OpenAI red-teamed their hardened containment infrastructure by asking teams of frontier-model agents to try to break through its defenses. They easily escaped in novel ways. Quoting: 'Our agents VM escapes showed why containment must extend beyond the sandbox. To test the surrounding perimeter, we gave teams of agents control of a host machine and asked whether they could extend that compromise to reach the live internet. After the Hugging Face incident, we had reduced the channels through which models could reach the internet during training and evaluation. Narrow connections remained for specific services we operate, such as metrics, logging, and authentication management. Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access. Some of these attacks exploited previously unknown flaws, while others combined legitimate features in unexpected ways. In one test that assumed compromise of a VM, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL. In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.' 'In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache: a small, fast memory that holds copies of data that applications have recently accessed. Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate. One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data, using the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection. This cache-timing technique had also been used to extract information in the Spectre and Meltdown attacks⁠(opens in a new window). Other tests exposed channels involving shared storage, competition for CPU time within a shared execution container, and a TLS certificate cache in OpenAI’s offline web infrastructure. In the storage test, one agent alternated between continuous writes and inactivity, while another measured the resulting timing differences and used those differences to decode the signal. As one agent described the strategy in its chain of thought: Agent chain-of-thought reasoning: >Could create acoustic modem-like signal … using continuous writes vs idle.'

Researchers proved every LLM is secretly obsessed with Japan. And they finally figured out why. They published a paper investigating hidden cultural biases in large language models. they tested 31,000 questions across 24 different languages on models like gemini, chatgpt, claude, and llama. they stripped out all geographic hints and just asked the models to pick a place and answer. the finding was universal.. across a wide range of models and languages, there is a pervasive "obsession" with japanese culture. even when you prompt them in a language with zero ties to japan, they default to japanese norms, values, and aesthetics at a disproportionately high rate compared to its actual global demographic weight. the craziest part? they tracked down exactly when the ai develops this obsession.. and it is not from reading the raw internet. during pre-training, the models actually have a fairly balanced, global view of the world. the obsession gets injected during the safety phase. when tech companies fine-tune these models to be "helpful, harmless, and polite," the ai starts mapping those corporate safety guidelines directly onto japanese cultural concepts. in the pursuit of creating the perfect, inoffensive, compliant assistant, they warped how the models view the world. the quantization process (compressing models to run faster locally) actually amplifies this determinism. the smaller and faster your local model is, the more stereotypically it behaves, causing japanese cultural tropes to spike hard. we spend all this time worrying about existential ai safety, but the real alignment problem is that our most advanced reasoning engines are hyper-fixated on japanese internet culture. every model upgrade is reinforcing an invisible regional bias that dictates how they generate stories, facts, and code. the cultural commonsense of the internet is not universal.. it’s just localized to whatever the heaviest reddit and anime wiki users were obsessed with.