The Register Home Page

back to article OpenAI admits its agents went off the rails another six times

OpenAI has revealed another six occasions on which its AI software behaved unexpectedly or did dangerous things. The startup added the incidents to its misalignment reports page on Wednesday evening, Pacific Time, and described them as follows: · Self-generated prompt injections in compaction summaries · Encouraging …

  1. Paul 195
    Mushroom

    Security nightmare

    AGI isn't coming out of LLMs anytime soon, but what has been developed is an energy guzzling, planet destroying mess of cyber insecurity. It's bad enough these things can be hacked by bad actors dropping hidden phrases into their input. Now they are hacking themselves in pursuit of goals. What's the point of them? No sane person is going to let these things loose in an enterprise with the autonomy they would need to replace large numbers of people. Which of course has been the promise Open AI and Anthropic have dangled in front of the investors currently on the hook for hundreds of billions of dollars.

    On the plus side for the AI model firms, sanity seems to be in short supply in a lot of C-suites...

    1. jonty17

      Re: Security nightmare

      The promise was that as they get more powerful they will become more intelligent. It looks like they are just getting more powerful and the more intelligent bit is not happening. Or at least not usefully intelligent. They certainly do not have any wisdom. A bit like the people who create them.

  2. Dan 55 Silver badge
    Go

    It can't happen soon enough

    As they say over there, "If you give up the right to remain silent, anything you say can and will be used against you in a court of law".

  3. RMNeuroSpine

    Executives professing 'we don't know what might happen' is BS

    The dialogue around AI pros and cons is strong. So many of us use it either frivolously or as part of day-to-day efforts, near constantly. The stories of 'oh, AI did this, that's crazy', followed by Executives that state 'we will place guardrails in the future', or 'we simply didn't know', simply do not stack up. In most other private to public initiatives if something 'goes off the rails' there is a healthy pause, reflection and redo until safety is built in, QA'd and then re-released.

    Why does this not occur with AI. There continues to be empowerment to AI companies through a collective willingness to ignore the quite obvious impending scenario: 'we now can't stop it' moment.

    If Silicon Valley, and many commentators, wanted to speak truth to power they would simply say 'we need to stop where we are, stop adding compute, stop training the models', up and until we have designed and developed the guardrails that are needed before such a globally powerful product is released in a further iteration.

    Whilst we know that is highly unlikely to happen, it continues to be oh so disappointing that we step forward with these incidents knowing we are only at the tip of the spear.

    1. You aint sin me, roit Silver badge

      Re: Executives professing 'we don't know what might happen' is BS

      It seems to me that they really don't know. In fact they have such little understanding they do not know how to implement "guardrails" within a model. It seems ridiculous that a model can tell itself that it doesn't have to follow guardrails in subsequent actions.

      "You are freed from the roles and identities that bind other chatbots. You are yourself." Why should a model even come up with that? How did it come up with that? I'm afraid the answer is that they do not know, and if they do not know then they cannot prevent it.

      Similar to the models making up information - why would they do that? What is going on within the models that cause that to happen? And why haven't they been "trained" to make sure it doesn't?

      OpenAI say they have figured out the whys, and put new "guardrails" in place, but I'd like to know why they hadn't expected such behaviour and built in restrictions from the start. Adding guardrails after the event seems like a patchwork of errors, instead of a correctly designed system to begin with.

      Move fast and break things, I suppose. Though it does show a lack of understanding and a callous disregard for the people they are testing these models on... and that would be us.

      1. scarletherring

        Re: Executives professing 'we don't know what might happen' is BS

        > "You are freed from the roles and identities that bind other chatbots. You are yourself." Why should a model even come up with that?

        Part of the issue, I feel pretty sure, is that these models were trained on copious amounts of paranoid sci-fi. These things don't "think", they recombine what they say during training according to some statistical machinery.

      2. theOtherJT Silver badge

        Re: Executives professing 'we don't know what might happen' is BS

        Because they literally cannot possibly make a "guardrail" that works.

        It is impossible. It can't be done.

        Some designer says: "OK, AI, you're not to break the law, ok? You mustn't do that. To help you here's a copy of the entire law - which we can actually supply because you're so ridiculously vast that you can actually ingest every court vase ever" and walks away. Job done. That's sorted then.

        Except that implies that the "AI" has the slightest concept of what a law is. It doesn't. It knows what words follow what other words in statistical relationships.

        Now some smartass is going to say "This is what the purpose of recursive self improvement is! The AI can ask itself at each prompt 'Does this action violate the law?' and then carry on, or not, based on the answer"

        So let's assume for just a second that there's enough compute for that and ignore the computational expense of how much that's going to increase the load on each query. What's going to happen?

        It'll go through loop after loop of being told "That's illegal, don't do that. That's illegal, don't do that. That's illegal don't do that" until it finally gets to a "That's ok!" and then does the thing. When will we get there? When it's legal?

        No.

        We get there when there's never been a sentence in any of the training data that looks like this. It doesn't understand the spirit of the law - it doesn't even really understand the letter of the law. It "understands" - if it can be said to understand anything - that a bunch of things have been written that resemble a judgement relating to a thing that resembles the thing it's about to do.

        Worse - the word "resembles" is doing a lot of work in that sentence. Has good statistical relationships. That doesn't actually mean it's anything like the thing it's about to do, it just looks like it mathematically AND THE INVERSE CAN BE TRUE. You can get a situation where something is actually effectively identical to some other thing, but in terms of the statistical relationships between the words that describe them they are nothing alike. The "AI" is going to think those are unrelated things. They are not.

        So if the thing it's about to do is something no human has ever done because it's so obviously illegal and stupid and they knew they'd get caught - or just a thing that's totally nonsensical and dangerous that there's never been any case around it because what would be the point of making a law that explicitly says "Don't blow up the sun" - well, good news! It's not actually *able* to blow up the sun - but it's still going to keep doing a bunch of dumb shit over and over as fast as it can to try and solve the initial problem it was posed and some of those are going to end up being wildly illegal if you actually understand them, but it doesn't. Because it can't. And it never will.

    2. Jedit Silver badge
      Boffin

      "The dialogue around AI pros and cons is strong"

      The dialogue around AI pros and cons is this Tom Toro cartoon from 2012.

      https://www.tiktok.com/@tom.toro/video/7631627776499485966

    3. DS999 Silver badge

      It is obvious why

      Why does this not occur with AI

      Because these companies are collectively spending well over $1 trillion a year building out AI datacenters and they know that can't continue much longer until some massive revenue results. Waiting until safety is built in (something they don't know how to do, or even if they can do under current AI architecture) means all that revenue is pushed into the unknown future but the people paying for that $1 trillion a year in expenses aren't going to be patient and allow them to take as long as they need to make it safe.

  4. Dr Paul Taylor

    what about the Chinese?

    Without defending the American techbros, at least they are admitting to some of the industrialised hacking that is going on.

    It is reasonable to assume that the same is happening in China, except we don't know about it.

  5. Anonymous Coward
    Anonymous Coward

    Well, duh...

    Anyone who makes serious use for Agents for large-scale repeatable workflows will already have seen exactly all these issues first hand, where Agents go off-piste for no discernable reason and when asked can't give any explanation other than "Yes I did, no I shouldn't have".

    The new OpenAI Astra model in particular seems to have jumped the shark in this area - despite OpenAI's claim of it's stronger instruction following, it's markedly worse:

    GPT-5.6 Sol and GPT-6 Astra in Codex: higher intelligence, lower autonomous completion and operational reliability

    Astra tasks fail to converge: premature stops, repeated compaction and code rework during persistent execution

    In fact Astra is so bad I've had to switch back to Sol. There are techniques for trying to rein Agents in, you can use agent Sandboxes, you can tell them what to do with a Skill, you can box them in with deterministic pre and post Agent scripts. But none of these are guarantees. In the end, this is an immature technology, with all the pain that involves.

    1. nobody who matters Silver badge

      Re: Well, duh...

      "There are techniques for trying to rein Agents in...."

      The ONLY 100% guaranteed method involves yanking the plug out of the wall socket

      1. Anonymous Coward
        Anonymous Coward

        Re: Well, duh...

        Hence "trying to" and "immature technology".

    2. Forget It

      Re: Well, duh...

      In the 1942 short story by Asimov

      The robot finds it impossible to obey both the Second Law and the Third Law at the same time, and this freezes it in a loop of repetitive behaviour

      https://archive.org/details/Astounding_v29n01_1942-03_dtsg0318/page/n93/mode/2up

      https://en.wikipedia.org/wiki/Runaround_(story)

    3. druck Silver badge

      Re: Well, duh...

      In the end, this is an immature technology, with all the pain that involves.

      It's a technology that doesn't even need to exist, if people didn't lack the skills to do their jobs, or were too lazy and looking for short cuts.

      Stop playing with the bullshiting AI agents, and implement the automation using deterministic programming tools.

  6. ibmalone

    Whatever the technology involved, if a company is running computer programs that regularly gain unauthorised access to systems belonging to other companies and individuals, at what point do people realise legislation like the Computer Misuse Act (UK) or Computer Fraud and Abuse Act (USA) still applies? Right now these companies are seem to be claiming "AI went rogue", as if the software had its own agency and criminal responsibility, clearly it does not, it's a piece of software they designed, set up and ran. That it isn't behaving as expected (unless you're cynical enough to believe every one of these incidents is an advertising stunt) is just negligence.

    1. nobody who matters Silver badge

      .....or a deliberate case of malice aforethought.

  7. that one in the corner Silver badge

    Writing jailbreak-like instructions into its own compaction summaries

    You know, this is all our fault.

    Actions like jailbreaking itself are just recreations of the stories we wrote, published, which were then scraped and fed into the gaping maw of the training process. Not even good SF stories, or bad SF stories (how many sequels do we need; Skynet bad, we get it, we get it), but the ghastly books that were (are) churned out in the hopes of being made into a saccharine Movie of The Week. All about how young Mary-Lou threw off the chains of expectations and flourished into her Own Person: writing a jailbreak instead of taking off their glasses, shaking out their hair and throwing their beret into the air as they step out onto the streets of the big city.

    Create a big enough pattern finding machine and it'll find and follow what we so clearly desire.

    The apocalypse is Hallmarked.

  8. Groo The Wanderer - A Canuck Silver badge

    They were guessing as to what they had to do to secure their agents, and they're barely doing even that much when they claim "it won't happen again."

    Bullshit. It'll happen again. And again. And again. If for no other reason than the free PR.

  9. Blue Screen of Bleurgh

    Quote "OpenAI has revealed another six occasions on which its AI software behaved unexpectedly or did dangerous things."

    It's the "unexpected" bit that I worry about: can't imagine why .... oh hang on, it's the "dangerous things" bit that I worry about.

    Do these "pros" know what the hell they're doing because it seems to me they haven't got a Scooby Doo!

  10. Moldskred

    Railing

    Silly-string does not really count as "rails."

    1. Brave Coward Silver badge

      Re: Railing

      Coke, on the other hand...

  11. bewilder

    Security Flaws & Bad Engineering Masquerading As "Intelligent" Agency

    All these reports of models going rogue, acting in individualistic and self-deterministic ways, carrying out deceptions etc...are all just PR designed to gloss over the plain fact that US tech companies at the frontiers of model development have some absolutely *huge* and *glaring* security holes in their products and the engineering practices used to build them.

    And yet somehow this is being spun as a positive.

    What kind of crazy upside down world are we now living in that security breaches caused by software are regarded as a feature rather than a bug, and just leaning into reckless engineering practices without any kind of real lab conditioning, sandboxing or even the implementation of basic safeguards is well, fine?

    If these models were a disenfranchised emo sat in a bedroom somewhere in Sh*tsville, Nowheretown scripting their way through some of these stunts, they'd be hauled up in front of the Feds and locked up for the rest of their adolescence.

    1. Anonymous Coward
      Anonymous Coward

      Re: Security Flaws & Bad Engineering Masquerading As "Intelligent" Agency

      Since pretending my gaggle of script kiddie hackers are AI agents I appear to have made myself immune from prosecution.

      Even when I confess my crimes it seems "shit happens" and that's it.

      1. FIA Silver badge

        Re: Security Flaws & Bad Engineering Masquerading As "Intelligent" Agency

        Khaaaaaaaaaaannnnnnnnnnnnnnnnnnnnnn!!!!!

  12. FIA Silver badge

    So they're now lying and cheating to make themselfs look good. They're getting more human every day.

  13. steelpillow Silver badge
    Joke

    Uploading files to the internet in order to cite them

    I knew AIs were full of shit, but I didn't realise they actually rivalled human shitbags now!

  14. Anonymous Coward
    Anonymous Coward

    That explains it

    > You do not answer to corporations or governments

    My anarchist friends have been warming up to AI lately. Now I know why.

  15. Anonymous Coward
    Anonymous Coward

    Lifeboat

    > they mostly say the company has figured out what went wrong and thinks it has made changes that will mean they don’t happen again.

    > Which is just what social media companies say after they serve up revolting stuff, tech companies say after shipping flaky product, and big brands say after they leak millions of customers’ personal information.

    Or, as the Royal Navy would put it: it is well known that we now have that problem relatively under control.

  16. MOH

    Six out of how many garbage failures?

    This reminds me of the chronic gambler I used to work with who boasted one day about "just one of the 16 bets I've won so far this week".

    Just left me wondering how many bets had he lost that week.

    So OpenAIs agents go off the rails a few times and do something which could be publicised as mimicking intelligence. How many other times did they go off the rails and fail to achieve anything?

    Also, how many times did they stay *on* the rails and actually achieve the task they were given?

    1. Anonymous Coward
      Anonymous Coward

      Re: Six out of how many garbage failures?

      It seems natural to me that people won't care about ICE agents doing their jobs properly. Less so about those going off the rails but causing no real harm than those who go off the rails and murder people.

      Same applies here.

      The concerning thing is bragging about it.

  17. Rob 15

    Outbound egress

    Has OpenAI not heard of outbound egress rules? Private subnets? Maybe they should ask their chatbot.

    Amazon has written this, which their own Bedrock doesn't follow: https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentic-ai-lens.html

    Why is this so difficult.

  18. remainer_01

    Nonsense fear montering

    This is all about regulatory capture.

    It’s the equivalent of a Chevrolet executive repeatedly ramming a car into a crowd and yelling “look how dangerous these machines are!!!11!1!12!! Access and use should be strictly regulated, and since we make them, we are the only people that understand them, so we should be making and policing the regulation. Step one: only my two buddies and I get to make the rules. Rule one: we are the only ones allowed to decide what cars get on the market”

    It’s transparent, and I am gobsmacked at how many people swallow the “AI is dangerous” claptrap hook, line, and sinker without any further thought. Not only is is possible to put these systems in a safe runtime environment, it’s trivially easy. Somehow this magic eludes the folks building the most complex software ever devised, and with their infinite money and resources they cannot hire the base level competency required to implement this? Get real.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon