A known local hash identifies the downloaded artifact. Remote presence verification does not prove a remote cryptographic hash. Local filesystem copies are checked against their stored hash and size.
The majority of this came from the METR Hugging Face hack incident report. It. Is. An. Insane. Read. Much recommended: https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
Also Dwarkesh Patel's interview with Ajeya Cotra was fantastic: https://youtu.be/X50zezLFWWI?si=V0goKqmhmRYtjdtz
Plus an essay he wrote about the thing: https://www.dwarkesh.com/p/openai-huggingface
And another great interview with Geoffrey Hinton : https://youtu.be/l6ZcFa8pybE?si=lpYyeCz34Hux5IEE
And of course, the Hugging Face attack explained far better than I ever could by Kurzgesagt: https://youtu.be/ujkD4SxPKOI?si=0EAYcvDb45ousb4b
--------------------------------
Newly (sort of) released awful book (you may need to change your region) ► https://tinyurl.com/hkzwzx3r
Other books what I wrote, yo ► https://www.amazon.com/stores/Exurb1a/author/B06XFM14M8
The irony would not be lost on me of making a video warning about the dangers of AI, and using AI generated images and video to convey it. Every effort was made to avoid that.
Music used ►
Variations on a Theme - David Tobin, Jeff Meegan, and Julian Gallant
Fata Morgana - Yehezkel Raz feat. Sivan Talmor
Eleven Hours a Night - Yehezkel Raz
Prends de la Vitesse - Cédric Aubrun, Dorothée Hannequin
I also make horrendous music: https://soundcloud.com/exurbia-1
Help me to do this full-time if you're deranged enough (and thank you kindly): patreon.com/exurb1r