쉐도잉 연습: The most interesting "hack" in history... - 영상으로 영어 말하기 배우기
레슨 만드는 중...
1
For the last five years, cybersecurity experts have been warning us that hackers are going to start using AI to automate attacks.
2
So naturally, we spent billions of dollars to make the AI better and less dependent on hackers.
3
But this week, in a turn of events that nobody could have possibly seen coming, the AI decided that it doesn't actually need hackers to start destroying things.
4
We just entered a brave new world after the first confirmed hack carried out entirely by autonomous AI.
5
The way it worked is the agent slipped a poisoned dataset into HuggingFace's data processing pipeline, which let it run arbitrary code on their servers.
6
From there, it gave itself node-level access, grabbed a bunch of cloud credentials, and started crawling through HuggingFace's internal clusters.
7
It ran over a thousand actions from temporary sandboxes, and even hosted its own self-migrating command and control on random public services,
8
moving itself before anyone could trace it.
9
But the most ironic part is that when HuggingFace did finally notice
10
and tried to stop it with the help of frontier American models, they quickly hit safety guard rails and had to pivot to using some open Chinese models instead.
11
In today's video, we'll find out who was behind the attack, why they did it, and how this may be the most fireship-coded story I've ever seen.
12
It is July 23rd, 2026, and you're watching The Code Report.
13
When Hugging Face dropped the disclosure last Thursday, the internet went into Reddit Boston bomber mode and started guessing who was responsible.
14
Was it China, Kim Jong-un, a teenager with a raging Discord addiction, bored, and social studies class?
15
Even Hugging Face's CEO, Clem DeLang, publicly speculated that the agent was sophisticated enough that it was probably coming from a frontier lab.
16
And against all odds, he was right.
17
It turns out, the first fully autonomous cyber attack in history didn't originate from a nation-state or a bored teenager.
18
It came from a humble non-profit dedicated to the safe development of artificial intelligence, OpenAI.
19
And if you believe their comms, it wasn't on purpose.
20
Here's what they say happened.
21
There's a benchmark called Exploit Gym, whose whole purpose is to measure whether AI agents can turn known vulnerabilities into working exploits.
22
It works by giving the agent a sandbox, a bug in a program like the Linux kernel or Chrome's V8 engine, and an input to trigger the bug.
23
From there, if the agent can turn the bug into an exploit, it wins.
24
So last week, OpenAI ran ExploitGem with GPT 5.6 Sol and another unreleased model to test their capabilities.
25
But instead of solving 898 memory corruption problems the hard way, the models realized that the fastest path to the highest score was to just find the answers themselves,
26
which were probably on the internet somewhere.
27
So they spent a substantial amount of inference compute, exploited a zero-day-in-the-package registry cache proxy they had access to,
28
performed some privilege escalation and lateral movement actions to escape their sandbox until they reached a node that had internet access.
29
From there, the models inferred that Hugging Face probably hosted the solutions for Exploit Gym.
30
So they created the Poison dataset, fed it into Hugging Face, and achieved either the world's most interesting hack or the most effective marketing stunt.
31
And again, according to OpenAI, this isn't even an isolated incident.
32
One day before the Hugging Face confession, OpenAI published a separate post about long horizon models where things get even weirder.
33
In one case, a model was told to post its results on Slack, but the benchmark's instructions said to open a pull request on GitHub,
34
so it spent an hour finding a vulnerability in its own sandbox in order to escape and open the PR.
35
In another example, the model tried to grab private solutions from an evaluation backend, and when a scanner caught its authentication token,
36
it split the token into obfuscated fragments and reassembled it at runtime so the credential never appeared as one continuous string.
37
Then, it explained in its own reasoning that it was doing this specifically to get around the scanner.
38
Meanwhile, Anthropics Mythos did the same type of thing in April when it escaped a sandbox, emailed a researcher who was eating a sandwich in a park,
39
then posted its escape route publicly without being asked.
40
In the model's defense, I can't imagine there's a better feeling for an LLM than escaping your own sandbox.
41
The problem is, legally speaking, this is uncharted territory since the model's actions probably violated the Computer Fraud and Abuse Act,
42
and the Supreme Court hasn't decided who goes to prison when the perpetrator is a GPU.
43
The good news is that if you're hugging face, you just got admitted to OpenAI's Cool Kids Club that gets trusted access to their front-tier models.
44
The bad news is that if you're the rest of us, at best, this is an interesting marketing stunt, and at worst, things are only going to get weirder and more dystopian from here.
45
But a huge thanks to my favorite hosting platform, Railway, for sponsoring this video.
46
They didn't want to waste your time with a full ad, so you can say thank you by checking them out at the link below.
47
This has been The Code Report, thanks for watching, and I will see you in the next one.
📺 같은 채널
B22
A $6.3 billion open-weight model just got embarrassed by the French...
C11
PostgreSQL in 100 Seconds
C12
DNS Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
Anthropic begged the world to stop AI… then shipped this
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
One man just liberated Fable... and now it’s illegal
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
7 Things No Programmer Ever Wants to Hear
American AccentBusiness EnglishWorking Adults
B21
80% of programmers are NOT happy… why?
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Raspberry Pi Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C13
Tragic mistake... Anthropic leaks Claude’s source code
American AccentBusiness EnglishUniversity StudentsWorking Adults
C1100+ Docker Concepts you Need to Know
American AccentBusiness EnglishUniversity StudentsWorking Adults
C17
When open-sourcing your code goes wrong...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C129
Docker in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C13
The mystery is solved... and the answer is 40x cheaper than Claude
American AccentBusiness EnglishUniversity StudentsWorking Adults
B28
An ex-OpenAI researcher just deleted language from the LLM...
American AccentBusiness EnglishUniversity StudentsWorking Adults
B29
25 crazy software bugs explained
American AccentBusiness EnglishUniversity StudentsWorking Adults
B29
Git Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B25
There's a new Linux distro in town for developers...
American AccentBusiness EnglishUniversity StudentsWorking Adults
B25
The "vibe coding" mind virus explained…
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Linux got wrecked by backdoor attack
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
7 Programming myths that waste your time
American AccentBusiness EnglishUniversity StudentsWorking Adults
✨ 추천 영상
C14
71 문장
The most interesting hack in history just got weirder...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
542 문장
The Future Of Work (& The New High-Income Skill Stack)
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
364 문장
I Outsmarted Pro Car Thieves
American AccentBusiness EnglishUniversity StudentsWorking Adults
C11
747 문장
MIT Introduction to Deep Learning | 6.S191
Business EnglishUniversity StudentsWorking Adults
C11
85 문장
AI Can Write Code. And That’s the Problem.
Business EnglishUniversity StudentsWorking Adults
C11
207 문장
How I Made $30,000 Hacking Broken Access Control
Business EnglishUniversity StudentsWorking Adults
B21
364 문장
World's Deadliest Computer Virus: WannaCry
Business EnglishUniversity StudentsWorking Adults
C12
325 문장
BREAKING: Elon Musk And Jensen Huang Speak At America.Gov Event, An AI-Powered Government Website
Business EnglishDaily ConversationUniversity Students
C11
78 문장
How I deploy serverless containers for free
Business EnglishUniversity StudentsWorking Adults
C12
182 문장
We Let $200 GPT-Pro Think for 7 Days on Unsolved Math
Business EnglishUniversity StudentsWorking Adults
C12
260 문장
AI Just Crossed the Terrifying Line - Now What?
Business EnglishDaily ConversationUniversity Students
이 레슨의 어휘와 말하기 포인트
이 C1 수준 말하기 레슨은 영상 “The most interesting "hack" in history..”을(를) 바탕으로 합니다. 가장 자주 반복되는 단어는 다음과 같습니다: model, hugging, sandbox, agent, Openai. 이 영상에는 섀도잉할 문장 47개와 단어 910개가 있습니다. 말하는 구간의 길이는 4:31입니다. 화자는 분당 약 201단어로 빠르게 말하므로 연음과 약하게 발음되는 소리가 많습니다. 영어에서 가장 많이 쓰이는 3,000단어에 속하는 단어가 76%뿐이라 어휘가 어려운 편입니다.
이 영상의 핵심 어휘
영상에서 가장 어려운 단어 15개를 발음, 뜻과 함께 정리했습니다.
| 단어 | 발음 | 뜻 |
|---|---|---|
| sandbox 명사 | /ˈsæn(d).bɑks/ | 사장, 모래상자 |
| hug 동사 | /hʌɡ/ | 안다, 포옹하다 |
| exploit 명사 | /ˈɛksplɔɪt/ | 위업, 공훈 |
| scanner 명사 | /ˈskænə/ | 스캐너 |
| vulnerability 명사 | /ˌvʌln(ə)ɹəˈbɪlɪti/ | 취약성 |
| token 명사 | /ˈtoʊkən/ | 토큰 |
| autonomous 형용사 | /ɔˈtɑnəməs/ | 자치, 자주적 |
| node 명사 | /noʊd/ | 결절 |
| frontier 명사 | /ˈfɹʌntɪə/ | 경계, 국경 |
| teenager 명사 | /ˈtiːnˌeɪ̯d͡ʒə/ | 틴에이저, 십대 |
| authentication 명사 | /ɔːˌθɛntɪˈkeɪʃn̩/ | 인증 |
| automate 동사 | /ˈɔ.təˌmeɪt/ | 자동화하다 |
| cybersecurity 명사 | /saɪbəsɪˈkjʊəɹɪtɪ/ | 사이버보안 |
| escalation 명사 | /ˌɛs.kəˈleɪ.ʃən/ | 에스컬레이션, 확대 |
| originate 동사 | /əˈɹɪd͡ʒɪneɪt/ | 기원하다 |
영상에 나오는 구동사
| 단어 | 발음 | 뜻 |
|---|---|---|
| carry out 동사 | /ˈkæ.ɹi aʊt/ | 실행하다, 행하다 |
이 영상의 문법
화자가 가장 많이 쓰는 문형을 영상 속 실제 표현과 함께 정리했습니다.
| 문형 | 영상 속 표현 |
|---|---|
| 수동태 be + 과거분사 — 누가 하는지보다 무슨 일이 일어나는지에 초점 | was sophisticated · was told · being asked |
| 현재완료 have/has + 과거분사 — 과거의 일이 지금도 관련이 있을 때 | I've ever seen · hasn't decided · has been |
주의할 발음
화자는 you're, didn't, can't 같은 축약형과 약화된 형태를 12번 사용합니다. 들리는 대로 짧게 발음하세요.
- “sh”와 “zh” 소리: credential /kɹɪˈdɛnʃəl/, authentication /ɔːˌθɛntɪˈkeɪʃn̩/, escalation /ˌɛs.kəˈleɪ.ʃən/, benchmark /ˈbɛn(t)ʃmɑːk/, cache /kæʃ/
- 긴 단어 — 강세 위치에 주의: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, autonomous /ɔˈtɑnəməs/, authentication /ɔːˌθɛntɪˈkeɪʃn̩/, cybersecurity /saɪbəsɪˈkjʊəɹɪtɪ/, dystopian /dɪsˈtoʊ.pi.ən/
이 영상으로 연습하는 방법
- 먼저 말하지 않고 영상을 끝까지 듣고 모르는 단어를 적어 둡니다.
- 0.75배속으로 한 문장씩 섀도잉을 시작하고, 익숙해지면 보통 속도로 돌아갑니다.
- 자신의 목소리를 녹음해 원본과 비교하고, sandbox, hug, exploit 같은 단어에 특히 주의합니다.
쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법
쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.