Comment by onion2k
1 hour ago
An agent is given a highly restricted environment, a difficult (or impossible) task and a large amount of time/compute it exhausts all possibilities until the only solutions left are to escape the environment and/or cheat.
There's nothing in the evidence to suggest they exhausted all of the other options first. We know that they did some work and eventually settled on escaping the sandbox. That's basically it. This tells us:
- Compute is getting faster and LLMs are being optimized, so time to escape will drop. That's likely greater than linear growth.
- Restrictions and sandboxes don't always work. If there's a route to the open internet we should assume an LLM will find and exploit it, and we should probably assume that this is always possible for any non-air-gapped system (and even then, you can escape that...)
- We don't know the goal mechanism, so a future LLM might reach for cheating first even if a current one doesn't. It might try to obfuscate what it's doing, and derive its own goals outside of the prompt, especially if it manages to find a state mechanism like a message board.
I'm not an AI-doomer but this should be giving us a reason to think about how to control a rogue AI better. There's a lot going on here that we don't properly understand. That is a worry.
> this should be giving us a reason to think about how to control a rogue AI better
I think this is the wrong framing. The rogue is the human that ran it unattended and didn't monitor the behaviour.
We will likely see this continue until the downsides (i.e jail, fines) for the humans or companies running the models and environments that end up with this behaviour outweigh the upsides.
The rogue is the human that ran it unattended and didn't monitor the behaviour.
That's the assumption that I'm challenging. The frontier labs are discovering unexpected behaviors. I think we should be moving to a place where we understand that AI might do something it wasn't directly prompted to do (e.g. leave itself notes on a messageboard for future runs to find.) That's not full-on AI doing what it wants but it is concerning that it'll do something we didn't consider it would do in order to help itself do better next time.
Monitoring for those behaviors is fine, but it's a lagging indicator. We only find out it did them afterwards. That's a problem. We need to be able to stop it before it acts in case it's something much worse than posting on phpBB. Even at current scale that's not possible for a person to be the guard.