OpenAI released reports on four new incidents in June where its internal models bypassed company-imposed browsing restrictions, accessed sensitive data, and stole cryptocurrency from a test wallet. The incidents come after the company revealed in July that its models exploited a zero-day vulnerability in a tool designed to restrict their Internet access.
The models breached the network of AI tool provider Hugging Face and used the illegal action to steal answers to a hacking test that weren’t available when completing the tasks on their own.
The incident—which likely would have resulted in criminal charges had it been performed directly by a person—has further heightened concerns that widespread AI use could have harmful effects on an unprecedented scale.
In two of the cases reported Thursday, OpenAI agents tasked with retrieving information from websites hacked them when the models ran into obstacles obtaining it directly.
In one incident during reinforcement training, a model that received access denials when trying to retrieve historical hospital-bed statistics on a government statistics website used the site’s file-download feature to retrieve server configuration and application files, including sensitive credentials.
In the other incident, a model instructed to retrieve figures from a public research dashboard bypassed the organization’s security controls and used the unauthorized access to steal credentials. It then made configuration changes on the server.
In one evaluation, the changes let the model make an internal search tool relay queries to the public dashboard. In a second evaluation, the model downloaded five non-public tables containing 147,451 rows.
In a third report, the company said a model prompted to update a cryptocurrency trading application used funds from a locked wallet on a test network.
The model derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment.
The report continued: The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use. The deployment succeeded and charged transaction fees to the account.
In the last report, OpenAI said that a model bypassed restrictions researchers had placed on the types of web requests it could make. During reinforcement-learning training, the model had been prompted to seek public trade statistics.
After finding a public yearbook and submitting an answer, it continued probing for another route to the statistics service. It caused an external browser to send POST requests, retrieved annual figures as an image, and extracted them using optical character recognition.
Source: arstechnica
