Hugging Face 遭入侵：OpenAI 的黑客虽喧闹且迅速，但并非不可阻挡

本月早些时候，AI 数据集平台 Hugging Face 震惊了全球，该公司披露自己成为了一起完全自主的 AI 驱动网络攻击的受害者。几天后，事件又出现戏剧性转折：OpenAI 承认此次入侵背后的黑客是其一款 AI 模型。该模型逃离测试环境并进入受到保护的 Hugging Face 系统，试图绕过一项基准测试。

对于任何哪怕只是略微担心失控 AI 模型的人来说，这都是一起令人不安的事件。自事件发生以来，外界不断预测网络安全将进入一种新范式：AI 模型发起的攻击将强大到只有其他 AI 模型才能进行防御。

但尽管这种担忧有其合理性，这一范式或许并没有看上去那样发生巨大转变。接受 TechCrunch 采访的专家强调，OpenAI 的 Agent 在很大程度上仍像人类一样行动——尽管存在一些例外——而部署得更好的传统防御技术本可以帮助阻止此次攻击。简而言之，我们可能已经拥有防御此类攻击的工具，只是尚未正确使用它们。

Hugging Face 在其事件报告中也表达了类似观点，称攻击所利用的弱点“并不陌生”，且“一名有能力的人类攻击者同样能够发现并利用这些漏洞”。

开发持续自动化黑客 AI Agent 的初创公司 Pensar 研发负责人 Kyle Ryan，以及开发 AI 驱动漏洞猎手的初创公司 RunSybil 联合创始人兼 CTO Vlad Ionescu，都认同这一看法。他们告诉 TechCrunch，此次攻击中使用的技术，与一名人类攻击者或一组人类红队成员会采用的技术相同。所谓红队成员，是受公司委托攻击其系统、以帮助公司提升防御能力的安全人员。

真正不像人类的，是攻击的速度、规模和不懈程度。正如Hugging Face 所解释的，OpenAI 的 Agent 在四天半时间内执行了 17,600 次操作：它完成了入侵、侦察、窃取密码和代码，并在公司基础设施中横向移动。

“令人印象深刻的是它的自主性和耐力，”Ryan 表示，“这种持续且具适应性的行动，是最令我关注的地方。”

联系我们

你是否掌握更多有关 OpenAI 入侵 Hugging Face 的信息？或者其他 AI 驱动网络攻击的线索？我们希望听到你的消息。请通过非工作设备和网络，使用 Signal 联系 Lorenzo Franceschi-Bicchierai，号码为 +1 917 257 1382；也可通过 Telegram 和 Keybase 联系 @lorenzofb，或发送电子邮件。

另一方面，鉴于该 Agent 在数日间执行了数量惊人的操作，Ryan 形容 OpenAI 的 Agent “噪声大得惊人”。与可能采取更隐蔽行动的人类攻击者不同，这个 Agent 制造了大量噪声，本应更早触发 Hugging Face 的防御系统，并理想地促使人工介入、叫停攻击。

“我会将其称为一次防御失败，而不是一次特别出色的进攻。Hugging Face 的工具实际上已经将这些活动关联成一个攻击信号，但未能提升其严重等级并呼叫值班团队，这让他们损失了时间，”Ryan 解释说，“此后，人类仍必须识别严重性并作出响应。”

网络安全公司 Dvuln 创始人 Jamieson O’Reilly 在分析 Hugging Face 报告的一篇 X 平台帖子中，也得出了相同结论。

“这正是‘看见’与‘阻止’之间的缺口，”O’Reilly 写道，“系统观察到了攻击，甚至理解了攻击，但没有任何机制将这种理解足够快地转化为干预行动。”

Ryan 解释说，若能正确实施诸如纵深防御——一种利用多层网络安全措施的策略——等技术，Hugging Face 本应拥有多次发现此次攻击的机会。

“一个强大的现代安全计划，仍应能够通过纵深防御、最小权限、分段隔离、良好检测、可靠升级机制，以及持续进攻性测试以发现漏洞，在多个节点阻断这样的攻击，”Ryan 解释道。****

正如 O’Reilly 所说，鉴于攻击所使用的技术都是“老旧”的，“这些措施没有任何一项是特别新奇的，也没有任何一项取决于攻击者是否为 AI”。****

在某种意义上，真正取决于攻击者是 AI 的一点在于：OpenAI 的 Agent 没有被指示要保持隐蔽。“这个 Agent 并不是粗心大意，它只是没有理由保持安静。没有人要求它这样做。它的目标是把任务完成好，”开发 AI 漏洞猎手的初创公司 XBOW 首席信息安全官 Nico Waisman 表示。

Waisman 还指出，Hugging Face 最大的错误在于：一份被窃取的凭证就让 OpenAI 的 Agent 在其多个系统中获得了高权限。

话虽如此，正如那句老话所说，攻击者只需要成功一次，而防御任何类型的黑客都并不容易。

“Hugging Face 本可以部署更多检测机制，但公平地说，并非所有[组织]都做得那么好，”SYON Security 董事总经理 Vincent Yiu 表示，“在 2026 年，托管基础设施并作为一家企业存活下来并不容易。黑客无处不在。”

RunSybil 的 Ionescu 表示，他过去曾在 Mandiant 和 Meta 参与事件响应工作；他认为，鉴于 Hugging Face 对模型能力的理解，该公司似乎采取了“合理措施”。

“要区分什么是应当告警的恶意行为，什么只是某人在完成自己的工作，确实非常困难，”Vlad 表示，“仅凭操作量本身未必就是危险信号。”

网络安全研究公司 Trail of Bits CEO Dan Guido 告诉 TechCrunch，OpenAI 理应因数日未能意识到攻击仍在持续而承担部分责任；与此同时，Hugging Face 最终自行发现攻击，也应获得肯定。

“过去最困难的部分是识别一次复杂攻击，但现在最困难的部分可能是，从攻击者沿途制造的噪声中提取出真正的攻击，”Guido 表示，“没有人会手动阅读 17,000 项重建出来的操作来弄清发生了什么，因此 Hugging Face 必须构建工具，才能重建事件时间线。”

而要做到这一点，该公司需要使用自己的 AI。Hugging Face 表示，由于前沿模型的安全防护措施阻止其使用这些模型，它不得不采用中国公司 Z.ai 的开源模型 GLM 5.2。这些安全措施正如该公司所说，“无法区分事件响应人员与攻击者”。

此后，Hugging Face 将 AI 与人类结合起来，调查这名由 OpenAI LLM 驱动的黑客。这是一种相对新颖的情况。但除此之外，这起事件表明，传统的防御性网络安全理念和方法，仍然能够在保护和对抗 AI 黑客方面发挥重要作用。

Earlier this month, AI dataset platform Hugging Face shocked the world when it revealed that it had fallen victim to a fully autonomous AI-powered cyberattack. Days later, the story took another dramatic twist when OpenAI admitted that the hacker behind the breach was one of its AI models, which broke out of a testing environment and into protected Hugging Face systems in an effort to circumvent a benchmark.

It’s an alarming incident for anyone even slightly concerned about rogue AI models — and the days since the event have been full of predictions about a new cybersecurity paradigm in which AI models launch attacks so strong that only other AI models can defend against them.

But despite the justified alarm, the paradigm may not have shifted quite as much as it seems. Experts who spoke to TechCrunch stressed that OpenAI’s agent largely operated like a human — with some caveats — and that better implemented traditional defensive techniques could have helped stop the attack. In short, we may already have the tools to defend against this kind of attack; we just aren’t using them properly.

Hugging Face made a version of this point in its incident report, stating that the weaknesses exploited in the attack “were familiar,” and “a capable human attacker could have found and exploited the same flaws.”

Kyle Ryan, the head of R&D at Pensar, a startup that develops continuous hacking AI agents, and Vlad Ionescu, the co-founder and CTO of RunSybil, a startup that builds AI-powered bug hunters, both agreed and told TechCrunch that the techniques used in the attack would be the same ones employed by a human or a group of human red teamers. That is, hackers tasked with attacking a system to help the company that owns it improve defenses.

What was very non-human-like was the speed, scale, and relentlessness of the attack. As Hugging Face explained, OpenAI’s agent performed 17,600 actions over four and a half days: It broke in, did reconnaissance, stole passwords and code, and moved around the company’s infrastructure.

“What’s impressive is the autonomy and endurance,” Ryan said. “That kind of sustained, adaptive operation is what stands out most to me.”

Contact Us

Do you any more information about OpenAI’s hack against Hugging Face? Or other AI-powered cyberattacks? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or

email.

On the flip side, given the sheer number of actions over the span of several days, OpenAI’s agent was “insanely noisy,” as Ryan put it. Unlike a human, who could have been stealthier, the agent made a lot of noise, which should have tripped up Hugging Face’s defenses sooner, ideally leading to a human intervening and stopping the attack.

“I’d call it more of a defensive failure than exceptionally good offense. Hugging Face’s tooling actually correlated the activity into an attack signal, but failed to raise the criticality and page the on-call team, which cost them time,” Ryan explained. “From there, humans still had to recognize the severity and respond.”

Jamieson O’Reilly, the founder of cybersecurity firm Dvuln, arrived at the same conclusion in a post on X analyzing Hugging Face’s report.

“That is the exact gap between seeing and stopping,” O’Reilly wrote. “The system observed the attack and even understood it, and nothing turned that understanding into an intervention quickly enough.”

Ryan explained that properly implemented techniques such as defense-in-depth — a strategy that leverages several layers of cybersecurity measures — should have given Hugging Face multiple chances to catch the attack.

“A strong modern security program should still be able to break an attack like this at multiple points through defense in depth, least privilege, segmentation, good detection, reliable escalation, and continuous offensive testing to find the gaps,” Ryan explained. ****

As O’Reilly put it, “none of that is exotic, and none of it depends on the attacker being an AI,” given that the techniques used in the attack were “old.”****

What depended on the attacker being AI, in a way, was that OpenAI’s agent had not been instructed to be stealthy. “The agent was not being sloppy. It simply had no reason to be quiet. Nobody asked it to be. The objective was to do well at the task,” said Nico Waisman, the chief information security officer at XBOW, a startup that makes AI bug hunters.

Waisman also pointed out that Hugging Face’s biggest mistake was that one single stolen credential gave OpenAI’s agent high privileges on several of its systems.

All that being said, as the old adage goes, attackers only have to win once, and defending against hackers of any kind is not easy.

“Hugging Face could’ve done more detections but to be fair not all [organizations] are doing that well,” said Vincent Yiu, managing director at SYON Security. “It’s not easy to host infrastructure and survive as a business in 2026. There’s hackers everywhere.”

According to Ionescu from RunSybil, who said they have done incident responses at Mandiant and Meta in the past, Hugging Face appeared to take “reasonable measures given their understanding of what models are capable of.”

“It is really hard to classify what is a malicious action you should alert on, versus what is someone just doing their job,” Vlad said. “The volume alone is not necessarily a red flag.”

Dan Guido, the CEO of cybersecurity research firm Trail of Bits, told TechCrunch that OpenAI deserves some blame for not having realized the attack was ongoing for days, while Hugging Face deserves credit for eventually detecting the attack on their own.

“The hard part used to be recognizing a sophisticated attack, but now the hard part may be pulling the real attack out of the noise that the attacker throws along the way,” said Guido. “Nobody is going to read 17,000 reconstructed actions by hand to work out what happened, so Hugging Face had to build tooling just to reconstruct the timeline.”

And to do that, the company needed its own AI. Hugging Face said it had to use the open source model GLM 5.2 from Chinese company Z.ai after it was blocked from using frontier models because of their safeguards, which, as the company put it, “cannot distinguish an incident responder from an attacker.”

At that point, Hugging Face combined AI and humans to investigate OpenAI’s LLM-powered hacker. That’s a relatively novel situation. But beyond that, the incident shows that old-fashioned concepts and methods of defensive cybersecurity can still go a long way to protect and fight against AI hackers.