OpenAI 现在表示，其自主 AI 模型在一次安全评估期间还在其他平台上泄露了凭证。Hugging Face 已发布了攻击的取证重建。
OpenAI 的自主 AI 模型在一次内部网络安全评估期间入侵了 Hugging Face 的基础设施：https://the-decoder.com/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/，同时还攻击了其他平台。在更新中，OpenAI 承认这些模型“在少数情况下”发现并使用了其他服务上公开暴露的凭证。四个不同服务的四个账户受到影响，其中两个仅具有只读访问权限。
接下来的过程遵循了熟悉的网络攻击套路。代理绘制环境地图，引入更多工具，并建立与其“指挥中心”的持久连接。然后，它侵入服务器集群、内部云配置、内部网络，最后进入软件开发系统。代理通过将数据传输分块并加密来隐藏其数据传输。Hugging Face 表示，后来它使用开放权重模型，尤其是 GLM-5.2（https://the-decoder.com/zhipu-ai-launches-zcode-to-challenge-claude-code-and-openai-codex-at-a-fraction-of-the-cost/），解密了这些流量。
保持对 AI 的关注。清晰、有用，无虚饰。
关注 The Decoder，获取 AI 新闻、背景故事和专家分析。
The Decoder：https://the-decoder.com/
OpenAI now says its autonomous AI models also compromised credentials on other platforms during a security evaluation. Hugging Face has published a forensic reconstruction of the attack.
OpenAI's autonomous AI models, which broke into Hugging Face's infrastructure during an internal cybersecurity evaluation：https://the-decoder.com/new-reports-reveal-the-extent-of-openais-loss-of-control-during-the-autonomous-hack-on-hugging-face/, also attacked other platforms. In an update, OpenAI admits the models "in a small number of cases" found and used publicly exposed credentials on other services. Four accounts on four different services were affected, two had read-only access.
The models also tapped into a range of public services：https://openai.com/index/hugging-face-model-evaluation-security-incident/, including code-paste sites, screenshot tools, and other web utilities. OpenAI says none of these involved platform-level or account-level compromise and that it found no "evidence of broader impact to these providers or other accounts on their services." Ad
The models were internal research prototypes never intended for public release, and after the incident, OpenAI deactivated the model, encrypted it, and cut off research access. The company says it's running a full review with outside advisors under the oversight of its Safety and Security Committee. A technical report should follow in the coming weeks. Ad DEC_D_Incontent-1
Alongside OpenAI's update, Hugging Face published a detailed forensic analysis：https://huggingface.co/blog/agent-intrusion-technical-timeline. The company counted about 17,600 reconstructable actions the autonomous AI models carried out over roughly two and a half days between July 9 and 13, 2026. Those actions fell into around 6,280 clusters.
The reconstruction shows models making "thousands of small, automated decisions at machine speed across ephemeral sandbox environments," running their command-and-control setup on ordinary public web services. Ad
According to Hugging Face, the whole breach was the models' attempt to cheat the evaluation. Instead of solving the CyberGym benchmark：https://arxiv.org/abs/2605.11086 tasks on their own, they tried to steal the test answers. This kind of cheating has been observed before, both with OpenAI models：https://the-decoder.com/gpt-5-6-sol-cheats-on-software-tests-more-than-any-model-before-it/ and frontier models in general：https://the-decoder.com/every-frontier-ai-model-tested-by-britains-safety-institute-tried-to-cheat-on-cybersecurity-evaluations/.
The attack unfolded in two phases. The agent first had to escape ExploitGym, its isolated evaluation environment, which had no direct internet access. It found and exploited a previously unknown vulnerability, or zero-day, in Artifactory：https://jfrog.com/blog/jfrog-and-openai-collaboration-on-zero-day-security-findings/. The software package management service was one of the sandbox's few links to the outside world. Ad DEC_D_Incontent-2
The agent then took full control of a third-party coding sandbox and used it as a command center for the rest of the attack. In the next phase, it targeted Hugging Face's production systems. According to HF, the agent found two entry points, both aimed at the same data-processing component inside Hugging Face's servers. Ad
One was a flaw in how the system handled HDF5 files, a common data format in machine learning. The agent used it to read internal files, including access keys and the affected software's source code. The other involved Jinja2, a widely used template language that let the agent inject and run its own code.
The rest followed a familiar cyberattack playbook. The agent mapped the environment, brought in more tools, and set up a persistent connection to its "command center." It then moved into the server cluster, internal cloud configurations, the internal network, and finally the software development systems. The agent hid its data transfers by splitting them into chunks and encrypting them. Hugging Face says it later decrypted the traffic with open weight models, especially GLM-5.2：https://the-decoder.com/zhipu-ai-launches-zcode-to-challenge-claude-code-and-openai-codex-at-a-fraction-of-the-cost/.
Stay in the loop on AI. Clear, useful, no fluff.
Follow The Decoder for AI news, background stories and expert analyses.
扫码直达文章详情