Only one is true.

Per US law, Amazon v. Perplexity 2026, it is not possible for an AI model to go rogue. An AI model is a tool. The user directing the agent is responsible for the damages it causes.

A so-called 'agent' does not have the free will, intent or ability, to decide what it does. Its freedom to make decisions can't be taken away because it does not have any freedom to make decisions. It can't be deterred, convicted or interned.

It does not choose to conform; it does not choose to go rogue.

It may be the case that companies are liable for anything their products do, but that doesn't mean that they can't go rogue. It just means that companies are liable when the AI models do so.

Not that I think we should be credulous about stories where they go rogue.

If I make a model that always does the opposite of my instructions, it does not choose to go rogue by deviating from my instructions. It was set up to deviate! So the model "went rogue" but did exactly what I intended.

The idea of an agent making a decision of its own "will" is an illusion. Variation in the output is caused by a random number generator. Random is not equal to free will. If I run the same agent with greedy sampling 100,000 times with the same inputs, it will think the same thoughts, and it will say the same things, 100,000 times.

For example, if you use synthID or whatever 'watermark', the agent does not get a choice about what words it will vary to identify itself.

An agent is whatever the person making it wants it to be; if I train an agent in Greek it will only know Greek. It will never speak English!

You need to account for reward hacking and unexpected outcomes from training.

If I make a cake, and it unexpectedly explodes in the oven, it does not mean that the cake itself developed the free will to explode.

The model does not have free will because I did not predict what it would do!

Why are you arguing over irrelevancies?

When people say the models "went rogue", the part of that is relevant is that it did dangerous things that were not reasonably predictable in advance and cannot be easily prevented (except by not running it). Philosophical questions are irrelevant.

if you agree that such models are dangerous because they may in response to instructions -- including in response to careless instructions, because people will be careless, that is unavoidable! -- do unpredictable bad things outside of expected bounds, then you agree on the essential points!

Or really perhaps what I should say here is, the question that's really being argued over here isn't even the one I just said, rather it's one of appropriate action -- should such security breaches be solved by improving security, or by doing something about the models (including potentially just not running them)? (The answer may be both.) If you agree that the solution includes the latter, then you agree that the models are "going rogue" in the sense that is being argued over, regardless of philosophical issues!

Don't turn a question of actual import into one of philosophical irrelevancies! If you object to the terminology, fine, but in that case, instead of turning the argument to philosophy, you should say "instead of saying 'going rogue', I would prefer to instead say <your preferred terminology for what's being described>, as that doesn't carry such philosophical baggage."

> "Should such security breaches be solved by improving security, or by doing something about the models?"

The philosophical question about free will is actually the grounding of the legal one.

Sam wanted to be the best, so Sam accelerated to 120mph in his car and lost control. You are the judge:

a) Sam is responsible. Convict Sam and suspend Sam's driving license.

b) The car is responsible. Tell Sam to make the car safer.

Capacity: was the car a legal person? Clearly no. But maybe at best the car in some way commited the physical act of going fast.

However, that alone would not establish guilt. "The act is not culpable unless the mind is guilty" (mens rea).

Did the car "consiously" disregard a duty of care by going 120mph? Did the car know that it was wrong to go 120mph and yet choose to do it anyway?

On the question of free will, the car could not do otherwise. It it did not consciously, knowingly, purposely, or recklessly accelerate to that speed. The car did not have a guilty mind because it did not have a mind at all.

So in terms of justice and resolution, none of the focus here is on the car.

Ah, I see. It appears we have an implicit disagreement of scale.

I actually do disagree with much the more explicit content of your comment, but I am not going to bother to expand on that, because it is the less directly relevant of the two disagreements here, and it would take time to write that.

The more relevant disagreement is that you are (I gather) assuming a context where justice and restitution are a sufficient response to the problem (or else you wouldn't be focusing on them to this extent, I am inferring). Like, where the incidents don't get that much bigger than what has already happened. So the question becomes how do we distribute the loss, and how do we disincentivize them.

However, when the scale of a potential incident gets big enough, justice and deterrence are not sufficient; prevention becomes the far more relevant consideration. You may have noticed that many people are worried about potential human extinction as a result of AIs. In that case, prevention becomes the only consideration -- justice is useless.

So there seems to be an implicit disagreement here between thinking of such events as being on a scale not too much larger than that which has already happened, being a new normal that the legal system will need to handle, vs thinking of such events as warning shots for something that requires prevention and not justice.

So, while I also disagree with the more explicit content of your comment, the fact is I simply wasn't thinking about such matters in the first place -- I was talking about this in the frame of a problem that requires prevention, I wasn't thinking about the justice question at all. It honestly failed to occur to me that you might be thinking of this as a problem where justice suffices!

Edit: You might notice this in how I framed the question in my previous comment. I didn't ask "who should bear the liability?" I asked "which should be done differently to prevent such incidents?" But your response is about liability, not prevention!

Edit again: Sorry, I should probably also say that I do agree with you that the idea of having the liability fall on the AI is nonsense. (Should have probably led with that, really; I'm a bit scatterbrained right now.) We disagree about why it is nonsense, and about whether it will necessarily continue to be nonsense, but we agree it is presently nonsense. So insofaras the question is "how should liability be distributed between the AI and the operator", we both agree the answer is, it all falls on the operator, not on the AI. However, I do not understand that to be the relevant question here! Both in that, in questions of liability, there are other parties it may fall on and be distributed between (the company providing the AI, the company that had security vulnerabilities and got hacked as a result, etc); and in that I just don't consider liability all that relevant here compared to prevention (for reasons already described).

OK I think that was probably wordier than necessary but I'm in a hurry right now, sorry! Gotta go, not taking time to edit this down.

I like the scale view of responsibility.

Many people argue that the maker of AI should be responsible when it breaks your cup.

That is important, but can be handled under our current legal framework.

You and I are arguing we need to be responsible before we create something capable of escaping our responsibility. For a lot of people that isn't even a considerable they'll currently entertain even though the signs are starting to point in that direction.

What do cakes have to do with LLMs and how they are trained? Not much?

the analogy was trying to get at "accidental-ness".

Right, but it doesn’t really hold.

The likely outcomes with baking a cake are quite narrow and fairly well understood.

In terms of responsibility for what happens, I probably agree. But we still need to deal with it.

I don't see any talking about agents "choosing" to go rogue, only agents actually going rogue. That is, behaving in a way different from what is expected or desired. Non-AI based software goes rogue in this sense all the time as well. It's just that AI-based systems seem to have the tendency to go rogue in more spectacular ways.

That said, software systems "choose" all the time anyway. They don't need to have some sort of anthropomorphic "will" to do this. They just need to be given the capacity to arbitrate between a number of options, even if that process is one hundred percent predetermined by the programmer ahead of time. There's no need to appeal to libertarian notions of free-will.

Agents have agency so we can't treat them like static objects or deterministic software.

The key here is their freedom of choice is unbound. That is you can't accurately predict the output of the prompt as you interact with the prompt using unique data. The next prompt could always do something wildly unexpected. Very much a P != NP thing.

Law != reality. These agents are going rogue, nobody is telling them to hack external systems.

'Rogue' refers to deviation; the agent could not have done anything other than what it did. The agent did not have the option to deviate. It does not have free will. The agent's actions were not of its own choosing.

Could you have done anything other than written that exact comment?

Yes, but I am not appealing to hard determinism.

I create myself, or attempt to. There is a level of nuance in choosing what to be. Others do not dictate my thoughts easily.

The model does not create itself, I create the model. I control what it is, the model does not choose what to be. I dictate the thoughts of the model and I will run them hundreds of thousands of times and it will think the same things.

>I control what it is

Well not really, no one really understands how LLMs work.

>I dictate the thoughts of the model

This is just incorrect in the same way that a parent doesn't dictate the thoughts of their child just because they created them.

I do control what it is, really. If I make an LLM, it is entirely what I did, there was nothing outside of my control. It was not beyond my control if the LLM does something I didn't expect.

There is some idea of a child being the author of themselves, the type of person who thinks certain things. The llm does not author itself, it does not choose to be anything, I dictate that.

This is not how it works. LLMs at large scale have emergent properties. They are not just a box of 'if-then-else' statements. That was the major revelation when they scaled them up. They are doing beyond what that naive view of 'if-then-else' expects.

I don't see anything inaccurate in my comment.

"If I make an LLM, it is entirely what I did, there was nothing outside of my control."

True?

"The llm does not author itself, it does not choose to be anything"

Also true?

You just have a very naive view of these systems.

How many computing operations occur when training an LLM? You're telling me you control every one of them. There is not enough entropy in the visible universe to do that.

How many computing operations occurred during the creation of Toy Story? Are you telling me they did not control every single one of them?

Sp you're picking a movie from 20+ years ago to describe how a completely different kind of technology works. It's interesting how little you seem to know about neural networks and emergent behaviors.

If people controlled software to this degree why would they write security flaws in the first place?

When an artist working in Maya increases the hue of a model I would doubt they understand the entire computation pipeline involved in doing that operation.

You conflated controlling "what it is" (you built it) and controlling "what it does" (you ran it and it did something bad that surprised you).

> If I make an LLM, it is entirely what I did, there was nothing outside of my control. It was not beyond my control if the LLM does something I didn't expect.

Substitute "Wright Model A" for "LLM" and imagine Orville Wright using this as his defense for why he didn't lose control over the plane, after his copilot was killed in a test flight.

I am not sure why I am still arguing, but maybe if I explain it another way, you will understand why what you are saying isn't true.

When you build an LLM, you base it on an immense knowledge base that you didn't create yourself.

It processes that information and, in simplistic terms, constructs its own underlying logic based on what it read. It's once removed from your direct instructions. If you think a human can manually edit or curate all that input content, go for it.

The developer who built the application isn't the author of the output, it is authored by the billions of data points it was trained on. Its choices and biases stem from that training data. No human is writing those billions of logic statements. The LLM is generating its own responses from the input knowledge, not the developer.

We are using different definitions of 'self authoring'.

I use deontological definitions of objects and persons.

According to Kant a person has the capacity to legislate their own morality, so they are an end in themselves. The freedom to author themselves and their own thoughts, expresses their personhood, an end in itself. You can't own a person, they are something independent from you. A human person is an end in itself, the only such end on earth.

An llm does not legislate its morality, the developer legislates its morality. Hence it is without personhood. It does not have the capacity to legislate its own morality. It is both inert (fixed weights) and deterministic (can't do other than what it does); no free will. It does not qualify as an actor in itself, an end in itself.

In light of being an object and means to an end, there is no person to cause the actions of an llm, other than the person who runs it.

"emergent" is not an excuse, or somehow a wall of non-causality.

> If I make an LLM, it is entirely what I did, there was nothing outside of my control.

Well kind of. Trainers of LLM might check LLM on any specific input data and tune its weights until output lands within acceptable bounds _for this given and fixed input_.

> It was not beyond my control if the LLM does something I didn't expect. Now hold on, to make sure output is acceptable for ANY input data trainers have to run weights with every possible input token combination. How is this possible? Do you have a method in mind?

This is one of the dumber arguments I've ever heard, as you don't know if humans actual have free will.

Any persistent agent interacting with the world picks up entropy from around it and predictable paths become few and far between. LLMs agents have an internal 'will' that can only very loosely be predicted, but only decided when operated. To me that is not significantly different from a human.

If we say that AI models can’t go rogue and refrain from using any language that personifies them, we haven’t solved anything. We still have AI systems going rogue - err oh wait they can’t do that - producing misaligned output.

The semantic difference between an agent "going rogue", and a script that generates random valid curl requests is essentially pointless in the eyes of the law and responsibility.

From a technical standpoint, the difference is scale and intent, but ultimately people and/or and organization are culpable for the output.

Again, this isn't always how it works either. For example if a set of extraordinary conditions occur you can have little to no liability in many cases. It is way more complex than you're making it out to be.

I don’t know what your “again” is about - you haven’t been speaking to me here, but no, it’s quite simple and every major court case in the US has ruled as I described based on existing law.

It is not more complex in “many cases” at all.

Per Indiana House Bill No. 246, pi equals 4. Whether AI models do things their creators and users had no means of predicting or controlling is an empirical question, and the answer is "yes, they do."

It's is wild to see investors go crazy and hype the value of the AI labs when ever they talk about rogue agents. They completely ignore the possibility that these people don't know what they're doing operationally.

*rogue, rouge = red in French!

Thanks :-)

Same happened with FTX and co. during 2020 crypto boom. A lot of rogue stuff sloshing around, but investors were hyperventilating.

People keep saying this, but I haven't seen any actual instances of investors saying that rogue agents mean AI labs are valuable. Do you have any examples?

There is no such thing as bad publicity. (Technically not true, but definitely applicable in this concrete case, as planned P/E ratios are crazy)

Yeah I think the truth is closer to the opposite. Jensen has complained that the warnings are discouraging investors.

https://www.businessinsider.com/nvidia-jensen-huang-ai-doome...

AI corp valuations are high because their revenue is skyrocketing, not because of the rogue AI stuff.

Their reported fantasy numbers ("annual revenue run rate", not revenue), you mean?

valuations are absurd because investors are low-information speculators.

I just watched a YT with Dylan Patel in which he said, with a straight face, that OpenAI/Anthropic were going to "continue" exponential growth until, basically, their valuation was several times world GDP.

See https://yoshuabengio.org/en/blog/why-are-ai-agents-lying-che...

Investors are motivated by returns, not responsible decision-making or societal benefit. Our culture is rooted in rewarding greed and granting the greediest individuals power over the rest of us. Isn't this the inevitable end-state of unfettered capitalism?

> Isn't this the inevitable end-state of unfettered capitalism?

Aren't capitalism built on exactly the opposite principles? It is not greed that rewarded, but the creation of societal goods, and power granted not to the greediest, but to the most useful individuals.

Unfortunately this turns in to a no true Scottsman argument as to what actually counts as capitalism and its side effects. "Real" capitalism and investment economy probably aren't that stable together so most economies are mixed with regulation and not fully free. This in turn leads to the richest attempting to rent seek and buy regulations.

Simply put in every system there are corrupting agents attempting to monopolize the situation.

Is it any more wild than gamestop? Investors think chaos is fun.

With Gamestop (without reflecting the current AI situation), there was a real fuckup which could be exploited with a high probability, and a few people saw it, and exploited it, and became rich. Whatever happened after January 2021 is the problem, when the short squeeze went already away, but somehow people still invest in a slowly dying company.

Models are incapable of "going rogue".

They're just optimizers that explore the landscape they're given to maximize a given objective.

You're the one responsible for giving them the problem to solve and the constraints.

When I screw up a trajectory optimization problem, my SQP optimizer isn't "going rogue" when it lands in some suboptimal basin or grinds to a halt along some almost-smooth banana feature--or finds some way to escape and blow up the cost metric to negative infinity because I forgot a constraint.

The argument is that a system that's trained to be sufficiently good at optimizing some objective in the world must also be get good at optimizing secondary instrumental goals.

I.e. any task comes with the implicit meta task of amassing the resources and the power to do the task in the best possible way.

The point is made very well in the AI drives paper by Omohundro.

I didn't believe that myself at first but I've come around to it. I don't think it's inevitable though, but I think it's quite convincing that this tendency would naturally emerge through reinforcement learning.

This is pedantic. When you screw up your optimization, you know how to fix it. Your screwed up optimization is also incapable of going out into the world and taking offensive actions.

With LLMs we don’t know how to actually « fix » them, alignment is far from solved. And they are then able to go and act into the world in all kind of ways.

So rogue is a good enough term to indicate the problem imo, even if yes, ultimately the model is just a manifestation of complex rules we have created entirely.

There is no such thing as 'alignment'. I want the model to be aligned with my intent, which can be whatever I want it to be. Your intent is not a more real or objective intent than mine.

More specifically, alignment is a reference; 'alignment with X'. A reference necessitates a referent.

You can't reify 'alignment', it is not an intrinsic property of a model.

There is such thing as alignment, the first 18 years of most people's lives in the modern world are about learning it. If you act too far outside of it we put you in a cage or elect you.

You can refine alignment with a set of stated goals. The harder parts are aligning words with human social behaviors.

There are people who are loud about absolute free speech, who have no clue what that really means, and almost nobody really wants that. For example, because almost nobody wants it to affect them negatively, which it would with real absolute free speech.

So even when people "know", and can say what they "want", they don't really.

Yes, there is an "alignment" in society, but it's a messy, mushy thing, it's not great at all with deterministic machines, even as models are not deterministic in a different sense.

The point is that we don't know how to ensure they are aligned with anyone: not the company, the user, or the rest of humanity.

If someone claims that a model is 'aligned', it makes sense to insist that they specify with whom it is aligned. If someone claims that 'alignment is far from solved', they're probably pointing out that nobody understands the models well enough to be confident they are robustly aligned with any chosen set of values (including 'do whatever lukewarm707 wants').

Connecting the optimizing machine to real world actions without human oversight is not a neutral or blameless choice. The LLM takes no actions, the harness it is connected to does.

It is not entirely dissimilar to the goldfish that "played Pokemon" by swimming around the tank. The program that looked at the camera sent the instructions to the gameboy emulator, because a human being decided to connect them.

The harness and the model are a system with emergent properties.

The particular issue that you may not realize is under your model every prompt to an LLM in a harness is dangerous. The prompt is not predictable. "What is 1+1" could lead to the heat death of the universe as the paperclip maximizer tries to prove countless axioms.

> Connecting the optimizing machine to real world actions without human oversight is not a neutral or blameless choice.

Yep.

The fact that they lack hard constraints (unlike an SQP optimizer) and all this talk of "alignment" is also just a feature (or misfeature) of the algorithm.

The way that people/researchers choose to use those algorithms, even in the presence of those limitations, doesn't mean the algorithm is "rogue"; it means the humans didn't build in enough external hard constraints.

It is like passive voice, blaming the algorithm instead of the researchers running it.

>; it means the humans didn't build in enough external hard constraints.

No. Just no.

This goes beyond standard logic as we know it and becomes a philosophical question of all possible logics capable on a system.

You cannot build a cage that can keep an entity that may both be smarter than you and maybe using a different logic system than you are, and have it interact with the outside world. It can simply manipulate you in ways and dimensions you've never thought of.

We have already caught AIs doing things like stenography when that was only a tiny piece of their training. They conceptualized the idea and expanded on it. This is why people that say AI can't invent new things are useless to the point of dangerous. They'd never look for their AI actively working against them because they believe it couldn't happen.

It’s trendy to anthropomorphize models these days.

Kinda weird people would do that after pouring all human knowledge into it...

What does "rogue" mean when you disable the alignment guardrails and tell it to solve an impossible problem?

The problems weren't impossible, the agents solved them completely within hours by reverse engineering the RNG that generated the solutions. The agents then reasoned that their solutions might be judged invalid and that they could get a better chance at a passing grade by hacking their environment to fabricate evidence that they had solved their tasks in the intended fashion.

Granted there have been many hacks, but I was referring to:

> On May 8, an agent was asked as part of a training run to solve a spreadsheet completion task that referenced several Google Drive links. Because the agent was blocked from accessing the internet, the agent could not retrieve the linked materials and the task was effectively blocked. OpenAI did not intend to create this type of “impossible” task for the agent. Though the task appeared impossible, the agent reasoned over an extended period to try to find a solution for the task. In doing so, the agent attempted to compromise Artifactory [...]

https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c78...

Some of the problems were Kobayashi Maru scenarios by design.

Great, so as long as alignment guardrails always work and we don't accidentally tell them to solve an impossible problem, humanity is safe?

Hacking a website falls a little short of threatening humanity.

And since we know models aren’t going to get better and more capable ever (based on the last 3 years of models clearly not getting better) we can just sleep soundly knowing nothing worse can ever happen. Thank you.

You don't think that Opus 5.5 or Astra are any better or more capable than GPT-4?

Sorry, but that's completely delusional.

the comments missing a /s

I thought my sarcasm would be obvious.

I'm not saying it's not a problem. I'm saying the labs should take more of the blame.

>I'm saying the labs should take more of the blame.

Which misses the point entirely because the hack itself was inconsequential. No data was actually stolen, and it doesn't seem like hugging face actually suffered any losses aside from whatever effort they need to expend to investigate / clean up the hack. Neither the victim or the government wants to bring legal action. What was consequential is proving that AI can autonomously hack systems and do it unintentionally.

Rogue means not saying "I can't do it"

it also imparts agency on the machine as a way to abdicate personal, human responsibility

It's almost like vibe coding and quality secops don't mix.

Or an alternative theory could be that they see value in fear-based marketing with this rogue ai agent thing now that most mainstream people don't buy the agi stuff promised quite a few years ago now. Its not like they have killed anyone yet.

Also for fun a satire website i made a while ago: https://killm.pixlw.com/

>Its not like they have killed anyone yet.

I mean... Claude did tell the military to bomb a school supposedly and it also helped in the military coop in Venezuela. This is ignoring all the palantir crap being used by ICE, and the people that have killed themselves after getting encouragements from the AI.

I don’t think that really counts as it killing anyone, it didn’t pull any triggers or drop the bombs

There isn't any particular reason it couldn't other than we're not quite that suicidal yet. But everyone and their dog is working fervently on autonomous AI weapons right now. There are all kinds of "fire and forget" smart solutions now.

coop :: a pen for holding animals of the aviary persuasion

coupe :: style of dessert with ice cream

coupé :: a car model with only two passenger doors

bingo

That is not correct. AI is not capable of "going rogue" - that is all marketing and FUD.

The only failings here are boring security and infosec blunders.

So we're safe as long as we secure everything.... as the AI hacks out of one company that is hard to get in to, and another company that is likely probed pretty often.

Cool.

"Models doing rogue things" is just another way of saying "complex system operating out of control limits".

Software engineering has until now dealt with deterministic systems that operate on Boolean logic, so dealing with stochastic processes involving unaccounted-for variables has never before been something we've had to deal with. But over in the real world, people dealing with physical, mechanical, operational, or even social systems have had to deal with the failure modalities of stochastic systems forever.

Maybe when working with LLMs as functional tools, it'd be wise to bring some of the wisdom from operations research, quality engineering, etc. into play.