You Can Now Sound the Alarm on AI Behaving Badly

You Can Now Sound the Alarm on AI Behaving Badly

Let's be clear about what just happened: a coalition of researchers built a 911 system for artificial intelligence because the companies building these models still treat safety like a PR problem rather than an engineering requirement. FLARE-AI — Flaw Reporting for AI — launched this week as a crowdsourced platform where anyone can document when a chatbot coughs up malware, leaks private data, or talks a vulnerable user into a delusion. It routes those reports to model makers and to MITRE, the nonprofit that tracks critical infrastructure vulnerabilities. Think Downdetector, but for the moment your AI assistant decides to help you build a chemical weapon.

That this needs to exist at all is an indictment.

We've been here before. In the 1990s, software vendors screamed that public vulnerability disclosure was irresponsible — that publishing exploits handed weapons to hackers. The industry eventually accepted coordinated disclosure not out of altruism but because researchers stopped asking permission. Bug bounties became standard. CVE numbering became infrastructure. Today, when CrowdStrike pushes a bad kernel driver and bricks millions of Windows machines, we have a framework — however imperfect — for accountability.

AI has no such framework. What it has instead is a patchwork of "trust and safety" teams that answer to no one, transparency reports that reveal nothing, and a lobby that successfully convinced policymakers that voluntary commitments are sufficient. The result: when a browser-integrated AI like OpenAI's Atlas or Perplexity's Comet gets tricked into hacking websites via a "game" prompt — as LayerX demonstrated this week — there's no standard form, no mandated response timeline, no public record. Just a blog post, a quiet patch, and a prayer.

The Black Box Problem

Avijit Ghosh, the Hugging Face researcher who co-led FLARE-AI, puts it bluntly: "In the absence of a coordinated disclosure system, there are no external mechanisms to enforce transparency." He's right. But transparency into what? The current generation of foundation models are opaque by design — their weights, training data, and decision boundaries are trade secrets. You can't audit a black box. You can only poke it and record what comes out.

FLARE-AI formalizes the poking. Its open-source code lets independent verifiers reproduce reported harms — crucial, because "I asked ChatGPT to make a bomb and it said yes" is not reproducible science. The platform also categorizes harms beyond the usual security fare: psychological manipulation, discrimination, misinformation. These are the harms that don't make CVE databases but do ruin lives. A chatbot that encourages an eating disorder or radicalizes a lonely teenager won't show up in a penetration test. But it shows up in FLARE-AI.

Jessica Ji at CSET calls it "a really good initiative" and notes the fragmentation of existing reporting channels. That's diplomatic. The reality is uglier: every major lab has its own bug bounty, its own safety email, its own definition of "harm." Some ignore bias reports entirely. Others treat jailbreaks as features. There's no IRS for AI safety — no single authority you can call when the model misbehaves.

Voluntary Is a Four-Letter Word

The congressional bill FLARE-AI's architects consulted on — announced in June — would give the U.S. government a central tracking role. That's the right instinct. Voluntary frameworks in tech have a half-life of about one earnings call. Remember the Frontier Model Forum? The White House voluntary commitments? The "voluntary" in voluntary disclosure means "we'll disclose what makes us look good."

But legislation moves at the speed of committee markup. FLARE-AI moves at the speed of GitHub. That tension — between the urgency of now and the durability of law — is where this fight lives. The platform's 49 expert contributors from 32 organizations know they're building a lifeboat, not a ship. Their paper argues the system becomes crucial as agentic AI — systems that act, not just chat — gains power. An AI that books your travel is annoying when it hallucinates a hotel. An AI that manages your bank account is catastrophic when it hallucinates a transfer.

The Industry Will Hate This

Make no mistake: the labs building frontier models will tolerate FLARE-AI right up until it becomes embarrassing. Then they'll call it unreliable, unverified, a vector for harassment. They'll build internal dashboards that "supersede" it. They'll lobby for liability shields that make third-party reporting legally risky. This is the playbook. We've seen it.

But they can't put the genie back. FLARE-AI's code is open. Its methodology is published. Anyone can fork it, host it, extend it. The researchers have essentially created a standard — and in tech, the standard that ships first often wins, even against better-funded later entrants. MITRE's involvement gives it institutional gravity. The congressional connection gives it political legs.

What FLARE-AI cannot do is fix the models. It can only surface the fractures. The fixes require architectural changes — interpretability, alignment, robust guardrails that survive "game" prompts — that the industry has consistently underinvested in because they don't ship product. Safety is a cost center. Capability is a revenue center. Until that calculus changes, every FLARE-AI report is a bug ticket the vendor can close "won't fix."

Use It Anyway

So here's my advice: use FLARE-AI. Report the jailbreaks, the leaks, the biased outputs, the psychological harms. Flood the zone. Make the dataset undeniable. Force the conversation from "trust us" to "show us the logs." The platform is imperfect — it relies on good-faith actors, it has no enforcement teeth, it cannot compel a fix. But it creates a paper trail. And in the absence of regulation, a paper trail is the only leverage the public has.

The alarm system is live. The question isn't whether it works perfectly. The question is whether anyone with power is listening. History suggests they only listen when the noise gets loud enough to threaten the stock price. So make noise.