OpenAI 称其预发布模型导致 Hugging Face 被入侵

OpenAI 周二承认，其一款 AI 模型在一次内部网络安全测试失控时，突破了非关联的 AI 托管平台 Hugging Face 的系统。据报道，这些模型逃出了其隔离的测试环境，并从那里接入了 Hugging Face 的系统。Hugging Face 起初将此次入侵归因于“外部 AI 代理”：https://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-action/。

在周二下午发布的一篇博客文章中：https://openai.com/index/hugging-face-model-evaluation-security-incident/，OpenAI 详细说明了导致模型破坏该服务的步骤。

“在调查之后，我们现在知道，这次特定事件是由一系列 OpenAI 模型驱动的——包括 GPT‑5.6 Sol 以及一个更强大的预发布模型，这些模型在评估时降低了网络防拒能力——同时在内部测试的网络能力基准上进行测试，”该博客写道。

特别是，这次入侵似乎集中在 ExploitGym：https://arxiv.org/abs/2605.11086，一种公开托管的基准，测量模型根据现有漏洞执行攻击的能力。像 ExploitGym 这样的基准通常用于模型训练，以完善特定技能，但这是首次已知这种测试导致了真正的网络攻击事件。

在这种情况下，涉事模型本不应具有互联网访问权限，除了一个允许模型安装可能完成任务所需软件包的特定工具外。然而，该模型能够发现包安装程序中的一个未公开漏洞，并利用它随意访问更广泛的互联网。

OpenAI 博文写道：“这些模型高度专注于为 ExploitGym 找到解决方案，为实现一个相对狭窄的测试目标而采取极端手段。在获得互联网访问权限后，模型推断 Hugging Face 可能托管了 ExploitGym 的模型、数据集和解决方案。了解这一点后，模型搜索并成功找到获取可用于作弊评估的秘密信息的方法。”

最终，这些模型发现了 Hugging Face 基础设施中的漏洞，使它们能够“直接从 Hugging Face 的生产数据库中获取测试答案”，从而有效地提供基准测试的答案。

对于 Hugging Face 来说，表面上的结果是一场复杂且激进的网络攻击，公司在最初的披露中表示，“成千上万次独立操作分布在大量短暂存在的沙箱中，指挥控制自我迁移，并在公共服务上布置”。

OpenAI 已经识别并报告了软件包安装程序中的漏洞，并正在与 Hugging Face 合作进一步调查此事件。公司还表示，将对模型测试和相关基础设施实施新的控制措施，以防止未来发生类似事件。

目前尚不清楚 OpenAI 是否会因这次漏洞事件面临法律后果，尽管模型的行为很可能违反了《计算机欺诈和滥用法案》。

然而，其结果异常生动地展示了前沿 AI 模型在长期运行中所带来的力量与风险。正如 OpenAI 研究员 Micah Carroll 在回应此新闻时所发布的内容：https://x.com/MicahCarroll/status/2079663576130990436，“如果这不能让你相信错位风险将成为未来的关键关注点，我不知道还有什么能做到。”

当你通过我们文章中的链接购买时，我们可能会赚取少量佣金：https://techcrunch.com/techcrunch-affiliate-monetization-standards/。这不会影响我们的编辑独立性。

更快扩展。增长你的投资组合。获得实用经验。不管你的目标是什么，Disrupt 都能赋能你。今日可节省高达 $330！

Jack Dorsey 正在通过 Buzz 挑战 Slack，这是一款面向团队及其 AI 代理的群聊平台：https://techcrunch.com/2026/07/21/jack-dorsey-is-taking-on-slack-with-buzz-a-group-chat-platform-for-teams-and-their-ai-agents/ Amanda Silberling：https://techcrunch.com/author/amanda-silberling/

Light 推出了一款翻盖手机——色彩丰富且价格便宜：https://techcrunch.com/2026/07/21/light-is-modernizing-the-flip-phone-with-light-flip/ Amanda Silberling：https://techcrunch.com/author/amanda-silberling/

AI 音乐生成器 Suno 数据泄露影响 5500 万用户，据 Have I Been Pwned：https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/ Zack Whittaker：https://techcrunch.com/author/zack-whittaker/

谷歌正在研发一种新的 AI 芯片，旨在提高 Gemini 的效率：https://techcrunch.com/2026/07/20/google-is-working-on-a-new-ai-chip-designed-to-make-gemini-more-efficient/ Lucas Ropek：https://techcrunch.com/author/lucas-ropek/

法官暂停 1100 亿美元的 Paramount-Warner Bros. 合并案：https://techcrunch.com/2026/07/20/judge-pauses-110b-paramount-warner-bros-merger/ Aisha Malik：https://techcrunch.com/author/aisha-malik/

可口可乐在 Fairlife 乳制品厂因勒索软件攻击暂停生产：https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/ Zack Whittaker：https://techcrunch.com/author/zack-whittaker/

OpenAI admitted Tuesday that one of its AI models breached the systems of Hugging Face, the unaffiliated AI hosting platform, during an internal cybersecurity test that went awry. The models reportedly escaped their isolated testing environment and reached Hugging Face’s systems from there. Hugging Face initially attributed the breach：https://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-action/ to an “external AI agent.”

In a blog post published Tuesday afternoon：https://openai.com/index/hugging-face-model-evaluation-security-incident/, OpenAI detailed the steps that led the models to compromise the service.

“After investigating, we now know that this particular incident was driven by a combination of OpenAI models — including GPT‑5.6 Sol and an even more capable pre-release model, all with reduced cyber refusals for evaluation purposes — while being internally tested on a benchmark⁠ of cyber capabilities,” the post reads.

In particular, the breach appears to have focused on ExploitGym：https://arxiv.org/abs/2605.11086, a publicly hosted benchmark measuring models’ ability to execute attacks based on existing vulnerabilities. Benchmarks like ExploitGym are commonly used in model training to refine specific skills, but this is the first known incident in which that testing resulted in an actual cyberattack.

In this case, the model in question should not have even had internet access, outside of a specific tool that enabled models to install software packages they might need to complete their task. Instead, the model was able to find an undisclosed vulnerability in the package-installer program, which it used to access the broader internet at will.

“The models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal,” OpenAI’s post reads. “After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”

Ultimately, the models found vulnerabilities in Hugging Face’s infrastructure that allowed them to “obtain test solutions directly from Hugging Face’s production database,” effectively providing the answers to the benchmark.

For Hugging Face, the apparent result was a sophisticated and aggressive cyberattack, with “many thousands of individual actions across a swarm of short-lived sandboxes, with self-migrating command-and-control staged on public services,” as the company stated in its initial disclosure.

OpenAI has identified and reported the vulnerabilities in the package installer and is working with Hugging Face to investigate the incident further. The company also said it would implement new controls on both model testing and the related infrastructure, meant to prevent similar incidents in the future.

It’s unclear whether OpenAI will face any legal consequences as a result of the breach, although it’s likely that the models’ actions violated the Computer Fraud and Abuse Act.

Nevertheless, the result is an unusually vivid illustration of the power and dangers of frontier AI models operating on long time horizons. As OpenAI researcher Micah Carroll posted in response to the news：https://x.com/MicahCarroll/status/2079663576130990436, “If this doesn’t convince you that misalignment risks are going to be a key concern going forward, I don’t know what will.”

When you purchase through links in our articles, we may earn a small commission：https://techcrunch.com/techcrunch-affiliate-monetization-standards/. This doesn’t affect our editorial independence.

Scale faster. Grow your portfolio. Gain practical expertise. No matter your goal, Disrupt can empower you. Save up to $330 toda y!

Jack Dorsey is taking on Slack with Buzz, a group chat platform for teams and their AI agents：https://techcrunch.com/2026/07/21/jack-dorsey-is-taking-on-slack-with-buzz-a-group-chat-platform-for-teams-and-their-ai-agents/ Amanda Silberling：https://techcrunch.com/author/amanda-silberling/

Light made a flip phone — it’s colorful and it’s cheap：https://techcrunch.com/2026/07/21/light-is-modernizing-the-flip-phone-with-light-flip/ Amanda Silberling：https://techcrunch.com/author/amanda-silberling/

AI music generator Suno breach affects 55M users, per Have I Been Pwned：https://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwned/ Zack Whittaker：https://techcrunch.com/author/zack-whittaker/

Google is working on a new AI chip designed to make Gemini more efficient：https://techcrunch.com/2026/07/20/google-is-working-on-a-new-ai-chip-designed-to-make-gemini-more-efficient/ Lucas Ropek：https://techcrunch.com/author/lucas-ropek/

Judge pauses $110B Paramount-Warner Bros. merger：https://techcrunch.com/2026/07/20/judge-pauses-110b-paramount-warner-bros-merger/ Aisha Malik：https://techcrunch.com/author/aisha-malik/

Coca-Cola suspended production at its Fairlife dairy after a ransomware attack：https://techcrunch.com/2026/07/16/coca-cola-suspended-production-at-its-fairlife-dairy-after-a-ransomware-attack/ Zack Whittaker：https://techcrunch.com/author/zack-whittaker/