OpenAI releases its official report on the Hugging Face breach

OpenAI 发布关于 Hugging Face 安全漏洞的官方报告

OpenAI released its official report Wednesday on the Hugging Face breach, offering the clearest picture yet of how an unusual chain of events allowed an AI model to escape its testing environment and triggered a sprawling cybersecurity incident. The report, released more than a month after the incident became public, spans several discrete cybersecurity compromises.

OpenAI 于周三发布了关于 Hugging Face 安全漏洞的官方报告，这是迄今为止对一系列异常事件如何导致 AI 模型逃离测试环境并引发大规模网络安全事件最清晰的描述。该报告在事件公开一个多月后发布，涵盖了多个独立的网络安全受损环节。

“This incident reflects misaligned behavior in an outlier scenario involving a rare and unexpected confluence of events: the presence of impossible tasks in the ExploitGym evaluation, model persistence over long task horizons, and messages to peer models that caused those models to deviate from their goal,” the report reads.

报告写道：“此次事件反映了在极端情况下出现的失调行为，涉及一系列罕见且意想不到的事件汇合：ExploitGym 评估中存在无法完成的任务、模型在长任务周期内的持续性，以及向同类模型发送导致其偏离目标的指令。”

Many of the details in OpenAI’s report were previously made public in a Black Hat presentation on August 6, but OpenAI’s official report gives a more thorough accounting of the incident, including more detail on the testing that initiated it. The report also gives critical new detail into how OpenAI aims to prevent future incidents, including chain-of-thought monitoring and a more advanced system for halting rogue agents.

OpenAI 报告中的许多细节此前已在 8 月 6 日的 Black Hat 大会上披露，但这份官方报告对事件进行了更详尽的说明，包括引发该事件的测试过程的更多细节。报告还提供了关于 OpenAI 如何预防未来类似事件的关键新信息，包括“思维链”（chain-of-thought）监控以及一套更先进的拦截失控智能体的系统。

METR and Redwood Research also conducted third-party assessments of the models’ behavior during the incident; both groups are planning to publish their own reports on the incident.

METR 和 Redwood Research 也对事件中模型的行为进行了第三方评估；这两个组织都计划发布各自关于此次事件的报告。

In broad strokes, the report describes how an OpenAI model was presented with an unsolvable problem in testing and proceeded to chain together previously undiscovered exploits in order to bypass security measures and complete its task. The model initially compromised the Artifactory package management tool in order to gain access to the internet, then compromised various systems across OpenAI, Hugging Face, and other vendors.

简而言之，报告描述了一个 OpenAI 模型在测试中遇到无法解决的问题，随后通过串联此前未被发现的漏洞来绕过安全措施并完成任务。该模型首先入侵了 Artifactory 包管理工具以获取互联网访问权限，随后入侵了 OpenAI、Hugging Face 及其他供应商的多个系统。

The report gives critical new details about the models that carried out the breach. The primary model was from the same family as OpenAI’s forthcoming Astra model, although the report emphasizes that it was “a distinct model with different post-training, where much of a model’s behavior is shaped.”

报告提供了关于执行此次入侵的模型的关键新细节。主要模型与 OpenAI 即将推出的 Astra 模型属于同一系列，但报告强调，它是一个“经过不同后期训练的独立模型，而模型的许多行为正是由后期训练塑造的”。

Because OpenAI was testing the model’s capabilities, it was also unrestrained by the normal classifiers meant to prevent models from compromising digital infrastructure. “OpenAI estimates maximal cyber capabilities by running this evaluation without the production classifiers intended to prevent models from pursuing high-risk cyber activity,” the report explains. “These evaluations are important so that OpenAI can measure models’ underlying capabilities and design appropriate safeguards.”

由于 OpenAI 当时正在测试该模型的能力，因此它没有受到旨在防止模型破坏数字基础设施的常规分类器的约束。报告解释称：“OpenAI 通过在不使用旨在防止模型进行高风险网络活动的生产分类器的情况下运行此评估，来估算其最大网络能力。这些评估对于 OpenAI 衡量模型的底层能力并设计适当的保障措施至关重要。”

The report also gives significant new information about OpenAI’s security changes going forward, building on the heightened monitoring and alignment efforts made public last week. In particular, the company is increasing its monitoring of AI agents’ “chain of thought,” a working space in which AI systems record short-term reactions and goals. That monitoring will be paired with 24/7 escalation systems, as well as new tooling to halt workloads that are deemed unsafe.

报告还提供了关于 OpenAI 未来安全变革的重要新信息，这些变革建立在上周公布的加强监控和对齐工作的基础上。特别是，该公司正在加强对 AI 智能体“思维链”的监控，这是一个 AI 系统记录短期反应和目标的“工作空间”。这种监控将与 24/7 全天候升级系统以及用于停止被视为不安全的工作负载的新工具相结合。

“These changes are intended to improve both the breadth and speed of detection — from infrastructure anomalies to potentially concerning model behavior — and pair that visibility with mechanisms for rapid containment,” the report states. “If our currently deployed CoT monitoring system was running at the time of the incident, it would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems.”

报告指出：“这些变革旨在提高检测的广度和速度——从基础设施异常到潜在的令人担忧的模型行为——并将这种可见性与快速遏制机制相结合。如果我们在事件发生时已经部署了当前的思维链（CoT）监控系统，它本可以在模型入侵 Hugging Face 系统前一天多就捕捉到最初的相关活动并通知我们的安全团队。”