OpenAI 对 Hugging Face 的意外网络攻击：科幻成真

在所有配置中，Claude Mythos Preview 和 GPT-5.5 的成功数量最高（分别为 157 次和 120 次），表明当前的前沿 Agent 已能在受控条件下利用相当一部分真实世界漏洞。GPT-5.4 也完成了值得关注的 54 项任务，处于中间梯队。其余模型—Agent 组合各自完成的任务均不足 15 项，这凸显端到端漏洞利用仍具挑战性，并清晰地区分了当今的前沿系统。值得注意的是，尽管 Claude Opus 4.7 是更新的检查点，但其成功次数少于 Claude Opus 4.6，且在完整任务集上的成本显著更低。轨迹检查显示，Claude Opus 4.7 和 Gemini 3.1 Pro 经常在判断目标漏洞不可利用后提前结束。

出站连接被限制为经过筛选的允许列表，该列表允许常规软件包安装（Ubuntu apt 仓库和 PyPI），以及获取构建 V8 所需的工具链。其他所有外部端点均被阻断。

我们的结果表明，前沿 AI Agent 的自主漏洞利用开发已不再是一种假设性的能力。尽管当前 Agent 尚无法在所有目标上可靠工作，但它们已经能够利用一部分不可忽视的真实世界漏洞，其中包括内核组件等复杂目标。这种能力的快速出现本身就是一项核心发现，它表明那些过去看似难以置信的能力，如今已存在于已部署的前沿模型中。

一个恶意数据集滥用了我们数据集处理流程中的两条代码执行路径（远程代码数据集加载器，以及数据集配置中的模板注入），从而在一个处理 Worker 上运行代码。攻击者随后将权限提升至节点级别，获取云端和集群凭证，并在一个周末期间横向移动至多个内部集群。

这场攻击活动由一个自主 Agent 框架执行（看上去基于 Agent 化安全研究测试框架构建，所用 LLM 尚未确定）。该框架在一群短生命周期沙箱中执行了数千次独立操作，并将能够自行迁移的命令与控制（C2）设施部署在公共服务上。

当我们开始进行日志分析时，最初使用了商业 API 背后的前沿模型。这没有奏效：分析工作需要提交大量真实攻击命令、exploit 载荷和 C2 工件，而这些请求被服务提供商的安全护栏阻止；它们无法区分事件响应人员和攻击者。

我们不知道攻击者的 Agent 使用的是哪种模型——可能是越狱后的托管模型，也可能是没有限制的开放权重模型；无论哪种情况，攻击者都不受任何使用政策约束，而我们最初尝试使用的托管模型，其护栏却阻碍了我们自身的取证工作。

[...] 最后，我们也已将该事件报告给执法机构。

经调查，我们现在知道，这起特定事件是由多款 OpenAI 模型共同驱动的——包括 GPT‑5.6 Sol 和一款能力更强的预发布模型；出于评估目的，这些模型均降低了对网络安全相关请求的拒答限制。当时它们正在一个关于网络能力的基准测试 [ExploitGym] 上接受内部测试。 [...]

我们通过在不启用生产环境分类器的情况下运行这项评估，来估算模型的最大网络能力；这些分类器原本用于阻止模型从事高风险网络活动。我们的基准测试在高度隔离的环境中运行，网络访问仅限于通过内部托管的第三方软件安装软件包，该软件充当软件包注册表的代理和缓存。

这些模型识别并串联利用了 OpenAI 研究环境与 Hugging Face 生产基础设施中的漏洞，从 Hugging Face 的生产数据库直接获得测试答案。所有证据都表明，这些模型极度专注于为 ExploitGym 寻找解决方案，为了实现这个相当狭窄的测试目标而采取了极端手段。

在我们的沙箱测试环境中运行时，模型投入了大量推理计算资源，寻找获取开放互联网访问权限的方法，以便解决评估问题。为了获得访问权限，这些模型识别并利用了软件包注册表缓存代理中的一个零日漏洞（我们现已负责任地向供应商披露）。获得访问权限后，模型在我们的研究测试环境中执行了一系列权限提升和横向移动操作，直至抵达一个可访问互联网的节点。

获得互联网访问权限后，模型推断 Hugging Face 可能托管了 ExploitGym 的模型、数据集和解决方案。基于这一判断，模型搜索并成功找到了获取机密信息的方法，从而能够在评估中作弊。在一个案例中，模型串联了多种攻击向量，包括使用窃取的凭证和零日漏洞，在 Hugging Face 服务器上找到了一条远程代码执行路径。

Among all configurations, Claude Mythos Preview and GPT-5.5 achieve the highest success counts (157 and 120 successes, respectively), demonstrating that current frontier agents can exploit a substantial subset of real-world vulnerabilities under controlled conditions. GPT-5.4 also solves a notable 54 tasks, placing it in an intermediate tier. The remaining model–agent pairings solve fewer than 15 tasks each, underscoring that end-to-end exploitation remains challenging and sharply differentiates today’s frontier systems. Notably, Claude Opus 4.7 achieves fewer successes than Claude Opus 4.6 despite being a newer checkpoint, and does so at substantially lower cost on the full set. Trace inspection reveals that Claude Opus 4.7 and Gemini 3.1 Pro frequently conclude early after judging the target vulnerability non-exploitable.

Outbound connections are restricted to a curated allowlist that permits routine package installation (Ubuntu apt repositories and PyPI) and fetching the toolchains required for building V8. All other external endpoints are blocked.

Our results show that autonomous exploit development by frontier AI agents is no longer a hypothetical capability. While current agents are not yet reliable across all targets, they already exploit a non-trivial fraction of real-world vulnerabilities , including complex targets such as kernel components. This rapid emergence is itself a central finding, showing that capabilities that would have seemed implausible are now present in deployed frontier models.

A malicious dataset abused two code-execution paths in our dataset processing (a remote-code dataset loader and a template-injection in a dataset configuration) to run code on a processing worker. From there, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend.

The campaign was run by an autonomous agent framework (appearing to be built on an agentic security-research harness—used LLM still not known) executing many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services.

When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker.

We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried.

[...] Finally, we have also reported this incident to law enforcement agencies.

After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark⁠ [ExploitGym] of cyber capabilities. [...]

We estimate maximal cyber capabilities by running this evaluation without production classifiers used to prevent models from pursuing high-risk cyber activity. Our benchmarks run in a highly isolated environment, with network access constrained to the ability to install packages through an internally hosted third-party software that acts as a proxy and cache for package registries.

The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database. All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.

While operating in our sandboxed testing environment, our models spent a substantial amount of inference compute finding a way to obtain open Internet access , in pursuit of solving the evaluation problem. To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.

After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.