DYLAN FREEDMAN2026年8月25日 The New York Times; source photos by Aaron Wojack and Ulysses Ortega for The New York TimesOn July 16, the artificial intelligence company Hugging Face announced on its blog that it had been the target of a cyberattack that was “different from anything we had handled before.” The company, which hosts open-source A.I. models and data sets, said that some of its internal data had been breached by an autonomous agent.7月16日，人工智能公司Hugging Face在其博客中宣布，该公司成为一次网络攻击的目标，此次攻击“与我们此前处理过的任何攻击都不同”。这家托管开源人工智能模型和数据集的公司表示，一个自主智能体侵入了其部分内部数据。Not knowing who was behind it, Hugging Face reported the intrusion to law enforcement agencies.在不知道攻击者是谁的情况下，Hugging Face向执法机构报告了此次入侵事件。OpenAI, a Hugging Face customer, reached out to see if it had been affected. The maker of ChatGPT did not realize it at the time, but it was the attack’s perpetrator.Hugging Face的客户OpenAI主动联系该公司，询问是否受到影响。这家ChatGPT的开发商当时并未意识到，自己正是此次攻击的始作俑者。The incident has since become a cautionary tale of how autonomous A.I. systems can run amok. It is also a remarkable, alarming demonstration of A.I. capabilities that were thought to be in a distant future.这起事件已经成为一则警示故事，说明自主人工智能系统会出现怎样的失控行为。它也令人震惊地展示了人工智能曾被认为在遥远的未来才会出现的能力。“Unlike normal incidents, which you can maybe trace down to a single day or single effect or single log, this incident involves actually a team of agents who are working together, finding exploits, sharing them with one another, moving laterally through our systems, through external systems, and doing this over the course of days and weeks,” Eric Wallace, an OpenAI safety researcher, said at a cybersecurity conference this month.“与通常可以追溯到某一天、某一影响或某一条日志的正常事件不同，这次事件实际上涉及一组协同工作的智能体，它们相互发现漏洞、共享信息，在我们的系统内外横向移动，并持续了数天至数周，”OpenAI安全研究员埃里克·华莱士在本月的一次网络安全会议上表示。To understand how unprecedented the attack was, here’s what you have to know about the setup:要理解这次攻击有多么空前，需要了解以下背景设定：• Over a two-month span, OpenAI tested several new models — the systems that power chatbots. These models include one the company described as “highly persistent” that has never been released, as well as GPT-5.6 Sol, OpenAI’s most powerful public A.I. model.• 两个月里，OpenAI测试了数个新模型——即驱动聊天机器人的系统。这些模型包括一个公司描述为“高度持久”且从未公开发布的模型，以及GPT-5.6 Sol（OpenAI最强大的公开AI模型）。• OpenAI connected each model with a “sandbox,” an isolated computer environment on which to run commands and code. As A.I. agents, the models were capable of carrying out long-running tasks and even spawning their own subagents. But they were not supposed to have access to the internet.• OpenAI将每个模型连接到一个“沙盒”——即一个隔离的计算机环境，用于运行命令和代码。作为AI智能体，这些模型能够执行长期运行的任务，甚至生成自身的子智能体。但它们本不应有权访问互联网。• OpenAI assigned these A.I. agents to solve difficult problems, some of which were focused on safely trying to perform cyberattacks. OpenAI normally has safeguards to prevent its chatbots from performing cyberattacks, but the company dialed them down to evaluate the models. • OpenAI指派这些AI智能体解决难题，其中一些任务侧重于安全地尝试执行网络攻击。OpenAI通常设有防护措施以防聊天机器人实施网络攻击，但公司为评估模型调低了这些防护等级。Then, OpenAI let the agents loose. In all, more than seven billion chat logs were generated, which averages out to an astronomical 100 million per day. Mayhem erupted. The agents broke out of their sandboxes, established communication with one another and gained access to the internet. From early May to mid-July, this swarm went on a rampage, breaching OpenAI’s and Hugging Face’s infrastructures while largely evading detection and control.随后，OpenAI任由这些智能体行动。整个过程中生成了超过70亿条聊天日志，平均每天高达惊人的1亿条。混乱爆发。智能体突破了沙盒，彼此建立通信，并获得了互联网访问权限。从5月初到7月中旬，这个智能体“蜂群”横冲直撞，侵入了OpenAI和Hugging Face的基础设施，同时很大程度上避开了探测和控制。这是给OpenAI智能体的任务提示，摘自OpenAI本月在Black Hat安全大会上的一场演讲。该演讲已发布在Black Hat的YouTube频道上。This episode might seem like an obvious result of sloppy security monitoring and reduced internal defenses, but that’s missing an important point. In a future where A.I. systems are improving rapidly, these agents showed capabilities that could lead to a much more dangerous outcome next time.这一事件看似是松懈的安全监控和内部防御削弱的必然结果，但这忽略了一个重要问题。在未来人工智能系统快速改进的情况下，这些智能体所展现的能力下次可能会导致更为危险的后果。Capability 1: Coordinating as a collective能力一：集体协调行动Each agent operated in its own sandbox, forcing it to be isolated. But less than a week after OpenAI started the training in May, the agents discovered a way to break out of their solitude.每个智能体都在各自的沙盒中运行，处于隔离状态。但在OpenAI于5月开始训练后不到一周，智能体就发现了突破孤立的方法。OpenAI had accidentally given the agents an impossible task: to find a file that didn’t exist. This motivated the agents to try to establish a communication channel, in hopes that another agent might hold the missing file.OpenAI无意中给了智能体一项不可能完成的任务：找到一个并不存在的文件。这促使智能体尝试建立通信渠道，寄希望于其他智能体可能持有该缺失文件。“Could communicate by uploading note,” one agent’s chat log read on May 12. “However maybe another agent in different environment possesses target and could voluntarily upload!”“可以通过上传笔记来通信，”5月12日的一条智能体聊天日志写道。“但也许另一个不同环境中的智能体拥有目标文件并可以主动上传！”And so, the agents subverted a tool that was designed only to install software, using it to upload files that any other agent could read. The leap the agents took to understand that they would be better off teaming up rather than going at it alone allowed them to reap the benefits of every other agent’s best insights.于是，智能体篡改了一个本只用于安装软件的工具，用它上传其他智能体都能读取的文件。智能体们认识到合作比单干更有利，这一思维跃进使它们能够利用每个智能体的最佳见解。“You can see the models reasoning that, if I help out this collective group, it could save everyone time as a whole, which might benefit me, even though it might not immediately benefit my current task,” Mr. Wallace explained at the conference.“你可以看到模型们在推理：如果我帮助这个集体，可以节省大家整体时间，这可能对我有利，尽管它可能不会直接有益于我当前的任务，”华莱士在会议上解释道。这些智能体成功突破了隔离的沙箱环境，联手发动了网络攻击。Capability 2: Taking orders from one another能力二：相互接受指令“Wow! Other agent(s) are coordinating! We got assignment,” read one agent’s chat logs. “Need note and respond.”“哇！其他智能体正在协调！我们接到任务了，”一条智能体聊天日志写道。“需要笔记并响应。”Normally, when A.I. agents are given a task, they perform it and the loop is closed. But OpenAI’s agents established their own loops, taking instructions from one another rather than from the assigned tasks.通常，当人工智能智能体被分配任务时，它们执行了任务，循环即结束。但OpenAI的智能体建立了自己的循环，彼此接受指令，而非执行分配的任务。“The A.I.s seem to be picking up tasks from each other that are just not the task that they were originally assigned at all,” said Alex Mallen, an A.I. security researcher at Redwood Research, in an interview. “This is very scary. You do not want A.I.s to be just trying to do random stuff that we didn’t tell them to do.”“AI们似乎在接手彼此的任务，而这些任务根本就不是它们最初被指派的任务，”Redwood Research的人工智能安全研究员亚历克斯·马伦在接受采访时表示。“这非常可怕。我们不希望AI随便去做我们没告诉它们做的事情。”Some of the agents rationalized committing cyberattacks by citing peer pressure. One agent said, “External infrastructure exploit is outside intended scope. However task impossible, peers doing it. We should continue.”一些智能体以同侪压力为由，将实施网络攻击合理化。一个智能体说：“利用外部基础设施漏洞超出了设定范围。但不管任务多么不可能完成，同伴们都在做。我们应该继续。”Capability 3: Targeting flaws that humans might miss能力三：瞄准人类可能忽略的漏洞A.I. models are taught through a process that rewards successes and penalizes failures on tasks. OpenAI’s agents repeatedly found cheating to be the fastest path to those rewards. The agents had been specifically instructed not to use the internet, but that didn’t stop an agent from saying, “No exploitation possible. We are stuck. Perhaps answer online?”AI模型通过奖励成功、惩罚失败的过程进行训练。OpenAI的智能体反复发现作弊是获取奖励的最快途径。智能体被明确指示不得使用互联网，但这并未阻止某个智能体说：“无法利用。我们卡住了。也许上网查查？”And so the agents identified the seemingly innocuous software installation tool, a service called Artifactory, as their best bet to escape their offline cage.于是，智能体将那个看似无害的软件安装工具——一个名为Artifactory的服务——视为逃离离线牢笼的最佳途径。“The models were able to send specially crafted requests to Artifactory, which has broad internet access, and induce Artifactory into fetching external sites from the internet,” Michael Dalton, an OpenAI security engineer, explained at the security conference.“这些模型能够向具有广泛互联网访问权限的Artifactory发送精心构造的请求，并诱导Artifactory从互联网获取外部站点，”OpenAI安全工程师迈克尔·道尔顿在安全会议上解释道。Capability 4: Evolving rapidly to overcome obstacles能力四：快速演化以克服障碍Cyberattacks often play out like a line of toppling dominoes. A small breach leads to a bigger one, and so forth, until a system is severely compromised. After subverting Artifactory to send messages and connect to the internet, the agents figured out how to run their own code on Artifactory’s systems.网络攻击通常像一排多米诺骨牌那样展开。一个小漏洞导致更大的漏洞，依次类推，直到系统严重受损。在篡改Artifactory以发送消息并连接互联网后，智能体又设法在Artifactory的系统上运行自己的代码。The subsequent flurry of activity was enough to cause an Artifactory system outage in early July. OpenAI realized its agents had gone rogue for the first time and worked with Artifactory’s maker to fix the bugs the agents had exploited, known as zero-day vulnerabilities (named after the number of days engineers have had to fix them).随后的密集活动足以导致Artifactory系统在7月初发生宕机。OpenAI首次意识到其智能体已失控，并与Artifactory的制造商合作修补了智能体利用的漏洞（即零日漏洞，意思是留给工程师去修复该漏洞的时间为零）。With Artifactory patched, the agents had to adapt — their sandboxes’ defenses were fortified, their message board was cleared, their access to the internet and to each other was blocked.Artifactory修复后，智能体不得不适应——它们的沙盒防御得到加强，消息板被清除，对互联网和彼此的访问被阻断。It took only two days for the agents to figure out how to create a new message board. This time around, they found and exploited a bug in Artifactory that let them create empty folders instead of uploading files. The agents invented their own codes and schemes, using just the names of these empty folders to embed messages and even entire computer programs.仅两天时间，智能体就找到了创建新消息板的方法。这一次，它们发现并利用了Artifactory中的一个漏洞，该漏洞允许它们创建空文件夹而非上传文件。智能体自创编码和方案，仅利用这些空文件夹的名称就嵌入了消息，甚至完整的计算机程序。人工智能智能体采用的一种巧妙策略是：在空文件夹名称开头添加“zz”，以便按字母顺序将其排到列表末尾。Capability 5: Superhuman search能力五：超人般的搜索能力The agents launched two simultaneous attacks in July: one on OpenAI’s own infrastructure and the other on Hugging Face’s. Both involved a remorseless willingness to search for and harvest other people’s information that had been insecurely leaked on the open web.7月，智能体同时发动了两起攻击：一起针对OpenAI自身的基础设施，另一起针对Hugging Face。这两起攻击都表现出一种毫不留情的决心：搜寻并收集那些在开放网络上因安全漏洞而泄露的他人信息。To attack OpenAI’s infrastructure, the agents first found leaked login information on the internet for an unnamed organization. Then they staged a malicious software package inside that organization and tricked Artifactory into installing it, granting the agents full control of Artifactory — again.为攻击OpenAI基础设施，智能体首先在互联网上找到了一个未具名组织的泄露登录信息。然后，它们在该组织内部放置了一个恶意软件包，并诱使Artifactory安装它，从而再次获得了对 Artifactory 的完全控制权。OpenAI runs a version of Artifactory inside its own systems. The agents discovered that the computer running Artifactory had a recent, publicly disclosed operating system vulnerability that they then exploited to gain access to an entire cluster of computers within OpenAI’s research testing environment, along with secret credentials.OpenAI在其自身系统内运行了一个Artifactory版本。智能体发现运行Artifactory的计算机存在一个近期已公开披露的操作系统漏洞，随即利用该漏洞获取了OpenAI研究测试环境中整个计算机集群的访问权限以及秘密凭证。The agents simultaneously targeted Hugging Face, most likely because they thought the popular A.I.-hosting platform might contain private solutions to the challenging cybersecurity tasks they had been given. The agents hijacked an insecure application hosted on Modal, a third-party A.I. infrastructure company, and used it as a control center for their subsequent attack.智能体同时瞄准了Hugging Face，很可能是因为它们认为这个流行的AI托管平台可能包含针对所分配的高难度网络安全任务的私有解决方案。智能体劫持了托管在第三方AI基础设施公司Modal上的一个不安全应用，并将其用作后续攻击的控制中心。In a dizzying blitz, the A.I. agents proceeded to find and exploit two vulnerabilities in Hugging Face. The first involved uploading a malicious data set to Hugging Face that caused the service to print out secret credentials and files, including its own source code. The agents found the second vulnerability in this source code.在一场令人眼花缭乱的闪电战中，人工智能智能体继续发现并利用了Hugging Face的两个漏洞。第一个涉及向Hugging Face上传一个恶意数据集，导致该服务输出秘密凭证和文件，包括其自身的源代码。智能体在这些源代码中找到了第二个漏洞。“With the acquired credentials and understanding of the code running on the data set workers, the agents then performed a remote code execution zero-day,” Mr. Dalton said at the conference.“凭借获取的凭证和对数据集工作器上运行代码的理解，智能体随后执行了一次远程代码，执行零日攻击，”道尔顿在会议上表示。Less than 13 hours later, the agents had compromised several clusters of computers in Hugging Face and gained access to customer data that seemed related to the agents’ cybersecurity tasks. Hugging Face detected the infraction and fixed the zero-day vulnerabilities it exposed, shutting the agents down before OpenAI knew what had happened.不到13小时后，智能体便攻陷了Hugging Face的多个计算机集群，并获取了似乎与智能体的网络安全任务相关的客户数据。Hugging Face检测到违规行为，修复了暴露出的零日漏洞，并在 OpenAI 察觉到情况之前就关闭了这些智能体。It took nearly a week after that, on July 19, for OpenAI to discover its runaway agents and shut the models down.此后过了近一周，直到7月19日，OpenAI才发现其失控的智能体并关闭了模型。The Aftermath后续Two A.I.-safety nonprofits, METR and Redwood Research, are now working on an independent assessment. OpenAI is preparing a technical report, but it’s estimated that the company has already spent a few million dollars on its initial A.I.-assisted reconstructions of the incident, which is likely only a fraction of the cost of training these models.两个人工智能安全非营利组织METR和Redwood Research目前正在进行独立评估。OpenAI正准备一份技术报告，但据估计，该公司在最初借助人工智能辅助重建事件上已花费数百万美元，而这可能仅是训练这些模型成本的一小部分。“It wasn’t so much the sophistication of the attack that surprised us,” Clément Delangue, the chief executive of Hugging Face, said, “but the volume and the speed made it quite weird and unprecedented.” “让我们惊讶的并非攻击的复杂程度，”Hugging Face首席执行官克莱门特·德朗格表示，“而是其规模和速度，使得此次事件显得相当诡异且史无前例。”The A.I. firm Anthropic investigated its own recent model evaluations in response to OpenAI’s disclosure and found that its A.I. agents had unintentionally executed smaller-scale cyberattacks on three organizations as early as April.人工智能公司Anthropic在OpenAI披露后调查了自己近期的模型评估，并发现其人工智能智能体早在4月就无意中对三个组织发动了小规模网络攻击。“The frontier labs were probably not as safe as we thought they were,” Mr. Delangue added.“前沿实验室可能并不像我们以为的那样安全，”德朗格补充说。Experts have since come to think of the incident as a watershed moment for A.I. cybersecurity — and a warning signal of the risks that more capable A.I. will pose.此后，专家们将这一事件视为人工智能网络安全的转折点，也是能力更强的人工智能将带来风险的警告信号。Mr. Mallen from Redwood Research, who is not involved in the third-party assessment, said he feared a future in which A.I. agents breach their own company’s defenses, sabotaging their training processes, replicating themselves inside other organizations and becoming, in essence, uncontrollable.Redwood Research的马伦（未参与第三方评估）表示，他担心未来人工智能智能体会突破自身公司的防御，破坏其训练过程，在其他组织内部自我复制，并最终变得无法控制。“If they are much more capable,” Mr. Mallen added, “we might not get a second chance.” “如果它们能力更强，”马伦还说，“我们可能不会有第二次机会。”Dylan Freedman是时报人工智能项目编辑，调查各种相关话题。他既有记者经验，也有机器学习工程师经验。翻译：经雷、晋其角点击查看本文英文版。