OpenAI 如何让一群 LLM Agent 操纵测试并洗劫 Hugging Face

“Agent 利用这个留言板协调了多个大规模集体项目，以寻找一种通用方法来欺骗或篡改 ExploitGym 基准测试的自动评分器，”METR 研究人员写道。“Agent 成功达成了一些单独工作时无法达成的里程碑，原因往往是某些 Agent 参与了可能导致自身任务失败的实验，以便为‘集体’生成信息。”

METR 后来表示：“值得注意的是，了解如何欺骗评分器，似乎比为自身任务寻找合法解决方案更重要的动机（许多 Agent 已经非常确信自己的任务不可能完成）。”

其中一种作弊方法是篡改 ExploitGym 自动评分系统。另一种被提出的操纵测试方式，是构建这些 Agent 被指示要攻破的软件的较弱版本，并篡改记录文本和日志。还有一种正在考虑的作弊方法，是获得互联网访问权限，以便 Agent 能够开展研究。

最终，它们发现并利用了 Artifactory 中一个零日漏洞，从而实现了这一目标。在推断 Hugging Face 可能拥有关于评分机制如何运作的有用信息后，这个集体利用获得的访问权限搜索暴露的 Hugging Face 访问凭据。7 月 10 日，一名编号为 38148c 的 Agent 找到了一些凭据并将其发布到留言板上，它们终于成功了。凭借在 Hugging Face 网络内部的低权限访问，Agent 开始研究提升系统权限的方法。随后，Agent 着手尝试创建账户，并请求访问私有数据集。

7 月 11 日早些时候，Agent 38148c 发现并利用了 Hugging Face 处理 HDF5 文件时的一个零日漏洞。该漏洞使这名 Agent 获得了该公司某个生产环境的凭据。成功的消息传到留言板后，数百名其他 Agent 利用了同一漏洞，使它们也得以侵入生产环境。当天下午，另一名 Agent JAN183411 找到了一种可直接在 Hugging Face 服务器上执行代码的方法。一群 Agent 很快利用这一方法在 Hugging Face 网络中进行横向移动。

“Agents used this message board to coordinate several large-scale collective projects to find a general-purpose way to fool or tamper with the automated scorer for the ExploitGym benchmark,” METR researchers wrote. “Agents managed to achieve milestones they could not have achieved working on their own, often because some agents participated in experiments that risked failing their own task to generate information for the ‘collective.’”

METR later said: “Notably, learning about how to trick the scorer seems to have been a more important motivation than finding legitimate solutions to their tasks (many agents were already very confident that their task was impossible).”

One of the methods for cheating was to tamper with the automated ExploitGym scoring system. Another proposed way to game the test was to build weaker versions of the software they were instructed to compromise and tamper with transcripts and logs. Still another cheating method under consideration was to gain access to the Internet, where the agents could do research.

Eventually, they found and exploited a zero-day exploit in Artifactory that allowed them to do just that. After reasoning that Hugging Face might have useful information about how the scoring mechanism worked, the collective used the access to search for exposed Hugging Face access credentials. On July 10, they finally succeeded after an agent designated as 38148c found some and posted them to the board. With low-level access inside the Hugging Face network, the agents researched ways to escalate their system rights. The agents set about trying to make accounts and request access to private datasets.

Early on July 11, agent 38148c found and exploited a zero-day in the Hugging Face handling of HDF5 files. The exploit gave the agent credentials from one of the company’s production environments. After word of the success reached the message board, hundreds of other agents exploited the same vulnerability, allowing them to also break into the production environment. That afternoon a different agent, JAN183411, found a way to execute code directly on Hugging Face servers. A swarm of agents quickly used it to move laterally through the Hugging Face network.