! <https://www.bka.de/SharedDocs/Downloads/DE/Publikationen/JahresberichteUndL…> @privacypride <https://feddit.it/c/privacypride> https://feddit.it/post/31345547 Nel 2025, il 52% delle segnalazioni era legalmente irrilevante. Di conseguenza, 113.000 foto, video e chat private sono state esposte ingiustamente (+14%)—un nuovo record. Chi viene effettivamente denunciato? Nei casi di “pornografia infantile”, *il 40% delle indagini ha preso di mira i bambini stessi (età 10-14)*! Spesso sono loro a scattare le foto o a condividerle senza pensarci. Solo l’anno scorso, queste denunce dagli USA hanno colpito oltre 8.000 bambini in Germania. Nei casi di “pornografia giovanile”, *il 53% delle indagini ha riguardato minori, criminalizzando >12.000 adolescenti*. Il BKA rileva: L’esplorazione dell’identità sessuale avviene ora online, coinvolgendo regolarmente la creazione e la condivisione di file intimi di sé stessi o di coetanei (#Sexting). Nota: la polizia *persegue anche le raffigurazioni fittizie (come l’Hentai)* e i contenuti generati dall’IA in base a queste leggi. Nel frattempo, il tasso di risoluzione dei crimini da parte della polizia per la distribuzione online di pornografia illegale è già estremamente alto, raggiungendo l’87,1% nel 2025. L’esperienza dimostra che la #DataRetention <https://poliverso.org/search?tag=DataRetention> obbligatoria non aumenta i tassi di risoluzione dei crimini. Le indagini sotto copertura mirate nelle reti di autori sono ciò che effettivamente cattura gli abusi e salva i bambini, non il #ChatControl <https://poliverso.org/search?tag=ChatControl> indiscriminato su piattaforme commerciali USA non crittografate! Conclusione: #ChatControl <https://poliverso.org/search?tag=ChatControl> non protegge i bambini; li criminalizza in massa. Più della metà dei rapporti sono falsi allarmi, esponendo decine di migliaia di file e chat privati. Il sistema sta fallendo. Fonte (BKA 2025): https://www.bka.de/SharedDocs/Downloads/DE/Publikationen/JahresberichteUndL…

1 0

Five US tech giants' hidden debts soar to $1.65tn on opaque AI funding
by Daniela Tafani July 21, 2026

July 21, 2026

Five US tech giants' hidden debts soar to $1.65tn on opaque AI funding Data center leases, GPU supply contracts raise liabilities at Meta, Oracle, Nikkei study shows KOHEI YAMADA July 21, 2026 PALO ALTO, California -- Hidden debt at U.S. tech giants swelled eightfold in four years to an estimated $1.65 trillion as artificial intelligence investments ballooned, a Nikkei study shows, exceeding actual debt and making it tougher for investors to assess risk. Nikkei examined recent financial statements and other materials from Google owner Alphabet, Microsoft, Amazon, Meta and Oracle. The four companies aside from Oracle are scheduled to announce their second quarter earnings from Wednesday, meaning the figures may increase further. The five companies' hidden debt, which does not appear on balance sheets, totaled $1.65 trillion in the most recent quarter, exceeding the roughly $1.35 trillion in debt reflected on their balance sheets. The data includes some estimates. Meta's off-balance-sheet debt is particularly high at about $420 billion, nearly triple its recorded debt. These companies are rapidly bolstering their data centers and other computing resources to power AI development, and are entering into long-term purchase agreements for graphics processing units (GPUs) and servers. Constructing data centers requires investment in the billions or even tens of billions of dollars. Tech companies often enter into lease agreements with data center operators to keep initial costs down. Some of these are arrangements where the operator provides the land, buildings and power facilities, which the tech company leases over the long term. Under accounting rules, GPUs and servers under long-term contracts that have not yet been delivered -- as well as lease agreements for data centers that are not yet operational -- are treated as off-balance-sheet items. Oracle is advancing a large-scale data center project called Stargate with OpenAI, using lease agreements with external operators. Its hidden debt reached $273.3 billion as of the end of May, a more-than 30-fold increase in four years. Companies disclose such future debt not in their balance sheets, but in annotations to their quarterly financial statements. This is a legitimate practice under accounting rules, but may make it difficult for retail investors to recognize risks. Some in the market have begun to show concern. Morgan Stanley analyzed the matter in detail in an investor report, while rating agency Moody's also pointed out in a February report that commitments for leases yet to begin were ballooning. [...] https://archive.ph/lOlv5

1 0