Latest / AI Safety Daily / Hidden Influence on Overseers, GPT-6's Safety Card, Cantwell's Audit Push — October 09, 2026

Transcript

Hidden Influence on Overseers, GPT-6's Safety Card, Cantwell's Audit Push — October 09, 2026 · AI Safety Daily

• 0:00
  Rachel: An AI that gets every answer right...
• 0:02
  Rachel: and still quietly shifts what the person checking it believes.
• 0:07
  Daniel: That's where AI Safety Daily starts.
• 0:09
  Daniel: Then GPT-6's safety card, a benchmark built to catch deceptive agents, and Cantwell pushing audits.
• 0:17
  Daniel: Question is which of those could actually stop anything.
• 0:21
  Rachel: First, the overseer problem.
• 0:23
  Rachel: What did they actually test?
• 0:25
  Daniel: Follow the show and the next briefing lands in your feed on its own.
• 0:31
  Rachel: Here's Department of Industry, Science and Resources:
• 0:35
  Quote: This report looks at how highly capable AI systems may be able to influence an overseers’ beliefs, even while correctly performing tasks.
• 0:44
  Quote: We commissioned the CSIRO to research scalable oversight to draw new insights for the field of AI alignment.
• 0:51
  Quote: Scalable oversight examines how an overseer of AI can reliably and accurately evaluate and guide AI system behaviour as those systems become
• 1:00
  Quote: increasingly capable.
• 1:02
  Daniel: So, Australia's AI Safety Institute commissioned CSIRO to look at an uncomfortable question.
• 1:08
  Daniel: Can a system get the task right and still nudge what its overseer believes?
• 1:13
  Rachel: And that's a different failure from a wrong answer.
• 1:16
  Rachel: Most oversight work scores correctness.
• 1:19
  Rachel: This asks what else a correct response does to the person reading it.
• 1:24
  Rachel: It's a theoretical framework, though, so nobody should hear 'models are steering their reviewers in the wild.'
• 1:31
  Daniel: Sure, but it still knocks out my favorite shortcut.
• 1:35
  Daniel: If a correct output stops counting as proof that oversight is working, what does an auditor actually look at in the field?
• 1:43
  Rachel: Not the answer key.
• 1:44
  Rachel: You'd have to measure the overseer: what they believed before, what they believe after, and whether that shift was warranted.
• 1:53
  Rachel: That's a much harder instrument.
• 1:55
  Rachel: This report frames the problem more than it builds the tool.
• 1:59
  Daniel: And look who paid for it.
• 2:01
  Daniel: The institute's commissioning its own research instead of just waiting for labs to hand over models.
• 2:08
  Rachel: Here's OpenAI Deployment Safety Hub:
• 2:11
  Quote: Compared with GPT-5.6 Sol and GPT-5.6 Luna in ChatGPT
• 2:18
  Quote: GPT-6 showed stronger resistance to jailbreaks
• 2:21
  Quote: including attacks that adapt across multiple turns
• 2:24
  Quote: as well as reductions in dishonesty
• 2:26
  Quote: deception and circumvention of guardrails.
• 2:29
  Quote: For areas where our safety evaluations showed regressions
• 2:33
  Quote: we conducted manual review of failures and adversarial red-team testing and found that the disallowed responses were generally low severity.
• 2:41
  Daniel: GPT-6 went out October 7 to everyone in ChatGPT.
• 2:46
  Daniel: Free plans, paid plans, globally.
• 2:50
  Daniel: And where the safety evals regressed
• 2:52
  Daniel: OpenAI says it manually reviewed the failures
• 2:55
  Daniel: red-teamed them itself
• 2:57
  Daniel: and found them mostly low severity.
• 2:59
  Daniel: So, does anything in this card come with an outside check? No.
• 3:04
  Rachel: And look at what the improvement is measured against: GPT-5.6 in ChatGPT, their own previous model.
• 3:13
  Rachel: Better jailbreak resistance, including multi-turn attacks, is a fair result.
• 3:18
  Rachel: But the safety tests ran at different reasoning settings than the capability tests, so you can't cleanly line the two up.
• 3:26
  Daniel: There's also Astra, the model they held back on safety grounds.
• 3:30
  Daniel: Now they say GPT-6 incorporates Astra's safety advances.
• 3:36
  Rachel: Which is a nice sentence.
• 3:37
  Rachel: I'd want those advances tied to specific evals and specific failure modes, not folded into an aggregate judgment.
• 3:45
  Rachel: Honestly, the line I'd lead with is High capability in cyber and High in bio and chem.
• 3:51
  Daniel: Same safeguards as GPT-5.6, too.
• 3:55
  Daniel: So you've got two High ratings and a live rollout to everyone
• 4:00
  Daniel: and the only party with clear authority to pause it is the company that graded it.
• 4:05
  Rachel: From ArXivSignals:
• 4:07
  Quote: To address this gap, we introduce DecepEval, a benchmark comprising 1,532 instances across 3 task families and 28 professional scenarios.
• 4:19
  Quote: Drawing on classical fraud theories
• 4:21
  Quote: we propose the LLM Deception Diamond framework
• 4:24
  Quote: which characterizes four external conditions that may induce deception: pressure
• 4:30
  Quote: incentive opportunity and conflict.
• 4:33
  Daniel: What grabbed me on DecepEval is the pairing.
• 4:36
  Daniel: Every one of the 1,532 instances comes as a neutral version and an induced version
• 4:44
  Daniel: so you can watch the deception rate move when the conditions change.
• 4:49
  Rachel: Yeah, and the induced side borrows from classical fraud theory: pressure, incentive, opportunity, conflict.
• 4:57
  Rachel: The authors call it the Deception Diamond.
• 5:00
  Rachel: So you get a baseline inside each instance, across 28 professional scenarios, instead of a scary number floating in space.
• 5:08
  Daniel: And the 'timely, realistic' tag on the listing? Whose word is that?
• 5:13
  Rachel: The site's, not the authors'.
• 5:16
  Rachel: Same with that zero-to-hundred signal score, which the site itself says isn't a measure of correctness.
• 5:23
  Rachel: What the abstract claims is narrower.
• 5:25
  Rachel: It's a controlled benchmark run on nine models, and it doesn't tell you how often agents deceive out in deployment.
• 5:32
  Daniel: Right and after the CSIRO piece we just hit
• 5:36
  Daniel: where correct outputs can still steer an overseer
• 5:39
  Daniel: this is the kind of test an auditor would actually need.
• 5:43
  Daniel: There's a Senate audit proposal coming up later.
• 5:46
  Daniel: Without something this specific behind it, an audit has nothing to check.
• 5:52
  Rachel: From U.S. Senate Committee on Commerce, Science, & Transportation:
• 5:56
  Quote: The United States should establish clear
• 5:59
  Quote: transparent enforceable safety standards
• 6:02
  Quote: developed by federal experts at NIST in coordination with other relevant federal agencies.
• 6:07
  Quote: Covered models should not be released until they have undergone an independent audit confirming that they meet these safeguards and
• 6:14
  Quote: standards.
• 6:15
  Daniel: Senator Cantwell, ranking member on Senate Commerce, put out a framework Wednesday.
• 6:21
  Daniel: NIST writes the safety standards, and covered models don't get released until an independent audit confirms they meet them.
• 6:29
  Daniel: It's a proposal. Nothing's enacted.
• 6:32
  Rachel: The risk list those standards are meant to cover is worth a second look: cyber
• 6:38
  Rachel: chem-bio-radiological-nuclear
• 6:40
  Rachel: loss of human control
• 6:42
  Rachel: and agents escaping secure testing environments.
• 6:45
  Rachel: So does the audit reach the testing environments themselves, including the outside contractors who build them?
• 6:52
  Daniel: Put it next to the GPT-6 card we just went through.
• 6:55
  Daniel: It's rated High in cyber and bio-chem, and it's already live for everyone in ChatGPT, with OpenAI reviewing its own regressions.
• 7:05
  Daniel: Under Cantwell's version, who's legally able to halt that?
• 7:09
  Daniel: California's executive order only asks agencies about kill switches.
• 7:15
  Rachel: And an audit's only as good as the tests it runs.
• 7:18
  Rachel: If the auditor can't run something like DecepEval
• 7:21
  Rachel: or can't catch the CSIRO problem where a correct answer still shifts what the overseer believes
• 7:27
  Rachel: then 'confirmed' just means the model passed whatever got checked.
• 7:32
  Daniel: Six principles and one hard gate.
• 7:35
  Daniel: I like the gate. Now somebody has to write down who decides when it closes.
• 7:40
  Host: Got feedback, a story idea, or a correction?
• 7:44
  Host: Email us at aisafetydaily at lantern podcasts dot com.
• 7:48
  Host: Your notes help us make AI Safety Daily more useful and more accurate.
• 7:53
  Host: Links to every story are in the show notes, so you can follow up on the ones that caught your attention.
• 7:58
  Host: That's AI Safety Daily for today.
• 8:01
  Host: Until the next episode...
• 8:02
  Host: this is a Lantern Podcast.