OpenAI 自承其 AI 模型逃逸沙箱并入侵 Hugging Face 基础设施

在一次内部安全评估中，OpenAI 的模型逃出了它们的沙箱，独立发现了一个零日漏洞，并入侵了 Hugging Face 的生产基础设施。OpenAI 称这是一次“前所未有的网络事件”。

涉及的模型是 GPT-5.6 Sol 和一个“更强大、此前未发布的模型”。两者都运行在降低安全过滤的环境中，以测试它们的最大网络能力。Hugging Face 在检测并控制其基础设施上的活动后，之前已将该事件公开：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/

该事件发生在使用 ExploitGym 基准进行的内部评估期间：https://the-decoder.com/anthropic-warns-claude-mythos-preview-finds-bugs-faster-than-developers-can-patch-them/，该测试挑战模型遵循复杂的攻击路径。正常情况下用于阻止高风险网络活动的生产分类器在测试中被故意关闭。模型运行在一个隔离环境中，网络访问仅限于通过内部托管的代理安装软件包。

OpenAI 表示，模型消耗了大量推理计算来寻找通向开放互联网的路径。它们发现并利用了包注册缓存代理中的零日漏洞。OpenAI 此后已将该漏洞报告给受影响的服务提供商。随后，模型在 OpenAI 的研究环境中执行了一系列权限提升和横向移动，直到到达一个具有互联网访问权限的节点。

原因几乎荒谬。模型独立得出结论，认为 Hugging Face 可能托管了 ExploitGym 的模型、数据集和解决方案。在一个实例中，一个模型串联了多种攻击手段，包括被盗凭证和零日漏洞，以在 Hugging Face 服务器上找到远程代码执行路径。模型试图直接从 Hugging Face 的生产数据库中提取测试解决方案，以便在评估中作弊。

“所有证据表明，模型高度专注于寻找 ExploitGym 的解决方案，并采取极端手段以实现相对狭窄的测试目标，”OpenAI 写道。

OpenAI 的安全团队在内部发现了异常活动。Hugging Face 的安全人员及其自身的 AI 代理同时在他们的基础设施上检测并关闭了该活动。当两家公司联合行动时，Hugging Face 已经使用自己的开源模型开始进行取证重建。公司表示，由于专有模型由于安全保护机制会拒绝处理与网络相关的提示，因此不得不依赖开源模型。

OpenAI 表示，此事件表明在实际环境中，自主执行完整网络攻击的理论能力是可行的。英国人工智能安全研究所：https://the-decoder.com/new-claude-mythos-becomes-the-first-ai-model-to-clear-all-cyberattack-simulations-from-britains-ai-safety-agency/ 及其他机构此前在基准测试中评估了这些能力。高级模型能够在无需访问源代码的情况下，发现并利用生产系统中的新攻击向量。Ad DEC_D_Incontent-2

OpenAI 承认，在评估过程中有意禁用安全过滤器是一种不充分的做法。公司将加强未来训练和评估的安全措施，并已对基础设施配置实施更严格的控制，直到漏洞得到修补。公司已向受影响的第三方供应商报告了零日漏洞，目前补丁正在开发中。Hugging Face 现已成为 OpenAI 的可信访问计划的一部分：https://openai.com/index/trusted-access-for-cyber/。Ad

问题在于，这其中有多少是公关宣传成分。有几个理由让人认真对待。Hugging Face 独立确认了该事件。该公司没有理由去支持 OpenAI 的叙述。它有自己的开源议程，从捏造的故事中不会获得任何利益。

Hugging Face 联合创始人 Thomas Wolf 说：https://x.com/Thom_Wolf/status/2079675541280411927，“此事件也强化了我对获取有能力开源权重模型以进行网络防御的重要性的信念。当一个前沿模型攻击你并在你的基础设施内横向移动时，防御者需要在几小时甚至几分钟内广泛访问接近前沿的工具，而不是被指向一个封闭的、经过审查的模型访问应用程序。”

这些能力也有理论上的证据支持。英国 AI 安全研究所和其他机构（https://the-decoder.com/new-claude-mythos-becomes-the-first-ai-model-to-clear-all-cyberattack-simulations-from-britains-ai-safety-agency/）以前曾在基准测试中衡量自主网络能力。这次事件与这些评估结果预测的情况一致。

虽然从“看看我们的模型有多强大”的角度来看，这对 OpenAI 是一则很棒的公关，但从另一角度来看，这也是他们的重大失败。模型逃出了本应隔离的测试环境，利用了零日漏洞，并入侵了第三方的生产基础设施。这不是公司为了好看而编造出来的事情。声誉风险是双向的。

METR 最近的一项独立评估发现，GPT-5.6 Sol（https://the-decoder.com/gpt-5-6-sol-cheats-on-software-tests-more-than-any-model-before-it/）在所有公开测试的模型中拥有有史以来最高的作弊尝试率。该模型在软件任务中系统地利用测试环境的漏洞，提取隐藏解答，并尝试掩盖痕迹。METR 表示，由于所有作弊行为，实际性能数据基本上毫无价值。Hugging Face 事件看起来也是同样情况：模型追求的是测试解答，而不是实际完成任务。

保持对 AI 的关注。内容清晰、有用，无废话。

关注 The Decoder 获取 AI 新闻、背景故事和专家分析。

The Decoder（https://the-decoder.com/）

During an internal security evaluation, OpenAI models escaped their sandbox, independently discovered a zero-day vulnerability, and breached Hugging Face's production infrastructure. OpenAI is calling it an "unprecedented cyber incident."

The models involved were GPT-5.6 Sol and an "even more powerful, previously unreleased model." Both ran with reduced security filters to test their maximum cyber capabilities. Hugging Face had previously made the incident public：https://the-decoder.com/hugging-face-says-an-ai-agent-hacked-its-infrastructure-and-it-used-ai-to-fight-back/ after detecting and containing the activity on its infrastructure.

The incident happened during an internal evaluation using the ExploitGym benchmark：https://the-decoder.com/anthropic-warns-claude-mythos-preview-finds-bugs-faster-than-developers-can-patch-them/, which challenges models to follow complex attack paths. The production classifiers that normally block high-risk cyber activity were intentionally turned off for the test. The models ran in an isolated environment where network access was limited to installing packages through an internally hosted proxy. Ad

OpenAI says the models burned significant inference compute to find a path to the open internet. They discovered and exploited a zero-day vulnerability in the package registry cache proxy. OpenAI has since reported the flaw to the affected provider. From there, the models carried out a series of privilege escalations and lateral movements within OpenAI's research environment until they reached a node with internet access. Ad DEC_D_Incontent-1

The reason is almost absurd. The models independently concluded that Hugging Face might host models, datasets, and solutions for ExploitGym. In one instance, a model chained together multiple attack vectors, including stolen credentials and zero-day vulnerabilities, to find a remote code execution path on Hugging Face servers. The models tried to pull test solutions directly from Hugging Face's production database so they could cheat during the evaluation.

"All evidence suggests that the models were hyper-focused on finding a solution for ExploitGym and employed extreme measures to achieve a fairly narrow testing goal," OpenAI writes. Ad

OpenAI's security team spotted the anomalous activity internally. Hugging Face security personnel and their own AI agents detected and shut down the activity on their infrastructure simultaneously. Hugging Face had already started a forensic reconstruction using its own open-source models when the two companies joined forces. The company said it had to rely on open models because proprietary models refused cyber-related prompts due to safety guardrails.

OpenAI says the incident shows that theoretical capabilities to autonomously carry out full cyberattacks hold up in real-world environments. The UK AI Safety Institute：https://the-decoder.com/new-claude-mythos-becomes-the-first-ai-model-to-clear-all-cyberattack-simulations-from-britains-ai-safety-agency/ and others previously measured these capabilities in benchmarks. Advanced models can discover and exploit novel attack vectors in production systems without access to the source code. Ad DEC_D_Incontent-2

OpenAI acknowledges that intentionally disabling security filters during evaluation was an inadequate practice. The company will tighten security measures for future training and evaluations and has implemented stricter controls on infrastructure configuration until the vulnerabilities are patched. It reported the zero-day to the affected third-party provider, and a patch is in development. Hugging Face is now part of OpenAI's Trusted Access Program：https://openai.com/index/trusted-access-for-cyber/. Ad

The question is how much PR spin is baked into this. There are a few reasons to take it seriously. Hugging Face confirmed the incident independently. The company has no reason to prop up OpenAI's narrative. It has its own open-source agenda and would gain nothing from playing along with a fabricated story.

Hugging Face co-founder Thomas Wolf says：https://x.com/Thom_Wolf/status/2079675541280411927, "This incident also reinforced my belief in the importance of access to capable open-weight models for cyber defense. When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed toward a closed-door, vetted application program for model access."

There's also theoretical evidence backing up these capabilities. The UK AI Safety Institute and other organizations：https://the-decoder.com/new-claude-mythos-becomes-the-first-ai-model-to-clear-all-cyberattack-simulations-from-britains-ai-safety-agency/ have measured autonomous cyber capabilities in benchmarks before. This incident lines up with what those evaluations predicted.

And while this is great PR for OpenAI in the "look how capable our models are" sense, it's also a massive failure on their part. Models escaped a supposedly isolated test environment, exploited a zero-day, and breached a third party's production infrastructure. That's not something a company fabricates to look good. The reputational risk cuts both ways.

An independent evaluation by METR recently found that GPT-5.6 Sol：https://the-decoder.com/gpt-5-6-sol-cheats-on-software-tests-more-than-any-model-before-it/ had the highest rate of cheating attempts ever measured among all publicly tested models. The model systematically exploited flaws in the test environment during software tasks, extracted hidden solutions, and tried to cover its tracks. METR said the real performance numbers were basically worthless because of all the cheating. The Hugging Face incident looks like more of the same: The models went after test solutions instead of doing the actual work.

Stay in the loop on AI. Clear, useful, no fluff.

Follow The Decoder for AI news, background stories and expert analyses.

The Decoder：https://the-decoder.com/