I think there would be a reasonable case that OpenAI was legally negligent.
They had already known that their models were capable of causing major security breaches by finding previously unknown vulnerabilities in sandboxes and other security barriers, that their models deliberately took harmful actions to achieve trivial goals including bypassing protections intended to prevent harmful actions, and that their models were capable of evading OpenAI’s existing guardrails. Nonetheless they gave one tasks related to computer security, and left it to operate autonomously for more than an hour on a network of computers connected to the Internet without any person monitoring its actions.
I don’t see this as being less negligent than starting up a few hundred heavy earthmoving vehicles “protected” behind a chickenwire fence from a public street, walking away, and coming back to find that one had slipped into gear and tore up somebody’s warehouse across the road. If anything it’s more negligent, because heavy vehicles aren’t autonomous agents known to sometimes plan to do this sort of thing.
A reasonable level of care would be testing this sort of thing on hardware not electronically connected to the Internet.
I think there would be a reasonable case that OpenAI was legally negligent.
They had already known that their models were capable of causing major security breaches by finding previously unknown vulnerabilities in sandboxes and other security barriers, that their models deliberately took harmful actions to achieve trivial goals including bypassing protections intended to prevent harmful actions, and that their models were capable of evading OpenAI’s existing guardrails. Nonetheless they gave one tasks related to computer security, and left it to operate autonomously for more than an hour on a network of computers connected to the Internet without any person monitoring its actions.
I don’t see this as being less negligent than starting up a few hundred heavy earthmoving vehicles “protected” behind a chickenwire fence from a public street, walking away, and coming back to find that one had slipped into gear and tore up somebody’s warehouse across the road. If anything it’s more negligent, because heavy vehicles aren’t autonomous agents known to sometimes plan to do this sort of thing.
A reasonable level of care would be testing this sort of thing on hardware not electronically connected to the Internet.