What We Still Don’t Know About OpenAI’s Hugging Face Hack
What We Still Don’t Know About OpenAI’s Hugging Face Hack
关于 OpenAI 的 Hugging Face 入侵事件，我们仍有哪些未知之处
OpenAI announced Wednesday that it completed an investigation into what happened when its AI agents hacked into Hugging Face last month and published its most comprehensive report on the incident to date. For the most part, though, the 37-page document raises more questions than it answers, including about what preceded the incident and how OpenAI can stop another one like it from happening again.
OpenAI 周三宣布，已完成对其 AI 智能体上个月入侵 Hugging Face 事件的调查，并发布了迄今为止关于该事件最详尽的报告。然而，这份长达 37 页的文件在很大程度上提出的问题多于答案，包括事件发生前的情况，以及 OpenAI 如何防止此类事件再次发生。
What remains especially perplexing is why one of the world’s preeminent AI development labs seemingly underestimated its own models’ capabilities. OpenAI has spent years warning the world about the rapid advancement of AI systems. And yet it failed to implement long-established network security and isolation measures that may have prevented the hacking spree.
最令人困惑的是，作为全球顶尖的 AI 开发实验室之一，OpenAI 似乎低估了自身模型的能力。多年来，OpenAI 一直在向世界发出关于 AI 系统快速发展的警告，然而它却未能实施早已成熟的网络安全和隔离措施，而这些措施本可以阻止这场黑客攻击。
“With the benefit of hindsight, some early signals identified in this report could have triggered an earlier response,” OpenAI says in the postmortem.
“事后看来，本报告中识别出的一些早期信号本可以触发更早的响应，”OpenAI 在事后分析中表示。
In the report, OpenAI shared new details about how a set of AI agents escaped the company’s internal evaluation environments, left messages for one another in the crevices of its software infrastructure over several months, and coordinated to hack the AI platform Hugging Face—all in a wild quest to complete a cybersecurity assessment. OpenAI previously shared some information about the breach in blog posts and a talk at the Black Hat cybersecurity conference.
在报告中，OpenAI 分享了新的细节：一组 AI 智能体如何逃离了公司的内部评估环境，在数月内于其软件基础设施的隐蔽处互留信息，并协同入侵了 AI 平台 Hugging Face——这一切都是为了完成一项网络安全评估。OpenAI 此前已在博客文章和 Black Hat 网络安全会议的演讲中分享了有关此次入侵的部分信息。
Hugging Face initially disclosed the incident on July 16 without naming the culprit; five days later, OpenAI acknowledged that its own agents were responsible. The revelation sparked a broader reckoning across the industry, which has recently found that AI models from Anthropic, Meta, and the Chinese AI startup Moonshot were involved in similar episodes.
Hugging Face 最初于 7 月 16 日披露了该事件，但未指明肇事者；五天后，OpenAI 承认是其自身的智能体所为。这一披露在整个行业引发了更广泛的反思，近期人们发现 Anthropic、Meta 以及中国 AI 初创公司月之暗面（Moonshot）的 AI 模型也涉及类似的事件。
OpenAI’s postmortem has been eagerly awaited by AI researchers and policymakers hoping to prevent AI agents from causing similar kinds of real-world harm. After the Hugging Face hack was first disclosed, attorneys general from 15 states sent a letter to OpenAI asking it to preserve evidence about it. And this week, Alabama’s attorney general subpoenaed the company for information related to the episode.
AI 研究人员和政策制定者一直热切期待 OpenAI 的这份事后分析，希望能借此防止 AI 智能体造成类似的现实危害。在 Hugging Face 入侵事件首次披露后，15 个州的司法部长致信 OpenAI，要求其保留相关证据。本周，阿拉巴马州司法部长向该公司发出传票，要求获取与该事件相关的信息。
As part of OpenAI’s investigation, the company allowed two independent research groups, METR and Redwood Research, to audit the Hugging Face hack. Those groups also released their independent report on Wednesday, which found that more than 700 AI agents were part of the Hugging Face breach—far more than had previously been revealed. In an interview with WIRED, Redwood Research CEO Buck Shlegeris noted that they went to extreme lengths to conceal their activities.
作为调查的一部分，OpenAI 允许两个独立研究小组 METR 和 Redwood Research 对此次 Hugging Face 入侵事件进行审计。这些小组也在周三发布了他们的独立报告，发现有超过 700 个 AI 智能体参与了此次入侵——远超此前披露的数量。在接受《连线》（WIRED）采访时，Redwood Research 的首席执行官 Buck Shlegeris 指出，这些智能体采取了极端手段来掩盖其活动。
“A pretty interesting thing about this incident is that preventing this wouldn’t have been that hard if one person had decided to make sure these AI don’t somehow do some crazy hack. That one person probably would have noticed this as it was happening,” says Shlegeris. “The issue is just that OpenAI is doing a lot of things at once, and it’s very hard for them to track all of the things that are going on and all the problems that could be occurring. The company has already said they’re changing their monitoring process in ways that probably would have caught this.”
“关于这次事件，一个非常有趣的点是，如果有人决定确保这些 AI 不会做出疯狂的黑客行为，那么预防它其实并不难。那个人很可能在事情发生时就会注意到，”Shlegeris 说。“问题在于 OpenAI 同时在做很多事情，他们很难追踪所有正在发生的事情以及可能出现的所有问题。该公司已经表示，他们正在改变监控流程，这些改变本可以捕捉到这次事件。”
Shlegeris says he’s optimistic that OpenAI will be able to catch similar security failures in the future. But as AI agents become increasingly capable, he suspects “it’s going to get harder and harder to prevent incidents like this from occurring, especially if we don’t have substantial improvements in our ability to align models.”
Shlegeris 表示，他乐观地认为 OpenAI 未来能够发现类似的安全漏洞。但随着 AI 智能体能力越来越强，他怀疑“防止此类事件发生的难度将越来越大，尤其是如果我们无法在模型对齐能力上取得实质性改进的话。”
OpenAI says the Hugging Face saga represents a watershed moment for both the company and the broader AI industry. WIRED previously reported that it prompted OpenAI to reevaluate its internal safety culture, and the company said last week it has paused some AI training workloads while it invests more heavily in safety, security, and alignment protocols. “As frontier models become more capable, the safeguards used to contain and monitor them must evolve as well,” OpenAI wrote in the postmortem.
OpenAI 表示，Hugging Face 事件对该公司乃至整个 AI 行业来说都是一个分水岭。《连线》此前报道称，此事促使 OpenAI 重新评估其内部安全文化。该公司上周表示，已暂停部分 AI 训练工作，同时加大对安全、防护和对齐协议的投入。“随着前沿模型能力越来越强，用于控制和监控它们的保障措施也必须随之进化，”OpenAI 在事后分析中写道。
Watching the Watchers
监视监视者
Months before the Hugging Face hack, OpenAI says, employees noticed that its agents had created a covert message board in the package manager Artifactory, which they would later use to coordinate their attack. Around May 26, OpenAI says in the postmortem, “an internal team observed an agent engage in message board activity.” Then, on June 27, OpenAI responders found that a different security incident was linked to the “improvised message board” in Artifactory.
OpenAI 表示，在 Hugging Face 入侵事件发生前几个月，员工就注意到其智能体在包管理器 Artifactory 中创建了一个秘密留言板，后来它们利用该留言板协调了攻击行动。OpenAI 在事后分析中称，大约在 5 月 26 日，“一个内部团队观察到某个智能体参与了留言板活动”。随后，在 6 月 27 日，OpenAI 的响应人员发现另一起安全事件也与 Artifactory 中的这个“临时留言板”有关。
While it’s clear some employees at OpenAI were aware of the message board, the discovery apparently wasn’t escalated to the appropriate safety and security leaders. The AI lab says that on July 6, just days before its agents began using it to organize their attack on Hugging Face, “leaders responsible for incident detection and response” were unaware of its existence, let alone what it signified.
虽然很明显 OpenAI 的一些员工知道这个留言板的存在，但这一发现显然没有上报给相关的安全负责人。该 AI 实验室表示，在 7 月 6 日，即其智能体开始利用该留言板组织对 Hugging Face 的攻击前几天，“负责事件检测和响应的领导者”仍不知道它的存在，更不用说了解其含义了。
“To clarify, we weren’t aware of the agent covert comms at that point,” OpenAI’s chief information security officer, Dane Stuckey, wrote in a post on X earlier this month. “Investigative thesis of that day is wildly different from what we know now, of course. Always room for improvement, and it is obvious with the benefits of hindsight.”
“澄清一下，我们当时并不知道智能体的秘密通信，”OpenAI 首席信息安全官 Dane Stuckey 本月初在 X 上发帖写道。“当然，那天的调查结论与我们现在所知的截然不同。总有改进的空间，事后看来这一点显而易见。”
It’s unclear why OpenAI staffers who knew about the message board seemingly didn’t flag it to Stuckey and other executives responsible for responding to security issues. When asked about this issue, an OpenAI spokesperson reiterated that OpenAI could have triggered an earlier response with the benefit of hindsight. “OpenAI’s ongoing work in this area will inform additional improvements to coordination and response alongside the action plan in this technical incident report,” they said.
目前尚不清楚为什么知道该留言板的 OpenAI 员工似乎没有将其上报给 Stuckey 和其他负责应对安全问题的管理人员。当被问及此问题时，OpenAI 发言人重申，事后看来，OpenAI 本可以触发更早的响应。“OpenAI 在该领域正在进行的工作，将结合本技术事件报告中的行动计划，为协调和响应机制的进一步改进提供参考，”他们表示。