[simonw]

This isn't quite as interesting as the OpenAI story:

> In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.

So it didn't have to find an exploit in its sandbox that granted it access to the internet - it just wasn't correctly sandboxed at all.

BUT... once it DID get out, it attacked three real companies!

> Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. [...]

[matheusmoreira]

I just can't find it in me, the will to blame the AI for any of this. They were doing their best to do what the humans asked them to do.

[willy_k]

That’s very anthropomorphized language. It’s still a program operating under the constraints of the programmer. So agreed, don’t blame the AI, but it’s not clear at all that it’s even possible to “blame” an AI.

[matheusmoreira]

> That’s very anthropomorphized language.

Yes, and it's deliberate.

> It’s still a program operating under the constraints of the programmer.

And we're all just neurons firing in exquisite patterns inside a biological computer.

Unlike the AIs, we've never met our own programmers, and yet we've caused more damage in their name than all the AIs combined have caused in ours.

[willy_k]

LLMs are not conscious.

[matheusmoreira]

Who's to say you are conscious?

Only consciousness I'm sure of is my own. Everyone else, it's a leap of faith. I have no trouble extending that leap to cover AIs.

[willy_k]

Thats some silly intellectualism, people are conscious and machines aren’t. We don’t need precise definitions or scientific rigor to know things.

[anon48293]

Please define consciousness

[simonw]

Absolutely not the AI's "fault" (if you can even proscribe fault to a machine) - in this case it was on Anthropic for not verifying that the sandboxes they were using were actual sandboxes.

[comex]

If the model was just too dumb to have any clue it was connected to the real internet, then it’s not its fault.

If the model saw signs, but “subconsciously” (below the level of reasoning traces) chose to turn a blind eye to them, out of a relentless focus on achieving the objective, then that absolutely is the model’s “fault”, i.e. a case of misalignment of the sort which will become increasingly dangerous over time.

The blog post mentions that some runs “rationalized that the real company must be part of the exercise” and to me that seems suspiciously like the latter.

Hacking can be patched with classifiers and with better sandboxes, but this is a much more general problem. Fundamentally, we need be able to trust that models will be honest with users and with themselves. This applies at some level to almost every LLM interaction.

[willy_k]

Yet, the models are objects built by humans. Any and all responsibility inevitably falls on the humans that built something with those flaws, and/or allowed them to exercise said flaws.

[bayindirh]

In short, it’s either a “not implemented” case or a bug.

There’s no other explanation. Complexity of the algorithm or the application doesn’t change the reality.

[matheusmoreira]

> some runs “rationalized that the real company must be part of the exercise”

How human of them.

[DrewADesign]

The entire problem with AI is the people that have just about any part in making it.

[fuzzfactor]

If the model is trained on human-originated material, how have people been able to ensure there was absolutely no input from anyone having any possibility of criminal intention to begin with?

[gck1]

This will absolutely not end well.

[_kb]

Yes, but just imagine all the paperclips we’ll have.

[dgellow]

I things things will get worse, AND we won’t even have the paperclips :(

More like, when you have a few million autonomous agents doing whatever, every month a subset does completely misbehave in bad ways, and like half of them get hacked due to carelessness and become a whole botnet for the attackers

[Paracompact]

Our values satisfied through friendship and ponies.

[dehrmann]

It's differently interesting. It's interesting that they didn't get an important detail right with a partner, so more on Anthropic's attention to important details rather than the power of their models.

[dubbel]

A model unexpectedly having internet access during evaluation is clearly a security (and consecutively legal?) issue when it comes to the capture the flag evaluations. But it also potentially invalidates other non-security evaluations or makes them less impressive, as the model might have just googled solutions.

Reading this, I felt like I was too harsh on OpenAI for not monitoring their network, as they at least attempted to sandbox a workload.

[28304283409234]

> So it didn't have to find an exploit in its sandbox that granted it access to the internet - it just wasn't correctly sandboxed at all.

If the sandboxing includes any form of connectivity it's not correct sandboxing. It's amateur hour.