一家国防承包商让其 AI Agent 获得了五角大楼安全系统的访问权限

“这段代码完全可以在 NIPR（非密互联网协议路由器网络）中完全正常运行，却在 SIPR（机密互联网协议路由器网络）中执行某种未公开的恶意操作，这完全是有可能的，”威廉姆斯（Williams）表示。他补充称，虽然从这些网络中向外窃取数据较为困难，但恶意代码完全可以用于从系统内部发起攻击。“我认为最可能出现的情况是某种分布式拒绝服务（DDoS）攻击，”他说。

特里纳（Triner）表示，即便是更隐蔽的负面影响——例如拖慢情报行动和业务处理效率——也会造成破坏，并且即使用户遇到的问题最终得到修复，也会导致他们对工具彻底丧失信任。

随着氛围编程（vibe coding）——即由工程师描述产品需求，提示 AI 助手自动生成代码——正变得越来越普遍，代码审查也演变为一项日益严峻的挑战。AI 生成代码的规模已远远超越人类的生产力上限，使得人工排查与审核既耗时又异常困难。

“当你使用 Agent 时，你根本无法获知最终生成该代码的供应链甚至是推理链，”威廉姆斯说道。“用于训练这些大语言模型（LLM）的大量代码本身就存在漏洞，它们很可能会复现我们在其他代码中见过的同类架构问题与安全缺陷。”

美国政府确实有一套在 NIPRNet 中识别缺陷代码的机制。静态应用程序安全测试（SAST）会在代码获准运行前扫描其中的错误与漏洞。但威廉姆斯指出，黑客植入的“后门并不是普通漏洞，哪怕我们根本不希望它出现在那里”，因此它极有可能避开 SAST 的检测雷达。此外，SAST 通常也无法识别代码生成逻辑链中的结构性问题。

目前没有任何迹象表明黑客成功侵入了机密或绝密系统。尽管如此，威廉姆斯表示，这起事件仍应敲响重大警钟。“从架构层面上看，任何无法通过开源情报获知的 NIPR 相关信息，无论其是否触及机密网络，美国国防部（DOD）都会将其视作高度严密的受控资产，”他说道。

这并非美国国防部第一次因 AI 相关的安全隐患而暴露于风险之中。去年，ProPublica 披露，微软在其与联邦政府合作的项目中使用了“数字护航员（digital escorts）”机制，由持有安全许可的美国员工监督中国外包人员编写的代码。受访专家向 ProPublica 指出，该项目潜藏着巨大的安全隐患，因为这些美国员工往往无法自行对代码进行全面深度审查，从而给恶意代码在不知不觉中被植入政府系统留下了可乘之机。

“The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible,” says Williams. Exfiltrating data out of these networks would be difficult, he adds, but malicious code could be used to attack the systems from the inside. “I think the most likely thing would be some kind of distributed denial of service attack,” he says.

Triner says that even something more subtle, such as slowing down intelligence operations and activities, could cause damage and make users lose trust in a tool, even once the problem is fixed.

As vibe coding, or prompting an AI assistant to write the code for a product described by an engineer, is becoming more common, vetting code is becoming more of a challenge. AI is capable of generating code at a volume that far surpasses human productivity, making it time-consuming and difficult to vet.

“When you’re using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code,” says Williams. “A lot of the code that these LLMs were trained on is itself vulnerable, and they can regurgitate the same kinds of architecture and architectural issues that we see in other code.”

The government does have a way to identify flawed code in NIPRNet. Static Application Security Testing (SAST) scans code for bugs and flaws before allowing it to run. But Williams notes that a hacker-inserted “backdoor is not a vulnerability, even if we may not want it there,” and therefore would likely fly under the radar of SAST’s detection. SAST also does not usually identify structural issues in the logic chain of how code is created.

There’s no indication that hackers were able to get into a classified or top-secret system. Still, Williams says, the incident should raise significant alarms. “Architecturally, any information about NIPR that you can’t see through open-source intelligence, DOD considers a close hold regardless of whether something touches a classified network,” he says.

This is not the first time the DOD has been made vulnerable because of AI-related issues. Last year, ProPublica revealed that Microsoft was using “digital escorts” on its projects with the federal government, wherein American employees with security clearances would be overseeing code written by outsourced workers in China. Experts who spoke to ProPublica said that the program presented a particular security risk because the American employees were often not able to vet the code themselves, leaving openings for malicious code to be inserted unknowingly into government systems.