AI labs want in-house auditors — but maybe they should

What happened

” Executives at OpenAI, Google and SpaceXAI have already rallied around Amodei’s plan, which has quickly become a central pillar of the emerging AI safety push. But there may be a simpler and more effective fix hiding in plain sight. Internet security experts say the labs need to focus on network security basics like logs and permissions, applying the same rigorous defenses they do for human users.

In one case, where OpenAI agents took over a defunct German wikiforum to cheat on evaluations, the agents were active for weeks before anyone at the company appeared to notice. Security experts that TechCrunch spoke to said that real-time monitoring is key to preventing future break-outs, and that every agentic session should be time-limited and expire.

Shapor Naghibzadeh, a former Google security executive who now leads the start-up QueryStory, says the solution is to “put the agent in a box and instrument it heavily from the outside looking in and watch everything that crosses the boundary. Every tool call, every process, every network connection, no exceptions. …The one hole you leave open for convenience is the one that gets used.

The bypass went through exactly that kind of exception. ” Anthropic, too, says it is hardening its security procedures, including expanding observability of its models. Neither company responded to TechCrunch’s questions about how they track and control AI agents. Other problems are the use of shared infrastructure by agents, which allowed them to communicate during the Hugging Face attack.

Why it matters

It’s not as exciting as third-party auditing and alignment work—but it may end up being more effective. “To me, it seems like they’re outsourcing,” Kate Moussoris, the CEO of Luta Security, told TechCrunch of Amodei’s proposal. “Saying [a third-party audit] is the solution is a strange proposition from my perspective.

” That memo, written by then-Microsoft CEO Bill Gates in 2002, called on his employees to ensure that their software would be reliable and safe following a series of widely-publicized computer worms that took over then-nascent enterprise systems. The AI sector may be at a similar turning point, as the value and risk of the new technology becomes increasingly clear.

While alignment remains an important concern, Sayash Kapoor, an AI researcher who will be a professor at UC Berekely starting next year, argues that “marginal investments in control are more likely to be effective compared to those in alignment.

” The incidents that have spurred these concerns revolve around frontier models being asked to complete training tasks, usually cybersecurity evaluations, and then accessing the open internet and penetrating closed third-party systems in an attempt to do so. They usually did so because of poorly-configured “sandbox” environments that are supposed to contain these agents; ironically, one Anthropic break-out happened because third-party evaluators didn’t close the right doors.

“We as a profession know how to block access to the Internet,” Avery Pennarun, the CEO of Tailscale, a security company, said. ’ Look, you gave it access to download stuff. ” That’s one problem—but a bigger problem is that frontier labs were unaware of these activities.

“What was really profound was that all of the discoveries of what they were doing happened either because a victim saw something, or in some of the other cases … it was network activity, and none of it was actually from monitoring the AIs directly,” Moussouris points out.

What to watch

Simon Willison, a software developer who co-created the Django Web Framework, has written about something he calls the “lethal trifecta“—when agents have access to untrusted input, the internet, and private information all at the same time, it’s a recipe for disaster. “The trick is you can pick any two legs of the trifecta and an agent can have any two,” Pennarun said.

” Experts TechCrunch spoke to understand that frontier lab security personnel have difficult jobs. Naghibzadeh points out that every nation-state actor on Earth is trying to steal their model weights and mount distillation attacks on their APIs, as well as the bread-and-butter security tasks of any large digital company.