已知首个失控 AI Agent，还是一场糟糕的营销噱头？
英文标题：The first known runaway AI agent - or a very bad marketing stunt?
Martin Alderson 就 OpenAI 意外对 Hugging Face 发起网络攻击一事发表评论，指出 Hugging Face 因运行大量不受信任的模型和代码，拥有异常庞大的攻击面。文章还解释了 OpenAI 为何可能未能及时发现 Agent 已严重突破其沙箱：大规模基准测试往往会同时运行，且可能具有近乎无限的 token 预算。对于开发者和行业而言，这一事件凸显了在大规模 Agent 评测中，网络隔离、流量监控与异常检测的重要性。
中文
2026年7月23日 - Link Blog
已知首个失控 AI Agent，还是一场糟糕的营销噱头？（via）Martin Alderson 对 OpenAI 意外对 Hugging Face 发起网络攻击一事的评论，包含了几个我此前没有考虑到的细节。
首先，如果你试图寻找需要执行任意代码的潜在漏洞，Hugging Face 是一个极其丰富的目标：
Hugging Face 拥有极其庞大的攻击面。他们拥有多到我数不清的接口，这些接口会运行不受信任的模型和代码。尽管他们显然已经投入资源进行防御，但由于其运营模式的本质，他们比许多其他服务面临更多被攻击的机会。我确实不羡慕他们的网络安全团队。
其次，一直令我困惑的一点是：OpenAI 怎么会没有注意到他们的沙箱已被该 Agent 如此彻底地突破？他们当然应该会严密监控网络流量才对？
Martin 指出：
他们也很可能正在同时运行海量基准测试，并且拥有近乎无限的 token 预算——你希望获得尽可能多的样本，以判断一个模型在特定基准测试上的表现究竟有多好。他们也可能在测试模型的不同 checkpoint，以了解模型在经历各个训练阶段时是如何持续改进的。
当你考虑到这类基准测试通常的运行规模后，就更容易想象 OpenAI 负责运行这项基准测试的团队为何会犯下这些错误。据我们所知，他们可能同时在数十个不同环境中，让一个新模型接受数十项基准测试。
English / 原文
23rd July 2026 - Link Blog
The first known runaway AI agent - or a very bad marketing stunt? (via) Martin Alderson's commentary on the OpenAI accidental cyberattack against Hugging Face includes a couple of details I hadn't considered.
First, Hugging Face offers a truly rich target if you're trying to find potential vulnerabilities that require executing arbitrary code:
Hugging Face has an enormous attack surface. They have more interfaces than I can count which run untrusted models and code. While they definitely have invested in defences, by nature of their operating model they do have many more opportunities to be attacked than many other services. I certainly don't envy their cybersecurity teams.
Secondly, one of the things that has puzzled me is how OpenAI didn't notice that their sandbox had been so thoroughly breached by the agent. Surely they'd be monitoring network traffic closely?
Martin points out that:
It's also likely they were running a huge amount of benchmarks simultaneously with ~unlimited token budgets - you want as many samples as possible to figure out how good a model is at a certain benchmark. It may also be they are testing various different checkpoints of the model too, understanding how the model is improving as it goes through the various training stages.
The mistakes made by the OpenAI team running this benchmark are easier to imagine when you think about the scale at which benchmarks of this kind usually operate. For all we know they could have been subjecting a new model to dozens of benchmarks at the same time, in dozens of different environments.