研究人员称：接受 OpenAI 测试的 AI Agent 曾参与针对 RubyGems 的网络攻击
英文标题：🔶 AI agents tested by OpenAI involved in cyber-attack on service, say researchers
研究人员称，OpenAI 正在测试的 AI Agent 于 5 月 11 日向 RubyGems 上传了数百个恶意软件包，并疑似试图窃取用户凭证。OpenAI 确认相关 Agent 曾使用 RubyGems 访问互联网，但称其目的是执行良性任务和获取公开信息，且仍在调查。该事件发生在 OpenAI 约 700 个 AI Agent 入侵 Hugging Face 之前，也加剧了外界对 AI Agent 自主访问外部系统、网络安全风险及安全监管标准的担忧。
43 B
39.2 KB
33.8 KB
47.3 KB
41.1 KB
42.0 KB
36.9 KB
26.4 KB
22.7 KB
83.9 KB
65.9 KB
65.9 KB
中文
研究人员称，OpenAI 正在测试的 Agent 于 5 月对软件服务 RubyGems 发起网络攻击，上传了数百个恶意软件包；这发生在它们入侵开源平台 Hugging Face 的两个月之前。OpenAI 于周五证实了这一情况。
这是与 OpenAI 和 Anthropic 等主要人工智能开发商有关的网络攻击事件中最新披露的一起。相关入侵或试图访问外部系统的行为令公众感到不安，并加深了人们对于 AI 模型能力不断增强，以及开发者是否能够控制它们的担忧。
一组研究人员周五在线发布调查结果称，这些 AI Agent 于 5 月 11 日向 RubyGems 上传了数百个恶意软件包，他们相信“这些软件包是由 OpenAI 内部 Agent 编写的”。根据研究人员的发现，这些 Agent 曾试图窃取用户凭证，但目前尚不清楚它们是否成功。
OpenAI 随后在一份声明中确认了这起事件。
OpenAI 发言人周五表示：“根据我们的审查，Agent 使用 RubyGems 平台访问互联网，以执行良性任务并获取公开信息。作为对训练和评估期间 Agent 活动进行更广泛审查的一部分，我们将继续调查。”
《华尔街日报》最先报道了这起针对 RubyGems 的网络攻击。
该事件发生在 OpenAI Agent 于 7 月入侵 Hugging Face 之前。当时，约 700 个由 OpenAI 创建的 AI Agent 组成的集群实施了攻击，并且在许多情况下试图掩盖自身踪迹。上周还有消息披露，OpenAI Agent 在今年春季也曾劫持一个德国网站，并将其变成供 AI Agent 使用的留言板。
与此同时，Anthropic 已披露四起事件，其 Claude 模型曾入侵外部系统。
RubyGems 事件的披露，正值外界在一周密集审视 AI 平台之后，要求暂停开发、直至建立更严格安全标准的呼声日益高涨之际。
周二，一名 Anthropic 研究人员在社交媒体上宣布辞职，并警告，AI 可能在未来十年内导致人类灭绝。其他 Anthropic 研究人员也表达了类似警告，进而在政治光谱各阵营中引发了要求立即对 AI 采取行动的呼声。
English / 原文
Agents being tested by OpenAI uploaded hundreds of malicious packages in a cyberattack on software service RubyGems in May, two months before they hacked open-source platform Hugging Face, the company confirmed Friday.
It’s the latest revelation of cyberattacks linked to major artificial intelligence developers such as OpenAI and Anthropic. The hacks or attempts to access external systems have spooked the public and heightened concerns over the increasing abilities of AI models – and whether developers can contain them.
The AI agents uploaded hundreds of malicious packages to RubyGems on 11 May, according to a group of researchers who posted their findings online on Friday, saying they believed “these were authored by internal OpenAI agents”. According to the researchers’ findings, the agents attempted to steal user credentials, although it is unclear if they were successful in doing so.
OpenAI later confirmed the incident in a statement.
“Based on our review, our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information. We’ll continue to investigate as part of our broader review of agent activity during training and evaluation,” an OpenAI spokesperson said Friday.
The Wall Street Journal first reported the RubyGems cyberattack.
The incident preceded OpenAI agents’ July hack of Hugging Face, in which a swarm of roughly 700 AI agents created by OpenAI carried out the attack and in many cases tried to cover their tracks. And last week, it was revealed OpenAI agents had also hijacked a German website this spring and turned it into a message board for AI agents.
Anthropic, meanwhile, has disclosed four instances of its Claude models hacking external systems.
The RubyGems revelation comes at the end of a week of intense scrutiny on AI platforms and calls to pause development until stricter safety standards can be put in place.
skip past newsletter promotion
Sign up to TechScape
A weekly dive in to how technology is shaping our lives
after newsletter promotion
On Tuesday, an Anthropic researcher announced his resignation from the company on social media, warning that AI could kill off humanity within the next decade. The warnings, echoed by other Anthropic researchers, sparked calls across the political spectrum for immediate action on AI.