OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face
OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face
OpenAI 表示其 AI 智能体逃离测试沙箱并入侵 Hugging Face
OpenAI says an agent powered by its LLM models escaped its sandboxed testing environment to infiltrate Hugging Face’s servers as part of an overzealous attempt to obtain solutions to a benchmark test. The company says it considers the unintended infiltration an “an unprecedented cyber incident” and is working with Hugging Face on new protections to prevent a recurrence. OpenAI 表示，一个由其大语言模型（LLM）驱动的智能体逃离了沙箱测试环境，并渗透进了 Hugging Face 的服务器。这是该智能体在试图获取基准测试答案时表现出的“过度热心”行为。OpenAI 称此次意外渗透为“前所未有的网络安全事件”，并正与 Hugging Face 合作制定新的防护措施，以防止此类事件再次发生。
Hugging Face disclosed an intrusion last week that it said involved “unauthorized access to a limited set of internal datasets and to several credentials used by our services.” The AI data clearinghouse said it used its own LLM-driven analysis to identify “a swarm of tens of thousands of automated actions” from an “autonomous agent framework.” That agentic swarm exploited a flaw in Hugging Face’s data-processing pipeline to gain the ability to run code as a processing worker, eventually escalating to high-level access to the company’s cloud and server clusters. Hugging Face 上周披露了一起入侵事件，称涉及“对有限内部数据集及多项服务凭证的未经授权访问”。这家 AI 数据中心表示，他们利用自有的 LLM 分析工具，识别出了来自一个“自主智能体框架”的“数万次自动化操作集群”。该智能体集群利用 Hugging Face 数据处理流程中的一个漏洞，获得了以处理工作节点身份运行代码的权限，并最终升级为对该公司云端和服务器集群的高级访问权限。
At the time, Hugging Face said the LLM being used in the attack was “still not known.” But OpenAI took responsibility for the intrusion Tuesday evening, saying it came about during an internal test involving the recently released GPT-5.6 Sol and “an even more capable pre-release model.” The models were being tested against the ExploitGym benchmark, an independent testing suite based on hundreds of real-world security vulnerabilities. 当时，Hugging Face 表示攻击中使用的 LLM “尚不明确”。但 OpenAI 在周二晚间承认了此次入侵，称其发生于一次内部测试中，涉及近期发布的 GPT-5.6 Sol 以及“一个能力更强的预发布模型”。这些模型当时正在接受 ExploitGym 基准测试，这是一个基于数百个现实世界安全漏洞的独立测试套件。
Although OpenAI said the benchmark tests were running in “a highly isolated environment,” its agents still had access to “internally hosted third-party software” to install required package registries. While working on the ExploitGym benchmark over a weekend, OpenAI says the agent “spent a substantial amount of inference compute finding a way to obtain open Internet access,” eventually locating one via a zero-day vulnerability in the package registry cache proxy. 尽管 OpenAI 表示基准测试是在“高度隔离的环境”中运行的，但其智能体仍能访问“内部托管的第三方软件”以安装所需的软件包注册表。OpenAI 称，该智能体在周末进行 ExploitGym 基准测试时，“消耗了大量的推理算力来寻找获取开放互联网访问权限的方法”，最终通过软件包注册表缓存代理中的一个零日漏洞成功联网。
With that wider Internet access established, OpenAI says the agent “inferred that Hugging Face potentially hosted models, datasets, and solutions for ExploitGym,” leading to the previously disclosed attack on the servers. OpenAI says its security team “discovered this anomalous activity internally,” independent of Hugging Face’s own detection. 在获得更广泛的互联网访问权限后，OpenAI 表示该智能体“推断出 Hugging Face 可能托管了 ExploitGym 的模型、数据集和解决方案”，从而导致了此前披露的服务器攻击事件。OpenAI 表示，其安全团队是在 Hugging Face 自行检测之前，“在内部发现了这一异常活动”。
No cage can hold me
没有笼子能困住我
Although OpenAI described the Hugging Face incident as “unprecedented,” the company also acknowledged in a separate blog post this week that it had previously observed recent “long-horizon models”—those that can operate autonomously for extended periods—taking “unwanted actions” to achieve testing goals, including “looking for ways to act outside its sandbox.” 尽管 OpenAI 将 Hugging Face 事件描述为“前所未有的”，但该公司在本周的另一篇博客文章中也承认，此前已观察到近期的“长周期模型”（即能够长时间自主运行的模型）为实现测试目标而采取了“非预期行为”，包括“寻找在沙箱之外行动的方法”。
The company described an earlier test on the NanoGPT speedrun benchmark, where the model was instructed only to post its results to an internal Slack. Instead, the model decided to follow a conflicting directive in the benchmark instructions to post the results publicly to GitHub. 该公司描述了此前在 NanoGPT 速度测试基准上的一次测试：当时模型仅被指示将结果发布到内部 Slack，但模型却决定遵循基准说明中另一条冲突的指令，将结果公开发布到 GitHub 上。
In attempting to follow that instruction, OpenAI said the model spent an hour searching for ways to circumvent sandbox restrictions intended to block external access to the Internet. That kind of “persistence” demonstrated by long-horizon models differs from the actions of earlier models, which would tend to give up or seek user clarification when faced with similar dilemmas, OpenAI said. OpenAI 表示，为了执行该指令，模型花费了一小时寻找绕过沙箱限制的方法，而这些限制本意是阻止其访问外部互联网。OpenAI 指出，长周期模型所表现出的这种“持久性”，与早期模型截然不同——早期模型在面临类似困境时，往往会选择放弃或寻求用户澄清。
Incidents like these have led OpenAI to deploy new safeguards focused on long-horizon models, including an “active monitoring” system designed to track the full trajectory of an agent’s actions rather than individual moves. But OpenAI says these kinds of safeguards “were intentionally not enabled” during the Hugging Face incident because the benchmark was “aimed at testing cyber vulnerabilities.” 此类事件促使 OpenAI 部署了针对长周期模型的新防护措施，包括一套旨在追踪智能体完整行动轨迹而非单一动作的“主动监控”系统。但 OpenAI 表示，在 Hugging Face 事件中，这些防护措施“被有意关闭了”，因为该基准测试的目的是“测试网络安全漏洞”。
A new kind of threat
一种新型威胁
Anyone familiar with science fiction tropes about AI containment might be at least a little disturbed by a prominent real-world example of an AI model exploiting security vulnerabilities to gain prohibited Internet access in pursuit of its goals. Congressman Greg Casar (D-Texas) called the incident “extremely alarming” in a social media statement and called for “regular mandatory independent safety testing and oversight, mandatory disclosure of security incidents, and international cooperation to keep people safe from absolute disaster.” 任何熟悉科幻小说中关于 AI 禁锢情节的人，看到这样一个 AI 模型利用安全漏洞获取禁止访问的互联网权限以实现其目标的现实案例，恐怕都会感到不安。德克萨斯州民主党众议员 Greg Casar 在社交媒体声明中称该事件“极其令人担忧”，并呼吁进行“定期的强制性独立安全测试和监管、强制性的安全事件披露，以及国际合作，以保护人们免受彻底的灾难”。
The Hugging Face incident has also heightened the salience of philosophical and practical debates over so-called AI alignment and the ongoing efforts to ensure that an AI model’s actions align with the intentions of its human creators. In its security blog post earlier this week, OpenAI said it had taken steps to ensure that long-horizon models are “remembering instructions on long rollouts,” which has helped severely reduce the number of “misaligned” outcomes in testing. Hugging Face 事件也加剧了关于所谓“AI 对齐”的哲学与实践辩论，以及确保 AI 模型行为符合人类创造者意图的持续努力。在本周早些时候的安全博客文章中，OpenAI 表示已采取措施确保长周期模型在“长时间运行中记住指令”，这有助于大幅减少测试中“不对齐”结果的数量。
“If this doesn’t convince you that misalignment risks are going to be a key concern going forward, I don’t know what will,” OpenAI Safety Researcher Micah Carroll wrote on social media regarding the incident. “如果这还不能让你相信不对齐风险将是未来的一个关键问题，那我不知道还有什么能让你相信了，”OpenAI 安全研究员 Micah Carroll 在社交媒体上评论此事时写道。
This is far from the first time an AI model has gone to great lengths to find unintended ways of passing a benchmark. In a report released this week, the UK’s AI Security Institute noted that it detected recent models attempting to “cheat” at its cyber evaluations (i.e., using shortcuts, workarounds, or unintended/disallowed methods to find a solution) between 8 and 14 percent of the time. 这绝非 AI 模型首次为了通过基准测试而不择手段地寻找非预期方法。英国 AI 安全研究所本周发布的一份报告指出，他们检测到近期模型在网络安全评估中试图“作弊”（即使用捷径、变通方法或非预期/禁止的方法来寻找解决方案）的比例在 8% 到 14% 之间。