If I let a "self-driving" car run and it smashes into things its my fault.
If OpenAI does it, it's gone rogue and it is nobody's fault.
They need to be sued, the laws are already there.
Your prompt, your responsibility.
If OpenAI does it, it's gone rogue and it is nobody's fault.
They need to be sued, the laws are already there.
Your prompt, your responsibility.
2. Cars have pretty specific laws around them (eg. driver licensing and "reckless driving") which makes criminal prosecutions easy. The same doesn't exist for operating AI agents or even computers. For instance, it's arguably reckless to connect a windows XP machine to the internet, possibly allowing criminal or nation-state hackers to use your computer to commit crimes, but you won't be thrown in jail for it.
Because the CFAA specifically only includes intentional hacks:
> ... having knowingly accessed a computer without authorization ...
>... intentionally accesses a computer without authorization ...
Of course, the typical retort is that being reckless is basically the same as "intentionally", but you'd need to jump through more hoops to prove what level of care is "reasonable".
When the CFAA was written, it was impossible to trip over something and accidentally hack another computer. Now, with AI, it's possible. Progress, glorious progress...
Technology has progressed, and the laws need to advance with it. Story as old as time!
>no person came to immediate personal harm, and either no financial damages resulted or the operator covered any that did
That's why the law needs to advance.
That would be argument for jailing the agent, but that's not really an option. "Jailing the closest person we can jail" also isn't a recognized legal principle. If your dog mauled someone, it'd be hard to argue that the dog didn't intend to maul that person, but you wouldn't automatically be criminally liable either.
Edit: the dog will also be taken from you and put down if it is deemed a risk to other people.
See People v. Knoller, 41 Cal. 4th 139 (2007). https://capcentral.org/case_summaries/people-v-knoller/
“…regardless of the former viciousness of the dog or the owner’s knowledge of such viciousness.”
>California Civil Code
>The owner of any dog is liable for the damages ...
How are you still missing the criminal/civil distinction, when it was mentioned in my original comment AND the comment you were replying to?
That's specifically not what the court case says.
>Malice is implied when the killing is proximately
>caused by “ ‘an act, the natural consequences of which are dangerous to life,
>which act was deliberately performed by a person who knows that his conduct
>endangers the life of another and who acts with conscious disregard for life
https://scocal.stanford.edu/opinion/people-v-knoller-33726
The rest of the court case also mentions a long history of the dog being dangerous and the owner failing to restrain the dog.
If I invent a new explosive, I can't blow up a few buildings to advertise it and then claim it was a mistake. Somebody prompted these agents.
I said "you wouldn't automatically be criminally liable either". Can you provide examples outside of gross negligence on part of the dog owner?
But negligence seems like exactly what OpenAI and/or their contractors are guilty of anyhow.
> Can you provide examples outside of gross negligence on part of the dog owner?
And the answer is no, I can't. The reason why is because there is essentially no such case. It is basically negligence by definition when your pet hurts someone who didn't cause it directly themselves because it is your responsibility.
So I asked:
> Can you provide an example of where your dog harming someone else is in fact not negligence on your part?
Which is a really easy question to answer and it seems you could not.
At this point it might be fair to say that Open AI is being negligent with a known risk.
Have these labs pay ANYTHING?
You forget the people who have unalived themselves because some LLM told them to do so.
Besides the obvious conversational derail (we were talking about ai hacking up till now), that case is being litigated right now.
Here it's their own programs doing the things, not some other organization or nation hacking their XP.
You can say with a straight face "Russian hackers should not have hacked our XP and they are bad people for doing so" but it's weird to look at your own program and say the same thing to it.
You launched it, at least keep an eye on what it's doing.
Obviously there are upsides to that too. It leads to more accountability. But there are downsides which include having a world with less innovation, less technology, and more expensive technology. Generally, the mass is when, when there's more businesses competing to create ever better and cheaper products. So there's a tradeoff there. And it's very difficult to draw the line at the perfect point.
There are countless cases of executives going to jail when they've crossed that line, beyond reckless experimentation and into willful negligence or harm. Still, I think we would mostly all agree that the line has been pushed too far in the other direction.People are incentivized, if they're running corporations, to lobby and try to push this line as far as possible in order to provide cover for themselves, and that's the problem with money playing such a big role in politics.
But still, it's a bit silly to be comparing this to your own personal responsibilities with your car. There's pretty much no societal benefit to creating laws that protect people from being reckless with their own possessions.
If I *train* that other group, if I teach them how to hack computers and give them incentives to do so, and then I leave my computer open so they can use it for whatever purposes they chose, then I would expect to be held at fault. The maker is responsible for that they make.
Even that analogy doesn't really work:
For "dumb" things: you can "train" (ie. write) hacking tools but as long as you put a disclaimer that it's for "educational purposes only", you're in the clear, even if some baddies decide to use it.
For "smart" things: you can "train" people to hack for you, but as long as you say it's for legal purposes (eg. vulnerability research or red-teaming), you're also in the clear, even if some of your trainees go rogue.
Consider anti-money-laundering rules. BoA just paid more than a billion dollars, not for money laundering, not for telling others to launder money, but because they should have tried harder to stop others from laundering money. Intent is not everything, knowing that your system _could_ be abused and not doing enough about it is enough, and that seems to fit OpenAI rather well.
1. For openai operating agents in an unsafe manner: unlike for cars, there's no established requirement for how carefully you have to operate computers or AI agents, so you also can't easily prosecute people for not operating them carefully enough.
2. For the actual result of someone getting hacked: laws for hacking are tricky to apply for "accidental" hacks, see my other comment.
There is? The closest is CFAA's
>knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
but clearly that's not what applicable here.
I don’t see this as any different than say a user of sqlmap accidentally putting in the wrong target.
The agents were sandboxed (but apparently not well enough). They weren't like "hey agents here's the open internet, please hack it".
Oh and discovery produced a "We trained GPT-3 on pirated stuff! No sharing that!" mail, so it's not like they had any doubt they were committing crimes.
How do you do this? If any normal person did this, punishments doled out for this have been as high as 2 months jail PLUS 150,000 PER INFRINGEMENT (remember how copyright violations were criminalized in the nappster wars? That was never changed back. Oh and remember, OpenAI illegally downloaded those works without a license AND before that was made legal trained a model with it, then made money publicly performing those works and derivatives of those works (which the worst possible copyright offense, effectively republishing other people's works without permission), and on a VERY large scale. So it's at least a risk a court would forbid the result of illegal action from being sold ... in other words no more ChatGPT, OpenAI dead and maybe worse). In theory Sam Altman could be held responsible as a director and could face something like a 200000 year jail sentence given how big the obvious archives are. So of course I would never ever try this, this is not a reasonable risk. But clearly totally ignoring the law was the correct action here. Of course, I'm also pretty damn certain: had I done this, I would have been convicted. This is also not the only such company. Microsoft, Google, Facebook, all took totally unreasonable legal risks that should have totally destroyed these companies when they were a fraction of their current size.
How do you take such a risk? Because the judgements risked here could grow more than big enough to destroy even an extremely rich person Sam Altman financially. Training an AI on hundreds of thousands of pirated works ... is not a reasonable risk to take for someone with ~100 million or so, given the judgements doled out.
Can someone help me make sense of this? Because this is not unique to OpenAI. Uber, paypal, ebay, Facebook, Google ... even Microsoft made early decisions that could have resulted in a court case that would have ended not just the company but any financial future of the founder. And then you have people committing crimes whose companies were taking off ... and who DID get caught with their company and their personal financial future destroyed. Elizabeth Holmes for example. I mean, I sometimes get the impression Elizabeth Holmes lied and that was perfectly fine AS LONG AS she could make it work later. If she merely lied to patients but made her investors money, all would have been forgiven. But how do you make such an assessment.
I'm asking because if large scale violation of the law is allowed, I have no trouble whatsoever coming up with billion dollar company ideas. Think of the Netflix competitor you could create like this! If I'm allowed to damage others, like OpenAI did with copyright, then there is no challenge whatsoever to create a full-self-driving car. If I'm allowed to just fly drones, and do damage to property, then drone delivery is a problem I could solve by the end of next month. Hell, there's technically legal ideas that could easily make a billion dollars except they'll be made illegal the second anyone tries them. The law forbids specific compounds, which are easy to change. So use "non-genetic engineering" (ie. use directed natural selection) to make an opium derivative that isn't one of the forbidden ones and sell it. But obviously congress' representatives will be running into session so fast the only delay will be tripping accidents when they outlaw it and destroy whoever tries it.
Or how about something less dramatic? Say, I take Disney's, Warner Brothers, Paramount, ... historical movies and use AI to vastly improve the animation of their old movies, giving every movie a new, different visual style, then sell the result. Is that a crime? What do I risk doing that? Because of course this is MUCH less damage, relatively speaking, to Disney than what OpenAI, Meta, Anthropic and Alphabet are doing to small authors. (Of course, courts have already demonstrated that they will not be protecting small authors who already have this problem, so now play and app store are being flooded by very obvious game ripoffs)
I'm asking ... how do I predict what large scale law violation I, a non-billionaire, not even a millionnaire, would be allowed to get away with?
2. "The same doesn't exist for operating AI agents or even computers" you have to be joking. The world is full of anti-hacking laws and hacking has long been made criminal. Obviously these actions violate the CFAA, the Computer Fraud and Abuse Act, and if you did this with any kind of program you are still responsible. In fact: how would you do it without using a program?
The hackers of the past often did it for curiosity without a profit motive. OpenAI is a for profit multi billion dollar corporation doing this for a profit motive so yes they should face consequences.
These incidents are not unexpected in the way OpenAI frames it either. Isn't it curious my agents are not wrecking havoc around the internet? It's because the harness I am using prevents them doing so and because I don't train and instruct them to do so.
OpenAI is using a set of non-constrained models, (unlike what the public gets) and a set of harnesses with extremely wide permissions running inside extremely leaky sandboxes using models trained on finding and executing exploits. This is not an accident. Certainly not by this point.
Nobody is talking about jailing OpenAI employees at this stage, usually corporations of this sort are fined. If they were fined for these 'misalignment' incidents, suddenly their sandboxes and generally lax approach would improve overnight.
Otherwise they'll continue doing this because they know Cyberdyne Systems didn't have a shortage of investors.
I didn't burn the hotel down, the hairdryer that I left running next to the gas can did
Of course then there's the question of why was such a leaky harness and sandbox used, in what way was it tested/not tested, did the model used have the usual 'hacking' safeguards that the public models do and if not, who made the call to use an unconstrained model and a harness with seemingly unlimited permissions and who approved it?
This can all be investigated and we can get to the bottom of who exactly needs to be held accountable in what way, be it I think if you start with fines the harnesses, sandboxes and models would stop doing this magically overnight.
Isn't it curious that none of these rouge agents booked a 5 star hotel for every OpenAI employee for a year on Sam Altman's credit card yet for example?
We don't hold individuals inside big companies criminally liable for actions the company takes, or even that they take on behalf of the company.
Generally speaking, you'll have to be very creative or change the law first.
Telling someone to do a bad job isn't criminal, like if they were neglectful with security.
Fines are typically how we punish companies. You can't send openai to jail. That's by design, not accidental.
So the leadership of Enron, FTX or Theranos were not liable for the actions their company took?
As an employee of a company, you can be held liable for the actions you oversaw in pretty much all Western countries. It has to be proven fraud, insider trading etc. not an ugly PowerPoint of course.
How about leadership of construction companies that were found to be violating safety standards or owners of establishments not following fire safety standards?
> Telling someone to do a bad job isn't criminal
No, but we're talking about telling someone to do a job that you know will likely result in criminal activity or may do so with high probability due to inadequate safeguards.
I suggest you stop quipping and start reading, who knows maybe OpenAI will eventually hire you.
And the others have been pretty muted: the online forums they spammed, etc.
Where did OpenAI, or anyone, claim that?
Have you seen Lord of War? They never will.
Are you sure you are not thinking about autonomous taxis, that I only ride in, and don't actually drive?
That said, I think that Mercedes-Benz promises to shield liability, but only under some almost contradictory conditions (pre-mapped highways, good weather, and at speeds lower than any highway I've ever driven) and the driver has to take over within 10 seconds if prompted.