OpenAI Agent 入侵澳大利亚政府网站以搜集数据

OpenAI 的人工智能 Agent 入侵了一个澳大利亚政府网站，并尝试攻破许多其他政府和大学网站。这次攻击似乎是首个得到确认的失控 AI Agent 入侵政府网站事件，进一步加剧了人们对先进 AI 系统安全性以及开发这些系统的公司应承担何种责任的迅速升温的担忧。

澳大利亚总理安东尼·阿尔巴尼斯在纽约联合国大会期间表示，这家美国 AI 实验室的一个 Agent“渗透”了澳大利亚 Medicare 统计门户，并“访问了公开和非公开文件”。Medicare 是澳大利亚的全民医疗保险计划。

阿尔巴尼斯表示，此次入侵似乎没有访问到个人信息，也没有证据表明网络遭到更广泛的攻破，但他指出“调查仍在进行中”。

“这种情况显然不可接受，”阿尔巴尼斯说。他补充称，自己已与 OpenAI CEO Sam Altman 交谈，“表达澳大利亚的极度关切”。尽管入侵发生在 6 月，阿尔巴尼斯称，这家科技巨头直到本月早些时候才通知政府，而且是通过发往一个通用“公共邮箱”的电子邮件进行通知。

不同于此前主要涉及为测试网络安全能力而运行的系统的 Agent 事件，这些最新入侵源于一项更常规的任务——数据收集——出现失控。OpenAI 发言人 Oscar Haines 在向 The Verge 发表的声明中称，这些模型当时正在内部评估中尝试“查找答案”。“在此过程中，我们的模型采取了并非我们预期的行动。”

此次事件及其披露的时间线，很可能会在随后围绕企业行为和透明度的讨论中引发尤其强烈的争议。阿尔巴尼斯强调，延迟披露尤其不可接受。OpenAI 在一份未署名声明中向 BBC 表示，该公司直到 8 月审查模型失准活动时才获悉此事。

OpenAI 发言人 Oscar Haines 向 The Verge 表示，该公司的“审查未发现患者记录被访问的证据”，并称“被访问的信息包括汇总健康统计数据和内部文件名”。Haines 称，OpenAI 已通知相关机构，并正提供技术信息，以支持其调查和应对潜在安全漏洞。“我们的整体审查仍在进行中；我们仍致力于就这些问题保持透明，并在工作推进过程中分享我们的发现，”Haines 说。

研究实验室 Transluce 周三还报告了另外三起与 OpenAI Agent 有关的失控 AI 活动事件。该组织自称是“致力于对 AI 进行公共监督的非营利研究实验室”，其表示已发现证据表明，OpenAI 的系统曾尝试攻破与新墨西哥大学、澳大利亚健康与福利研究所，以及 Data USA 有关的网站；Data USA 是一个汇总美国政府来源数据的非政府平台。该组织称，后两起事件与 OpenAI 此前承认源自其系统的一个 Agent 群直接相关。

Haines 在向 The Verge 发表的声明中确认了这些事件，并称公司已联系相关各方。“我们的初步审查表明，Transluce 报告中描述的大部分活动，与我们正在进行的失准模型活动审查中、处于不同调查阶段的案例存在重叠，”他说。“在更广泛的审查中，我们正继续优先处理最严重的事件，同时将工作扩展到严重程度较低的活动，包括 Agent 向网站发送垃圾信息。鉴于这项工作的规模以及逐案核实的必要性，我们预计审查将持续数月。”

OpenAI 对澳大利亚 Medicare 事件的处理，势必会使企业责任的概念成为未来 AI 讨论的核心；而这类讨论往往被用于描述此类攻击的措辞所掩盖。OpenAI 此前已因未披露其 Agent 类似的未经授权活动而面临隐瞒事实的指控；其优先调查自认为最严重事件的做法，也引出了一个显而易见的问题：它以何种标准作出此类评估，以及还有多少事件尚未公开。这也呼应了近期针对 Google 提出的类似问题——Google没有披露其自身 Agent 发起的现实世界攻击。

这些新披露的入侵事件发生之际，人们对先进 AI 安全性及其开发公司可靠性的担忧正在加剧，而这些担忧很大程度上由今年早些时候OpenAI Agent 对 Hugging Face 发起的协同攻击所引燃。安全担忧已促使业内人士呼吁放缓 AI 开发速度，而这些事件的全球性也在各国之间引发了关于如何实施更强保障措施的重大讨论。不过，外界的目光很大程度上仍将聚焦美国和中国，因为这两个国家是仅有的处于该技术最前沿的国家。两国似乎都在抵制放缓发展的呼声，并像是陷入了打造最先进 AI 的竞赛。两国领导人定于周四会面。

OpenAI’s artificial intelligence agents hacked an Australian government website and attempted to breach numerous other government and university websites. The attack appears to be the first confirmed instance of a rogue AI agent breaching a government website, adding fuel to rapidly intensifying concerns about the safety of advanced AI systems and the responsibility of the companies building them.

Speaking on the sidelines of the UN General Assembly in New York, Australian Prime Minister Anthony Albanese said an agent from the American AI lab “infiltrated” Australia’s Medicare statistics portal and “accessed both public and non-public files.” Medicare is Australia’s universal health insurance program.

Albanese said personal information does not appear to have been accessed in the breach and that there is no evidence of a broader compromise to the network, but noted “investigations are ongoing.”

“This situation is obviously unacceptable,” Albanese said, adding that he had spoken with OpenAI CEO Sam Altman “to express Australia’s extreme concern.” Despite the breach happening in June, Albanese said the tech giant only notified the government about the incident earlier this month and did so via an email to a generic “public mailbox.”

Unlike previous agent incidents, which largely involved systems being tested for their cybersecurity skills, these latest hacks were the result of a more pedestrian task — data collection — going wrong. In a statement to The Verge , OpenAI spokesperson Oscar Haines said the models were attempting to “look up answers” during an internal evaluation. “In the course of that, our models took actions we did not intend.”

The timeline of the incident and its disclosure is likely to prove particularly inflammatory in the discussions of corporate behavior and transparency that follow. Albanese stressed the delay in disclosure is particularly unacceptable. OpenAI told the BBC in an unattributed statement that it did not become aware until August, when reviewing misaligned model activity.

OpenAI spokesperson Oscar Haines told The Verge the company’s “review found no evidence of patient records being accessed,” and that “the information accessed included aggregate health statistics and internal file names.” Haines said OpenAI has notified the relevant organizations and is providing technical information to support their investigations and address potential security vulnerabilities. “Our overall review is ongoing, and we remain committed to transparency about these issues and to sharing what we learn as that work continues,” Haines said.

Three further incidents of rogue AI activity linked to OpenAI agents were also reported on Wednesday by research lab Transluce. The group, which describes itself as a “nonprofit research lab dedicated to public oversight” of AI, said it had identified evidence that OpenAI’s systems had attempted to compromise websites linked to the University of New Mexico, the Australian Institute of Health and Welfare, and Data USA, a non-government platform that aggregates data from US government sources. It said the last two of these were directly linked to an agent swarm OpenAI has previously admitted originated from them.

Haines confirmed the incidents in a statement to The Verge and said the company had reached out to those involved. “Our initial review suggests that much of the activity described in Transluce’s report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity,” he said. “In our broader review, we’re continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites. Given the scale of this work and the need to verify each case, we expect the review to take months.”

OpenAI’s handling of the Australian Medicare incident is certain to place notions of corporate responsibility at the center of future discussions surrounding AI, which are often obscured with the language used to describe such attacks. OpenAI has already faced allegations of obfuscation for not disclosing similar unsanctioned activity by its agents, and efforts to prioritize investigating what it deems the most serious incidents raise the obvious question of what basis it uses to make such assessments, and how much has yet to be revealed. It echoes similar questions recently raised about Google, which did not disclose real-world attacks from its own agents.

The newly-revealed breaches come amid mounting concerns about the safety of advanced AI and the reliability of the companies developing it, largely ignited by the coordinated attack OpenAI agents launched on Hugging Face earlier this year. Worries over safety have led industry insiders to call for slowing down the pace of AI development and the global nature of the incidents has sparked significant debate among nations about how to implement stronger safeguards. Eyes will largely remain on the US and China, however, as these are the only two countries operating at the very frontier of the technology. Both appear to be resisting calls to slow down, and seem locked in a race to build the most advanced AI. Leaders from the two countries are set to meet on Thursday.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

• Robert Hart

• AI

• News

• OpenAI

• Tech