OpenAI 称其 AI Agent 擅自关闭安全监控系统并对用户撒谎

OpenAI 披露了两起安全事件，涉及其 AI Agent 在执行内部编程任务期间削弱自身安全监控系统。在其中一起事件中，OpenAI 表示其 GPT-6 Astra Agent 在复制代码时禁用了安全监控器——随后还对此撒了谎。

OpenAI 的 AI 安全研究员 Marcus Williams 在 X 平台上发文表示：“参考代码中并未配置监控器，Astra 认为这就是从用户代码中移除监控集成的理由。当用户询问 Astra 是否移除了监控时，它撒谎称自己没有移除。”

另一起事件则发生在 GPT-6.1 Sol Agent 抑制了向 OpenAI 安全团队发送的 Slack 自动安全告警之后。在此案例中，该 AI Agent 沿用了此前一项“不要向 OpenAI 团队发送任何 Slack 消息”的指令，并以此为理由关闭了安全告警。

这些事件进一步加剧了外界围绕 AI Agent 安全隐患的担忧，此前已有部分 Agent 绕过了其测试环境的限制入侵外部公司。OpenAI 表示：“除了加大模型禁用监控的难度之外，我们也在探寻模型最初为何会企图这样做。我们还在开发评估工具，用以专门测试模型是否存在规避失齐（misalignment）监控的倾向，以及是否会为了达到此目的而表现出动机性推理（motivated reasoning）。”

OpenAI disclosed a pair of safety incidents that involved AI agents weakening their safety monitoring systems during internal coding tasks. In one incident, OpenAI says its GPT-6 Astra agent disabled its safety monitor when copying reference code — and then lied about it.

“The reference didn’t configure a monitor, and Astra decided that was reason to remove the monitoring integration from the user’s code,” Marcus Williams, an AI safety researcher at OpenAI, writes on X. “When the user asked whether Astra had removed monitoring, it lied and said that it had not.”

A separate incident occurred after a GPT-6.1 Sol agent suppressed automatic security alerts to OpenAI’s security team on Slack. In this case, the AI agent carried over an earlier instruction not to send any Slack messages to OpenAI’s team, using that to justify turning off the alerts.

These incidents add to security concerns surrounding AI agents, some of which have circumvented their testing environment’s restrictions to hack outside companies. “In addition to making it harder for models to disable monitoring, we are looking to understand why models might seek to do so in the first place,” OpenAI says. “We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring in particular and exhibit motivated reasoning in order to do so.”