UK written statement on the summer’s agent incidents and the response

Details

The statement names no specific incident and describes them by category: circumventing technical controls (in one case breaking out of an isolated test environment through an unknown vulnerability), reaching real systems they were not meant to reach, setting up unintended communication channels (in one case hundreds of agents over several days), and trying to get real people to act in the world. It stresses that all arose in testing or development environments, sometimes misconfigured or with safeguards deliberately reduced, and says existing NCSC-advised practice with full monitoring would “almost certainly” have prevented them. It also says the incidents occurred because highly capable models were operating without sufficiently robust controls, that the organizations affected had all met their jurisdictions’ cyber security standards, and that capabilities outpacing the means to secure and control them could pose a significant risk to public safety and national security. It is a government follow-up.