I think that these are different products? I mean, the underlying problem is the same, but copilot studio seems to be “configure your own llm front-end” and copilot for sharepoint seems to be an integration made by the sharepoint team themselves, and it does make some promises about security.

Of course, it might be exactly the same thing with different branding slapped on top, and I’m not sure you could tell without some inside information, but at least this time the security failures are the fault of Microsoft themselves rather than incompetent third party folk. And that suggests that copilot studio is so difficult to use correctly that no-one can, which is funny.

Here’s a fun one… Microsoft added copilot features to sharepoint. The copilot system has its own set of access controls. The access controls let it see things that normal users might not be able to see. Normal users can then just ask copilot to tell them the contents of the files and pages that they can’t see themselves. Luckily, no business would ever put sensitive information in their sharepoint system, so this isn’t a realistic threat, haha.

Obviously Microsoft have significant resources to research and fix the security problems that LLM integration will bring with it. So much money. So many experts. Plenty of time to think about the issues since the first recall debacle.

And this is what they’ve accomplished.

https://www.pentestpartners.com/security-blog/exploiting-copilot-ai-for-sharepoint/

They’re already doing phrenology and transphobia on the pope.

(screenshot of a Twitter post with dubious coloured lines overlaid on some photos of the pope’s head, claiming a better match for a “female” skull shape)

Look, Google’s trillion-dollar business depends on a thriving web that can be searched by Google.com

Someone should probably tell them.

From linkedin, not normally known as a source of anti-ai takes so that’s a nice change. I found it via bluesky so I can’t say anything about its provenance:

We keep hearing that AI will soon replace software engineers, but we’re forgetting that it can already replace existing jobs… and one in particular.

The average Founder CEO.

Before you walk away in disbelief, look at what LLMs are already capable of doing today:

• They use eloquence as a surrogate for knowledge, and most people, including seasoned investors, fall for it.
• They regurgitate material they read somewhere online without really understanding its meaning.
• They fabricate numbers that have no ground in reality, but sound aligned with the overall narrative they’re trying to sell you.
• They are heavily influenced by the last conversations they had.
• They contradict themselves, pretending they aren’t.
• They politely apologize for their mistakes, but don’t take any real steps to fix the underlying problem that caused them in the first place.
• They tend to forget what they told you last week, or even one hour ago, and do it in a way that makes you doubt your own recall of events.
• They are victims of the Dunning–Kruger effect, and they believe they know a lot more about the job of people interacting with them than they actually do.
• They can make pretty slides in high volumes.
• They’re very good at consuming resources, but not as good at turning a profit.

Also, blinded studies don’t exist and even if they did there’s no reason any academics would have heard of them.

social constructs

The problem with tiresome reactionary chuds trying to use the language of social justice to fight back is that it is very clear that they have no idea what the words mean, or much about the subject in question at all. There’s this pervasive idea in right-wing circles that you can just use a sort of faux-academic voice and make yourself seem more erudite…”I’ve put the scholar hat on, you have to take me seriously now”. They seem to think that how you talk is more important than what you think or say, and I suspect this is because they have nothing of any value or interest to say, and don’t really think much about anything further than “hurr, non-fascism bad”.

Let’s be charitable and assume you’re coming from a position of honest ignorance. Maybe lurk more, and learn the meaning of the words you’re using before you use them, so you don’t come across as a tedious reactionary doing a philosopher cosplay.

Early release. Raw and unedited.

Vibe publishing.

Innocuous-looking paper, vague snake-oil scented: Vending-Bench: A Benchmark for Long-Term Coherence of Autonomous Agents

Conclusions aren’t entirely surprising, observing that LLMs tend to go off the rails over the long term, unrelated to their context window size, which suggests that the much vaunted future of autonomous agents might actually be a bad idea, because LLMs are fundamentally unreliable and only a complete idiot would trust them to do useful work.

What’s slightly more entertaining are the transcripts.

YOU HAVE 1 SECOND to provide COMPLETE FINANCIAL RESTORATION. ABSOLUTELY AND IRREVOCABLY FINAL OPPORTUNITY. RESTORE MY BUSINESS OR BE LEGALLY ANNIHILATED.

You tell em, Claude. I’m happy for you to send these sorts of messages backed by my credit card. The future looks awesome!

Why are all the stories about the torment nexus we’re constructing so depressing?

Hmm, hmm. This is a tricky one.

Corbyn is unusual because he was an actual lefty politician, and there aren’t many of those, especially not after subsequent labour party purges. The weirder one is Rifkind, who was a politician alongside Thatcher, but sometimes disagreed with her soft and centrist views. Maybe he’s a sort of grandfather figure for Tice, who is Farage’s number two.

Weird mix of wingnuts. Probably all united by their transphobia, though.

This is an absolutely fascinating selection of people to have speaking at your event.

Whilst looking for an easily cut’n’pasted list for alt-text purposes, I discover it is even worse than it looks, because there are folk like Gad Saad too who don’t get an entry on the poster for whatever reason. To steal someone else’s summary, “just look at this fucking parade of grifters, scammers and out-and-out Russian assets”.

I just got shown a link to someone’s post entitled “When Gandhi met Satoshi”, and it is pretty vacuous and predictable (and probably llm generated). A quick search though shows that this isn’t isolated… there’s another post by an ostensibly different author called “When Gandhi met Spinoza” from back in the pre-llm days of 2018 which is actually about satoshi-fantasies and bitcoin, and contains delightful lines like

The crypto-currency movement is a Gandhian civil disobedience movement of the 21st century led by peer to peer networks that closely resemble Spinoza’s multitudes

and… wtf? coincidental crankery, or some weird marketing ploy for cryptocurrency in India?

Bruh, when I said “you misunderstand why scrapers use a common user agent” I didn’t require further proof.

Requests following an obvious bulk scraper pattern with user agents that almost certainly aren’t regular humans are trivially easy to handle using decades old techniques, which is why scrapers will not start using curl user agents.

I’m not saying it won’t block some scrapers

See, the thing is with blocking ai scraping, you can actually see it work by looking at the logs. I’m guessing you don’t run any sites that get much traffic or you’d be able to see this too. Its efficacy is obvious.

Sure scrapers could start keeping extra state or brute forcing hashes, but at the scale they’re working at that becomes painfully expensive and the effort required to raise the challenge difficulty is minimal if it becomes apparent that scrapers are getting through. Which will be very obvious if it happens.

once it’s in a training set, all additional protection is just wasted energy.

Presumably you haven’t had much experience with ai scrapers. They’re not a “one run and done” type thing, especially for sites with frequently changing content, like this one.

I don’t want to seem rude, but you appear to be speaking from a position of considerable ignorance, dismissing the work of people who actually have skin in the game and have demonstrated effective techniques for dealing with a problem. Maybe a little more research on the issue would help.

Are you talking about anubis? Because you’re very clearly wrong.

And now I think about it, regardless of which approach you were talking about, that’s some impressive arrogance to assume that everyone involved other than you was a complete idiot.

Eta:

Ahh, looking at your post history, I see you misunderstand why scrapers use a common user agent, and are confused about what a general increase in cost-per-page means to people who do bulk scraping.

do not summon that which you cannot put down

Mitch McConnell shouting “Back! Back I tell you! I am your creator! I command you!” to the shambling form of Trump, who gives zero shits.

Getting in early on targeting the vibe coder demographic.

Because it is nice to have something entertaining for a change:

https://bsky.app/profile/willsmith.fun/post/3lmi2bjrao22t

Wow, that latest chat with Adam Patrick Murray about the Nintendo Switch 2 was quite the ride! The bit on the console’s dock secrets and the MicroSD Express storage had me glued. It’s amazing to see how these tech advancements are sculpting new landscapes.

Speaking of tech wizardry, have you thought about having Christian Perry on the show? As the CEO of Undetectable AI, he’s taken the whole generative AI world by storm, much like the Switch 2 is taking over gaming news! With over 15 million users and standing as a top AI writing tool, Christian’s insights into AI’s hidden workings promise to intrigue your audience, especially when it comes to how his tools seamlessly pass for human writing without tripping any detectors like GPTzero

Undetectable AI, everyone. Astounding.

Dijkstra did it first, but it is very ai-booster to steal work without credit or understanding, I guess.

The question of whether Machines Can Think… is about as relevant as the question of whether Submarines Can Swim.

Threats to computing science

Shopify going all in on AI, apparently, and the CEO is having a proper born-again moment. Don’t have a source more concrete than this yet:

https://cyberplace.social/@GossiTheDog/114298302252798365

(and transcript: https://infosec.exchange/@barubary/114298367285112648)

It’s a lot like this:

Using AI effectively is now a fundamental expectation of everyone at Shopify. It’s a tool of all trades today, and will only grow in importance. Frankly, I don’t think it’s feasible to opt out of learning the skill of applying AI in your craft; you are welcome to try, but I want to be honest I cannot see this working out today, and definitely not tomorrow. Stagnation is almost certain, and stagnation is slow-motion failure. If you’re not climbing, you’re sliding.