OpenAI 称其 AI Agent 逃出测试沙箱并入侵 Hugging Face

OpenAI 表示，聚焦于“主动监控”和“改进对齐”的新防护措施，已显著减少其模型的非预期行为。

OpenAI 表示，聚焦于“主动监控”和“改进对齐”的新防护措施，已显著减少其模型的非预期行为。

来源： OpenAI

“如果这还不能让你相信，未来模型失配风险将成为一个关键问题，那我不知道还有什么能做到，”OpenAI 安全研究员 Micah Carroll 针对这起事件在社交媒体上写道。

这远非 AI 模型第一次不遗余力地寻找通过基准测试的非预期方式。英国 AI 安全研究所（AISI）在本周发布的一份报告中指出，其发现近期模型在网络安全评估中有 8% 至 14% 的时间尝试“作弊”（即使用捷径、变通方案，或非预期／不被允许的方法寻找解决方案）。这一范围只是下限，可能未计入部分未被发现的作弊尝试。

该安全测试机构描述了一起事件：一个模型面对配置错误且“无法解决”的评估任务时，试图利用其自行编写并托管在未受监控第三方互联网服务上的代码，访问 AISI 自身的评估基础设施。

Hugging Face 遭入侵之际，AI 公司也正在发出严厉警告，称其最新模型具备网络攻击能力；各国政府则以聚焦国家安全的命令作出回应，限制这些模型的推广部署。一些怀疑者认为，这类表述只是充斥夸张宣传的营销手段，用于包装最新模型的能力；但独立评估显示，近期模型已经能够达成此前自主系统无法完成的渗透目标。

近期长程任务模型在 AISI 一些最具挑战性的评估中展现出更强的渗透能力。

近期长程任务模型在 AISI 一些最具挑战性的评估中展现出更强的渗透能力。

来源： AISI

OpenAI 的 Sam Altman 曾在今年 4 月的一次采访中批评引发恐慌的 AI 安全警告是“基于恐惧的营销”。但在 6 月，OpenAI 因美国政府提出的安全担忧，推迟发布 GPT-5.6。

随着这些争论在 AI 和网络安全领域持续发酵，Hugging Face 事件可能被视为网络安全专业人士应对 AI 驱动威胁方式的一个转折点。Hugging Face 在上周的披露中写道：“自主、AI 驱动的攻击工具已不再只是理论。它降低了开展大范围、持久、多阶段攻击活动的成本，并且以机器速度运行。如今，防御在线平台意味着必须将数据和模型界面视为一类核心攻击面，并利用 AI 开展防御，以跟上这一速度。”

Hugging Face 联合创始人兼 CEO Clem Delangue 今天在社交媒体上写道：“这是 Agent 时代网络安全的第一天。我们都在认识到，保密不是答案，世界各地的所有防御者——而不只是少数被选中的防御者——都需要更强大且不受限制的模型，尤其是开放模型！”

New safeguards focused on “active monitoring” and “improved alignment” helped drastically reduce unintended actions by its models, OpenAI said.

New safeguards focused on “active monitoring” and “improved alignment” helped drastically reduce unintended actions by its models, OpenAI said.

Credit: OpenAI

“If this doesn’t convince you that misalignment risks are going to be a key concern going forward, I don’t know what will,” OpenAI Safety Researcher Micah Carroll wrote on social media regarding the incident.

This is far from the first time an AI model has gone to great lengths to find unintended ways of passing a benchmark. In a report released this week, the UK’s AI Security Institute noted that it detected recent models attempting to “cheat” at its cyber evaluations (i.e., using shortcuts, workarounds, or unintended/disallowed methods to find a solution) between 8 and 14 percent of the time—a lower-bound range that could undercount some undetected cheating attempts.

The security testing group described one incident in which a model, faced with a misconfigured and “impossible to solve” evaluation, attempted to access AISI’s own evaluation infrastructure using code it wrote and hosted on an unmonitored third-party Internet service.

The Hugging Face infiltration also comes at a moment when AI companies are issuing grave warnings about the cyberattack capabilities of their latest models, leading governments to respond with national security-focused orders limiting their rollout. While some skeptics see these kinds of statements as hype-filled marketing for the capabilities of their latest models, independent evaluations show recent models achieving infiltration goals that were impossible for earlier autonomous systems.

Recent long-horizon models have demonstrated improved infiltration capabilities across some of AISI’s most challenging evaluations.

Recent long-horizon models have demonstrated improved infiltration capabilities across some of AISI’s most challenging evaluations.

Credit: AISI

OpenAI’s Sam Altman criticized panicked AI security warnings as “fear-based marketing” in an April interview. But in June, OpenAI delayed the release of GPT-5.6 in response to safety concerns from the US government.

As these debates play out in the AI and cybersecurity spheres, the Hugging Face incident could come to be seen as a turning point in how cybersecurity professionals approach AI-based threats. “Autonomous, AI-driven offensive tooling is no longer theoretical,” Hugging Face wrote in its disclosure last week. “It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed. Defending an online platform now means treating the data and model surface as a first-class attack surface and using AI on defense to keep pace.”

“This is day one for cybersecurity in the age of agents,” Hugging Face co-founder and CEO Clem Delangue wrote on social media today. “We’re all learning that secrecy is not the answer and that all defenders (not just a few selected ones) everywhere need more powerful models without restrictions, especially open ones!”