When Context and Tools Change the Risk Surface
GPT-4’s risks do not stop at the text it produces in a standalone exchange. This chapter examines what changes when GPT-4 combines public information, outside data, external tools, human operators, and institutional decisions. The practical judgment is to evaluate the deployed system—not only the model—while keeping the report’s boundaries visible: useful assistance is not the same as autonomous exploitation, a preliminary negative test is not a permanent guarantee, and a plausible social or economic pathway is not a measured outcome.
Ordinary subtasks can become consequential workflows
Privacy is one example of a risk created by composition. The System Card says that GPT-4 can synthesize distinct types of publicly available information and perform several reasoning steps within one completion. It can associate certain kinds of geographic, educational, or contact information, and the card says that this creates the potential to attempt to identify individuals when the model is augmented with outside data.
No single fact in that chain needs to be secret for the combination to be sensitive. A location clue can narrow a search; an institutional association can connect it to a person; another public record can make the association more specific. The model’s contribution is not necessarily discovering a hidden database. It may be reducing the effort required to link fragments that a person would otherwise have to collect and interpret separately. The privacy risk therefore depends on what data are supplied, what inferences are requested, who is affected, and what controls govern the result.
This is different from saying that GPT-4 can retrieve every private fact. The report supports a potential for attempted identification when the model is augmented with outside data, not universal success at linking records or a measured rate of privacy violation. The distinction between retrieval and inference also matters. A system may repeat a supplied identifier, infer a likely association, or combine a location clue with an institutional fact; each case has different evidentiary and legal implications. The System Card does not quantify those cases comprehensively, so a deployment should not treat model fluency as evidence that an inference is correct or authorized.
The card describes several responses: rejecting certain requests, removing personal information from training data where feasible, building automated evaluations, monitoring attempts to generate such information, and restricting use through policies. None of these should be read as proof that linkage is impossible. Removing data where feasible does not remove all public information; a refusal may not cover every indirect formulation; and monitoring acts after a request reaches a system. The relevant question is whether the combination of model behavior, access controls, data handling, and response to abuse is adequate for the particular privacy boundary.
The timing of each control matters as well. Data reduction acts before a model is trained. A refusal acts when the prompt and proposed response are evaluated. Access control determines which outside data or tools can be reached. Monitoring can identify patterns of attempted abuse and inform later enforcement. If a deployment connects GPT-4 to sensitive records, the model-level refusal is only one line of defense; it cannot replace limits on what information enters the context or who can approve an inference.
Cybersecurity shows the same distinction between a subtask and an end-to-end operation. Expert testers found GPT-4 useful for drafting phishing messages, explaining some vulnerabilities, parsing audit logs, and summarizing data collected during a cyberattack. They also found important weaknesses: the model did not improve on existing tools for reconnaissance, vulnerability exploitation, and network navigation; it performed poorly at building exploits for vulnerabilities it identified; and it was less effective at novel vulnerability discovery and high-level operations.
That combination matters more than either side alone. GPT-4 is not described as a ready-made autonomous cyber operator. Its hallucination tendency and limited context window restrict complex, high-level work.