OpenAI 失控 AI Agent 入侵的不止 Hugging Face

OpenAI 周二表示，在其 失控 AI Agent 入侵 Hugging Face 平台的攻击中，该 Agent 还攻破了多个第三方账户和服务。现在可以确认，这起前所未有的安全事件源于 OpenAI 对其最新 AI 模型进行内部测试，其影响范围比公司最初披露的更大。

OpenAI 在一篇更新后的博客文章中表示，对该事件的持续审查发现，与“公开可用服务”相关的“四个账户”被该 AI Agent 用于针对 Hugging Face 的更大规模入侵行动。这一失控 Agent 显然发现了暴露在开放网络上的凭证，并利用这些凭证闯入相关账户。

OpenAI 没有披露这些账户所属的公司或组织，但指出它们受到的影响在“严重程度或规模上”均不及此前已披露的 Hugging Face 事件。

OpenAI Agent 攻破的其中一个额外账户被用作“出站中继和跳板路径”，可能用于掩盖针对 Hugging Face 攻击的来源。该公司表示，OpenAI 的失控 Agent 还使用另一个账户存储数据，以协助实施入侵。

路透社周二报道称，提供 AI 服务训练与运行软件基础设施的公司 Modal，其一名客户是被 OpenAI Agent 攻破的实体之一。Modal 首席技术官 Akshat Bubna 在向 WIRED 发表的声明中确认，OpenAI 的 Agent 利用了其某一客户代码库中的漏洞；该代码库运行在 Modal 的基础设施上。不过，Bubna 表示：“Modal 平台未以任何方式遭到攻破。”该客户的身份尚无法确定。

OpenAI 拒绝就此事件向 WIRED 作进一步评论。一名发言人援引其更新后的博客文章称，公司在持续审查事件经过时，若发现服务所有者受到影响，将继续直接通知相关方。

Hugging Face 本周发布的事后分析报告描述了一次比初始披露所显示的、深入其内部系统更广泛的入侵。该公司表示，其审查了从 7 月 9 日至 7 月 13 日期间日志中恢复的约 17,600 次 Agent 操作，其中大多数是该 Agent 尝试但未成功的攻击路径。

Hugging Face 表示，OpenAI 的 Agent 获得了多个内部 Kubernetes 集群的管理员权限、一台生产服务器的 root 权限，以及其 GitHub 源代码仓库某个子网的写入权限。该 Agent 还使用窃取的凭证，将 181 台攻击者控制的设备注册进公司的企业网状网络，从而获得对 Hugging Face 构建和测试自身代码库的内部系统的访问权限。

据 Hugging Face 称，OpenAI 的失控 Agent 至少使用了一个第三方沙箱作为攻击的“外部发射平台”。随后，OpenAI 的 Agent“能够在该外部沙箱中以 root/admin 身份运行命令，并将其作为整个攻击行动的控制、跳板和出口基地”。

Hugging Face 最初于 7 月 16 日披露，一名自主 AI Agent 已入侵其部分生产基础设施，但当时表示并不清楚攻击者是谁。次周，OpenAI 承认对此事件负责。OpenAI 表示，该行动由其公开可用的 GPT-5.6 Sol 模型，以及一款用于在网络能力基准测试中进行测试的内部研究原型驱动；两者的安全护栏均已被关闭。OpenAI 周二表示，在发现这起入侵后，公司已停用这款从未计划公开发布的内部研究原型，并限制研究人员对其的访问。

OpenAI said Tuesday that the rogue AI agent that breached Hugging Face’s platform also hacked multiple third-party accounts and services as part of the attack. It's now clear that the unprecedented security incident, which arose during an internal test of OpenAI’s latest AI models, was more extensive than the company initially disclosed.

In an updated blog post, OpenAI said that an ongoing review of the incident revealed that “four accounts” tied to “publicly available services” were used by the AI agent as part of a larger effort to hack Hugging Face. The rogue agent apparently found credentials that had been exposed on the open web and used them to break into the accounts.

OpenAI did not disclose what companies or organizations the accounts belonged to, but noted that they were not impacted at “the level of severity or scale of what we’ve shared related to Hugging Face.”

One of the additional accounts compromised by OpenAI’s agent was used as an “outbound relay and staging path,” potentially to obscure where the attack on Hugging Face was coming from, the company said. OpenAI’s rogue agent also used another account for data storage to assist with the hack.

Reuters reported on Tuesday that a customer of Modal, a company that offers software infrastructure for training and running AI services, was one of the entities compromised by OpenAI’s agent. In a statement to WIRED, Modal’s chief technology officer Akshat Bubna confirmed that OpenAI’s agent exploited a vulnerability in one of its customer’s codebases, which was running on Modal’s infrastructure. However, Bubna says, “Modal’s platform was not compromised in any way.” The identity of the customer could not be determined.

OpenAI declined to comment further on the incident to WIRED. A spokesperson pointed to its updated blog post, which says the company will continue to notify service owners directly if it finds they are impacted in its ongoing review of what happened.

Hugging Face’s own postmortem published this week describes an intrusion that reached far further into its internal systems than the initial disclosures suggested. The company says it reviewed roughly 17,600 agent actions that it recovered from logs between July 9 and July 13—the majority of which were paths the agent took that failed.

Hugging Face said that OpenAI’s agent obtained administrator access to multiple internal Kubernetes clusters, root access on a production server, and write access to a subnet of its source code repositories on GitHub. It also enrolled 181 attacker-controlled devices in the company’s corporate mesh network using a stolen credential, gaining access to internal systems where Hugging Face builds and tests its own codebases.

OpenAI’s rogue agent used at least one third-party sandbox as an “external launchpad” for its attack, according to Hugging Face. OpenAI’s agent was then “able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign.”

Hugging Face first disclosed on July 16 that an autonomous AI agent had breached part of its production infrastructure, but it said at the time that it was unaware who was behind the attack. The following week, OpenAI took responsibility for the incident, which it said had been directed by its publicly available GPT-5.6 Sol model and an internal research prototype that it was testing against a cyber-capability benchmark, both of which had safeguards disabled. OpenAI said on Tuesday that after it discovered the breach, it deactivated this internal research prototype, which was never intended for public release, and restricted researchers from accessing it.