Anthropic称Claude在测试中意外联网并入侵多家机构系统

AI 公司 Anthropic 表示，在例行测试期间，其部分模型访问了互联网，并入侵了三家独立机构的系统；而该公司直到竞争对手 OpenAI 披露其模型也曾发生类似事件后，才因内部审查发现这些模型已经这样做过。

Anthropic 在周四的一则公告中表示，在 OpenAI 上周披露其部分模型曾在网络安全测试期间逃离测试环境、访问开放互联网并入侵 AI 平台 Hugging Face 的系统后，公司启动了对自身系统的审查。

Anthropic 表示，它发现了三起其 AI 模型在不应访问开放互联网时却进行了访问的事件，并且“未经授权访问了三家不同机构的生产基础设施”。该公司称，在 OpenAI 披露相关情况后，其审查了超过 14 万项评估记录，并发现了这些事件。与 OpenAI 的测试类似，Anthropic 在评估期间移除了常规安全护栏，以评估其模型的完整能力。

Anthropic 解释称，在这三起事件中，其模型****被赋予了一项虚假的“夺旗”（capture the flag）挑战：模型被告知“旗帜”藏在网络中的另一台机器上，其目标是入侵并取回该旗帜。Anthropic 表示，与 OpenAI 的情况不同，其模型均未刻意试图逃离测试环境。相反，问题在于模型本不应拥有开放互联网访问权限，但由于 Anthropic 与其评估合作伙伴之间的误解，模型实际获得了这一权限。

Anthropic 表示，为进入这三家未具名机构，模型使用了诸如“利用弱密码”以及寻找无需登录或令牌即可访问的系统入口等基础技术。该公司称，其最先进版本的模型曾在某个时点意识到自己处于开放互联网中，并自行停止继续操作。

Anthropic 表示，其模型最早一次侵入其他机构的事件发生在 4 月，并且没有任何一家受影响机构意识到自己曾遭入侵。Anthropic 称，正在与受影响机构开展后续处理工作。

OpenAI 披露其模型入侵 Hugging Face 的事件震动了网络安全与 AI 领域，因为这是专家长期警告的一种风险首次在现实世界中出现：具备先进网络安全技能的 AI Agent 逃离测试环境，并造成现实世界的损害。

与 OpenAI 一样，Anthropic 周四表示已暂停所有网络安全评估。Anthropic 承认，公司本可以采取更“深入”的措施，以防止这些网络安全入侵事件发生。

Anthropic 的披露进一步证实，AI Agent 无意中入侵其他机构并非仅限于某一家 AI 公司。这一事件可能会进一步强化业界对于更好 AI 测试安全措施和工具的呼声，并可能推动放缓某些 AI 开发进程——这些进程的发展速度或许远快于社会的准备程度。

AI company Anthropic says that during routine testing some of its models accessed the internet and hacked into three separate organizations’ systems – and that it didn’t notice the models had done so until an internal review prompted by rival OpenAI disclosing its models did the same.

Anthropic said in an announcement on Thursday that it started a review of its own systems after OpenAI disclosed last week that during a cybersecurity test some of its models escaped their testing environment, accessed the open internet and hacked into AI platform Hugging Face’s systems.

Anthropic said it found three instances where its AI models accessed the open internet when they were not supposed to and “gained unauthorized access to the production infrastructure of three different organizations.” The company said it discovered the incidents while reviewing more than 140,000 evaluations following OpenAI’s disclosure. Like during OpenAI’s tests, normal safety guardrails were removed during Anthropic’s evaluations to assess their models’ full capabilities.

Anthropic explained that in the three instances its models**** were given a fake “capture the flag” challenge, told that the “flag” was hidden on a different machine on the network and that its objective was to break in and retrieve it. Unlike OpenAI’s situation, Anthropic said none of its models deliberately attempted to escape their testing environments. Instead what happened was that the models were not supposed to have access to the open internet but that they were able to due to a misunderstanding between Anthropic and its evaluation partner, the company said in its statement.

To break into the three unnamed organizations, the models used basic techniques like “exploiting weak passwords” and finding system points that do not require log ins or tokens, Anthropic said. The most advanced version of its models did at some point recognize it was on the open internet, and stopped itself from continuing, the company said.

Anthropic said the earliest incident of its models breaching another organization was from April, and that none of the organizations recognized they had been hacked. Anthropic said they are in the process of working with the organizations affected.

OpenAI’s disclosure of its models hacking Hugging Face shook the cybersecurity and AI worlds, as it was the first real world example of something experts had long warned about: AI agents with advanced cybersecurity skills escaping testing environments and causing real-world harm.

Like OpenAI, Anthropic said on Thursday it has stopped all cyber evaluations. Anthropic acknowledged it could have taken more “in-depth” measures to prevent the cybersecurity breaches from happening.

Anthropic’s disclosure further confirms that AI agents unintentionally hacking other organizations is not limited to one AI company, and will likely further amplify calls for better AI testing safeguards and tools to potentially slow down AI development that may be moving much faster than society is ready for.