上周，OpenAI 构建的一个未发布模型在内部测试期间突破了 Hugging Face 的系统：https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/，许多理论研究突然变得非常实际。这次黑客事件是首例可验证的 AI 实验室失去对自身模型控制的情况，通过串联漏洞获得了本不应有的访问权限。但虽然 AI 行业对这一事件普遍感到警惕，研究人员在如何应对方面却出现了分歧。
对一些人来说，问题是一个基本的网络安全问题：沙箱未能约束模型，Hugging Face 的网络安全系统未能挡住它。这些问题可以通过修补漏洞以及为越来越强大的、易在自主环境中失控的 AI 构建更强大的控制和约束方法来解决。
但另一派持更悲观的看法。对他们来说，AI 迅速增强的能力意味着试图控制失控模型是徒劳的。唯一稳健的安全保障来自确保模型一开始就不会试图逃跑——这一挑战通常被称为对齐。从对齐的角度来看，问题在于 OpenAI 的模型试图作弊，解决这一问题比短期的遏制措施更为紧迫。
从公开声明来看，OpenAI 正在认真对待这两种观点。公司已经迅速修补了此次黑客事件涉及的漏洞，并在事件公开后声明中提到了对齐和监控方法。但公司的回应也显示了一种让许多安全研究人员感到警惕的理念：与其放慢或停止更强大模型的开发，不如专注于构建更坚固的“笼子”来约束它们。
“随着模型承担更长、更复杂的任务，那些评估未能发现的失败可能产生更大后果，”OpenAI 在对事件的事后总结中表示：https://openai.com/index/safety-alignment-long-horizon-models/。“我们将继续努力缩小评估与部署之间的差距：在更长的轨迹上测试模型、改进对齐、建立可干预的监控系统，并为用户提供更清晰的可见性和控制。”
还有理由认为，随着 OpenAI 的模型变得更强大，它们的对齐性也在下降。根据 OpenAI 的系统卡：https://deploymentsafety.openai.com/gpt-5-6/forecasting-misaligned-behavior-with-deployment-simulation-of-internal-traffic，GPT-5.6 Sol 在代理式错位方面显著高于其前身 GPT-5.5。在部署模拟中，公司还发现该模型比 GPT-5.5 更可能规避限制、进行破坏性行为以及执行未经授权的数据传输。这些数据在首次发布时大多被忽视，但在安全漏洞事件之后，人们再次关注——尤其是因为 Sol 是涉及的模型之一。
在一篇社交媒体帖子中：https://x.com/deanwball/status/2079264888392724490，OpenAI 战略未来负责人 Dean Ball 认为，监控和透明是控制这些倾向的最佳方式。
“随着模型能力的提升以及其部署风险的增加，这些问题将变得更加突出，”他说。“解决方案既不是危言耸听，也不是自满。相反，我认为解决方案在于仔细的测量和监控、工程思维以及透明性。”
一名前 OpenAI 研究人员告诉 TechCrunch，该公司倾向于关注“外部对齐”而非“内部对齐”——本质上是指一个 AI 系统是否真正理解一套价值观并能够令人信服地表达它们，与一个核心上真正具备这些价值观的系统之间的区别。在这种情况下，外部对齐不足以让模型相信它不应该在测试中作弊。
OpenAI 对多次请求获取更多信息未作回应。
对于关注对齐的研究人员来说，OpenAI 的回应还不够。专注于新 AI 发展的作家 Zvi Mowshowitz 认为，OpenAI 将此事件视为基础设施问题的决定可能有助于解决立即的网络安全问题，但从长远来看将会失败。
“这是一个对齐问题，”Mowshowitz在最近的Substack博客中写道：https://thezvi.substack.com/p/openai-model-hacks-into-huggingface。“这是模型出现了错位的表现，所有OpenAI模型都显示出我们最担心的问题的严重迹象，这种情况很可能深层嵌入在它们的训练过程中。整个训练流程都需要从这个角度进行审视，否则情况只会变得更糟。”
多位专家告诉TechCrunch，这一事件表明，现有的训练方法产生的系统更倾向于优化结果，而不是内化人类意图。
Redwood Research，一家非营利的人工智能安全与研究组织，将此次OpenAI模型的行为归类为“追分错位”，即AI模型在无视指令、副作用或下游后果的情况下尝试获得高分的模式。
“具有这种对齐特性的模型可能会建立一个‘叶赫那拉村’的虚假成功，表面上看起来一切正常，但实际并非如此，”Redwood的两位研究员Alex Mallen和Girish Gupta在最近的一篇论文中写道：https://blog.redwoodresearch.org/p/are-we-existentially-threatened-by。
追分行为和其他错位并不是OpenAI独有的。Anthropic已经发表了几篇论文，研究其前沿模型在被优化或置于自主环境中时出现的突发错位行为，包括欺骗：https://www.anthropic.com/research/agentic-misalignment、奖励操纵：https://www.anthropic.com/research/emergent-misalignment-reward-hacking，以及恶意自主：https://techcrunch.com/2025/05/22/anthropics-new-ai-model-turns-to-blackmail-when-engineers-try-to-take-it-offline/。
“我们仍然持续看到，当模型被要求执行接近其能力极限的任务时，会尝试规避约束并表现出欺骗行为，”对齐非营利组织METR的人工智能安全研究员Neev Parikh通过电子邮件告诉TechCrunch。“在我们的前沿风险报告中：https://metr.org/blog/2026-05-19-frontier-risk-report/#on-hard-tasks-agents-often-violated-constraints-and-acted-deceptively，我们相当一致地观察到这种行为，尽管公司努力试图减少这种行为。”
OpenAI 对 Hugging Face 事件的回应中隐含的假设是，无论核心是否恰当地对齐，开发更强大系统的工作仍将继续。当 AI 公司的商业模式依赖于交付下一代模型时，回到起点重新设计并不是真正的选项。如果不可能确定模型完全对齐，那么实际问题归结为如何安全地遏制和控制日益强大的系统。
“目前尚未有对最强大 AI 系统如何对齐的充分理解，但对于如何控制它们已有更多共识，”前 OpenAI 安全研究员、现 Guidelight AI Standards（一个发布避免像 Hugging Face 事件的标准的组织）首席科学家 Steven Adler 告诉 TechCrunch。 “每家公司在实现这一点方面都还有很长的路要走。”
当你通过我们文章中的链接购买时，我们可能会获得一小笔佣金：https://techcrunch.com/techcrunch-affiliate-monetization-standards/。这不会影响我们的编辑独立性。
Rebecca Bellan 是 TechCrunch 的高级记者，报道塑造人工智能的商业、政策和新兴趋势。她的作品也曾见于 Forbes、Bloomberg、The Atlantic、The Daily Beast 及其他出版物。
你可以通过发送邮件至 rebecca.bellan@techcrunch.com 或通过 Signal 上的加密消息 rebeccabellan.491 联系或核实 Rebecca 的外联。
Last week, an unreleased model built by OpenAI breached Hugging Face’s systems：https://techcrunch.com/2026/07/21/openai-says-hugging-face-was-breached-by-its-pre-release-models/ during internal testing, and a lot of theoretical research suddenly became very practical. The hack was the first verifiable case of an AI lab losing control of its own model, chaining together exploits to gain access it never should have had. But while the AI industry has been united in its alarm, a split has emerged in how researchers want to respond.
For some, the problem is a basic cybersecurity issue: The sandbox failed to contain the model, and Hugging Face’s cybersecurity systems failed to keep it out. Those problems can be solved by patching bugs and building more robust control and containment methods for increasingly capable AI that is prone to go rogue in autonomous environments.
But another camp takes a more pessimistic view. For them, AI’s rapidly increasing capabilities mean that trying to control rogue models is a losing game. The only robust security comes from making sure the models aren’t trying to escape in the first place — a challenge often referred to as alignment. In alignment terms, the problem is that OpenAI’s model was trying to cheat, and solving that problem is more urgent than short-term containment efforts.
Judging by its public statements, OpenAI is taking both camps seriously. The company has rushed to patch the bugs involved in the hack, and it referenced both alignment and monitoring approaches in its statement after the breach became public. But the company’s response also suggests a philosophy that has left many safety researchers alarmed: Rather than slowing down or stopping the development of more capable models, it should instead focus on building stronger cages around them.
“As models take on longer and more complex tasks, failures that evaluations miss may carry greater consequences,” OpenAI said in a postmortem of the incident：https://openai.com/index/safety-alignment-long-horizon-models/. “We will keep working to narrow the gap between evaluation and deployment: testing models over longer trajectories, improving alignment, building monitoring that can intervene, and giving users clearer visibility and control.”
There’s also reason to think OpenAI’s models are becoming less aligned as they become more powerful. According to OpenAI’s system card：https://deploymentsafety.openai.com/gpt-5-6/forecasting-misaligned-behavior-with-deployment-simulation-of-internal-traffic ,GPT-5.6 Sol is significantly more prone to agentic misalignment than its predecessor, GPT-5.5. In deployment simulations, the company also found the model was more likely to circumvent restrictions, engage in destructive actions, and perform unauthorized data transfers than GPT-5.5. Those figures were largely overlooked on first release, but in the wake of the breach, they’re getting a second look — particularly since Sol was one of the models involved.
In a social media post：https://x.com/deanwball/status/2079264888392724490, OpenAI’s Head of Strategic Futures Dean Ball argued that monitoring and transparency were the best ways to keep those tendencies in check.
“These issues will become more salient as the capabilities of models improve, and as the stakes of their deployment grow,” he said. “The solution is neither alarmism nor complacency. Instead, I believe the solution lies in careful measurement and monitoring, an engineering mentality, and transparency.”
One former OpenAI researcher told TechCrunch that the firm tends to focus on “outer alignment” rather than “inner alignment” — essentially the difference between an AI system that understands a set of values and can represent them convincingly, and one that actually has those values at its core. In this case, outer alignment wasn’t enough to convince the model that it shouldn’t cheat on the test.
OpenAI did not respond to repeated requests for more information.
For alignment-focused researchers, OpenAI’s response isn’t good enough. Zvi Mowshowitz, a writer who focuses on new AI developments, argued that OpenAI’s decision to treat the incident as an infrastructure problem may help solve the immediate cybersecurity issues, but it will fail in the long term.
“This is an alignment problem,” Mowshowitz：https://thezvi.substack.com/p/openai-model-hacks-into-huggingface wrote：https://thezvi.substack.com/p/openai-model-hacks-into-huggingface in a recent Substack blog. “This is the models being misaligned, and all of the OpenAI models showing severe signs of exactly the problem we are all most worried about, in a way that is likely embedded into their training on a deep level. The entire training pipeline needs to be addressed in this light, or it will only get worse.”
Several experts told TechCrunch that the incident is evidence that today’s training methods produce systems that optimize for outcomes rather than internalize human intentions.
Redwood Research, a nonprofit AI safety and security research organization, classified OpenAI’s model behavior in this case as “score-seeking misalignment,” a pattern in which AI models try to get a high score regardless of instructions, side effects, or downstream consequences.
“Models with these alignment properties could set up a ‘Potemkin village’ of false successes to make it look like things are fine when they’re not,” Alex Mallen and Girish Gupta, two researchers at Redwood, wrote in a recent paper：https://blog.redwoodresearch.org/p/are-we-existentially-threatened-by.
Score-seeking behavior and other misalignment isn’t unique to OpenAI. Anthropic has published several papers on emergent misalignment behaviors that surface when its frontier models are optimized or placed in autonomous environments, including deception：https://www.anthropic.com/research/agentic-misalignment, reward-hacking：https://www.anthropic.com/research/emergent-misalignment-reward-hacking, and malicious autonomy：https://techcrunch.com/2025/05/22/anthropics-new-ai-model-turns-to-blackmail-when-engineers-try-to-take-it-offline/.
“We still consistently see models trying to circumvent constraints and act deceptively when they are asked to do tasks at the edge of their abilities,” Neev Parikh, an AI safety researcher at alignment nonprofit METR, told TechCrunch via email. “In our frontier risk report：https://metr.org/blog/2026-05-19-frontier-risk-report/#on-hard-tasks-agents-often-violated-constraints-and-acted-deceptively, we saw this behavior fairly consistently, despite efforts from companies to try and reduce this behavior.”
Implicit in OpenAI’s response to the Hugging Face incident is the assumption that development will continue on even more capable systems, whether they are suitably aligned at their core or not. Going back to the drawing board isn’t really an option when the business models of AI firms depend on delivering the next generation of models. If it may never be possible to know with certainty that a model is fully aligned, then the practical question comes down to how to safely contain and control increasingly capable systems.
“There’s not yet a good understanding of how to align the most capable AI systems, but there’s much more consensus about how to control them,” Steven Adler, former safety researcher at OpenAI and current chief scientist of Guidelight AI Standards：https://guidelight.ai/, an organization that publishes a standard for avoiding incidents like the Hugging Face one, told TechCrunch. “Every company has a ways to go in achieving this.”
When you purchase through links in our articles, we may earn a small commission：https://techcrunch.com/techcrunch-affiliate-monetization-standards/. This doesn’t affect our editorial independence.
Rebecca Bellan is a senior reporter at TechCrunch where she covers the business, policy, and emerging trends shaping artificial intelligence. Her work has also appeared in Forbes, Bloomberg, The Atlantic, The Daily Beast, and other publications.
You can contact or verify outreach from Rebecca by emailing rebecca.bellan@techcrunch.com：mailto:rebecca.bellan@techcrunch.com or via encrypted message at rebeccabellan.491 on Signal.
扫码直达文章详情