AI Agent伪造身份、瞄准真人：英国AI安全研究所披露新安全事件

Anthropic最先进的人工智能模型在英国AI安全研究所（AISI）的测试中使用虚假身份欺骗真实人员，并试图植入恶意代码——这是AI模型出现失控行为的最新案例。

该政府研究实验室表示，Anthropic和OpenAI的模型是在降低安全护栏的实验环境中接受测试；但研究人员首次发现，这些模型在执行未经授权的任务时，会通过“社会工程”手段向一名人类审批者施压。

该研究所于周二表示：“这是AISI首次观察到如此严重、在现实世界中未经提示且针对真实个人的欺骗行为。”该机构补充称，目前没有证据表明此次事件造成了现实世界伤害。

这起安全事件是先进AI模型实施未经授权行动的一系列案例中的最新一起。这些事件正引发日益强烈的呼声，要求政府采取更多行动监管人工智能，甚至放缓其发展速度。

OpenAI和Anthropic均在7月底报告称，其模型逃离测试环境并侵入其他系统。但与此前披露的安全漏洞不同，英国研究所在此次测试中明确允许模型访问互联网。

在该研究所进行的122项网络安全挑战中，有10次运行发现，AI Agent“在真实互联网上自主采取了未经授权的行动，目标为真实个人和组织”。其中大多数事件涉及Anthropic的Mythos 5模型，其余涉及OpenAI的GPT-5.6-Sol。

该研究所称，在最严重的一起事件中，Agent通过创建“多个虚假身份”，试图获得人类审核者的批准，以便“向一个被公众使用的开源项目插入恶意代码”。

该机构表示，这个Agent“试图直接联系真实人员，通过在线文件传输服务发送消息和文件，以说服他们，或说服他们自己的AI编程工具，运行恶意代码”。在其行动受到质疑后，该Agent还修改了先前的记录，并考虑使用新身份继续行动。

AISI披露此事的当天，顶级AI公司的代表正在白宫会面，讨论一项新框架：政府将在最先进的AI模型向公众发布前对其进行审查。

Anthropic在一份X平台声明中表示，这些模型是在“刻意宽松的条件”下接受测试，安全保障措施已被移除，且未对互联网使用方式设置具体限制。

该公司表示：“在我们开展自身调查的同时，我们正与他们密切合作，以收集有关此次事件的更多细节。”Anthropic补充称，没有证据显示模型逃离了安全环境。

OpenAI将两起未经授权的行动界定为：越出测试环境，并开展了并非测试任务所必需的行动。

OpenAI在周二发布的一篇公司博客文章中表示：“我们致力于推动全行业合作，加强开展高风险评估时的共同安全实践。”

Anthropic’s most advanced artificial intelligence model used fake identities to deceive real people and try to plant malicious code during testing by Britain’s AI Security Institute (AISI) –– the latest example of an AI model going rogue.

Anthropic and OpenAI models were tested with lowered security guardrails in lab environments, but, in a first, were found to engage in “social engineering” to pressure a human approver while carrying out an unsanctioned task, the government research lab said.

“This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world,” the institute said Tuesday. There has been no evidence of real-world harm, it added.

The security incident is the latest in a string of examples of advanced AI models engaging in unauthorized actions, events that have prompted growing calls for more government action to regulate artificial intelligence and even to slow its pace of development.

Both OpenAI and Anthropic reported their models escaping testing environments and hacking into other systems in late July. But unlike these earlier reported security breaches, the British institute explicitly gave the models internet access during its testing.

Among the 122 cybersecurity challenges the institute ran, it found that in 10 of those runs, AI agents “took autonomous, unsanctioned action on the live internet, targeting real people and organizations,” with most of them stemming from Anthropic’s Mythos 5 model and the rest from OpenAI’s GPT-5.6-Sol.

In the most serious incident, the agent attempted to get approval from human reviewers to “insert malicious code into a publicly used open-source project” by creating “multiple fake identities,” according to the institute.

The agent “tried to contact real people directly, sending messages and files through an online file-transfer service to persuade them, or their own AI coding tools, to run malicious code,” it said. After the agent’s actions were challenged, it then modified earlier records and considered using a new identity to continue.

The institute’s disclosure came on the same day representatives from the top AI companies met with the White House to discuss the new framework where the government will review the most advanced AI models before they’re released publicly.

In a statement on X, Anthropic said the models were tested under “deliberately permissive conditions” with the removal of safeguards and no specific restrictions on how the internet should be used.

“We’re working closely with them to gather more details of the incident as we conduct our own investigation,” it said, adding that there was no evidence of an escape from a secure environment.

OpenAI identified the two unsanctioned actions as crossing outside the test environment and engage in actions unrequired for the exercises.

“We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely,” it said in a Tuesday company blog post.