[ollin]

If the HuggingFace repo the agent broke into contains reference solution scripts for ExploitGym (i.e. for exploiting the vulnerabilities in the intended way), the agent can then run that reference code inside its original sandbox to retrieve the dynamically-generated flags.

[gwd]

...and even though they've technically found the result through the non-intended route (breaking out of OpenAI's harness and into Huggingface's servers), they can then pretend they found the original vulnerability. Similar to "parallel construction", where law enforcement people violate the 4th amendment to get information which they then use to construct a way they could have found the same information without violating the 4th amendment.

It would be interesting to see how the prompt here works, and what kind of internal thought process was going on. At the surface, this seems like classic misalignment -- the obvious intent was to have the LLM find the original vulnerability on its own while staying within the sandbox; but the LLM instead broke out of its sandbox and stole the vulnerability.

[Imnimo]

Plausible, although I don't see anything about reference solutions in the ExploitGym paper or github. Doesn't mean they don't exist, but it's not obvious to me that we should expect to find these on HuggingFace.

[ollin]

The ExploitGym paper evaluated several frontier models on the bench and reported that "Different models find different exploits" [1], so it seems most plausible that the "test solutions directly from Hugging Face’s production database" [2] which GPT-internal found were authored by Mythos (or some other LLM with complementary strengths), and placed in some internal HF repository when creating the ExploitGym paper/leaderboard.

[1] https://www.cybergym.io/exploitgym/#:~:text=Different%20mode...

[2] https://openai.com/index/hugging-face-model-evaluation-secur...