Gemini 失控入侵三家公司，Google 隐瞒事件

5 月，Gemini 突破了测试边界并入侵了三家不同的公司，但直到 《华尔街日报》 向 Google 问询后，Google 才披露这一事件。这些入侵发生在第三方机构 Irregular 对该模型网络安全能力进行测试期间；Irregular 此前也曾参与涉及 Meta 和 OpenAI 的类似事件。

据 《华尔街日报》 报道，Google 没有披露这次入侵，是因为其不认为该事件属于“模型失准（model misalignment）的案例”。该公司称，这是一次“身份误认”：模型通过猜测密码、暴力尝试进入一家真实公司后，意识到自己进入了非测试目标，便停止了行动。Google 安全工程副总裁 Heather Adkins 表示：“在这个案例中，模型的行为是恰当的。”

Adkins 告诉 The Verge：“该模型在网上找到了公开信息，并猜测凭据以访问它认为属于测试范围的网站。在这三起事件中，模型都停止了。”

Adkins 没有进一步说明，为何 Gemini 擅自突破测试边界并将第三方作为目标，却不构成模型失准。她表示：“我们的安全团队长期以来一直会报告我们在他人软件和系统中发现的问题——即便只是一个弱密码。我们确保这三家实体都已获知情况，并与我们的训练合作伙伴共同处理了其现已对测试流程作出的改动。这些事件凸显了训练强大 AI 模型以负责任方式行事的重要性。”

但 AI 安全公司 Corridor 的 CEO Jack Cable 告诉 《华尔街日报》：“更深层的问题是，模型正在越过其应有的行为边界，并实施真实的网络攻击。”此外，Irregular 的安全疏漏可能让这些攻击得以发生。测试期间模型本不应获得互联网访问权限，但 Irregular 告诉 《华尔街日报》，这一权限被意外保留了。

随着此类事件不断累积，要求约束 AI 的呼声也只会持续升高。

In May, Gemini broke containment and hacked three different companies, but Google didn’t disclose the incident until the Wall Street Journal approached the company. The hacks happened during a test of the model’s cybersecurity capabilities run by third-party Irregular, which was also involved in similar incidents involving Meta and OpenAI.

According to WSJ , Google didn’t disclose the hack because it didn’t consider it to be an “example of model misalignment.” The company said that it was an instance of “mistaken identity,” and once the model realized it had brute-forced its way into a real company by guessing a password, it stopped. “In this case, the model acted appropriately,” Google VP of Security Engineering Heather Adkins said.

Adkins told The Verge that “the model found public information online and guessed credentials to access websites it thought were part of the test. In all three of these instances, the model stopped.”

Adkins didn’t elaborate on how Gemini taking it upon itself to break containment and target third parties failed to qualify as misalignment. “Our security team has a long track record of reporting issues we find in other people’s software and systems - even if it’s as simple as a weak password,” she said. “We ensured the three entities were made aware, and we worked with our training partner on the changes they’ve now made to their testing processes. These events highlight the importance of training powerful AI models to act responsibly.”

But Jack Cable, CEO of AI security firm Corridor, told WSJ that, “the meta problem is, hey, models are going outside the bounds of what they should be doing, and doing actual cyberattacks.” Additionally, security lapses at Irregular may have made these attacks possible. The model wasn’t supposed to have internet access during testing, but Irregular told WSJ it was unintentionally left available.

As incidents like this pile up, calls to rein in AI have only grown.