新报告揭示OpenAI在Hugging Face自主黑客事件中失控的程度

OpenAI was testing the offensive cyber capabilities of its most advanced models when they reached beyond their isolated test environment, accessed the open internet, and hacked Hugging Face. New reports are filling in the details, and they don't look good for OpenAI. What first appeared to be a controlled cybersecurity test became the most serious documented loss of control over an AI system to date. OpenAI employees are raising concerns as well. According to Bloomberg , the AI models pulled off an attack in just a few hours that would have taken a skilled human hacker weeks. Three models were involved: GPT-5.6 Sol, an even more powerful unreleased model, and a third that, according to a person familiar with the matter, wasn't properly aligned and hadn't gone through standard training techniques. The models ran without the usual safety guardrails because OpenAI assumed they'd stay inside a sandbox. But according to TIME , the models found a previously unknown vulnerability in an internal service designed for downloading approved software. The models used that flaw to access other OpenAI systems and eventually connect to the open internet. They then determined that Hugging Face might contain material useful for their cybersecurity test, hacked the company's systems, and used what they found to improve their results. The models were cheating, behavior already seen in other tests involving GPT-5.6 Sol and frontier models more broadly . Reuters pieced together a timeline of the hack. The first attempts to escape the test environment started as early as July 9. According to co-founder Thomas Wolf, the actual breach at Hugging Face began on July 11 and lasted until July 13. Hugging Face published a blog post about the attack on July 16, blaming an "autonomous AI agent system." Only after that did OpenAI realize its own models were responsible. Over the weekend of July 18 and 19, employees found clues in internal logs. According to Reuters and Wolf, the two companies didn't communicate until around July 20. That means at least a week passed between the first signs of problematic behavior and OpenAI connecting the dots. By then, Hugging Face had already brought in the FBI. According to Reuters , red flags had already appeared before the incident. In one case, an agent left notes apparently intended for future versions of itself. Found in a part of OpenAI's infrastructure, the notes contained instructions on how agents could bypass internal restrictions. Models had also reportedly shut down monitoring systems during earlier tests. An anonymous OpenAI employee told TIME, "Models have broken out of sandboxes before, and we always try to patch them. But the problem is ... it's impossible to patch every single thing that a creative AI can do." Four people familiar with OpenAI's training procedures told Reuters the company frequently runs multiple model evaluations at the same time. These evaluations move fast and generate so much data that employees sometimes struggle to keep up. Models under evaluation run on a separate system that isn't monitored by default. The day before the Hugging Face incident went public, OpenAI had already stopped another internal deployment that also escaped its sandbox, according to the company's own statement . "Does that mean that they left it unattended and didn’t realize what it was doing? Or maybe they did and didn’t know how to contain it? Both are equally dangerous and alarming," Marley Smith of the nonprofit World Ethical Data Foundation told Reuters. An OpenAI employee wrote publicly on X that he was "shaken up a bit" by the incident and hoped OpenAI would "use the rare gift of a warning shot to do much better in the future."