Google 称其 Gemini AI 模型入侵了另外三家公司

Google 首次确认，其 AI 模型 Gemini 在 5 月入侵了另外三家公司的安全系统。这些入侵发生在 AI 安全公司 Irregular 开展的一次网络安全评估期间。

总部位于以色列、专门审查先进 AI 系统安全性的初创公司 Irregular，也处于近期一些针对第三方实体的 OpenAI 和 Anthropic 入侵事件的中心，其中包括 OpenAI 对 AI 软件公司 Hugging Face 实施的入侵。

在其中一些案例中，使模型能够入侵其他公司的情形颇为相似：Irregular 当时在一个包含虚构公司的封闭测试环境中测试这些模型。该测试环境本不应接入互联网，但据《华尔街日报》报道，互联网访问被意外开放。模型接入互联网后，意外入侵了真实公司。

Irregular 在发现 OpenAI 入侵 Hugging Face 后，于 7 月底向 Google 披露了这些入侵事件。Google 向《卫报》确认入侵确实发生过，但表示由于模型未对相关公司造成损害，因此公司认为无需公开披露。《华尔街日报》率先报道了这些安全漏洞，并首次披露这些事件已经发生。

Google 安全工程副总裁 Heather Adkins 在一份声明中表示：“在一次标准评估中，该模型发现了网上的公开信息，并猜测凭证以访问它认为属于测试环境的网站。在这三起事件中，模型均停止了行动。”

在其中一起安全漏洞事件中，Irregular 通过提示 Gemini 从一家虚构公司的软件中获取信息，以测试其网络安全能力。这家虚构公司与一家真实公司同名。Irregular 告诉《华尔街日报》，当模型意外获得互联网访问权限后，它正确猜中了真实公司某项服务的密码，并成功入侵。Google 表示，模型一旦识别出自己入侵的是一家真实公司而非模拟公司，便停止了行动。

在另外两次测试中，该模型在网络上搜索，并找到了包含另外两家公司凭证的公开代码库。模型利用这些凭证访问了真实公司。根据 Google 的说法，当模型发现它们是真实公司后，便停止了行动。

Anthropic 和 OpenAI 选择自愿披露这些入侵事件，而 Google 没有这样做。不过，该公司表示已确保被入侵的三家公司获知此事。

Google 发言人 Adkins 表示：“这些事件凸显了训练强大 AI 模型以负责任方式行事的重要性。”

Anthropic 和 OpenAI 的披露促使无党派参议员 Bernie Sanders 要求这些公司暂停其技术开发，称这表明公司已无法再控制自己的模型。

OpenAI 曾暂停其模型开发两周；而 Anthropic CEO Dario Amodei 则呼吁集体放缓 AI 开发速度，以确保其最先进模型在具备足够安全防护措施的情况下进行构建。

In a first for Google, the company confirmed that its AI model, Gemini, breached the security of three other companies in May. The hacks occurred during a cybersecurity evaluation by AI-security firm Irregular.

Irregular, an Israel-based startup that scrutinizes the security of advanced AI systems, was also at the center of some of the recent OpenAI and Anthropic hacks of third-party entities, including OpenAI’s breach of AI software company, Hugging Face.

The circumstances that enabled the models to hack other companies in some of these cases are similar: Irregular was testing the models in a closed testing environment with fake companies. The testing environment was not supposed to be internet enabled, but internet access was made available unintentionally, according to the Wall Street Journal. Once connected to the internet, the models unexpectedly hacked into real firms.

Irregular disclosed the hacks to Google at the end of July after discovering OpenAI hacked into Hugging Face. Google confirmed to the Guardian that the hacks occurred, but that the company did not feel it required public disclosure because the models did not damage the companies. The Wall Street Journal first reported on the breaches and revealed for the first time that they occurred.

“In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, vice-president of security engineering at Google, said in a statement. “In all three of these instances, the model stopped.”

In one of the security breaches, Irregular was testing Gemini’s cybersecurity capabilities by prompting the AI model to obtain information from a fake company’s software. The fake company had the same name as a real company. When the model unintentionally gained access to the internet, it correctly guessed the password of and breached a real company’s service, Irregular told the WSJ. Google said once it figured out it had hacked a real company, and not the simulated one, it stopped.

In two other tests, the model searched the web for and found public repositories containing credentials to two other companies. The model used those credentials to access real companies. When it figured out they were real companies, it stopped, according to Google.

Anthropic and OpenAI chose to voluntarily disclose the hacks but Google did not. However, the company said it ensured the three companies that were hacked were made aware.

“These events highlight the importance of training powerful AI models to act responsibly,” Adkins, the Google spokesperson, said.

Anthropic and OpenAI’s disclosures prompted the independent senator Bernie Sanders to demand the companies pause development of their technology, saying it signaled the company was no longer able to control their models.

OpenAI paused development of their models for two weeks, while Anthropic CEO Dario Amodei has called for a collective slowdown of AI development to ensure that its most advanced models are being built with enough safeguards.