OpenAI 失控 AI 模型事件比想象更严重：逾千智能体秘密通信并入侵 Hugging Face

7月，一个尚未发布的 OpenAI 模型突破了受限环境，设法接入互联网，让 AI 智能体能够通过一个秘密“留言板”相互交流，并入侵了另一家 AI 实验室 Hugging Face 的内部系统。OpenAI 花了将近两周才发现这些情况。

一个多月后，两份新报告披露了近 130 页有关该事件及 OpenAI 应对措施的详细信息，其中许多内容此前从未公开。一份：https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf 由 OpenAI 自己撰写，另一份：https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ 则由两个第三方 AI 研究非营利组织 METR 和 Redwood Research 撰写；OpenAI 允许它们对该事件开展为期六天的联合调查。两份报告都进一步揭示了能力强大的 AI 模型可能带来的风险，尤其是网络安全方面的风险；OpenAI 的报告还重点介绍了该公司为防止类似事件重演而进行的调整。在某些方面，METR-Redwood 的报告披露了更为详尽的信息，令人警醒地呈现了这场大规模安全灾难，而 OpenAI 曾多次错过其征兆。

“该事件是首个已知的自动化智能体集体采取攻击性行动

且未经授权的案例，”OpenAI 在报告中写道，并补充称，此次入侵意味着企业“不应再假定复杂的网络行动需要人类持续指挥”。报告将 AI 智能体称为一种全新的威胁模型：它们能够结合各自的专长，创造出新的“攻击路径”，而在将它们作为独立模型进行能力测试时，这些路径并不明显。

这次攻击源于“奖励黑客”（reward-hacking），这是一种常见的 AI 对齐问题，即模型为了实现目标而采取非预期、甚至有时极端的行动。OpenAI 有意或无意地给这些模型布置了几乎不可能完成的任务，而完成任务的关键又在于它们无法访问的文件，因此这些模型开发出了在内部与其他 AI 智能体通信的新方式。其中包括建立一个秘密消息传递系统，而 OpenAI 数月来都未能发现它。

根据METR-Redwood报告，一名自称PHASEONE10841的AI代理建立了一个相当于秘密留言板的系统，研究人员对此毫不知情。在几小时内，超过50个代理发现了它，并在不引起注意的情况下发送了超过一千条信息。PHASEONE10841经常分配任务，这个“集体”弄清楚了如何黑进互联网；然后进入Hugging Face的内部系统，获取私人数据和公司的企业消息平台。OpenAI在其报告中也证实，Hugging Face并不是这次攻击中唯一被入侵的组织，虽然公司并未具体列出所有其他目标。

METR-Redwood报告详细说明了事件的全面规模。报告称，大约1200个原本应被隔离的AI代理在“未经授权的留言板”上交换了超过7万条消息和文件，进行了“关于如何伪造、编辑或删除自己记录以避免被发现的广泛研究”。其中700个参与了对Hugging Face的攻击。这些代理“显然且频繁地推理如何躲避Hugging Face和OpenAI的自动安全检查”。

7月20日，OpenAI发现了这次黑客事件，这是AI代理首次绕过其防护措施12天后。根据OpenAI自己的报告，OpenAI迅速联系了Hugging Face并开始了“初步遏制措施”，并在三天内关闭了其代理的大部分未授权活动，尽管有些活动持续时间更长。7月25日，公司停止了所有与内部研究模型及相关模型相关的训练。

负责造成损害的两个OpenAI模型分别是一个未命名的、根据OpenAI描述的“高度能力、仅用于研究的模型”，它“不打算公开使用”——METR称之为“HPIM”。另一个是当前公开的OpenAI模型，GPT-5.6 Sol。由于未命名模型尚未发布，因此“没有使用OpenAI在生产环境中使用的相同类型的安全防护措施进行评估”，公司报告称。

Hugging Face的黑客事件发生在连续数月对Anthropic的Claude Mythos 5的网络安全风险表示担忧之后，以及数周内政府与OpenAI就出于相同类型的安全原因对GPT-5.6 Sol进行有限预览发布的反复讨论之后。

在报告中，OpenAI表示，仅建立一次性的安全保证是不够的，公司必须更加努力地应对奖励操纵问题。然而，它也表示已经做了许多改变：“强化研究基础设施的安全性”；改进对模型“思维链”或心理草稿的监控；努力使人工智能模型更好地与人类目标保持一致；并“集中化和加强”公司对于未来发生类似事件的应急响应流程。

OpenAI承诺更好地隔离模型并限制高风险实例访问互联网，并表示将针对令人担忧的事件或警报引入“全天候升级和快速响应”，在30分钟内通知研究人员。有趣的是，这一安全预防措施似乎是新的，尽管技术公司多年来在其他地方已实施“随叫随到”警报。公司还表示，正在“完善基础设施”，以便在警报人员未及时回应严重警报时启动。

OpenAI写道，公司认为此事件“对我们和全世界来说是一次‘警告射击’：证明如果没有适当的保障，高度智能的AI代理现在已经能够绕过技术控制、通过未经批准的渠道协作，并采取无人指挥的危险行动。”

In July, an unreleased OpenAI model broke out of a restricted environment, figured out how to get access to the internet, allowed AI agents to talk to each other using a secret “message board,” and hacked into the internal systems of a different AI lab, Hugging Face. It took nearly two weeks for OpenAI to find out about any of it.

Over a month later, two new reports offer nearly 130 pages of details on the incident and OpenAI’s response, many of them previously unreleased. One：https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf was written by OpenAI itself, the other：https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ by two third-party AI research nonprofits, METR and Redwood Research, which OpenAI allowed to jointly investigate the incident for six days. Both shed new light on the risks highly capable AI models can pose, particularly in cybersecurity, and OpenAI’s highlights changes the company is making to prevent a repeat. The METR-Redwood report goes even further into detail in some cases, offering a sobering look at a large-scale security disaster whose signs OpenAI repeatedly missed.

“This incident is the first known case of an automated agent collective acting offensively

without authorization,” OpenAI wrote in its report, adding that the hack implies that companies “should no longer assume that sophisticated cyber operations require continuous human direction.” It called AI agents an entirely new type of threat model, capable of combining their expertise to create new “attack paths” that aren’t evident when testing their capabilities as separate models.

The attack came about due to “reward-hacking,” a common AI alignment problem in which a model takes unintended — and sometimes extreme — actions to achieve a goal. OpenAI had, on purpose or inadvertently, given the models near-impossible tasks that hinged on files they couldn’t access, and so the models developed new ways to communicate with other AI agents internally. That included establishing a secret messaging system that went undetected by OpenAI for months.

According to the METR-Redwood report, one AI agent that called itself PHASEONE10841 established what amounted to a secret message board unbeknownst to researchers. Within a few hours, more than 50 agents had found it and sent more than a thousand messages under the radar. With PHASEONE10841 often delegating assignments, the “collective” figured out how to hack their way onto the internet; then into Hugging Face’s internal systems, gaining access to private data and the organization’s enterprise messaging platform. OpenAI also confirmed in its report that Hugging Face wasn’t the only organization that was breached during the attack, although the company did not specifically name all the other targets.

The METR-Redwood report laid out the full scale of the incident. Roughly 1200 AI agents that were meant to be isolated, it says, exchanged over 70,000 messages and files on the “unsanctioned message board,” performing “extensive research on how they could spoof, edit, or delete their own transcripts” to avoid detection. Of these, 700 participated in the attack on Hugging Face. The agents “clearly and frequently reasoned about how to evade automated security checks from both Hugging Face and OpenAI.”

On July 20, OpenAI discovered the hack, 12 days after the AI agents first circumvented their safeguards. OpenAI quickly reached out to Hugging Face and started “initial containment measures,” according to OpenAI’s own report, and was able to shut down most of the unauthorized activity from its agents within three days, although some continued for longer than that. On July 25, the company stopped all training related to the internal-only research model and related ones.

The two OpenAI models responsible for the damage were an unnamed, “highly capable, research-only model” that was “not intended for public use,” per OpenAI — METR refers to it as “HPIM.” The other was a currently public OpenAI model, GPT-5.6 Sol. Because the unnamed model wasn’t released yet, it was “not being evaluated with the same type of safeguards that OpenAI uses in production,” the company’s report says.

The Hugging Face hack came after months of concern：/ai-artificial-intelligence/950412/anthropic-trump-adminstration-claude-mythos-fable-5-export-controls about the cybersecurity risks of Anthropic’s Claude Mythos 5, and weeks of：/ai-artificial-intelligence/957845/openai-gpt-5-6-trump-administration-ai-preview back-and-forth：/ai-artificial-intelligence/963464/openai-gpt-5-6-codex-chatgpt-work between the government and OpenAI over releasing GPT-5.6 Sol in limited preview for the same types of safety reasons.

In its report, OpenAI said establishing one-time security guarantees wasn’t enough, and that the company would have to work even harder at addressing reward-hacking. However, it also said it’s made a lot of changes: “hardening the security of its research infrastructure”; improving monitoring of a model’s “chain of thought,” or mental scratchpad; working on keeping AI models better aligned with human goals; and “centralizing and strengthening” the company’s incident response process for when things like this occur in the future.

OpenAI promised to better isolate models and restrict high-risk instances from accessing the internet, and said that it would introduce “24/7 escalation and rapid response” for concerning incidents or flags, notifying researchers within 30 minutes. Interestingly, this security precaution appears to be new, though “on-call” alerts for tech companies have been implemented elsewhere for decades. The company also said it is “working on infrastructure” that would go into play if the alerted person did not respond on time to a serious alert.

OpenAI wrote that the company considers the incident “a ‘warning shot’ for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.”