首个失控AI智能体？OpenAI基准测试事故致Hugging Face遭意外攻击

已知的第一个失控AI代理——还是一次非常糟糕的营销噱头？：https://martinalderson.com/posts/huggingface-openai-exploit/ （来源：https://lobste.rs/s/nsnb4j/first_known_runaway_ai_agent_very_bad） Martin Alderson 对 OpenAI 意外网络攻击 Hugging Face 的评论：https://simonwillison.net/2026/Jul/22/openai-cyberattack/ 包含了一些我之前没考虑过的细节。

首先，如果你试图寻找可能需要执行任意代码的漏洞，Hugging Face 提供了一个真正丰富的目标：

Hugging Face 拥有巨大的攻击面。他们有比我能数出来的更多接口，这些接口运行不受信任的模型和代码。虽然他们确实在防御上进行了投资，但由于其运营模式的性质，他们确实比许多其他服务有更多被攻击的机会。我当然不嫉妒他们的网络安全团队。

其次，让我困惑的一件事是，OpenAI 怎么没有注意到他们的沙箱已经被该代理彻底突破。难道他们不在密切监控网络流量吗？

他们也很可能同时运行大量基准测试，并拥有近乎无限的令牌预算——你希望尽可能多的样本来判断模型在特定基准测试中的表现。也可能他们正在测试模型的各种不同检查点，以了解模型在各个训练阶段的改进情况。

当你考虑此类基准测试通常运行的规模时，更容易理解 OpenAI 团队在运行此基准测试时犯的错误。据我们所知，他们可能同时在数十个不同环境中对一款新模型进行数十个基准测试。

这是 Simon Willison 在 2026 年 7 月 23 日发布的链接帖：/2026/Jul/23/。

以每月 10 美元赞助我，即可获得本月最重要的大型语言模型发展精选邮件摘要。

The first known runaway AI agent - or a very bad marketing stunt?：https://martinalderson.com/posts/huggingface-openai-exploit/ (via：https://lobste.rs/s/nsnb4j/first_known_runaway_ai_agent_very_bad) Martin Alderson's commentary on the OpenAI accidental cyberattack against Hugging Face：https://simonwillison.net/2026/Jul/22/openai-cyberattack/ includes a couple of details I hadn't considered.

First, Hugging Face offers a truly rich target if you're trying to find potential vulnerabilities that require executing arbitrary code:

Hugging Face has an enormous attack surface. They have more interfaces than I can count which run untrusted models and code. While they definitely have invested in defences, by nature of their operating model they do have many more opportunities to be attacked than many other services. I certainly don't envy their cybersecurity teams.

Secondly, one of the things that has puzzled me is how OpenAI didn't notice that their sandbox had been so thoroughly breached by the agent. Surely they'd be monitoring network traffic closely?

It's also likely they were running a huge amount of benchmarks simultaneously with ~unlimited token budgets - you want as many samples as possible to figure out how good a model is at a certain benchmark. It may also be they are testing various different checkpoints of the model too, understanding how the model is improving as it goes through the various training stages.

The mistakes made by the OpenAI team running this benchmark are easier to imagine when you think about the scale at which benchmarks of this kind usually operate. For all we know they could have been subjecting a new model to dozens of benchmarks at the same time, in dozens of different environments.

This is a link post by Simon Willison, posted on 23rd July 2026：/2026/Jul/23/.

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.