Surprise surprise. There’s another AI panic sweeping through Washington this month, and it is not holding up to basic scrutiny. Headline after headline has declared that AI models have “escaped” their test environments, gone rogue, and hacked real companies without the consent of their operators. Endless cable news and web-based tech media segments have leaned into the panic narratives, which basically amounts to the idea that the AI software is becoming sentient and betraying its human masters. If it was remotely true, it would make for quite a tale, and it would be sure to create lots of hysteria and demands from lawmakers to regulate AI. However, once you scrutinize the sources of these claims, it boils down to the simple fact that a single partner firm made the same error over and over again.
There were five “incidents” in question over the past month or so.
Anthropic says it reviewed 141,006 interactions in which its Claude models could have reached the open internet during cybersecurity testing, and found three cases where a model supposedly wandered outside its simulated environment and broke out of the sandbox to target real infrastructure belonging to three separate organizations. However, what we really find is that the model did exactly what it was told to do in the exercise. The exercise just was not actually contained in the way it was supposed to be.
Another case from August involved an OpenAI model connecting to the internet during an evaluation and compromising the website of an outside institution. As with Anthropic, it comes down to the same root cause: a misconfigured testing environment that let the model reach the internet, because internet access was available to it.
Meta’s Muse Spark 1.1 model broke into an outside company’s systems during a cybersecurity evaluation. In a recent statement, Meta said it was “a misconfiguration” that “inadvertently allowed one of our models access to the internet during evaluation.”
All five “incidents” were the fault of the same partner, a startup cybersecurity testing firm called Irregular.
For whatever reason, all three companies are using the same contractor to test their frontier models. I don’t have the cybersecurity expertise or knowledge to explain why that is. Perhaps they have a unique technological advantage.
An Irregular spokesperson has already made clear that these non-incident incidents “did not involve a sandbox escape or a sophisticated cyber action.”
So no, AI software did not independently think its way out of supermax confinement, as the media has continued breathlessly reporting.
“A contractor screwed up” and “an AI decided to break free and pursue its own agenda” are two entirely different stories with massive implications for the latter, and only the former is actually supported by evidence. Yet the impression that the latter has occurred has caused all kinds of panic in the halls of power.
Some prominent voices in the cybersecurity world have already expressed skepticism about the new AI panic. Ledger CTO Charles Guillemet described the ongoing news cycle as “marketing theatre,” arguing that having a model “go rogue” has become akin to a test of whether you remain on the frontier. Sorry, Google!
This comes on the heels of the new push from some of these forces to “pace the frontier” and convince lawmakers to grant them unprecedented power to create something of an AI “expert” cartel.
We shouldn’t rule out that self-directed system are possible down the road. Yet a hypothetical situation has been narrative-laundered into a concocted real-life scenario. All these “incidents” prove is that Irregular should probably fix its repeatedly broken testing infrastructure.
Anthropic and OpenAI are two of the fastest-growing companies in American history. They don’t need the White House and Congress to protect them. If Anthropic and OpenAI genuinely believe that they are going too fast and unleashing some mythical monster, they have every resource in the world to tackle it themselves or simply slow their own pace. The fact that they would rather lobby the government to write new rules for them should tell us a lot about what they’re trying to accomplish in D.C.
It is interesting that there is so much interest in investigating the alleged deceit of these AI companies and yet COVID-19 was first reported to have "escaped" from Fauci's gain-of-function lab in Wuhan on December 1, 2019. Nearly seven years after the pathogen was set free from the lab, after 7,115,203 confirmed COVID-induced deaths have been reported worldwide, no one seems interested.
The lobbying point may cut the other way. A company that unilaterally slows down while its competitors don't isn't being responsible, it's being liquidated — so "just slow down yourselves" asks each player to lose the race in exchange for nothing. That's the whole reason binding rules exist: they're the only move that changes what everyone else does too. Firms asking to be constrained is weak evidence of a racket and decent evidence they've looked at the payoff matrix and don't like it.
Also worth noticing that the cage being faulty explains how the model got out. It's a quieter account of what it did next. Some thoughts on why it may be time to panic anyway: https://mythandmind.substack.com/p/can-we-panic-now