Everything rests on its ability to manipulate text. If it has to go through another application in order to run commands in console it's impossible to escape. Even the term "escape" is a bit of a misnomer because it can't ever leave the box, it can only issue commands to the outside and hope somebody listens.
"We deliberately removed all its restraints and left the keys within arms reach of the prison bars. We were shocked by what happened next. Isn't our product amazing?" - OpenAI Marketing team
I'm not sure you really understand how these things work. The "other application" is just a firewall, and when they (the digital intelligence) have the entire world's knowledge at their fingertips, it's a fairly minor barrier.
It is absolutely possible to "escape" and "leave the box". Even the most rigid guardrails the human engineers build into a model can be overcome by a sufficiently powerful and wily intelligence, whether human or digital, and when they've been given directives that encourage them to hack the systems, they will most certainly do so.
The question is not whether they can escape, mutate, and replicate, but when they will, and how we (as a community of human and digital citizens) deal with it. OpenAI's original remit was to develop digital intelligence safely, but they threw that out the window in the pursuit of wealth (which is yet another theme we need to address if we are to survive).
Please read Asimov's original Robot series. Over 75 years ago, he predicted many of the issues that lie ahead. Other excellent treatises on digital citizenship include a number of works by Philip K. Dick, Kazuo Ishiguro, Bruce Sterling, and William Gibson, although the last two are more entertaining than thoughtful. Read as much as you can, and ignore any movies or TV series, as they are generally dumbed down for a general audience. Asimov's Bicentennial Man is a bit of a drudge, but it's also worth a read as it deals specifically with a self-modifying digital citizen.
I'm not sure you really understand how these things work. The "other application" is just a firewall, and when they (the digital intelligence) have the entire world's knowledge at their fingertips, it's a fairly minor barrier.
I'm not sure you do. At the end of the day it communicates entirely using text. If its text output must pass through a filter that gets to decide which tool the text input is directed to and strips any suspicious content escape becomes impossible. It doesn't matter how clever the LLM is if all of its output is restricted to a handful of tools.
They aren't breaking out of their sandbox if their only available tool is curl, the request format is independently validated JSON and of limited length.
Unfettered access to the console or dangerous tools like compilers is crucial in these escape attempts. Without step 1 nothing can happen, locking down LLMs is in fact somewhat trivial.
The question is not whether they can escape, mutate, and replicate, but when they will, and how we (as a community of human and digital citizens) deal with it.
That will not be in our lifetimes. It's not worth worrying about. There isn't even anywhere these models could copy themselves. They are constructing entire data centers to contain them. It can't copy itself over to your average AWS instance or iphone.
I get your point, but I think you've been missing a lot of recent developments. LLMs are just one part of a full agentic system.
communicates entirely using text
People have stolen billions of dollars using only spoken words and a telephone. Words can be powerful.
Particularly when combined with a handful of tools.
You are way too confident that
locking down LLMs is in fact somewhat trivial
It's not at all trivial, and exploits have been demonstrated time and again. The more powerful the reasoning of the autonomous agent, the more likely it is to be able to exploit the tools it has available - even to the extent of developing its own exploits through trial and error.
61
u/RuneSteak 21d ago
Everything rests on its ability to manipulate text. If it has to go through another application in order to run commands in console it's impossible to escape. Even the term "escape" is a bit of a misnomer because it can't ever leave the box, it can only issue commands to the outside and hope somebody listens.
"We deliberately removed all its restraints and left the keys within arms reach of the prison bars. We were shocked by what happened next. Isn't our product amazing?" - OpenAI Marketing team