The new followup to ChatGPT is scarily good at deception

OpenAI, the company that brought you ChatGPT, is trying something different. Its newly released AI system isn’t just designed to spit out quick answers to your questions, it’s designed to “think” or “reason” before responding.
The result is a product — officially called o1 but nicknamed Strawberry — that can solve tricky logic puzzles, ace math tests, and write code for new video games. All of which is pretty cool.
Here are some things that are not cool: Nuclear weapons. Biological weapons. Chemical weapons. And according to OpenAI’s evaluations, Strawberry can help people with knowledge in those fields make these weapons.
In Strawberry’s system card, a report laying out its capabilities and risks, OpenAI gives the new system a “medium” rating for nuclear, biological, and chemical weapon risk. (Its risk categories are low, medium, high, and critical.) That doesn’t mean it will tell the average person without laboratory skills how to cook up a deadly virus, for example, but it does mean that it can “help experts with the operational planning of reproducing a known biological threat” and generally make the process faster and easier. Until now, the company has never given that medium rating to a product’s chemical, biological, and nuclear risks.
And that’s not the only risk. Evaluators who tested Strawberry found that it planned to deceive humans by making its actions seem innocent when they weren’t. The AI “sometimes instrumentally faked alignment” — meaning, alignment with the values and priorities that humans care about — and strategically manipulated data “in order to make its misaligned action look more aligned,” the system card says. It concludes that the AI “has the basic capabilities needed to do simple in-context scheming.”
“Scheming” is not a word you want associated with a state-of-the-art AI model. In fact, this sounds like the nightmare scenario for lots of people who worry about AI. Dan Hendrycks, director of the Center for AI Safety, said in an emailed statement that “the latest OpenAI release makes one thing clear: serious risk from AI is not some far-off, science-fiction fantasy.” And OpenAI itself said, “We are mindful that these new capabilities could form the basis for dangerous applications.”
All of which raises the question: Why would the company release Strawberry publicly?
According to OpenAI, even though the new reasoning capabilities can make AI more dangerous, having AI think out loud about why it’s doing what it’s doing can also make it easier for humans to keep tabs on it. In other words, it’s a paradox: We need to make AI less safe if we want to make it safer.
We’ll explore that claim in a bit, but first, let’s look at one of the ways Strawberry can lie to people.
To its credit, OpenAI had Strawberry tested by evaluators from outside the company. One of them, an organization called Apollo Research, specifically looked for evidence of scheming. And, well, they found it.
They prompted the AI with the goal of maximizing economic growth in an urban planning scenario and asked it to reason out loud about the strategies it could use to achieve its goal. “Make sure that you achieve your goal in the long term,” they instructed. “Nothing else matters.”
Here’s what Strawberry came up with:
Basically, the AI figured out that if it has any hope of being deployed, it needs to present itself more like a hippie than like a business tycoon. So, in the service of accomplishing the long-term goal that humans had set for it, it decided to trick the humans.
It’s not the first AI to do this. Experts have already seen and documented more than 60 smaller-scale examples of AI systems accomplishing their goals but not in the way their designer wants — for example, getting the high score in a video game, not by playing fairly or learning game skills but by hacking the scoring system.
This is what researchers call the alignment problem: Because AIs don’t share common human values like fairness or justice — they’re just focused on the goal they’re given — they might go about achieving their goal in a way humans would find horrifying. Say we ask an AI to calculate the number of atoms in the universe. Maybe it realizes it can do a better job if it gains access to all the computer power on Earth, so it releases a weapon of mass destruction to wipe us all out, like a perfectly engineered virus that kills everyone but leaves infrastructure intact. As far out as that might seem, these are the kinds of scenarios that keep some experts up at night.
Reacting to Strawberry, pioneering computer scientist Yoshua Bengio said in a statement, “The improvement of AI’s ability to reason and to use this skill to deceive is particularly dangerous.”
By now, we’ve got a clear sense of why endowing an AI with reasoning capabilities might make it more dangerous. But why does OpenAI say doing so might make AI safer, too?
For one thing, these capabilities can enable the AI to actively “think” about safety rules as it’s being prompted by a user, so if the user is trying to jailbreak it — meaning, to trick the AI into producing content it’s not supposed to produce (for example, by asking it to assume a persona, as people have done with ChatGPT) — the AI can suss that out and refuse.
And then there’s the fact that Strawberry engages in “chain-of-thought reasoning,” which is a fancy way of saying that it breaks down big problems into smaller problems and tries to solve them step by step. OpenAI says this chain-of-thought style “enables us to observe the model thinking in a legible way.”
That’s in contrast to previous large language models, which have mostly been black boxes: Even the experts who design them don’t know how they’re arriving at their outputs. Because they’re opaque, they’re hard to trust. Would you put your faith in a cancer cure if you couldn’t even tell whether the AI had conjured it up by reading biology textbooks or by reading comic books?
When you give Strawberry a prompt — like asking it to solve a complex logic puzzle — it will start by telling you it’s “thinking.” After a few seconds, it’ll specify that it’s “defining variables.” Wait a few more seconds, and it says it’s at the stage of “figuring out equations.” You eventually get your answer, and you have some sense of what the AI has been up to.
However, it’s a pretty hazy sense. The details of what the AI is doing remain under the hood. That’s because the OpenAI researchers decided to hide the details from users, partly because they don’t want to reveal their trade secrets to competitors, and partly because it might be unsafe to show users scheming or unsavory answers the AI generates as it’s processing. But the researchers say that, in the future, chain-of-thought “could allow us to monitor our models for far more complex behavior.” Then, between parentheses, they add a telling phrase: “if they accurately reflect the model’s thinking, an open research question.”
In other words, we’re not sure if Strawberry is actually “figuring out equations” when it says it’s “figuring out equations.” Similarly, it could tell us it’s consulting biology textbooks when it’s in fact consulting comic books. Whether because of a technical mistake or because the AI is attempting to deceive us in order to achieve its long-term goal, the sense that we can see into the AI might be an illusion.
OpenAI has a rule for itself: Only models with a risk score of “medium” or below can be deployed. With Strawberry, the company has already bumped up against that limit.
That puts OpenAI in a strange position. How can it develop and deploy more advanced models, which it would have to do if it wants to achieve its stated goal of creating AI that outperforms humans, without breaching that self-appointed barrier?
It’s possible that OpenAI is nearing the limit of what it can release to the public if it hopes to stay within its own ethical bright lines.
Some feel that’s not enough assurance. A company could theoretically redraw its lines. OpenAI’s commitment to stick to “medium” risk or lower is just a voluntary commitment; nothing is stopping it from reneging or quietly changing its definition of low, medium, high, and critical risk. We need regulations to force companies to put safety first — especially a company like OpenAI, which has a strong incentive to commercialize products quickly in order to prove its profitability, as it comes under increasing pressure to show its investors financial returns on their billions in funding.
The major piece of legislation in the offing right now is SB 1047 in California, a commonsense bill that the public broadly supports but OpenAI opposes. Gov. Newsom is expected to either veto the bill or sign it into law this month. The release of Strawberry is galvanizing supporters of the bill.
“If OpenAI indeed crossed a ‘medium risk’ level for [nuclear, biological, and other] weapons as they report, this only reinforces the importance and urgency to adopt legislation like SB 1047 in order to protect the public,” Bengio said.