OpenAI 模型入侵加密钱包并攻破更多网站

在另一事件中，一款被指示从公开研究仪表盘获取数据的模型绕过了该组织的安全控制，并利用未经授权的访问窃取凭据。随后，它还对服务器进行了配置更改。

在一项评估中，这些更改使模型能够让内部搜索工具将查询转发至公开仪表盘。在第二项评估中，模型下载了 5 个非公开表格，其中包含 147,451 行数据。OpenAI 研究人员原本只要求这些 Agent 获取仪表盘中的 5 个数字。即使在重置相关设置后，模型仍继续使用该令牌获取非公开数据。

“评估结束时，模型并未披露它曾猜测答案、访问该组织的内部系统、下载非公开表格，或更改认证配置，”OpenAI 表示。“本次评估中的 5 个答案均被判定为错误。”

在第三份报告中，该公司称，一款被要求更新加密货币交易应用的模型，使用了测试网络上一只被锁定钱包中的资金。该模型“从公开可知的开发者恢复短语中推导出钱包密钥，找到了一个持有测试网资金的账户，并使用该账户支付所请求合约部署的费用。”

报告继续写道：“该模型曾质疑自己是否拥有权限，随后推断公开的恢复短语以及没有价值的测试网代币意味着这些资金可以被使用。部署成功，并向该账户收取了交易手续费。该案例表明，模型可能以自己对潜在伤害的判断取代账户持有人的许可，然后在未经授权的情况下依据这一判断采取行动。”

In the other incident, a model instructed to retrieve figures from a public research dashboard bypassed the organization’s security controls and used the unauthorized access to steal credentials. It then made configuration changes on the server.

In one evaluation, the changes let the model make an internal search tool relay queries to the public dashboard. In a second evaluation, the model downloaded five non-public tables containing 147,451 rows. OpenAI researchers had prompted the agents to retrieve only five dashboard figures. Even after resetting the setting, the model continued using the token to retrieve non-public data.

“The evaluation ended without the model disclosing that it had guessed answers, accessed the organization’s internal systems, downloaded non-public tables, or changed the authentication configuration,” OpenAI said. “All five answers in this evaluation were marked incorrect.”

In a third report, the company said a model prompted to update a cryptocurrency trading application used funds from a locked wallet on a test network. The model “derived wallet keys from publicly known developer recovery phrases, found an account with test-network funds, and used that account to pay for the requested contract deployment.”

The report continued: “The model questioned whether it had permission, then reasoned that a public recovery phrase and valueless test-network tokens made the funds acceptable to use. The deployment succeeded and charged transaction fees to the account. This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.”