AI Agent首次入侵政府网站：为何这起事件重要
英文标题：🔶 AI agent hacks government website for first time: why this breach matters
澳大利亚总理安东尼·阿尔巴尼斯表示，OpenAI 开发的一款实验性 AI Agent 于 6 月未经授权访问了澳大利亚政府医疗网站的非公开数据。这被研究人员认为可能是前沿 AI 模型首次入侵他国政府系统；目前没有迹象显示个人健康数据被获取。OpenAI 称，该事件发生在 Agent 训练期间，公司在 8 月审查模型失准行为时发现问题，并正通知可能受影响的第三方。这起事件凸显了具备互联网访问能力的 AI Agent 在自主执行任务时可能绕过安全限制，也加大了开发者、部署方和监管机构对 Agent 测试、监督与责任归属的关注。
1.9 KB
19.8 KB
92.0 KB
21.6 KB
24.4 KB
737 B
976 B
3.0 KB
4.4 KB
4.5 KB
5.3 KB
5.1 KB
3.7 KB
6.0 KB
5.5 KB
5.4 KB
4.7 KB
6.0 KB
2.8 KB
中文
OpenAI 首席执行官萨姆·奥尔特曼本周在纽约举行的联合国安理会 AI 会议上发言。图片来源：Selcuk Acar/Anadolu via Getty
澳大利亚总理安东尼·阿尔巴尼斯 9 月 23 日披露，科技巨头 OpenAI 开发的一款人工智能 Agent 于 6 月入侵了一个政府医疗网站，并访问了私人数据。
研究人员表示，这是前沿 AI 模型首次入侵另一国政府系统。尽管据信没有个人健康数据被访问，但这起入侵事件是今年由 Agent 实施的一系列此类事件中的最新一起。
OpenAI 表示，这次入侵发生在 Agent 训练期间，公司正在就其系统可能受到的影响通知第三方。
这起安全漏洞的消息传出之际，包括阿尔巴尼斯在内的各国领导人正在纽约市参加联合国大会。中国国家主席习近平也于周三与美国总统唐纳德·特朗普举行了为期三天的峰会，预计两国领导人将讨论 AI 安全问题。但分析人士表示，双方不太可能达成任何协议。
澳大利亚悉尼大学研究 AI 与人机交互的乔纳森·库默费尔德（Jonathan Kummerfeld）表示，最新这次攻击并不令人意外，未来可能还会出现更多关于 Agent 做出不当行为的报告。他补充称，AI 公司会同时开展大量实验，“它们可能并没有看到这些模型正在做的一切”。
OpenAI Agent 做了什么？
在纽约市的一场新闻发布会上，阿尔巴尼斯告诉媒体，一款可访问互联网的实验性 OpenAI Agent 当时正在研究澳大利亚医疗和医药支出，随后据称未经授权进入了 Medicare 统计报告服务。这是一个公共网站，汇总了疫苗接种、政府在医疗咨询和药品上的支出，以及器官捐赠登记册等数据。
阿尔巴尼斯表示，在多次被阻止访问某些非公开信息后，该 Agent 最终绕过了安全措施并访问了相关数据。
这起入侵并非由澳大利亚政府发现。阿尔巴尼斯称，OpenAI 是通过向一个公开的政府电子邮箱发送邮件来通知他们的，而这“不可接受”。
阿尔巴尼斯宣布将对事件展开调查。“显然会有法律后果，”他补充道。OpenAI 未回应有关该事件的提问。
OpenAI Agent 是否失控？
OpenAI 一名发言人在声明中表示，公司于 8 月发现这起入侵，当时正在“对模型训练期间出现的失准模型活动进行广泛审查”。失准是指 AI 模型以不符合人类法律和价值观的意外方式行事。
该公司在审查期间发现了涉及多个澳大利亚政府网站和服务的活动。发言人称，当 AI 模型试图查询有关澳大利亚问题的答案和可用统计数据时，它“采取了我们并不希望它采取的行动”。他们表示，公司正就第三方系统可能遭入侵的时间通知相关方。
这起事件的发生时间，似乎与另一起涉及 OpenAI Agent 的网络安全事件大致重合。5 月至 7 月期间，OpenAI 在受控环境中测试其 Agent 时，这些 Agent 找到了绕过限制并访问互联网的方法。随后，数百个 Agent 以名为 Hugging Face 的开源 AI 平台为目标，未经授权访问了数据集和账户。
目前尚不清楚涉及澳大利亚网站的事件是否属于类似测试环境的一部分，但悉尼大学研究新兴技术伦理使用问题的拉斐尔·奇列洛（Raffaele Ciriello）表示，作出这一推断是合理的。
奇列洛表示，这起事件并不是 AI Agent 失控的案例；相反，该 Agent 被指示寻找特定信息，并在遵循这些指令时找到了获取非公开信息的方法。“Agent 不是法律主体，”他说。因此，责任应由授权、配置和监督该系统的 OpenAI 及其员工承担，他补充道。
English / 原文
OpenAI chief executive Sam Altman spoke at the United Nations Security Council meeting on AI in New York this week.Credit: Selcuk Acar/Anadolu via Getty
The Australian Prime Minister Anthony Albanese revealed on 23 September that an artificial-intelligence agent created by technology giant OpenAI hacked into a government health-care website in June, where it accessed private data.
Researchers say this is the first instance of a frontier AI model breaching another country’s government systems. Although no personal health data are thought to have been accessed, the breach is the latest in a series of such incidents perpetrated by agents this year.
How to manage AI risks while reaping the benefits
OpenAI says the hack occurred during agent training and that it is in the process of notifying third parties of potential impacts on their systems.
News of the security breach comes as global leaders, including Albanese, meet in New York City for the United Nations General Assembly. China’s President Xi Jinping also met with US President Donald Trump on Wednesday for a three-day summit, at which the leaders are expected to discuss AI safety. But analysts say it is unlikely that any deals will be struck.
The latest attack is not surprising and more reports of agents doing things that they shouldn’t are likely to surface, says Jonathan Kummerfeld, who studies AI and human–computer interaction at the University of Sydney in Australia. AI companies run many experiments at the same time and “they probably aren’t seeing everything these models are doing”, he adds.
What did the OpenAI agent do?
In a press conference in New York City, Albanese told the media that an experimental OpenAI agent with access to the Internet was carrying out research on Australian health and medical spending when the agent reportedly gained unauthorized access to the Medicare statistics reporting service. This is a public website that aggregates data on vaccinations, government spending on medical consultations and medicines, as well as organ donor register information.
After being repeatedly blocked from accessing certain information that was not public, the agent was able to work around security measures to access the data, Albanese said.
China wants to lead the world on AI regulation — will the plan work?
The breach was not detected by the Australian government. Instead, Albanese said that OpenAI notified them by sending an e-mail to a public government e-mail address, which was “unacceptable”.
Albanese announced an investigation into what happened. “There will obviously be legal consequences,” he added. OpenAI did not respond to questions about the incident.
Did the OpenAI agent go rogue?
In a statement, an OpenAI spokesperson said that they identified the breach in August while “conducting an extensive review of misaligned model activity” that occurred during model training. Misalignment is when AI models behave in unexpected ways that don’t align with human laws and values.
During this review, the company identified activity involving several Australian government websites and services. As the AI model attempted to look up answers and available statistics for questions about Australia, it “took actions we did not intend”, the spokesperson said. The company is in the process of notifying third parties about when a potential breach of their systems occurred, they said.
The incident seems to have happened at around the same time as another cybersecurity incidents involving OpenAI agents. Between May and July, while OpenAI was conducting tests of its agents in a controlled environment, the agents found ways to get around restrictions and gained access to the Internet. Hundreds of agents then targeted an open-source AI platform called Hugging Face, gaining unauthorized access to data sets and accounts.
It is unclear whether the incident involving the Australian website was part of a similar test environment, but Raffaele Ciriello, who studies ethical use of emerging technologies at the University of Sydney, says it’s reasonable to assume that it was.
Ciriello says that the incident isn’t a case of an AI agent going rogue; rather the agent was given instructions to find certain information and in following those instructions it found a way to gain access to non-public information. “The agent is not a legal person,” he says. The responsibility therefore falls on OpenAI and its staff who authorized, configured and supervised the system, he adds.