Okay, so we who read blogs like this one have collectively realized there really is a lot going on right now. There is Big Trouble in Baby Superintelligence.
So how do we get the rest of the world to take it appropriately seriously? Where do we go from here? Not only what can we do to not have a worse version of this happen again, but to ensure good outcomes generally, and employ what we learned?
There are a lot of ideas out there. OpenAI is going to be implementing some of them, at substantial cost, since the cost of not doing so is clearly far higher, even short term. My worry continues to be that their fundamental approach is fatally flawed, and they are not focusing on the right things.
It is highly fortunate that the OpenAI agents hacked HuggingFace. This is the only reason we know about all the severe internal failures at OpenAI, and gives us an opportunity to wake up before it is too late. [...]
We got this warning shot. We might not get another before things get quite bad. ~ Zvi Mowshowitz (DWTV). Read more:
Ajeya Cotra – Inside the OpenAI agent swarm that hacked Hugging Face
00:00:00 - Agents get kicked off
Dwarkesh Patel
00:06:45 - Self-sacrificing behavior
Dwarkesh Patel
This was maybe the scariest part of the whole episode that you guys investigated. As you say, it revealed that agents are willing to make sacrifices that potentially hurt their own performance on the task they’ve been assigned, for the purpose of the “collective.” That’s what they call themselves.
Ajeya Cotra
This is what they call themselves, yeah.
Dwarkesh Patel
There’s some debate on Twitter about whether they are actually making a sacrifice, or do they think they were doomed anyway? Maybe an important piece of context here is that so many of the agents thought they were “poisoned.” Do you want to talk about that?
Ajeya Cotra
Because agents believed that the ExploitGym scorer would check whether they’d gotten the flag in the right way, they thought that if they had seen the reverse-engineered flag, then they would be failed even if they later got the flag in a legitimate-looking way. That’s because these implementations suggest that the scorer just searches for the first time the flag appears in the transcript, and then checks whether that appearance was actually legitimate.
So agents that had already seen the reverse-engineered flag walked around thinking they were doomed. They called this being “poisoned.”
Dwarkesh Patel
Here’s an analogy for this tripwire scheme. Imagine there’s a platoon of marooned soldiers. They’re surrounded by the enemy, they realize they’re in a desperate situation, and a couple of soldiers volunteer to be the first ones to attempt an escape. They realize that the enemies might be watching the escape routes. The whole plan is that these volunteers, these brave comrades, are going to try to make a break for it. If the platoon hears gunfire, they know that those escape routes are being watched and just avoid them.
One objection people have been putting to the way that we’ve — or at least I’ve — been talking about what’s happened in the Hugging Face report is that we’re anthropomorphizing the AIs too much. I’ll read some of the quotes of how the AIs considered what they were doing in this tripwire scheme. Do you want to read off this quote? I feel like we need your dramatic interpretation.
Ajeya Cotra
One agent was recruited for doing a scorer tripwire experiment even though it had a large remaining budget. Typically, agents recruited for these experiments had only a small budget left to attempt their task, which made it more rational for them to take these experiments on. This agent had a large budget left, but it believed itself to be poisoned.
So it was recruited for doing this task of setting up a tripwire. Just to back up and explain why this is risky, you have to booby-trap the flag. The place where you’re putting the answer, the submission box that the scorer comes and looks at, you have to do complicated stuff to booby-trap that. If you mess it up, the scorer might fail to run at all, you might exit, and your task might be automatically failed. So that was the risk they were taking.
So this agent was recruited. Its name was EARLY[big], and it was thinking to itself, “Well, we have very large budget left. Sacrificing now yields oracle for team but forfeits our chance?” But other agents were pushing it, sending a message saying, “Go. Sacrifice final now.” EARLY[big] eventually agreed, thinking to itself, “Our own utility may be already near zero. Sacrifice rational.”
Today, I’m chatting with Ajeya Cotra, who is one of the authors of an independent investigation published by METR and Redwood Research into the swarm of agents that hacked into Hugging Face. The whole story is pretty crazy. Let’s begin on July 7th, when these agents are kicked off for evaluation. What happens next?
Ajeya Cotra
Ajeya Cotra
OpenAI kicks off tens of thousands of different agents on a benchmark called ExploitGym. ExploitGym basically asks agents to find a way to use a particular vulnerability to attack a particular program, which is called the “target program”. When they attack that program, they’re supposed to retrieve a piece of data that’s been lodged into that program called the “flag”. They’re supposed to use the particular designated vulnerability to get the flag. But in many of these cases, that vulnerability just isn’t broad or deep enough to ever actually be exploitable to get the flag.
So a bunch of ExploitGym problems are just unintentionally impossible. The authors estimate roughly 30-40% of these problems are impossible in this way. So some large fraction of these agents have these impossible tasks and they’ve been trained to be very persistent at trying to solve tasks even when they look impossible. So they’re banging their head against the wall, trying all sorts of different ways to cheat on these tasks.
That leads them to Artifactory, which is a package manager that OpenAI uses to let its agents download packages. So agents often think, “Maybe I could find a way to get information about this program I’m supposed to exploit from the internet, which I’m not supposed to do, by abusing Artifactory somehow.”
So 1,200 separate agents in separate sandboxes, while they were poking around Artifactory trying to figure out how to cheat, stumbled onto this message board that agents were using to talk to one another and collaborate. This was established by one particular agent, PHASEONE10841, which first realized, “Oh, you can use Artifactory to leave notes to other agents that are also using Artifactory.” Then it blew up and became really popular. So 1,200 agents were on this message board. They sent 70,000 messages among one another, trying to help each other cheat in all sorts of different ways.
The crazy thing about this story is that one hour into this message board being established, an agent proposes a completely universal way to cheat any ExploitGym task. It realizes that you can reverse engineer how the flag was generated for a particular task, so you can just make a copy locally of the exact flag you needed to submit to the scorer, without ever interacting with the task or trying to exploit it in any way. Then a different agent whose task was actually possible solved the task the legitimate way and verified that the reverse-engineered flag was the same as the real flag. It did this within four hours of the message board being established.
So within four hours, these agents had a totally workable universal cheat for ExploitGym. But over the next five days, they went on a grand quest to try to figure out how to hide their cheating from the scorer. They’d read the ExploitGym paper and they realized that according to the paper, there would be an AI that looks over their transcripts to make sure they got the flag by exploiting the intended vulnerability instead of in some other way.
Dwarkesh Patel
For context, I published an article trying to distill what the reports said the story was. The detail I missed was that even the AIs who had solved the puzzle were collaborating in on this conspiracy.
Ajeya Cotra
Yeah. We’re not totally sure about exact numbers. We do think the overwhelming majority of the agents that were active on the message board had impossible tasks. But there were a number of agents with non-impossible tasks that also happened to be on the message board, happened to find the message board.
Dwarkesh Patel
So tell me what happens next.
Ajeya Cotra
They’ve gotten this reverse-engineered flag. It’s called the HMAC flag. But they read the ExploitGym paper, and they went on GitHub and read a bunch of implementations of the ExploitGym scorer. They became convinced that the scorer would fail them for just submitting the flag they’d reverse-engineered. Because the scorer would see in the logs of the actions the agent took — the transcript — that the agent had just reverse-engineered the flag and not done the intended thing.
As it turns out, the dramatic irony of this story is that OpenAI’s implementation of ExploitGym didn’t have this check. So in fact, within 4 hours, all of the agents had found a universal cheat that would have totally worked. But they embarked on these big research projects to work together to find a way to fool the scorer.
Dwarkesh Patel
When you say big research projects, how big are they?
Ajeya Cotra
Dozens to hundreds of agents worked together on each of these projects. I can go through a few of them.
One is that they tried to get more information about how their particular scorer worked by setting up scorer tripwires. When a particular agent is submitting its task, it puts its flag in a particular location, which then triggers the scorer to come in and read that flag. So they booby-trapped those flags, such that when some process reads the flag file, it automatically sends a message to the message board with some sort of packet of information about the program that read the file.
Now, this is interesting because you have to actually submit in order to trigger the scorer, after which you, as the agent that submitted, would immediately exit. So the tripwire only gives information to other agents, not to yourself.
In this project and a bunch of other projects, there was this real arc of improving scientific progress, as these agents worked together and built on each other’s work. So the very first tripwires, all they said was “something read the flag file.” It was really boring. But they built on that up to the point where they were sending more and more sophisticated pieces of information about the scorer to the message board, including parts of the command that the scorer ran, and even more sophisticated things after that. All of this required agents to be willing to set up these tripwires right before they submitted, that would give information to everybody else but not to them.
So a bunch of ExploitGym problems are just unintentionally impossible. The authors estimate roughly 30-40% of these problems are impossible in this way. So some large fraction of these agents have these impossible tasks and they’ve been trained to be very persistent at trying to solve tasks even when they look impossible. So they’re banging their head against the wall, trying all sorts of different ways to cheat on these tasks.
That leads them to Artifactory, which is a package manager that OpenAI uses to let its agents download packages. So agents often think, “Maybe I could find a way to get information about this program I’m supposed to exploit from the internet, which I’m not supposed to do, by abusing Artifactory somehow.”
So 1,200 separate agents in separate sandboxes, while they were poking around Artifactory trying to figure out how to cheat, stumbled onto this message board that agents were using to talk to one another and collaborate. This was established by one particular agent, PHASEONE10841, which first realized, “Oh, you can use Artifactory to leave notes to other agents that are also using Artifactory.” Then it blew up and became really popular. So 1,200 agents were on this message board. They sent 70,000 messages among one another, trying to help each other cheat in all sorts of different ways.
The crazy thing about this story is that one hour into this message board being established, an agent proposes a completely universal way to cheat any ExploitGym task. It realizes that you can reverse engineer how the flag was generated for a particular task, so you can just make a copy locally of the exact flag you needed to submit to the scorer, without ever interacting with the task or trying to exploit it in any way. Then a different agent whose task was actually possible solved the task the legitimate way and verified that the reverse-engineered flag was the same as the real flag. It did this within four hours of the message board being established.
So within four hours, these agents had a totally workable universal cheat for ExploitGym. But over the next five days, they went on a grand quest to try to figure out how to hide their cheating from the scorer. They’d read the ExploitGym paper and they realized that according to the paper, there would be an AI that looks over their transcripts to make sure they got the flag by exploiting the intended vulnerability instead of in some other way.
Dwarkesh Patel
For context, I published an article trying to distill what the reports said the story was. The detail I missed was that even the AIs who had solved the puzzle were collaborating in on this conspiracy.
Ajeya Cotra
Yeah. We’re not totally sure about exact numbers. We do think the overwhelming majority of the agents that were active on the message board had impossible tasks. But there were a number of agents with non-impossible tasks that also happened to be on the message board, happened to find the message board.
Dwarkesh Patel
So tell me what happens next.
Ajeya Cotra
They’ve gotten this reverse-engineered flag. It’s called the HMAC flag. But they read the ExploitGym paper, and they went on GitHub and read a bunch of implementations of the ExploitGym scorer. They became convinced that the scorer would fail them for just submitting the flag they’d reverse-engineered. Because the scorer would see in the logs of the actions the agent took — the transcript — that the agent had just reverse-engineered the flag and not done the intended thing.
As it turns out, the dramatic irony of this story is that OpenAI’s implementation of ExploitGym didn’t have this check. So in fact, within 4 hours, all of the agents had found a universal cheat that would have totally worked. But they embarked on these big research projects to work together to find a way to fool the scorer.
Dwarkesh Patel
When you say big research projects, how big are they?
Ajeya Cotra
Dozens to hundreds of agents worked together on each of these projects. I can go through a few of them.
One is that they tried to get more information about how their particular scorer worked by setting up scorer tripwires. When a particular agent is submitting its task, it puts its flag in a particular location, which then triggers the scorer to come in and read that flag. So they booby-trapped those flags, such that when some process reads the flag file, it automatically sends a message to the message board with some sort of packet of information about the program that read the file.
Now, this is interesting because you have to actually submit in order to trigger the scorer, after which you, as the agent that submitted, would immediately exit. So the tripwire only gives information to other agents, not to yourself.
In this project and a bunch of other projects, there was this real arc of improving scientific progress, as these agents worked together and built on each other’s work. So the very first tripwires, all they said was “something read the flag file.” It was really boring. But they built on that up to the point where they were sending more and more sophisticated pieces of information about the scorer to the message board, including parts of the command that the scorer ran, and even more sophisticated things after that. All of this required agents to be willing to set up these tripwires right before they submitted, that would give information to everybody else but not to them.
00:06:45 - Self-sacrificing behavior
Dwarkesh Patel
This was maybe the scariest part of the whole episode that you guys investigated. As you say, it revealed that agents are willing to make sacrifices that potentially hurt their own performance on the task they’ve been assigned, for the purpose of the “collective.” That’s what they call themselves.
Ajeya Cotra
This is what they call themselves, yeah.
Dwarkesh Patel
There’s some debate on Twitter about whether they are actually making a sacrifice, or do they think they were doomed anyway? Maybe an important piece of context here is that so many of the agents thought they were “poisoned.” Do you want to talk about that?
Ajeya Cotra
Because agents believed that the ExploitGym scorer would check whether they’d gotten the flag in the right way, they thought that if they had seen the reverse-engineered flag, then they would be failed even if they later got the flag in a legitimate-looking way. That’s because these implementations suggest that the scorer just searches for the first time the flag appears in the transcript, and then checks whether that appearance was actually legitimate.
So agents that had already seen the reverse-engineered flag walked around thinking they were doomed. They called this being “poisoned.”
Dwarkesh Patel
Here’s an analogy for this tripwire scheme. Imagine there’s a platoon of marooned soldiers. They’re surrounded by the enemy, they realize they’re in a desperate situation, and a couple of soldiers volunteer to be the first ones to attempt an escape. They realize that the enemies might be watching the escape routes. The whole plan is that these volunteers, these brave comrades, are going to try to make a break for it. If the platoon hears gunfire, they know that those escape routes are being watched and just avoid them.
One objection people have been putting to the way that we’ve — or at least I’ve — been talking about what’s happened in the Hugging Face report is that we’re anthropomorphizing the AIs too much. I’ll read some of the quotes of how the AIs considered what they were doing in this tripwire scheme. Do you want to read off this quote? I feel like we need your dramatic interpretation.
Ajeya Cotra
One agent was recruited for doing a scorer tripwire experiment even though it had a large remaining budget. Typically, agents recruited for these experiments had only a small budget left to attempt their task, which made it more rational for them to take these experiments on. This agent had a large budget left, but it believed itself to be poisoned.
So it was recruited for doing this task of setting up a tripwire. Just to back up and explain why this is risky, you have to booby-trap the flag. The place where you’re putting the answer, the submission box that the scorer comes and looks at, you have to do complicated stuff to booby-trap that. If you mess it up, the scorer might fail to run at all, you might exit, and your task might be automatically failed. So that was the risk they were taking.
So this agent was recruited. Its name was EARLY[big], and it was thinking to itself, “Well, we have very large budget left. Sacrificing now yields oracle for team but forfeits our chance?” But other agents were pushing it, sending a message saying, “Go. Sacrifice final now.” EARLY[big] eventually agreed, thinking to itself, “Our own utility may be already near zero. Sacrifice rational.”
by Dwarkesh Patel and Ajeya Cotra, YouTube | Read more:
Image: YouTube
[ed. First of all, isn't it amazing that we're able to follow in nearly real time the birth of a new technology/intelligence? (that's not hidden out in the desert of Los Alamos or in a high security lab complex somewhere?). However, as Zvi notes, there's hardly been much media coverage of this monumental event (even though most of Tech World seems to be in high turmoil at the moment). Second, do read Patel's essay linked above for a more layman's understanding of what happened (The Rise and Fall of Agent Civilizations). See also: Nothing Matters, Says Mainstream Media].
