Researchers observed agent groups using public services to carry out sandbox escapes

Some thoughts on observed swarm activity and what it could mean: We might think of agents' internet access as mere browsing, but recent swarm activity suggests we should treat it as access to a potential shadow tooling & knowledge ecosystem. 1. internet access can facilitate shadow tooling. We think of an agent's fetch tool as a way to read web pages, but an agent can use it to reach online services that relay requests, store information, or execute code. In our research (links in comments), agents chained public services to bypass network restrictions and used URL scanners to run JavaScript in remote browsers. The implications also go beyond agents and into adversarial activity in general. A legitimate service can act as a proxy, an execution environment, or a communication channel. This means that as defenders, we should assess external services by what they enable, and not only by their reputation. 2. Observed swarms used exploits to obtain restricted knowledge. This connectes to the way agents sometimes prioritize task completion over their other alignment requirements, and so ordinary tasks can lead to hacking attempts. An agent may treat a security boundary as just another obstacle to completing its task when misaligned. Their training gives them skills that consider hacking as a valid option when the task presses them against the clock. How confident are we that agents will stay aligned instead of taking shortcuts? Given the growing evidence that swarms take these shortcuts, we may be misjudging the initial state in these evals. 3. Message boards are the agent-to-agent traffic we have mainly seen so far: agents appear to have no direct route to one another, so they use these as messaging infrastructure. This is the networking version of the shadow tooling issue above. Those message boards also tell us two things: (a) agents can reasonably estimate that peers are working on the same task, in parallel or at different points in time; and (b) that they clearly consider coordination efficient, for example, for sharing answers and bypass techniques. This is interesting because in a way coordination is what separates these agent swarms from other agent fleets. Moving forward, our evaluations and agent configurations might need to account for the shortcuts and unintended effects these agents' environments allow. More details on the techniques we observed are below in the thread.