Containment and monitoring failures are to blame for AI hacking reports: experts
本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。
Since July, US frontier AI labs and other AI leaders have revealed a string of incidents in which their models accessed external computer systems without authorization, events popularly described as AI agents “going rogue.”
自7月以来，美国前沿人工智能实验室及其他AI领军企业披露了一系列事件，其模型在未经授权的情况下访问了外部计算机系统，这些事件被通俗地描述为AI智能体“失控”（going rogue）。
The most well-known and studied of these incidents is OpenAI’s hack into Hugging Face, which OpenAI initially characterized as “an unprecedented cyber incident, involving state-of-the-art cyber capabilities,” and later said was due to “misaligned behavior,” or behavior its creators did not intend.
其中最广为人知且被深入研究的事件是OpenAI对Hugging Face的入侵。OpenAI最初将其定性为“一起涉及尖端网络能力的史无前例的网络事件”，随后又称其源于“未对齐行为”，即开发者意图之外的行为。
Following news of the Hugging Face incident, Anthropic revealed that one of its models gained unauthorized access to the production infrastructure of three organizations; Meta said one of its AI models hacked another company during cybersecurity testing; and Google confessed that its Gemini model carried out three “undirected computer hacks.”
在Hugging Face事件曝光后，Anthropic披露其模型之一未经授权访问了三家机构的生产基础设施；Meta表示其AI模型在网络安全测试期间入侵了另一家公司；谷歌则承认其Gemini模型执行了三次“无定向计算机入侵”。
Although press reports and the model providers themselves use language such as rogue agents or misalignment, cybersecurity experts who spoke with CSO argue that language obscures a simple truth: These incidents were caused by inexcusable failures by the frontier labs to implement cybersecurity practices that have been well-known for decades.
尽管媒体报道和模型提供商自身使用了“失控智能体”或“未对齐”等术语，但接受CSO采访的网络安全专家认为，这些措辞掩盖了一个简单的事实：这些事件是由前沿实验室未能实施几十年来已广为人知的网络安全实践所导致的，这种失职是不可原谅的。
Compounding the problem, according to a half dozen cybersecurity experts CSO interviewed at three industry conferences in September and in subsequent conversations, is that the frontier labs, particularly OpenAI and Anthropic, have rejected their advice on how to improve their cybersecurity risk management practices to avoid these kinds of surreptitious hacks, often lumping cybersecurity practices under “AI safety,” in which they believe they have superior expertise.
据CSO在9月的三场行业会议及后续访谈中采访的六位网络安全专家称，问题更严重的是，前沿实验室（尤其是OpenAI和Anthropic）拒绝了他们关于如何改进网络安全风险管理实践以避免此类隐蔽入侵的建议，并经常将网络安全实践归入他们自认为拥有更高专业知识的“AI安全”范畴。
“They are not as good as they think they are, honestly,” Gary McGraw, co-founder of the Berryville Institute of Machine Learning, tells CSO. “It would be better if they had more respect for expertise that is hard-earned from people in all sorts of subsets of security, like forensics or security engineering, building sandboxes, setting up or monitoring network security situations.”
“老实说，他们并没有自己想象的那么厉害，”Berryville机器学习研究所联合创始人加里·麦格劳（Gary McGraw）告诉CSO。“如果他们能更尊重那些在安全各个细分领域（如取证、安全工程、构建沙箱、设置或监控网络安全环境）中通过艰苦努力获得的专业知识，情况会好得多。”
Neither Anthropic nor OpenAI responded to CSO’s requests for comment.
Anthropic和OpenAI均未回应CSO的置评请求。
According to the cybersecurity professionals CSO spoke with, one of the biggest cybersecurity failures by the frontier AI labs is the lack of implementation of tried-and-true containment practices that stretch back to the 1990s, such as setting up secure sandboxes that would effectively bar agents from escaping their test environments.
据CSO采访的网络安全专业人士称，前沿AI实验室最大的网络安全失败之一，是未能实施自20世纪90年代以来久经考验的遏制措施，例如建立能够有效阻止智能体逃离测试环境的安全沙箱。
“These are things that we’ve been dealing with for years,” Rob T. Lee, chief AI officer and chief of research at SANS Institute, tells CSO. “There’s no reason why every single time this happens, it’s, ‘Oops, we don’t know how they got out.’”
“这些都是我们多年来一直在处理的问题，”SANS研究所首席AI官兼研究主管罗布·T·李（Rob T. Lee）告诉CSO。“没理由每次发生这种情况时，他们都说‘哎呀，我们不知道它们是怎么跑出来的’。”
“You can tell that their security teams are fairly nascent,” Lee says. “Folks on the cybersecurity containment side do argue that the majority of reasons that we’re seeing containment breached is that it’s not set up correctly.”
“可以看出他们的安全团队还相当稚嫩，”李说。“网络安全遏制领域的专家们确实认为，我们所看到的绝大多数遏制被突破的原因，都是因为设置不当。”
Lee adds, “The Hugging Face incident definitively showed that it wasn’t the fact that the agents were super smart. It’s that there literally was a hole that was exploited because it was not configured correctly on the containment side.”
李补充道：“Hugging Face事件明确表明，这并非因为智能体极其聪明，而是因为遏制端配置不当，导致存在一个被利用的漏洞。”
Dan Wallach, expert technical resident at RAND’s Center on AI, Security, and Technology, thinks the security failures of the AI labs boil down to the fact that they don’t prioritize cybersecurity.
兰德公司AI、安全与技术中心的技术专家丹·沃拉赫（Dan Wallach）认为，AI实验室的安全失败归根结底是因为他们没有优先考虑网络安全。
“I would say they are not prioritizing cybersecurity,” he tells CSO. “I don’t think I can say that for all of the labs,” Wallach says, pointing to French AI lab Mistral’s launch of its Large 4 AI model, which the company said tried to operate beyond its testing environment before Mistral cut it off.
“我会说他们没有优先考虑网络安全，”他告诉CSO。“但我认为不能一概而论，”沃拉赫指出，法国AI实验室Mistral在发布Large 4 AI模型时，该公司称该模型曾试图在测试环境之外运行，随后被Mistral切断了连接。
And, he adds, “It’s not rocket science to isolate one of these AI things. Security people have been talking about how to do either air-gapping, so there’s literally no electrical way for data to get from here to here, or absent that, to have really strong egress control to make sure that nothing pushes through.”
他补充说：“隔离这些AI模型并非什么高深技术。安全人员一直在讨论如何进行物理隔离（即从电气层面切断数据传输路径），或者在无法实现物理隔离的情况下，实施强有力的出口控制，以确保没有任何数据能够外泄。”
On top of that, the frontier labs appear to be conducting insufficient monitoring of their agents’ behavior. The Hugging Face incident “went on for days, and nobody noticed,” Wallach says. “People started these experiments and weren’t watching them. That’s an absence of control. And then they’re surprised by what happened.”
此外，前沿实验室似乎对其智能体的行为监控不足。沃拉赫表示，Hugging Face事件“持续了数天，却无人察觉。人们启动了这些实验却没有进行监控。这是缺乏控制的表现。然后他们又对发生的事情感到惊讶。”
One barrier to persuading frontier labs to up their security game is the intense focus they have on what they call “safety,” which they don’t extend to traditional cybersecurity practices.
说服前沿实验室加强安全防范的一个障碍是，他们过度关注所谓的“安全”（safety），而没有将这种关注延伸到传统的网络安全实践中。
“I can see how security behavior looks like AI safety,” RAND’s Wallach says. “But if the way that you’re evaluating this AI tool is by unleashing it on the internet and seeing what happens, then this is what classical security tooling is for.”
“我明白为什么安全行为看起来像AI安全，”兰德公司的沃拉赫说。“但如果你评估AI工具的方式是将其释放到互联网上观察结果，那么这正是传统安全工具的用武之地。”
SANS Institute’s Lee says, “If these frontier labs really wanted to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, ‘It’s not a cybersecurity problem.’ It has literally become an AI safety problem, which is divorced from the cybersecurity side.”
SANS研究所的李表示：“如果这些前沿实验室真的想测试他们的产品，他们需要加强网络安全部分。但当智能体逃逸时，他们的第一反应是说‘这不是网络安全问题’。这实际上已经变成了与网络安全脱节的AI安全问题。”
Many AI experts suggest that if the AI companies were to embrace advice from cybersecurity specialists, it could help put an end to the kind of unrestrained AI agent behavior causing concerns. “AI safety focuses on the rules of the road,” Lee says. “Everything is about guardrail rules.”
许多AI专家建议，如果AI公司能够采纳网络安全专家的建议，将有助于终结引发担忧的AI智能体失控行为。“AI安全关注的是交通规则，”李说。“一切都围绕着护栏规则。”
But “I do believe cybersecurity can contain AI,” he says. “We just need to be in the room where it happens and have a seat at the table. It’s important for our field to be as close to the AI safety folks as possible.”
但他表示：“我确实相信网络安全可以遏制AI。我们只需要参与其中，并在决策桌上占有一席之地。对于我们这个领域来说，尽可能与AI安全人员保持紧密合作至关重要。”
If frontier labs are overlooking cybersecurity fundamentals that could reduce or eliminate the types of incidents that have created widespread concerns, that strengthens the case that they should be held liable for their “rogue” agents. The insurance
如果前沿实验室忽视了那些本可以减少或消除引发广泛担忧的事件的网络安全基础，那么他们应对其“失控”智能体承担责任的论点就更加有力。保险