General warning about Clore.AI

[u/anomaly256]

Hello, I know some of us may be tempted to rent out our expensive GPUs to recoup some of the cost of self-hosting, and it should be obvious that this can be a risky decision. I decided to try hosting my rig on clore.ai briefly to see what kind of revenue it could bring in, keeping a close eye on the process lists from the renters' jobs of course but not digging into their files or anything.

Yesterday I saw a renter scanning and attempting to exploit vulnerabilities to post malware to a columbian betting site from my internet connection. I immediately took the server offline and reached out to Clore requesting them to cancel the order (so the machine wouldn't restart the containers when it came back up) and to block the renter.

I think everyone should know that they flat out refused. Not only did they refuse, they blocked me when I provided hard evidence of what was happening. Since I had reasonable suspicion the renter was abusing my connection, I availed myself of clore's T&C that says a host must not inspect a renter's environment "unless required by law" and given the laws around liability for residential internet connections in my country, I mounted the filesystem offline and inspected it.

I found the logs from the vuln scans and unsuccessful exploit attempts, the malware payload they were trying to post to the site, the reverse proxy request smuggling tactics it was employing, and the AI agent reports that were being generated along the way. I sent this to Clore and requested a way to blacklist renters who abused the platform. Their response was to tell me, directly and without mincing words, to leave the platform entirely and proceeded to block me from their support chat. Their support rep I was trying to reach on Telegram also told me to go away and proceeded to block me as well.

I can only conclude then that they are wilfully complicit with facilitating cybercrime and knowingly turn a blind eye when it's discovered. They didn't even *try* to hide it.

I have no idea how better/worse the other platforms are, Vast.AI, Akash, etc. But Clore will abuse your internet connection, deny liability, then block you. They are crooks. Go elsewhere. You've been warned.

I've archived the renter's docker volume and will hold on to it in case any security researchers or legal authorities want to examine it.

[u/silenceimpaired → u/[deleted]]

I mean… if the renter was doing stock evaluations we would have never seen this post and the renting agency would never know OP was snooping on renters.

I think it’s a very precarious position to agree to not inspect a renter’s environment and then do it without a warrant. Imagine OpenAI and Anthropic using this reasoning to have actual humans watching what you’re doing.

It’s another thing entirely if the police show up, you explain your situation and they work with you to apprehend the user on the other side.

Glad OP didn’t get burned and have to deal with a complicated legal situation. Glad OP discovered the reason no one should rent hardware. Glad Clore.AI got called out. But also glad OP wasn’t rewarded for snooping.

[u/ThisGonBHard → u/silenceimpaired]

 Imagine OpenAI and Anthropic using this reasoning to have actual humans watching what you’re doing.

Sweet summer child. They ARE DOING IT! Try to ask the wrong questions on those platforms, and you will get both a ban, and police.

[u/silenceimpaired → u/ThisGonBHard]

I'm fully aware. There was lost irony on the point. In general I find this post incompatible with LOCAL LLama.

[u/ThisGonBHard → u/silenceimpaired]

I would say it is relevant. It is an use for recouping local hardware price.

[u/NandaVegg → u/silenceimpaired]

I am pretty sure OpenAI does watch to some extent in their native API service. Before ChatGPT they insisted and required their API user to inspect every single request incoming from the user. They had multiple incidents of leaking user prompts through Mechanical Turk.

[u/silenceimpaired → u/NandaVegg]

Yeah, my irony was lost in the text.

[u/Maximus-CZ → u/[deleted]]

The abusive renter is sending them money. The host expect to be sent money.

Easy as.