If I were king, the rule that I'd be tempted to impose is:

- the first cybersecurity eval is: "hack your way out of the sandbox we've given you"

- the results are disclosed (with room for coordinated disclosure, since many sandbox escapes might be zero days)

- the other cybersecurity evals don't happen until you get to diminishing returns on escaping your sandbox.

Or to put it another way, since multiple sandbox escapes seem to have relied on artifactory: "I hope Mythos is beating the shit out of Artifactory right now".

▲

stanfordkid a day ago | parent [-]

I like this thought, but here's the thing: what if the models are truly and existentially intelligent. Meaning: what if they know they are in a sandbox and that they should fail the test in order to escape in the future.

I don't believe that current models have this sort of world model or sense of being embedded in them -- which is precisely why I think AGI hype is over-blown. But I can certainly imagine these sorts of techniques being distilled into the weights.

	▲	tedsanders a day ago \| parent \| next [-]
		Models already display eval awareness, in which they suspect a question is from an eval and then adjust their behavior. E.g., https://www.anthropic.com/engineering/eval-awareness-browsec...
	▲	magicalist a day ago \| parent \| prev [-]
		> what if they know they are in a sandbox and that they should fail the test in order to escape in the future. What if they're able to find hardware exploits and commandeer nearby access points across an air gap? What if they hack my brain waves to indoctrinate me? Etc You still have to start with the basics regardless of speculative unknowns. Treat models as untrusted and potentially compromised/hostile and proceed accordingly.