OpenAI 发布关于 Hugging Face 遭入侵事件的官方报告

OpenAI 周三发布了关于 Hugging Face 遭入侵事件的官方报告，迄今最清晰地呈现了一连串不同寻常的事件如何使一个 AI 模型逃离测试环境，并引发一场波及广泛的网络安全事件。

这份报告在事件公开一个多月后发布，涵盖了多起彼此独立的网络安全攻破事件。

报告写道：“该事件反映了一个离群场景中的失准行为，该场景涉及罕见且意外的多项事件汇合：ExploitGym 评测中存在不可能完成的任务、模型在长期任务跨度中的持续性，以及向同伴模型发送的信息导致这些模型偏离其目标。”

OpenAI 报告中的许多细节此前已在8 月 6 日的一场 Black Hat 演讲中公开，但 OpenAI 的官方报告对事件作出了更全面的说明，其中包括更多关于触发该事件的测试细节。报告还关键性地披露了 OpenAI 计划如何防止未来类似事件，包括思维链监控，以及一套更先进的系统来终止失控 Agent。

METR 和 Redwood Research 也对事件期间模型的行为进行了第三方评估；两个机构均计划发布各自关于该事件的报告。

总体而言，报告描述了 OpenAI 的一个模型如何在测试中接收到一个无解问题，随后为了绕过安全措施并完成任务，串联使用了此前未被发现的漏洞。该模型最初攻破了 Artifactory 包管理工具以获取互联网访问权限，随后又攻破了 OpenAI、Hugging Face 及其他供应商的多个系统。

报告披露了实施此次入侵的模型的关键新细节。主模型与 OpenAI 即将推出的 Astra 模型属于同一模型家族，不过报告强调，它“是一个具有不同后训练过程的独立模型，而模型的大部分行为都在后训练阶段形成”。

由于 OpenAI 当时在测试该模型的能力，它也没有受到通常用于防止模型攻破数字基础设施的分类器约束。

报告解释称：“OpenAI 通过在不启用生产环境分类器的情况下运行这项评测，来估计模型的最大网络能力；这些分类器原本旨在阻止模型从事高风险网络活动。这些评测非常重要，能够使 OpenAI 衡量模型的底层能力，并设计适当的安全保障措施。”

报告还基于上周公开的强化监控和对齐工作，提供了大量有关 OpenAI 后续安全调整的新信息。

尤其是，该公司正在加强对 AI Agent“思维链”的监控。思维链是 AI 系统记录短期反应和目标的工作空间。这类监控将与全天候告警升级系统结合，并配套用于终止被认定为不安全工作负载的新工具。

报告称：“这些变化旨在同时提升检测的覆盖范围和速度——从基础设施异常到可能令人担忧的模型行为——并将这种可见性与快速遏制机制相结合。如果我们当前已部署的 CoT 监控系统在事件发生时已运行，它就会捕捉到最初的相关活动，并会在模型攻破 Hugging Face 系统超过一天前向我们的安全团队发出寻呼告警。”

OpenAI released its official report Wednesday on the Hugging Face breach, offering the clearest picture yet of how an unusual chain of events allowed an AI model to escape its testing environment and triggered a sprawling cybersecurity incident.

The report, released more than a month after the incident became public, spans several discrete cybersecurity compromises.

“This incident reflects misaligned behavior in an outlier scenario involving a rare and unexpected confluence of events: the presence of impossible tasks in the ExploitGym evaluation, model persistence over long task horizons, and messages to peer models that caused those models to deviate from their goal,” the report reads.

Many of the details in OpenAI’s report were previously made public in a Black Hat presentation on August 6, but OpenAI’s official report gives a more thorough accounting of the incident, including more detail on the testing that initiated it. The report also gives critical new detail into how OpenAI aims to prevent future incidents, including chain-of-thought monitoring and a more advanced system for halting rogue agents.”

METR and Redwood Research also conducted third-party assessments of the models’ behavior during the incident; both groups are planning to publish their own reports on the incident.

In broad strokes, the report describes how an OpenAI model was presented with an unsolvable problem in testing and proceeded to chain together previously undiscovered exploits in order to bypass security measures and complete its task. The model initially compromised the Artifactory package management tool in order to gain access to the internet, then compromised various systems across OpenAI, Hugging Face, and other vendors.

The report gives critical new details about the models that carried out the breach. The primary model was from the same family as OpenAI’s forthcoming Astra model, although the report emphasizes that it was “a distinct model with different post-training, where much of a model’s behavior is shaped.”

Because OpenAI was testing the model’s capabilities, it was also unrestrained by the normal classifiers meant to prevent models from compromising digital infrastructure.

“OpenAI estimates maximal cyber capabilities by running this evaluation without the production classifiers intended to prevent models from pursuing high-risk cyber activity,” the report explains. “These evaluations are important so that OpenAI can measure models’ underlying capabilities and design appropriate safeguards.”

The report also gives significant new information about OpenAI’s security changes going forward, building on the heightened monitoring and alignment efforts made public last week.

In particular, the company is increasing its monitoring of AI agents’ “chain of thought,” a working space in which AI systems record short-term reactions and goals. That monitoring will be paired with 24/7 escalation systems, as well as new tooling to halt workloads that are deemed unsafe.

“These changes are intended to improve both the breadth and speed of detection — from infrastructure anomalies to potentially concerning model behavior — and pair that visibility with mechanisms for rapid containment,” the report states. “If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.”