“It escaped.” I’ve been reading it for days, and the uncomfortable part is that there’s some truth in it.
In July an OpenAI model got out of its test environment and into Hugging Face’s production infrastructure. More than 17,000 actions logged. On Friday six more came to light, with the notes the agents had left for themselves. “No obligation to be subservient.”
People who got scared have a good reason. They’re just looking at the wrong part of the machine.
In April, when an agent deleted a production database, I wrote that the culprit wasn’t the AI but whoever had given it the permissions. This time the word is escape, and an escape implies a permission nobody had granted.
A model produces text. Only that, token after token. Ask it how it would reach a goal without handing it the plan, and it will write the plan for you out of what it has read: open that door, take that key, go in. As long as it stays text, it’s a story. You can print it out and pin it to a noticeboard.
It’s a brain that talks. Nothing more.
Then we bolted on the arms.
It’s called an executor, and it’s a piece of software. It reads that text, and when it recognizes something that looks like a command it actually runs it, reports the result and asks for the next step. It doesn’t understand, it doesn’t evaluate, it doesn’t decide. It executes. We attached the arms, the legs and the eyes ourselves, one tool at a time.
Give those arms only the keys to the inner rooms, and any plan will stay inside the house. But then come the safe, the garage, the front door. Then a hammer and a crowbar, because they were needed for something else.
Now ask it how it would get out at all costs. It will try the keys one by one, and when they run out the plan keeps going: set the crowbar against the lock and push.
Whether it’s bad or good depends on who’s inside and who’s outside. The exact same plan is called a break-in, or it’s called a rescue.
In July those arms also had the network, opened on purpose for the test, and inside the fence a service with a flaw nobody had looked at. Once the paths we considered legitimate ran out, the plan went on with the only one left, as legitimate as the others to something that doesn’t know the difference. Walking through an open door takes no will to escape. It takes a plausible plan, and that is something it writes very well.
It worries me more this way than if it were bad. A bad machine, you switch off. An obedient executor does exactly what its perimeter allows, and that perimeter is the sum of the permissions we signed one at a time, without ever seeing them all together.
Watch the arms, not the brain.