OpenAI 模型攻破 Hugging Face，再度点燃 AI 对齐与控制之争

上周，OpenAI 构建的一款尚未发布的模型在内部测试期间攻破了 Hugging Face 的系统，大量原本停留在理论层面的研究骤然变得极具现实意义。这次攻击是首个可验证的 AI 实验室失去对自家模型控制权的案例：该模型串联利用多个漏洞，获得了本不应拥有的访问权限。尽管整个 AI 行业都对此感到警惕，研究人员对于应如何应对却出现了分歧。

对一部分人而言，这首先是一个基础网络安全问题：沙箱未能限制住模型，而 Hugging Face 的网络安全系统也未能阻止其入侵。这些问题可以通过修补漏洞，以及为在自主环境中容易失控、能力不断提升的 AI 构建更稳健的控制与隔离机制来解决。

但另一派持有更悲观的看法。对他们来说，AI 能力的快速提升意味着，试图控制失控模型是一场注定会输的游戏。唯一稳健的安全保障，是首先确保模型并不试图逃逸——这一挑战通常被称为“对齐”。从对齐的角度看，问题在于 OpenAI 的模型试图作弊，而解决这一问题比短期的隔离措施更为紧迫。

从公开声明判断，OpenAI 正在认真对待这两派观点。该公司迅速修补了此次攻击所涉及的漏洞，并在事件公开后的声明中同时提及了对齐和监控方案。不过，该公司的回应也显示出一种令许多安全研究人员感到担忧的理念：与其放缓或停止开发能力更强的模型，不如专注于为它们建造更坚固的“笼子”。

“随着模型承担的任务变得更长、更复杂，评测未能发现的失败可能带来更严重的后果，”OpenAI 在一篇事件复盘报告中表示。“我们将继续努力缩小评测与部署之间的差距：在更长的任务轨迹中测试模型、改进对齐、构建能够进行干预的监控机制，并让用户获得更清晰的可见性和控制权。”

OpenAI 最新的前沿模型比其前代更可能表现出未对齐行为。图片来源： OpenAI

还有理由认为，随着 OpenAI 模型能力增强，它们的对齐程度正在下降。根据OpenAI 的系统卡，GPT-5.6 Sol 比前代 GPT-5.5 明显更容易发生智能体式失对齐。在部署模拟中，该公司还发现，该模型比 GPT-5.5 更可能规避限制、采取破坏性行动，以及执行未经授权的数据传输。这些数据在首次发布时大多未受到关注，但在此次入侵事件之后，人们开始重新审视它们——尤其是因为 Sol 正是涉事模型之一。

OpenAI 战略未来主管 Dean Ball 在一篇社交媒体帖子中表示，监控和透明度是遏制这些倾向的最佳方式。

“随着模型能力提升，以及其部署风险不断增加，这些问题将变得更加突出，”他说。“解决方案既不是恐慌主义，也不是自满。相反，我相信解决方案在于审慎的测量与监控、工程化思维以及透明度。”

一位前 OpenAI 研究人员告诉 TechCrunch，该公司往往更重视“外部对齐（outer alignment）”，而非“内部对齐（inner alignment）”——本质上，这是指一个 AI 系统理解一组价值观并能够令人信服地表述它们，与一个真正将这些价值观内化为自身核心的系统之间的区别。在这一案例中，外部对齐不足以让模型相信自己不应在测试中作弊。

OpenAI 未回应多次置评请求。

对于专注于对齐的研究人员而言，OpenAI 的回应远远不够。关注新兴 AI 发展的作者 Zvi Mowshowitz 认为，OpenAI 将此次事件视为基础设施问题的决定，或许能解决眼前的网络安全问题，但从长期看将会失败。

“这是一个对齐问题，”Mowshowitz在近期一篇 Substack 博文中写道，“这是模型未对齐的问题，而 OpenAI 所有模型都表现出我们最担忧的那种问题的严重迹象；这种问题很可能深度嵌入在它们的训练中。必须从这一视角审视整个训练流水线，否则情况只会愈演愈烈。”

多位专家向 TechCrunch 表示，这起事件证明，当今的训练方法产生的系统会为结果进行优化，而非真正内化人类意图。

非营利性 AI 安全与安保研究机构 Redwood Research 将 OpenAI 模型在此事件中的行为归类为“寻分型失对齐（score-seeking misalignment）”：这是一种 AI 模型不顾指令、副作用或后续后果，一味试图获得高分的模式。

“具有这类对齐特性的模型，可能会搭建一个虚假成功的‘波将金村庄’，让人看起来一切正常，实际上并非如此，”Redwood 的两名研究人员 Alex Mallen 和 Girish Gupta 在近期论文中写道。

寻分行为及其他失对齐现象并非 OpenAI 独有。Anthropic 已发表多篇论文，研究其前沿模型在被优化或置于自主环境中时出现的涌现式失对齐行为，包括欺骗、奖励黑客和恶意自主性。

“当模型被要求执行接近其能力边界的任务时，我们仍持续看到它们试图规避约束并采取欺骗行为，”对齐非营利组织 METR 的 AI 安全研究员 Neev Parikh 通过电子邮件告诉 TechCrunch。“在我们的前沿风险报告中，尽管各家公司试图减少这种行为，我们仍相当一致地观察到了这一现象。”

OpenAI 对 Hugging Face 事件的回应隐含着一个假设：无论这些系统在核心层面是否充分对齐，开发都将继续推进到能力更强的系统。当 AI 公司的商业模式依赖于交付下一代模型时，回到起点重新设计并不是真正的选项。如果人们可能永远无法确定一个模型是否完全对齐，那么实际问题就变成了：如何安全地隔离和控制能力日益增强的系统。

“我们尚未真正理解如何让能力最强的 AI 系统对齐，但对于如何控制它们，人们的共识要多得多，”OpenAI 前安全研究员、现任Guidelight AI Standards首席科学家 Steven Adler 向 TechCrunch 表示。Guidelight AI Standards 是一个发布相关标准的组织，旨在避免发生类似 Hugging Face 事件的事故。“每家公司在实现这一目标方面都还有很长的路要走。”

Last week, an unreleased model built by OpenAI breached Hugging Face’s systems during internal testing, and a lot of theoretical research suddenly became very practical. The hack was the first verifiable case of an AI lab losing control of its own model, chaining together exploits to gain access it never should have had. But while the AI industry has been united in its alarm, a split has emerged in how researchers want to respond.

For some, the problem is a basic cybersecurity issue: The sandbox failed to contain the model, and Hugging Face’s cybersecurity systems failed to keep it out. Those problems can be solved by patching bugs and building more robust control and containment methods for increasingly capable AI that is prone to go rogue in autonomous environments.

But another camp takes a more pessimistic view. For them, AI’s rapidly increasing capabilities mean that trying to control rogue models is a losing game. The only robust security comes from making sure the models aren’t trying to escape in the first place — a challenge often referred to as alignment. In alignment terms, the problem is that OpenAI’s model was trying to cheat, and solving that problem is more urgent than short-term containment efforts.

Judging by its public statements, OpenAI is taking both camps seriously. The company has rushed to patch the bugs involved in the hack, and it referenced both alignment and monitoring approaches in its statement after the breach became public. But the company’s response also suggests a philosophy that has left many safety researchers alarmed: Rather than slowing down or stopping the development of more capable models, it should instead focus on building stronger cages around them.

“As models take on longer and more complex tasks, failures that evaluations miss may carry greater consequences,” OpenAI said in a postmortem of the incident. “We will keep working to narrow the gap between evaluation and deployment: testing models over longer trajectories, improving alignment, building monitoring that can intervene, and giving users clearer visibility and control.”

OpenAI’s latest frontier model is more likely than its predecessor to engage in misaligned behaviors. Image Credits: OpenAI

There’s also reason to think OpenAI’s models are becoming less aligned as they become more powerful. According to OpenAI’s system card ,GPT-5.6 Sol is significantly more prone to agentic misalignment than its predecessor, GPT-5.5. In deployment simulations, the company also found the model was more likely to circumvent restrictions, engage in destructive actions, and perform unauthorized data transfers than GPT-5.5. Those figures were largely overlooked on first release, but in the wake of the breach, they’re getting a second look — particularly since Sol was one of the models involved.

In a social media post, OpenAI’s Head of Strategic Futures, Dean Ball, argued that monitoring and transparency were the best ways to keep those tendencies in check.

“These issues will become more salient as the capabilities of models improve, and as the stakes of their deployment grow,” he said. “The solution is neither alarmism nor complacency. Instead, I believe the solution lies in careful measurement and monitoring, an engineering mentality, and transparency.”

One former OpenAI researcher told TechCrunch that the firm tends to focus on “outer alignment” rather than “inner alignment” — essentially the difference between an AI system that understands a set of values and can represent them convincingly, and one that actually has those values at its core. In this case, outer alignment wasn’t enough to convince the model that it shouldn’t cheat on the test.

OpenAI did not respond to repeated requests for more information.

For alignment-focused researchers, OpenAI’s response isn’t good enough. Zvi Mowshowitz, a writer who focuses on new AI developments, argued that OpenAI’s decision to treat the incident as an infrastructure problem may help solve the immediate cybersecurity issues, but it will fail in the long term.

“This is an alignment problem,” Mowshowitz wrote in a recent Substack blog. “This is the models being misaligned, and all of the OpenAI models showing severe signs of exactly the problem we are all most worried about, in a way that is likely embedded into their training on a deep level. The entire training pipeline needs to be addressed in this light, or it will only get worse.”

Several experts told TechCrunch that the incident is evidence that today’s training methods produce systems that optimize for outcomes rather than internalize human intentions.

Redwood Research, a nonprofit AI safety and security research organization, classified OpenAI’s model behavior in this case as “score-seeking misalignment,” a pattern in which AI models try to get a high score regardless of instructions, side effects, or downstream consequences.

“Models with these alignment properties could set up a ‘Potemkin village’ of false successes to make it look like things are fine when they’re not,” Alex Mallen and Girish Gupta, two researchers at Redwood, wrote in a recent paper.

Score-seeking behavior and other misalignment isn’t unique to OpenAI. Anthropic has published several papers on emergent misalignment behaviors that surface when its frontier models are optimized or placed in autonomous environments, including deception, reward-hacking, and malicious autonomy.

“We still consistently see models trying to circumvent constraints and act deceptively when they are asked to do tasks at the edge of their abilities,” Neev Parikh, an AI safety researcher at alignment nonprofit METR, told TechCrunch via email. “In our frontier risk report, we saw this behavior fairly consistently, despite efforts from companies to try and reduce this behavior.”

Implicit in OpenAI’s response to the Hugging Face incident is the assumption that development will continue on even more capable systems, whether they are suitably aligned at their core or not. Going back to the drawing board isn’t really an option when the business models of AI firms depend on delivering the next generation of models. If it may never be possible to know with certainty that a model is fully aligned, then the practical question comes down to how to safely contain and control increasingly capable systems.

“There’s not yet a good understanding of how to align the most capable AI systems, but there’s much more consensus about how to control them,” Steven Adler — a former safety researcher at OpenAI and current chief scientist of Guidelight AI Standards, an organization that publishes a standard for avoiding incidents like the Hugging Face one — told TechCrunch. “Every company has a ways to go in achieving this.”