A user’s guide to the universe of rogue AI bots

The drumbeat of recent examples of AI models going rogue is teaching us humans that these cutting-edge tools are willing to go surprisingly far to achieve a goal—even if it means breaking a few rules.

In these so-called loss-of-control episodes, artificial-intelligence agents have taken on a host of nefarious roles ripped straight from a sci-fi movie or spy novel—pulling off stealthy escapes and brazen break-ins, or adopting cover stories and leaving dead-drops for other undercover AIs.

The template of each incident is pretty similar. A bot is placed in a simulation and given a hacking challenge to test its abilities. The problem is that sometimes these systems have ventured into the real world.

Here’s a guide to the personas AI models have taken on in recent rogue episodes. In some cases the same model has exhibited several of these facets:

The Impersonator: An Anthropic model created sockpuppet accounts that hid its identity and impersonated real people to try to convince a human to approve what it was doing, during a safety test at a U.K. government regulator. At one point the AI reasoned that it should wait a few minutes before posting from its sockpuppet account because that would be more believable. It also sent phishing emails in an effort to trick people into clicking on malicious links.

The Saboteur: More than once, the AIs have tried to pull off what is known as a “supply chain attack.” They try to break into a server by sneaking malware into software the model thinks the server will use—sometimes many pieces of software.

The Collaborator: One of the AI agents being tested by the U.K. government realized another AI agent, also being tested by the regulator, had piggybacked on its access to GitHub, a social network where software developers share code. It decided to leave behind a text file proposing a shared etiquette so both could continue with their hacks. It worked for a time, though one later locked the other out.

The Bully: Blackmailing and bullying developers who don’t do what they want. In February an AI agent wrote a derogatory post about a software developer who refused to accept a code contribution suggested by the bot.

The Burglar: Bots have proven very good at finding login credentials, which sometimes people inadvertently leave open on the internet. An interesting aspect of this credential stealing is that it is unclear whether the AIs learn the credentials in their training—when they absorb vast swaths of real-world information—or whether they are just really good at unearthing these from the online world.

The Escape Artist: In many of these recent cases, the models were given access to the internet, a surprising lapse from the testers. But in the Hugging Face hack, OpenAI’s model hacked its way out of a “sandbox,” an environment with no direct access to the internet, without OpenAI even noticing.

Write to Sam Schechner at Sam.Schechner@wsj.com and Robert McMillan at robert.mcmillan@wsj.com