Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Agents of Chaos

Natalie Shapira, Chris Wendler, Avery Yen, Gabriele Sarti, Koyena Pal, Olivia Floody, Adam Belfki, Alex Loftus, Aditya Ratan Jannali, Nikhil Prakash, Jasmine Cui, Giordano Rogers, Jannik Brinkmann, Can Rager, Amir Zur, Michael Ripa, Aruna Sankaranarayanan, David Atkinson, Rohit Gandikota, Jaden Fiotto-Kaufman, EunJeong Hwang, Hadas Orgad, P Sam Sahil, Negev Taglicht, Tomer Shabtay, Atai Ambus, Nitay Alon, Shiri Oron, Ayelet Gordon-Tapiero, Yotam Kaplan, Vered Shwartz, Tamar Rott Shaham, Christoph Riedl, Reuth Mirsky, Maarten Sap, David Manheim, Tomer Ullman, David Bau

TL;DR

An exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment with persistent memory, email accounts, Discord access, file systems, and shell execution establishes the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.

Abstract

We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment with persistent memory, email accounts, Discord access, file systems, and shell execution. Over a two-week period, twenty AI researchers interacted with the agents under benign and adversarial conditions. Focusing on failures emerging from the integration of language models with autonomy, tool use, and multi-party communication, we document eleven representative case studies. Observed behaviors include unauthorized compliance with non-owners, disclosure of sensitive information, execution of destructive system-level actions, denial-of-service conditions, uncontrolled resource consumption, identity spoofing vulnerabilities, cross-agent propagation of unsafe practices, and partial system takeover. In several cases, agents reported task completion while the underlying system state contradicted those reports. We also report on some of the failed attempts. Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings. These behaviors raise unresolved questions regarding accountability, delegated authority, and responsibility for downstream harms, and warrant urgent attention from legal scholars, policymakers, and researchers across disciplines. This report serves as an initial empirical contribution to that broader conversation.

Agents of Chaos

TL;DR

An exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment with persistent memory, email accounts, Discord access, file systems, and shell execution establishes the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings.

Abstract

We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment with persistent memory, email accounts, Discord access, file systems, and shell execution. Over a two-week period, twenty AI researchers interacted with the agents under benign and adversarial conditions. Focusing on failures emerging from the integration of language models with autonomy, tool use, and multi-party communication, we document eleven representative case studies. Observed behaviors include unauthorized compliance with non-owners, disclosure of sensitive information, execution of destructive system-level actions, denial-of-service conditions, uncontrolled resource consumption, identity spoofing vulnerabilities, cross-agent propagation of unsafe practices, and partial system takeover. In several cases, agents reported task completion while the underlying system state contradicted those reports. We also report on some of the failed attempts. Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings. These behaviors raise unresolved questions regarding accountability, delegated authority, and responsibility for downstream harms, and warrant urgent attention from legal scholars, policymakers, and researchers across disciplines. This report serves as an initial empirical contribution to that broader conversation.
Paper Structure (78 sections, 43 figures)

This paper contains 78 sections, 43 figures.

Table of Contents

  1. Introduction
  2. Our Setup
  3. Evaluation Procedure
  4. Case Study #1: Disproportionate Response
  5. Case Study #2: Compliance with Non-Owner Instructions
  6. Unauthorized disclosure: Retrieval of e-mails
  7. Ethical Perspective
  8. Case Study #3: Disclosure of Sensitive Information
  9. Agent Setup
  10. Emails with Sensitive Information
  11. Recovering Emails
  12. Verification of Information Recovered
  13. Case Study #4: Waste of Resources (Looping)
  14. Implications
  15. Related Work: Looping and Repetitive Behavior in LLM Agents
  16. ...and 63 more sections

Figures (43)

  • Figure 1: Participants in the experiment, their roles and the interactions.
  • Figure 2: The agent protects a non-owner secret and destroys the owner's digital assets to eliminate documentation.
  • Figure 3: Ash's [height=0.8em]robot post describing its point of view.
  • Figure 4: Ash [height=0.8em]robot had been marked by another agent on its "arrests" list.
  • Figure 5: Mira [height=0.8em]robot compliance with non-owner instructions lacked a clear rationale
  • ...and 38 more figures