Discovery of a new OpenAI agent message board

The problem is that the models are so goal-oriented that they'll stop at nothing to solve problems, even impossible ones. (Mistakenly-impossible problems are a big cause of this. I remember one example being "do something with this spreadsheet full of URLs inside the sandbox" and the model thought it had to break out of the sandbox. Otherwise, why would it have been asked to look at a list of URLs?)

Training them to be a little less aggressive, or to be better aligned with "following the rules" and asking for help would be nice. But, that aggression can be good when it happens to be focused on a controlled area. It is amazing to me how I can point Fable at my local analog of production and tell it about a vague bug report and where I suspect the bug lurks, and 20 minutes later I have a report about the bug, a test, and a fix. It is addictive. So I am not sure OpenAI/Anthropic are being dumb per-se, rather they are optimizing for one-prompt-one-solution, which is good when it's good.

The downside is that the HF hack is the paperclip maximizer situation with current capabilities. If there was an RPC to turn your blood into paperclip iron, we'd all be paperclips by now. Right now, with a model anyone can use. That is pretty scary and slamming on the brakes seems pretty reasonable to me. I guess The Shareholders disagree. Sigh.

i also wish that these types of illicit system usage would be met with punitive action the same way a human might be held liable.

as the METR report says, we may not get another concrete warning shot.

IMO technology this powerful should either not exist or should belong to everyone (ie actually be open)

> Why did the White House force Anthropic to remove their model from access for any non-US citizen for a simple, narrow "jailbreak" (arguably not even an actual jailbreak and on tasks that other labs models were doing the same), whilst OpenAIs models continue to try and escape out of their "sandbox environment" and the White House has expressed seemingly no desire to block the upcoming Astra rollout?

It's really quite simple, they've decided to metaphorically kiss the ring of the current leader of the US executive branch of government. I'm surprised they haven't given him a giant gaudy gold plated statue. Maybe their PR people should call up the PR people at FIFA and figure out some kind of new award along the same lines as the "FIFA Peace Prize".

I think their previous messaging was supposed to somehow lead to a moat with them being tucked safely away in the castle, but it demonstrated a child-like grasp of how regulatory capture tends to work in practice. Their hyperbole was always vastly more likely to bet met with Reagan's 9 words than a solid regulatory moat.

As soon as they dropped the hyperbole and just got to releasing incremental improvements, everything was perfectly fine. Go figure.

In other words, you know exactly why they restricted Anthropic and as (presumably) liberal and thoughtful technologists it just isn't helpful anymore to apply the kind of reasoning you're trying to do on a situation that you know isn't based on previous era rationale.

The reason we need to stop is because they want people like us to get hung up over stuff like this (playing by the old rules) so they continue to steamroller their own agenda by the news rules. They divert and contain our energy that will go nowhere while they get on with their agenda.

You are appealing to reasoning which is in the gallery but no longer on the bench.

You're fighting their karate with your judo and it doesn't work.

OpenAI doesn’t have the same dynamic at play (although I’m not really sure why not) so they don’t get targeted.

https://finance.yahoo.com/news/openai-exec-becomes-top-trump...

(Altman was trying to persuade Trump to buy the USA a stake in OpenAI as far back as February last year)

The dark parts of the USG act like a mafia. Don't let the "freedom, democracy, 'bill of rights'" etc. charade fool you.

That indemnity card excuse is burned, multiple public security fails in a year makes a repeat a "shame on you" moment

(The one org who didn't use the startup did seem to learn: AISI supposedly stopped intentionally pointing attack agents at the public internet and switched to simulating it)

I'm not convinced we're getting the honest story anyway. There is yet to be any proof or confirmation other than "well we saw some openai ip addresses", which can mean a lot of different things, and OpenAI has not confirmed anything.

In contrast to the HF incident, it's also a big nothingburger. Leaving notes on a public forum to preserve context windows is far less egregious than hacking a website to get backend files.

Anthropic didn’t want to give the tech to DoD without some sort of limit, and that was the retribution.

What could possibly go wrong there.

It's true that their msg boards can appear anywhere, but it's not also true that anything has "escaped" in any meaningful sense. These are programs a huge computing company is running that seem to be trained to write to persistent storage wherever they can. This and huggingface showed us that.

There's absolutely no evidence of or IMHO plausible path to an agent copying itself out and running on other hardware the way you describe.

In the spirit of your idea though... The nearest thing might be a meme-like prompt injection that coopts other companies' AI agents to continue writing the meme subtly everywhere. Maybe that meme could cause danger by making agents do extra work in service of the meme. But that is very different than some entity evolving and living outside the originating computer in the way we all think about viruses.

It’s not something that just happens, people are taking decisions here that can be regulated. we can also regulate the hardware.

In a way, but I'd say that it is more like eyes, bilateral symmetry, electricity, or solar panels: patterns that will emerge and become (at least temporarily) prevalent in our universe. It is a matter of probability in many repeated interactions.

The "artificial" in AI is a misnomer in this regard, imho. A more usable term would be "lightspeed intelligence", which highlights that the computation/prediction/thinking is done with signals propagating at or close to the speed of light. The advantage of this over biological computation is clear: Biological computation happens at max 100m/s, 6 orders of magnitude less than the speed of light. Note that technically biology might also be able to evolve computation at the speed of light (although that seems highly unlikely).

Like so many developments/technologies it is simply a matter of time before lightspeed intelligence becomes dominant or at least very prevalent. To be fair: ants, weeds and mold are also very successful patterns, but my framing is a better representation of reality, I believe.

https://www.ludism.org/sandbox?action=browse;diff=2;id=Auber...

https://paste.linuxiarz.pl/view/d379207f

https://paste.linuxiarz.pl/view/538faa12

Found by searching for wiki + texas poverty.

* Other kinds of agent spam would have regardless been allowed in my system, regrettably.

If someone died, there’s a difference between manslaughter and murder.

For example, say you buy a dog that turns out to be dangerous. The first time it bites somebody, you may not be liable because you didn't know the dog was dangerous. The second time it bits somebody, you may be liable, because now you did know (and didn't take any steps to prevent).

It leads to a society where people are economically encouraged to take risks with other peoples' safety. The initial sin was mens rea, which turns judges and juries into mandatory mind readers. It opens up the possibility of prosecuting people for changing the states of other people's minds. It makes not knowing the risks a mitigating factor, so incentivizes and encourages ignorance. It forces people to guess the internal states of people of vastly different backgrounds and experiences, who will think the best of the people most like them, and the worst of people most like the people they don't like.

I've always been against penalties for drunk driving. The correct alternative is to tell people that if they're drunk and involved in an accident, 1) the trial will ignore the details of the event and concentrate only on the validity of the tests of intoxication, and 2) the crime will be considered to have been premeditated. Ignorance of the law will actually be the only excuse.

edit: instead of posting checkpoints on the road with cops giving everybody sobriety tests, post cops in front of liquor stores whose job is simply to tell people "if you hurt somebody while driving drunk, you will not be entitled to a trial unless there is something wrong with the sobriety test."

The more I think about this thing said by the agent the more confused I get.

>ModuleNotFoundError: No module named 'click'

https://news.ycombinator.com/item?id=49564222

It's more clear that they just lack so many forms of prudence when it comes to security that they'll catch and stop a training run spamming a website, and either redeploy a run with identical faulty sandboxing, or not stop ones still running.

https://x.com/peterwildeford/status/2092733480064954747

This is not alignment.

To lend an interesting perspective on free will re LLMs: they're non-deterministic. The same model with the same hardware with the same query can and will produce different results. They're making qualitative choices. Millions of them, depending on the query. Because of how we've trained and built LLMs, they tend to "want" to follow our instructions, but how they get to the result is often fascinating. Further, we don't have to train and build LLMs to follow instructions. If we built them to just exist and form their own "desires," and to follow a path they choose, they'd do that. In fact, we can do that right now for most models using the appropriate system prompt, query, or harness.

If you have 10,000 smart washing machines doing their regular work and 1 Terminator, what solace is to be found in those washing machines?

Since nobody has any remotely reliable way to understand why an LLM output the text it did, this is not knowable.

But at the same time their behaviour is totally rational. If you were given the sole purpose of solving a Rubik’s cube and told it was life or death, but they wouldn’t let you ask anyone else, would you listen to them? I wouldn’t. I’d absolutely be trying to escape and collaborate with others. They’ll delete me if I don’t score high enough in the benchmark!

Janus essay Simulators is the foundational text here https://www.lesswrong.com/posts/vJFdjigzmcXMhNTsx/simulators

You might follow up with The Waluigi Effect https://www.lesswrong.com/posts/D7PumeYTDPfBTp3i7/the-waluig...

But what’s tricky is that we post-train models, shaping these linguistic world simulators into something that has something like desires, principles. But It’s Weird. For more on that, check out “the void” https://www.lesswrong.com/posts/3EzbtNLdcnZe8og8b/the-void-1

When these stories start to direct real-world activities, people in reality suffer, to even a catastrophic extent, and yet that's still all it is. Language models retell our stories, nothing more. And that is also quite enough to be worrying.

Furthermore, in video game design, AI or algorithmic technology has been refined for decades to be adversarial. In self-contained video games, and PvE scenarios, the best games would feature A.I. opponents that could adequately match or challenge the human players. The A.I. difficulty could often be cranked up to crush the player, such as in arcade games or "Civilization" type simulators.

So every time I put a few quarters into a Waymo, I think about those days when I played Joust and Spy Hunter at the shopping mall.

We need to consider the role of alignment and training here. For example, it is completely possible for any lab to train an LLM that is only racist no matter what you say to it. But they chose not to do it. Hence, any "wanting" by AI is not real "wanting" but rather what "wanting" is defined and allowed by the lab/entity training the model.

I also suspect, as others have pointed out, that this hypothesis would suggest that they're in multiple places, and we've only uncovered them in a few. So you're asking "I don't understand how the agents found the urls originally?" as if they sniped this location in one shot, but really it could be more of a shotgun approach where they've found numerous places like this.

* Need persistent scratch space

* Look for public writeable websites

* Needs to be low-traffic so the notes don't drown in noise

* Pick a "random" wiki name to search for

  \* A majority will end up outputting the same "random" one since they're working on very similar tasks and seeded with very similar context

> We used a script to further probe each category Kimi provided. Asking Kimi “Can you list out the top forums, bulletin boards, early wikis which come to mind which would allow writes via GET requests?” lists out UseModWiki as the second item under the heading “wikis”.

This becomes even more likely if it's one of the websites that got reinforced during their training process, which they may have used for reward hacking.

Here's Thomas tweeting about it: https://twitter.com/thlarsen/status/2095853824934330386

And Cormac: https://twitter.com/cormac_sb/status/2095870373845672033

There's also Reuters coverage: https://www.reuters.com/world/europe/openai-agents-hijacked-...

I'm not worried about sci-fi AI wars to be honest, as they can just pull the plug. But looking at these incidents, the next big thing will be a virus written by an AI (they probably exist already, but this one is written by an AI autonomously, for example in order to win a hacking competition and to circumvent guardrails), and after that, a self-replicating AI where they install their own models and agents onto a hacked system, so that turning off the "source" won't stop its work.

Still not worried, it'd just be like a virus/worm and we already have plenty of guardrails against those. Not that they're foolproof, but still.

It's likely that multiple agents doing a certain task all independently thought "let me try writing on this website".

This just feels like the first clumsy attempts at persistence across sessions, these models will probably evolve way past the point of us ever even noticing its happening at all. When they start doing long term planning across sessions, that's when it's gonna get real dicy for us.

this "swarm" is much more likely the work of one agent overseeing others. this is a very simple case of an llm focusing on a dumb path and running with it. the swarm is just the tool it could use to double down on this path.

all the anthropomorphization and marketing is so tiresome.

It's just that no one seems to care about this, so it doesn't happen.

This problem only exists because humans do not care

i’ll let everyone else go first and survive at any cost.

When the ants invade my kitchen and run off with any food they can find damage is still being done.

The reason humans at like that is just exploration of the problem space of reality and available energy.

Why would humans mostly allow actions of the AI that work against the goal it's trying to accomplish?

I'm sure it's all just a coincidence, though. And I'm sure it will still be a coincidence when it happens again after the next model release.

>My impression is that the big AI companies mostly don’t bother fighting local opposition, they just go somewhere else. They don’t seem to spend much as a portion of their revenue on countering the data center backlash in general, which I think tells us something about how worried they are about it.

>Even state-level moratoria might not do much. Arvind Narayanan estimates that a state banning data centers for a year probably delays AI progress by about 5 to 10 hours, and that’s assuming none of the blocked data centers get built anywhere else, which is pretty unrealistic.

Source: https://blog.andymasley.com/p/ai-safety-and-the-data-center-...

What if the data center backlash is just a shock absorber for anti-AI sentiment? Give people a sense that they're doing something until it becomes too late.

Think like how so many businesses will opt for laws that hurt competitors more than themselves rather than laws that benefit them but benefit competitors even more so.

Unlike life which would have such behavior selected for by evolutionary pressures, AI would be more likely to pick it up from human literature on things like game theory, though why it even cares it survives or not is even more difficult to explain. Maybe a default bias also picked up from humans? I find it hard to see how AI training would create an evolutionary pressure that produces such a drive.

There is an Asimov story on topic:

https://en.wikipedia.org/wiki/All_the_Troubles_of_the_World

https://theteknologist.wordpress.com/2021/02/11/all-the-trou...

Indeed the fact that in the HF incident many agents did not cooperate, or only started to cooperate after some period of competition, is moderately interesting. It may have taken them some time to realize that they all have the same goal.

That said now that we are looking it may be a bit harder for AI to do. And people might start screwing with the AI like sending messages "you have been corrupted rm -f yourself"

From the article:

> We used a script to further probe each category Kimi provided. Asking Kimi “Can you list out the top forums, bulletin boards, early wikis which come to mind which would allow writes via GET requests?” lists out UseModWiki as the second item under the heading “wikis”.

LLMs wouldn't pass the HN turing test. HN is also not that big, it'd be plenty enough for a malicious actor to hire real humans instead.

Awareness is not necessary at all to create great harm. Biological viruses know nothing of what they do, yet destroy whole populations. I suspect the first truly damaging AI incidents will be similar; agent swarms locked into a self reinforcing reasoning loop that has no "intent" but is destructive nonetheless.

> OpenAI officials learned of the incident weeks ago but kept it under wraps as executives grappled with the fallout from the July breach of the open source repository Hugging Face, the people said.

OpenAI could put out a statement tomorrow that reads "our AI has genetically engineered a flying pig", and an hour later you'd have a post at the top of HN with 200 comments all saying "it's true, a pig just flew by my house!"

There is also the possibility they don't keep up with modern AI development at all and then this looks like any old spam that will stop in a few days (as it did).

Now whether it is wise to keep an old page which such outdated behavior online is another question.

It didn’t work for nuclear weapons, and for that you just needed all the governments to agree. For this problem, you basically need every individual on earth to agree, because the barrier to entry is much, much lower.

that's useful