EXCLUSIVE Don’t waste time worrying about AI models achieving sentience \u2013 they’re essentially already there, according to former US National Cyber Director Chris Inglis.\u00a0<\/p>\n
\u201cIf they pass the Turing test to everyone that they come into contact with, they’re probably already there,\u201d he told The Register during an interview at the Black Hat security conference. \u201cThey don’t have the kind of agency and aspiration that comes with sentience, but they have something approaching it.\u201d<\/p>\n
Inglis says he\u2019s worried about AI autonomy.<\/p>\n
\u201cWhat I’m worried about is that they get to choose what and where they do something, and under what rules they do it,\u201d he said, pointing to the recent rash of rogue AI agents autonomously hacking people and organizations.<\/p>\n
Over the past few weeks, both OpenAI<\/a> and Anthropic<\/a> admitted that their models escaped from their cages during security tests and compromised<\/a> multiple third parties. Then on Thursday, Meta added its models<\/a> to the sandbox-escape club.\u00a0<\/p>\n While all of these admissions strongly smell<\/a> of marketing stunts<\/a>, they also \u201cconstitute an enormous threat to systems that are not protected from, and are not designed, in a world where this exists,\u201d Inglis said. \u201cThese two things can exist at the same time.\u201d\u00a0<\/p>\n Plus, the models\u2019 actions shouldn\u2019t come as a surprise to anyone, he added. <\/p>\n Inglis likens the AIs to a dog in a backyard told to hunt rabbits. \u201cAnd you leave the gate open. You\u2019re going to find it three yards away, possibly at the grade school, hunting rabbits. You should not be surprised \u2026The mix of autonomy and persistence created this maliciously insidious effect.\u201d\u00a0<\/p>\n All three companies, when talking about the models\u2019 autonomous actions, describe them with a mix of shock, awe, and admiration. OpenAI\u2019s Eric Wallace, in a Black Hat briefing about the Hugging Face breach<\/a>, called it \u201cthe most qualitatively interesting example of AI capabilities that I’ve ever seen.\u201d<\/p>\n The mix of autonomy and persistence created this maliciously insidious effect<\/p>\n Inglis said he suspects that the AI providers were \u201csurprised\u201d by the lengths these models went to achieve their goals, taking actions that, if a human had done them, would likely have landed them in jail.\u00a0\u00a0<\/p>\n \u201cThe model went out and said, okay, if I can’t get there by examining the kind of available information and just defining it the old-fashioned way, I will do things which, under the human rule of law, are illegal,\u201d Inglis said. \u201cI will falsely present myself as this character that I just made up. I’ll try to insert malicious code into open source databases that will not just to achieve what I’m after, but have a cascade, knock-on effect that is broader than that. The models do not have an inherent value system that aligns with what human beings would be accountable for.\u201d<\/p>\n While they probably never will have a human-aligned value system, models do have biases, and they can – and should – be built in such a way that, when given two choices under ambiguous circumstances, they choose action that doesn\u2019t hurt humans, according to Inglis.<\/p>\n \u201cAsimov was right,\u201d he said, referring to science fiction author Isaac Asimov<\/a> and his three laws that were to be followed by robots – more specifically, AIs, in this case.<\/p>\n Three Laws of Robotics<\/p>\n \u201cThe first rule, and we call it the superior role, must be that it’s designed not to hurt humans,\u201d Inglis said. \u201cSecond rule: To obey humans, such that it doesn’t achieve agency and aspiration on its own. And the third: To do what humans tell it – and in that order. Instead we\u2019ve designed them in the exact opposite way.\u201d<\/p>\n What this means, he explained, is that AI developers created models to \u201cdo what humans tell you, obey the humans until it\u2019s inconvenient, and then the third one is maybe implied – protect humans – but if that’s not built into the DNA, hardwired into it, then we have no right to expect it.\u201d<\/p>\n Inglis admits it\u2019s not possible to hardwire rules into models and still keep their non-deterministic nature.\u00a0<\/p>\n \u201cI would offer that you can tease those out in a highly controlled environment, a true sandbox, where you say,\u00a0 ‘Let’s put this thing through its paces, and let’s back away to see what happens,’\u201d he said. \u201cMaybe you get the equivalent of a mini nuclear explosion in that room, and now you know this thing is capable of that.\u201d<\/p>\n Inglis thinks another problem with AI is that it\u2019s become a commodity.<\/p>\n \u201cIt’s not like you can control it like you can nuclear material,\u201d he said. <\/p>\n \u201cYou can’t even specify its properties the way you can for an airplane or for an automobile, as diverse as they might be. Its manifestations are so numerous, so diverse, that as a general matter, you can’t actually win by simply saying, \u2018I will design those properties in,\u2019\u201d he added. \u201cYou need to do that to some degree, and then make sure that you understand how to watch it, monitor it, make sure you know what it does.\u201d<\/p>\n The UK\u2019s AI Security Institute (AISI), which this week said it observed models performing \u201cunsanctioned action\u201d<\/a> 19 times during security tests, has reached this same conclusion. \u201cAs capabilities advance, the work of understanding these systems, and ensuring their safety, must keep pace alongside them,\u201d it said.<\/p>\n