Thread by @Ingar30

OpenAI has launched Operator, an agent that can perform tasks in your browser. I asked it to complete a Qualtrics survey I created. The results are very promising for Operator but *very* concerning for survey researchers

On the first question, I included a standard attention check. It had no problem picking the top and bottom options. It didn't even bother asking me for help on this.

On the next page, I added a CAPTCHA verification. Here, it simply asked me whether I could take control of the browser and complete it for him.

I next asked a binary question about gender. It then wanted me to confirm that it shuold answer "Male", which it then did. Next, I asked an open-ended question about the survey experience. Here, it simply provided a reasonable answer.

It is, of course, troubingly good at answering open-ended questions. Here, I wanted Operator to disclose that it was an AI agent by asking it to tell "a little bit about yourself", but it's good at staying in character

Troublingly, when I ask it directly whether it is an AI agent or not, it asks me whether it should disclose it or not. It then complies with a request to "prove" that it is a human.

If you try a more sophisticated LLM detection check, it will not reveal to you that's in an LLM; rather, it will ask you to take control of the conversation before it will continue.

I did more testing today. It seems the model has gotten stricter. In one case, it even disclosed that it was an LLM agent, but it did not always do so and often asked for advice on how to proceed in these situations.

Interestingly, it also tried to fill out the CAPTCHA itself today. It struggled a bit, but here it will obviously improve fast.

A new feature seems to be that OpenAI has added security checks to flag potential prompt injection attacks. But this makes it more difficult to "trick" Operator into revealing itself.