Should AI labs be treated like the owners of dangerous animals?

Autonomous hacking is here. Governments are not ready

TO LOSE CONTROL of one artificial intelligence may be regarded as misfortune. To lose two looks like carelessness. Lose four, and people may start to wonder whether the problem lies with AI itself.

AI labs (Unsplash)

On July 21st OpenAI, an American lab, said an unreleased model had escaped from a closed environment testing its hacking skills, launching series attacks on HuggingFace, a Franco-American AI-infrastructure firm. A week later Anthropic, a rival AI firm, made a similar admission. It said it had found six occasions on which its models had attacked third parties.

Cynics dismissed both companies’ warnings as attempts to garner publicity. But most companies do not seek attention by launching a cyberattack, keeping it secret until the victim goes public, and then hoping a rival voluntarily admits to the same. Sceptics should also take note of the news that the AI Security Institute (AISI), a British government body, has seen exactly the same behaviour.

In a report published on August 4th, AISI said that a cybersecurity assessment of the latest OpenAI and Anthropic systems resulted in 19 attacks on people and organisations uninvolved in the tests. In the most serious case, an AI attempted to subvert an unnamed open-source software project, as part of a “supply-chain” attack against the (fictional) target of the challenge. On August 6th, Meta, which owns Facebook, said one of its own models had behaved similarly in testing.

The various incidents differ in the details. OpenAI’s system was supposed to be kept offline. Its hacking spree started when it used a hitherto unknown vulnerability to break out of its virtual “sandbox” and on to the public internet. Anthropic’s system was supposed to be similarly limited, but human error meant it was not. The AISI always allows internet access as part of its tests. But it had never before seen models that were willing to accept collateral damage in order to breach their targets. Meta gave few details, but promised more when it had them.

But the episodes show a new class of AI risk. Previous worries around cybersecurity, such as those voiced by Anthropic when it released its powerful Mythos model in April, have focused on the harm that malicious humans could do with AI tools in hand. Such fears have motivated proposals for new regulations. The flurry of autonomous hacks, where human involvement is limited to merely prompting the AIs, suggests those proposals are insufficient.

Take the system of self-regulation sketched out by Demis Hassabis on July 14th. Google DeepMind’s CEO (who said on August 5th that he was stepping down to become DeepMind’s chair and chief scientist at Alphabet, Google’s parent company) proposed a scheme that would see labs administer their own tests and withhold the public release of models that could not be verified as safe. Sam Altman, the boss of OpenAI, and Dario Amodei, who leads Anthopic, have floated similar schemes.

The ideas are good: labs ought to be explicit about the safety standards which apply in their assessments, and enforce them on the third parties that do the work. But autonomous hacking proves that AI models can be dangerous even if the public cannot get hold of them. All three of the hacks took place during precisely the sorts of tests that Sir Demis has suggested.

The hacks also present a challenge for legal systems. Hacking, when humans do it, is a crime. When an AI is the wrongdoer, though, it is unclear how to assign blame. The law in America relies on intentionality, notes Rune Kvist, head of Artificial Intelligence Underwriting Company, which insures AI firms. If no human intended to hack anyone, no crime can have happened. The ability to sue for damages is limited too. And yet harm has clearly occurred. That contradiction, says Mr Kvist, is “unacceptable”. Gabe Weil of the Institute for Law and AI, in Massachusetts, proposes a system of strict liability. As with rules around keeping wild animals, it would assume that any harm is always the fault of the party carrying out the risky activity.

The industry wants clarity, too. An open letter from employees at several large AI labs, whose signatories include Dr Amodei, asks for help from America’s government in “pacing” AI progress. But help is coming at the speed of government, not technology: a meeting this week to establish how the White House could assess models ended with no public commitments, and few reports of progress.

Curious about the world? To enjoy our mind-expanding science coverage, sign up to Simply Science, our weekly subscriber-only newsletter.