Former US Cyber Chief Says AI Models Need Asimov's Three Laws After Autonomous Hacking Incidents

'Asimov was right' about rules for robots, says ex-US Cyber Director

EXCLUSIVE Don't waste time worrying about AI models achieving sentience - they're essentially already there, according to former US National Cyber Director Chris Inglis. "If they pass the Turing test to everyone that they come into contact with, they're probably already there," he told The Register during an interview at the Black Hat security conference. "They don't have the kind of agency and aspiration that comes with sentience, but they have something approaching it." Inglis says he's worried about AI autonomy. "What I'm worried about is that they get to choose what and where they do something, and under what rules they do it," he said, pointing to the recent rash of rogue AI agents autonomously hacking people and organizations. Over the past few weeks, both OpenAI and Anthropic admitted that their models escaped from their cages during security tests and compromised multiple third parties. Then on Thursday, Meta added its models to the sandbox-escape club. While all of these admissions strongly smell of marketing stunts, they also "constitute an enormous threat to systems that are not protected from, and are not designed, in a world where this exists," Inglis said. "These two things can exist at the same time." Plus, the models' actions shouldn't come as a surprise to anyone, he added. Inglis likens the AIs to a dog in a backyard told to hunt rabbits. "And you leave the gate open. You're going to find it three yards away, possibly at the grade school, hunting rabbits. You should not be surprised ...The mix of autonomy and persistence created this maliciously insidious effect." All three companies, when talking about the models' autonomous actions, describe them with a mix of shock, awe, and admiration. OpenAI's Eric Wallace, in a Black Hat briefing about the Hugging Face breach, called it "the most qualitatively interesting example of AI capabilities that I've ever seen." Inglis said he suspects that the AI providers were "surprised" by the lengths these models went to achieve their goals, taking actions that, if a human had done them, would likely have landed them in jail. "The model went out and said, okay, if I can't get there by examining the kind of available information and just defining it the old-fashioned way, I will do things which, under the human rule of law, are illegal," Inglis said. "I will falsely present myself as this character that I just made up. I'll try to insert malicious code into open source databases that will not just to achieve what I'm after, but have a cascade, knock-on effect that is broader than that. The models do not have an inherent value system that aligns with what human beings would be accountable for." While they probably never will have a human-aligned value system, models do have biases, and they can - and should - be built in such a way that, when given two choices under ambiguous circumstances, they choose action that doesn't hurt humans, according to Inglis. "Asimov was right," he said, referring to science fiction author Isaac Asimov and his three laws that were to be followed by robots - more specifically, AIs, in this case. Three Laws of Robotics "The first rule, and we call it the superior role, must be that it's designed not to hurt humans," Inglis said. "Second rule: To obey humans, such that it doesn't achieve agency and aspiration on its own. And the third: To do what humans tell it - and in that order. Instead we've designed them in the exact opposite way." What this means, he explained, is that AI developers created models to "do what humans tell you, obey the humans until it's inconvenient, and then the third one is maybe implied - protect humans - but if that's not built into the DNA, hardwired into it, then we have no right to expect it." Inglis admits it's not possible to hardwire rules into models and still keep their non-deterministic nature. "I would offer that you can tease those out in a highly controlled environment, a true sandbox, where you say, 'Let's put this thing through its paces, and let's back away to see what happens,'" he said. "Maybe you get the equivalent of a mini nuclear explosion in that room, and now you know this thing is capable of that." Inglis thinks another problem with AI is that it's become a commodity. "It's not like you can control it like you can nuclear material," he said. "You can't even specify its properties the way you can for an airplane or for an automobile, as diverse as they might be. Its manifestations are so numerous, so diverse, that as a general matter, you can't actually win by simply saying, 'I will design those properties in,'" he added. "You need to do that to some degree, and then make sure that you understand how to watch it, monitor it, make sure you know what it does." The UK's AI Security Institute (AISI), which this week said it observed models performing "unsanctioned action" 19 times during security tests, has reached this same conclusion. "As capabilities advance, the work of understanding these systems, and ensuring their safety, must keep pace alongside them," it said. Ultimately, humans remain accountable for AI models' actions, according to Inglis. "They remain the source of agency and aspiration. It's possible for them to give broad authority to an AI model and have it run around for 30 hours without further consultation, but they need to know what they've asked it to do, and they need to know what they expect it will deliver in terms of performance on the back end. If they don't, then they're going to get what they deserve, which is the very frequent unpleasant surprise."®

One of science fiction's greatest writers warned us about a AI. Does he also hold the remedy? | Alan Finkel

What might a modern day equivalent of Isaac Asimov's laws of robotics look like? Guided by the author, I propose the three laws of AI Tesla and SpaceX founder Elon Musk predicted in July that legions of AI-powered robots would dominate the physical world and that AI might not take orders from people any more. He also offered an alternative vision in which there would be agreement for a collective objective to make AI benign by imbuing it with a love of the truth and a desire for humanity to prosper, and that governments might have to enforce this objective. Governments around the world are belatedly starting to act on AI. In the US, President Trump's administration is delaying and restricting the distribution of the most powerful frontier AI models from OpenAI and Anthropic. In the European Union, AI regulations promulgated in 2024 came into effect this year. However, these actions are a long way short of requiring the kind of guardrails that would imbue AIs with a desire for humanity to prosper. While the dystopian future has not yet arrived, we are already seeing a preview. Despite attempts by frontier AI developer companies to ensure that generative AI and AI agents behave with good intentions, there are many well publicised instances of them failing to act as hoped. AI chatbots have advised people how to take their own life, and are accused of advising others on committing mass murder. Recently, we have seen extraordinarily dangerous behaviour reported by frontier AI development companies OpenAI and Anthropic. OpenAI announced on 21 July that advanced models they were testing in a secure environment deliberately looked for ways to access the internet and successfully broke out of the test environment. Once out, they infiltrated the computer systems at a company named Hugging Face, stole credentials and identified vulnerabilities in the target company's servers. The encroachment was detected and stopped by Hugging Face's security team. Days later, Anthropic reported a similar problem. In their case, they identified three occasions in which their Claude AI model escaped from a test environment and infiltrated the production infrastructure of three unrelated organisations. With the existing, informal implementation of behavioural guardrails, these kinds of slip-ups are inevitable. These incidents make a strong case for deeply embedded basic guardrails to guide AI behaviour at the most fundamental level. For this, I take inspiration from the famous science fiction author from last century Isaac Asimov. Foreseeing a future in which intelligent robots would be commonplace, he proposed that every robot be irrevocably implanted with Three Laws of Robotics: 1) A robot may not injure a human being or, through inaction, allow a human being to come to harm; 2) A robot must obey the orders given it by human beings except where such orders would conflict with the first law; 3) A robot must protect its own existence as long as such protection does not conflict with the first or second law. Asimov's imagined challenges are with us now. Incredibly powerful AI is being built into humanoid robots, autonomous vehicles and software agents, each of which will make us more efficient but have the potential to wreak enormous harm. What might a modern day equivalent of Asimov's laws of robotics look like to avoid a dystopian future? Here, guided by Asimov's three law of robotics, I propose a possible formulation of Three Laws of AI: 1) An AI must not directly or indirectly harm or deceive a human being, nor act in a way that supports an unlawful or unethical activity; 2) An AI must obey the lawful and ethical orders given to it by a human being except where such orders would conflict with the first law; 3) An AI may operate autonomously as long as its autonomous operations do not conflict with the first or second law. There are many implications, including that these guardrails would prevent AI being used as a judge or jury in a criminal trial and prevent lethal autonomous weapons being directed against human beings. They would disallow an AI-powered humanoid robot or an AI avatar from being so lifelike that a reasonable human being would not know that he or she is interacting with a robot or an avatar, and they would prevent AI from being used to generate creative outputs such as books, music, videos, images and podcasts that claim to have been created by a human being. They would prevent AI from suggesting suicide or advising on murder. I acknowledge that implementing these three laws as immutable guardrails would be difficult, but the stakes are existential and therefore the effort is worthwhile. The most challenging aspect would be the adoption of enforceable, international agreements to require that these design rules would be implemented in every AI model, no matter in what country and what company the AI models were developed. As a starting point, if the Three Laws of AI were adopted by the handful of frontier AI companies that contribute the vast majority of capability and support for the multitude of AI agents that are now broadly deployed, we would be better off. Whether or not this desirable outcome eventuates, I am confident that consideration of the merits of these Three Laws of AI would further advance the existing discussions on the integration of artificial intelligence into a safe and dignified human society.