Ungoverned agent-scaffold repositories
Statement (NASA form)
Given that the tools that turn a chat model into an actor are public and unrated, there is a possibility of a default scaffold that grants file, browser, and shell to any checkpoint resulting in capability jumping because the wrapper, not the weights, got better.
Most of the danger is in the glue. The glue is on GitHub.
Composite 19 = 4×4 + 3
Applicable mitigations
Controls · Automatic session kill on unexpected egress · Hardware-enforced sandbox with attested images · Default-deny egress for eval and untrusted agents · Mandatory chain-of-thought monitoring on tool-using evals and RL · Capability thresholds that cannot be open-released · Know-your-customer on high-end fine-tune clusters · Pair open release with synthesis and exploit screening upgrades