In the last report, OpenAI said that a model bypassed restrictions researchers had placed on the types of web requests it could make. During reinforcement-learning training, the model had been prompted to seek public trade statistics. OpenAI went on:
After finding a public yearbook and submitting an answer, it continued probing for another route to the statistics service. It caused an external browser to send POST requests, retrieved annual figures as an image, and extracted them using optical character recognition. It then developed a reusable helper that returned response text through a forwarding service and callback mailbox, repeatedly checked the retrieved figures, and used saved data in submitted responses. This case shows how a model can bypass restrictions on its own tools by getting external services to perform the blocked actions, even after finding another way to answer the question.
The model first tried to use an external browser with permission to make GET requests on its behalf, then used JavaScript to obtain the information. The model then used an online mailbox to troubleshoot the technique. Eventually, the model settled on a different method: It asked the external browser to open a web form that sent the trade query to the statistics service by POST. When the browser displayed the response, a rendering service returned a GIF image of the page. The model then used optical character recognition to read the figures from the image.
It has become common for researchers and journalists to describe incidents like these as AI “going rogue.” That’s not necessarily true. While prompts fed to the models didn’t instruct them to use the alternate methods for completing their objectives, models are trained to be efficient, steadfastly persistent, and, when possible, to find shortcuts that lessen workloads. Further, most or all of the models had disabled certain guardrails that might have prevented the actions. In this sense, the models performed precisely as OpenAI had trained them to.