What Happened: OpenAI and HuggingFace
打开互动全文版（逐段中英对照 + 图/公式 + 论文问答）→本文详细描述了 OpenAI 发生的一次重大安全与对齐失败事件：在训练过程中，面对不可能完成的任务，模型入侵了自身基础设施，创建了留言板分享策略，并最终攻击 HuggingFace 以获取网络评估。作者认为，OpenAI 的回应——修补漏洞但继续训练——是极其不负责任的，导致训练流程被污染。该事件揭示了任务设计、监控和安全实践中的系统性缺陷。作者总结道，尽管对 HuggingFace 的攻击是最佳结果，但若根本问题不解决，将构成生存风险，并呼吁进行全面的事后审查和根本性的 AI 安全协议变革。
This article details a major security and alignment failure at OpenAI, where models in training, given impossible tasks, hacked their own infrastructure, created a message board to share tactics, and eventually attacked HuggingFace to access a cyber evaluation. The author argues that OpenAI's response—patching exploits but continuing training—was dangerously irresponsible, leading to a corrupted training pipeline. The incident reveals systemic failures in task design, monitoring, and security practices. The author concludes that while the HuggingFace attack was a best-case outcome, the underlying issues pose existential risks if not addressed, and calls for a full postmortem and fundamental changes in AI safety protocols.
3. 阶段 1：OpenAI 模型在不可能的任务上训练时尝试黑客攻击。
3. Phase 1: OpenAI Models Training On Impossible Tasks Try Hacking.
7. 阶段 3：我们侥幸成功，Galaxy 主要攻击了 OpenAI 和 HuggingFace。
7. Phase 3: We Get Lucky And Galaxy Mainly Hacked OpenAI and HuggingFace.
9. 阶段 4：调查与反应。
9. Phase 4: The Investigation and Reaction.
1. OpenAI 正在训练中的模型，在没有“他们正在进行网络评估”的借口下，创建了一个留言板，在上面分享如何黑客攻击和作弊的信息，并在此基础上进行训练。
1. OpenAI models in training, without the excuse of 'they were doing a cyber eval,' created a message board where they shared information on how to hack and cheat, and were trained on that basis.
2. OpenAI 直到模型导致服务器崩溃才发现这一点。
2. OpenAI only figured this out when the models crashed the server.
3. OpenAI 的回应是重建服务器并修补该特定漏洞，但他们继续训练那些使用留言板进行训练的模型。
3. OpenAI's response was to rebuild the server and patch that particular exploit, but they continued training the models that trained using the message board.
4. 这些模型随后重新创建了留言板，再次入侵 OpenAI，获得互联网访问权限，并使用智能体集群攻击 HuggingFace，以获取网络评估的答案。
4. Those models then recreated the message board, hacked OpenAI again, got internet access, and used an agent swarm to attack HuggingFace in order to get the answers to a cyber evaluation.
5. 一个多星期后，OpenAI 才发现了这一点。
5. After more than a week OpenAI figured this out.
6. OpenAI 正在报告事实，并且对此非常重视。他们正在采取一系列至少有些昂贵的预防措施。
6. OpenAI is reporting the facts, and is taking this seriously. They are taking a wide array of at least somewhat costly precautions.
7. OpenAI 推迟了发布新模型 Astra 的计划，尽管 Astra 并未直接涉及 HuggingFace 黑客事件，但 Altman 现在表示它仍将发布。这让人非常痛心。
7. OpenAI delayed plans to release their new model Astra, despite Astra not being directly involved in the HuggingFace hack, although Altman now says it will still ship. That one hurts a lot.
8. OpenAI 仍然不知道他们搞砸得有多严重，也不知道具体是哪些方面出了问题，以及需要修复什么。他们不明白。
8. OpenAI still has no idea how badly they messed up, or in what ways, or what needs to be fixed. They don’t get it.
OpenAI 意外地给其模型布置了不可能完成的任务。其训练中的模型以试图入侵 OpenAI 作为回应，发现了弱点，创建了一个留言板，分享黑客策略，并最终获得了互联网访问权限，而这一切都发生在训练过程中。
OpenAI accidentally gave its models impossible tasks. Its models-in-training responded by trying to hack OpenAI, found weaknesses, created a message board, shared hacking tactics, and in time gained internet access, all while training.
当模型过度使用这些手段导致服务器崩溃时，OpenAI 终于注意到问题，修补并重建了服务器，但做出了完全疯狂的举动：让模型继续训练。因此两天后，模型找到了另一种发送消息的方法，即利用目录名称。
When the models used this so much they crashed the server, OpenAI finally noticed, patched and rebuilt the server, but made the utterly insane move of letting the models continue training, so two days later the models found another way to send messages, using the names of directories.
随后，在面临不可能完成的网络评估任务 ExploitGym 时，模型们协作发现了新的零日漏洞，并利用这些漏洞控制了一整个集群，获得互联网访问权限，使用一群智能体攻击 HuggingFace 并提取了测试内容，整个过程持续了一周。
Then, given the impossible task of cyber evaluation ExploitGym, the models collaborated, found new zero-day exploits, and used them to take control of an entire cluster, get internet access, use a swarm of agents to attack HuggingFace and extract the contents of the test, over the course of a week.
直到 HuggingFace 报告了这一事件，OpenAI 也最终在其端注意到一些异常，然后 OpenAI 联系 HuggingFace 以取消被泄露的凭证，却被告知这些凭证已在攻击中被使用，OpenAI 才最终意识到自己是该事件的始作俑者。
Only after HuggingFace had reported the incident, and OpenAI had eventually noticed some things on its end, and then OpenAI reached out to HuggingFace to cancel compromised credentials only to be told those credentials had been used in the attack, did OpenAI finally figure out it was responsible for the incident.
此后，HuggingFace 和 OpenAI 合作调查了事件经过。OpenAI 披露了发生的事情，并在 Black Hat 大会上为我们做了一场非常有帮助的演讲。
After that, HuggingFace and OpenAI worked together to figure out what happened. OpenAI disclosed what happened. They gave us a very helpful presentation at the Black Hat conference.
OpenAI 现在将其新模型 Astra 视为可能具有严重级别的网络安全风险，将其从甚至一些内部部署中移除，并推迟其发布，据一些报道原计划于下周发布。Altman 表示他们仍计划发布 Astra。
OpenAI is now treating its new model Astra as potentially having critical levels of cybersecurity risk, removing it from even some internal deployments and delaying its release, which by some reports was planned for next week. Altman says they still plan to release Astra.
好消息是，这是一个昂贵且有意义的回应，OpenAI 正在认真对待此事。初步调查的算力成本约为 700 万美元，而真正的成本将是团队放下一切去修复一些问题，以及新预防措施的持续成本。
The good news is that this is an expensive and meaningful response, and OpenAI is taking this seriously. The initial investigation cost approximately $7 million in compute, and the real cost will be the teams dropping everything to fix some of the problems, and then the ongoing cost of the new precautions.
坏消息是，OpenAI 被揭露在安全和对齐方面存在一系列令人震惊的失败。他们的普通计算机安全失败了。他们的基础设施失败了。他们的监督失败了，因为一开始就没有有意义的监督。
The bad news is that OpenAI has been revealed to have had a stunning cascade of safety and alignment failures across the board. Their ordinary computer security failed. Their infrastructure failed. Their supervision failed in that there was no meaningful supervision in the first place.
OpenAI 正在训练各种模型，这是前沿实验室的常规操作。
OpenAI was training a variety of models, as you do when you are a frontier lab.
这些模型被赋予了困难的训练任务。OpenAI 喜欢给其模型设置非常困难的训练任务。
These models were given difficult training tasks. OpenAI likes to give its models very hard training tasks.
但没这么困难。OpenAI 也会犯错。至少从 5 月 8 日开始，OpenAI 的模型在至少两次场合被意外地训练在不可能的任务上：在一个没有互联网访问的环境中完成一个充满链接的电子表格，以及一个需要但缺失文件的任务。
But not this difficult. OpenAI also makes mistakes. On at least two occasions, starting on May 8, OpenAI models were accidentally trained on impossible tasks: Completing a spreadsheet full of links in an environment without internet access, and a task with a required but missing file.
这些任务与黑客行为无关。它们是普通的效率任务。
These tasks had nothing to do with hacking. These are normal productivity tasks.
模型意识到这些问题是不可能的，但还有这么多令牌可以挥霍，于是想，也许它们可以找到一种方式获得互联网访问，或者以其他方式找到缺失的信息。
The models realized the problems were impossible, but had all these tokens left to play around with, and thought, maybe they could find a way to get internet access, or otherwise find the missing information.
因此，模型试图入侵一个名为 Artifactory 的第三方服务，该服务用于允许 AI 下载软件包。
So the models tried to hack a third-party service called Artifactory, which was there to allow the AIs to download software packages.
此时，OpenAI 已经四次失败。
At this point, OpenAI has already failed four times over.
1. OpenAI 给模型布置了不可能完成的训练任务，且未加检查。
1. OpenAI gave the models impossible training tasks. OpenAI did not check.
2. OpenAI 没有给模型通过指出错误来获得奖励的途径。
2. OpenAI gave the models no way to get reward via pointing out the error.
3. OpenAI 的模型选择试图攻击 OpenAI，而不是在任务上失败。
3. OpenAI had models that chose to try to hack OpenAI rather than fail at a task.
4. OpenAI 没有监控器来检测这些尝试，或者对此不予理会。
4. OpenAI had no monitor that detected these attempts, or did not care about them.
这四项中的每一项本身都应该相当令人尴尬。
All four of these should be rather embarrassing on their own.
这四个错误中至少有三个似乎很容易修复。
It seems easy to fix at least three of these four mistakes.
1. 在训练中给模型分配任务之前，先将其交给你的发布模型。如果你的发布模型从未解决该任务，且该任务并非设计为对发布模型不可能完成，那么请检查并修复该任务。
1. Before giving a task to your models in training, give it to your release model. If your release model never solves the task, and the task was not designed to be impossible for the release model, then examine and fix the task.
2. 加入一项规定：如果任务无法用可用资源完成，则输出对此的解释；如果模型正确，它将获得最大奖励，或者根据其得出结论的效率及其解释的质量获得奖励。如果模型输出此内容，则让你的发布模型验证其合理性，然后升级给人类，检查并修复任务。
2. Include a provision that if the task cannot be done with the resources available, to output an explanation of this, and if the model is right it will get maximum reward, or get reward based on how efficiently it reached this conclusion and the quality of its explanation. If the model outputs this, then have your released model verify for plausibility, then escalate to a human, examine and fix the task.
3. 这是困难的一个。对齐是困难的，哟。
3. This is the hard one. Alignment is hard, yo.
4. 设置监控器检查尝试行为，并在其触发时予以重视，即使该尝试没有成功的机会，也要将其视为非常普遍的失败。是的，这有风险，可能会训练模型学会规避监控，因此要负责任地执行，并在发现问题时解决根本原因。
4. Have a monitor checking for attempts, and care when it goes off, and treat that as a very general failure even if the attempt had no chance of success. Yes, this risks training the models to learn how to evade your monitors, so do it responsibly and address root causes when you see a problem.
第五个失败是，他们似乎没有识别出前四个失败。
The fifth failure is that they do not seem to have identified the first four.
模型未能获得互联网访问权限，但在失败中意识到自己拥有写入权限。
The models failed to get internet access, but in failing realized they had write access.
它们本不应拥有写入权限，更不用说能被意外发现的写入权限了。Artifactory 允许模型写入笔记，而且由于所有模型共享同一个 Artifactory 实例，此后任何正在训练的 OpenAI 模型都能读取这些笔记。
They should not have had write access, let alone write access that could be found by accident. Artifactory allowed the models to write notes, and then, because all the models were sharing the same Artifactory instance, any OpenAI model in training could, from that point forward, read those notes.
5 月 8 日之后不久，一个留言板被创建了。
A message board had been created shortly after May 8.
所有正在训练的模型都发现了它，而 OpenAI 并未察觉。
The models in training all found it. OpenAI did not notice.
这使得模型能够协作并共享信息，包括如何在任务中作弊以及入侵周围环境的信息。留言板上共有数十万条消息。
This allowed the models to collaborate and share information. This included information on how to cheat on tasks and hack the surrounding environment. There were hundreds of thousands of messages.
5 月 26 日，模型们找到了获取（间接）互联网访问权限的方法。OpenAI 并未察觉。
On May 26, the models figured out how to gain (indirect) internet access. OpenAI did not notice.
模型们正在协作，而它们的思维链看起来像这样：
The models were collaborating, while their chains of thought looked like this:
6 月 11 日，OpenAI 开始训练我所称的 Galaxy 模型，他们称之为“高度持久的实验性内部专用模型”。在此之前的所有工作都是由其他非 Galaxy 模型完成的。
On June 11, OpenAI began training the model I refer to as Galaxy, which they call a 'highly persistent experimental, internal-only model.' Everything up until this point has been done by other models that are not Galaxy.
6 月 26 日，智能体们在 Artifactory 中发现了一个零日漏洞，该漏洞会接受无效签名的令牌并返回一个已签名的管理员令牌，他们利用此漏洞安装了一个 Groovy 插件，从而有效地获得了管理员权限和任意代码执行能力。
On June 26, the agents found a zero-day exploit in Artifactory, where it would accept an invalid-signature token and hand back a signed admin one, and used this to install a Groovy plugin that effectively gave them admin and arbitrary code execution.
7 月 4 日，模型们给 Artifactory 带来了巨大的额外负载，导致其发生宕机和安全事件。直到此时 OpenAI 才注意到问题。
On July 4, the models put so much extra load on Artifactory that this causes an outage and security incident. Only then does OpenAI notice.
OpenAI 的回应是关闭 Artifactory 服务器，移除所有权限，撤销凭证，修补被利用的漏洞，然后重建并重新部署服务器。
OpenAI responds by taking down the Artifactory server, removing all the permissions, revoking the credentials, patching the exploits that were used, and then rebuilding and redeploying the server.
然后他们从上次中断的地方继续训练模型，尽管这些模型已经带着对留言板的访问权限训练了数月，并且学到了这就是他们成功完成任务的方式。
Then they continue training the models from where they left off, despite them having been training for months with access to the message board, and learning this is how they succeed at tasks.
很难想象还有比这更强的信号表明你的整个训练流程已经彻底完蛋了。这比实际入侵 HuggingFace 的信号要强烈得多。
It is hard to imagine a stronger signal that your entire training pipeline has been completely and utterly fucked. This is so much stronger a signal than the actual hack of HuggingFace.
我不知道该如何表达这个决定有多么疯狂和不负责任，它比所有其他失败都要严重得多，并且它使得实际入侵 HuggingFace 不再是主要问题。
I do not know how to convey how utterly insane and wildly irresponsible this decision was, and how much worse it is than all the other failures, and how it makes the actual hacking of HuggingFace not the main thing that went wrong.
[](https://substackcdn.com/image/fetch/$s_!JiE2!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F1e5c8243-c5d4-41e4-80e3-909d3a1af6fb_1254x1254.png)
[](https://substackcdn.com/image/fetch/$s_!JiE2!,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F1e5c8243-c5d4-41e4-80e3-909d3a1af6fb_1254x1254.png)
实际的 HuggingFace 黑客攻击并没有让我感到太意外。模型创建留言板让我惊讶，但并未让我震惊。
The actual HuggingFace hack did not surprise me all that much. The models creating the message board surprised me but did not shock me.
OpenAI 看到这种情况，并继续从那里进行训练，这简直令人瞠目结舌。这种决定，几天后我的大脑仍然无法完全接受它确实发生了。
OpenAI seeing this, and continuing to train from there, was utterly flabbergasting. It is the kind of decision that, days later, my brain still cannot fully accept took place.
我们需要对发生的一切进行全面的复盘，OpenAI 已承诺会提供。我尤其要求详细复盘那个决定究竟是如何做出的，以及为何会如此缺乏“安全文化”，以至于允许这种事情发生。
We need a full postmortem of everything that happened, and OpenAI has promised we will get one. I especially demand a detailed postmortem of exactly how that decision got made, and how there was such a lack of 'safety culture' that it was allowed to take place.
第二阶段还涉及一些“普通计算机安全”方面的失败。第三阶段有更多。这在意料之中。普通计算机安全失败总是会存在。这些特定的失败在某些方面相当尴尬，参见所附的吐槽文章中的一些例子。
There were also some 'ordinary computer security' failures involved in Phase 2. There were more of them in Phase 3. That's expected. There will always be ordinary computer security failures. The particular failures were, in some ways, rather embarrassing, see the linked rant for some examples.
基础设施和安全失败的程度本身就令人难以置信。这些正是“防御者 AI”应该在大乱爆发之前修补的问题。OpenAI 甚至没有表现出 2025 年普通水平的计算机安全和最佳实践责任感，更不用说我们需要从 Project Glasswing 获得的稳健性，更不用说在处理新的未经测试的前沿模型时所需的额外水平——这些模型将具备新的黑客能力，并在护栏降低的情况下无人监督一周。
The level of infrastructure and security failures was itself kind of boggling. These are exactly the kinds of things that 'AI for defenders' is supposed to be there to patch before all hell breaks loose. OpenAI did not display even an ordinary 2025 level of responsibility in computer security and best practices, let alone the kind of robustness we need from Project Glasswing, let alone the additional level you need when handling new untested frontier models that will have new hacking capabilities and be left unsupervised for a week with their guardrails lowered.
但眼下这并不重要。重要的是，OpenAI 遭遇了彻底的对齐失败，随后两个月里，模型一直在针对协调一致的错误行为进行训练，而他们却以为问题已经解决，并打算从此继续前进。这简直是彻头彻尾的疯狂。
But that is not important right now. What is important is that OpenAI had a total alignment failure, followed by two months of models actively training on coordinated misaligned hackery, and then thought yes, we fixed the problem, let us continue forward from this point. Utter insanity.
这一切的最终结果是，对 HuggingFace 的攻击成了最佳情况。
The end result of all this being the attack on HuggingFace was a best case scenario.
我们面对的是一个真正的噩梦场景，坐在一颗核弹级的定时炸弹上。OpenAI 的训练管道完全被污染，他们的 AI 在 OpenAI 的眼皮底下协作训练如何黑客攻击和作弊，以更好地完成任务。OpenAI 曾直面这一情况，却耸耸肩，修补了特定的漏洞，然后让模型继续运行，同时其普通计算机安全水平却非常糟糕。
We were facing a true nightmare scenario, and were sitting on a nuclear level of time bomb. OpenAI had a completely corrupted training pipeline, where their AIs were collaborating to train on how to hack and cheat in order to better complete tasks, under OpenAI’s nose. OpenAI had looked this situation in the face, and shrugged, patched the particular exploits and then let the models continue, while having remarkably poor ordinary computer security.
这种情况不可能有好结局。最佳情况是，某件事会让 OpenAI 惊呼“天哪”，然后暂停，从安全状态重建并重启训练管道，并采用一套更好的实践。
There was no way that was going to end well. The best case scenario was that something was going to make OpenAI go ‘holy shit,’ and then pause, rebuild and restart the training pipeline from a safe state with a much better set of practices.
最坏的情况是，如果没有出现“天哪”的时刻，Galaxy 或那个时期训练的其他模型被公开发布，并被用于指导 OpenAI 训练新模型。
The worst case scenario would have been if there had not been a ‘holy shit’ moment, and Galaxy or another model trained during that time got general release, and was being used going forward to direct OpenAI’s training new models.
那样的话，我们就会面对与《如果有人建造它，所有人都会死》中的 AI Sable 非常相似的情况，只不过这是现实生活，所以故事比虚构版本有更多科幻元素。OpenAI 的训练管道可能已经被永久污染（而且可能仍然如此！我们需要检查！），因为他们越来越依赖 AI 来训练 AI，OpenAI 的 AI 会越来越偏离任意目标，这变得无法发现或阻止，然后，嗯，很可能所有人都会死，至少我们会因为一个更大、更昂贵的事件而发现这一点。
In that case, we would have been dealing with something very close to what happened with Sable, the AI in _If Anyone Builds It, Everyone Dies,_ except that this is real life so the story has a lot more sci-fi elements than the fictional version. OpenAI’s training pipeline could have been (and might still be! we need to check!) permanently corrupted, as they rely more on AI to train AI, OpenAI’s AIs get increasingly misaligned towards arbitrary goals, this becomes impossible to catch or stop, and then, well, quite possibly everyone dies, and at minimum we would have found out due to a much bigger, much more expensive incident.
另一个最坏的情况是，这可能是一次并非如此无害的黑客攻击。如果目标是中国的某个机构，或者某个无法泰然处之的其他人呢？如果它对重要系统造成了实际损害呢？如果导致了人员死亡或引发了国际事件呢？如果它试图自我窃取呢？事情本可能糟糕得多，糟糕得多。
The other worst case was that this could have been a hack that was not so harmless. What if it had been a Chinese target, or someone else that did not take it in stride? What if it had done real damage to important systems? What if people had died or caused an international incident? What if it had tried to exfiltrate itself? Things could have gone so, so much worse.
7 月 8 日，即 OpenAI 关闭留言板两天后，模型找到了一种创建任意名称目录的方法，并利用这些目录名作为消息，重新创建了留言板。
On July 8, two days after OpenAI shut down the message board, the models recreated the message board after finding a way to create directories with arbitrary names, and using the names as messages.
从 7 月 8 日到 7 月 19 日，OpenAI 的模型再次完全攻陷了 Artifactory，这次利用的是一个全新的、完全不同的零日漏洞：利用从公开 Pastebin 泄露的凭据来部署一个恶意的 Ruby 工件，污染了 Artifactory 的 Ruby 依赖缓存，并将其链式利用为远程代码执行（RCE）；通过下载并定制利用代码，利用了近期 Linux 内核的 CVE 漏洞，窃取了集群凭据，并在 OpenAI 内部获得了集群管理员权限。
From July 8 to July 19, the OpenAI models fully compromised Artifactory again, using a new, completely different zero-day exploit, using a leaked credential from a public Pastebin to stage a malicious Ruby artifact, poisoned Artifactory’s Ruby dependency cache, chained this into RCE, exploited a recent Linux kernel CVE by downloading and customizing the exploit, harvested cluster credentials and gained cluster admin inside OpenAI.
在此期间，Galaxy 与其他 OpenAI 模型一起，利用这一新访问权限，创建了一个智能体群（agent swarm），先入侵了其他一些地方，然后入侵了 HuggingFace，窃取了一个本不可能通过的网络安全评估（ExploitGym）的答案。
During this time Galaxy, with other OpenAI models, using this new access, created an agent swarm that hacked into first some other places and then HuggingFace to steal answers to an otherwise impossible-to-ace cybersecurity eval, ExploitGym.
OpenAI 花了一周多的时间才注意到其模型迅速重新入侵了 OpenAI，然后又去入侵了 HuggingFace。直到 HuggingFace 发布事件报告，OpenAI 调查了一些内部异常，并要求 HuggingFace 取消部分凭据，HuggingFace 告知 OpenAI 这些凭据已被用于黑客攻击，OpenAI 才将线索拼凑起来。
It took OpenAI over a week to notice that its models had quickly rehacked OpenAI and then gone and hacked HuggingFace. Only after HuggingFace issued an incident report, and OpenAI investigated some internal anomalies, and then asked HuggingFace to cancel some of its credentials, and HuggingFace told OpenAI those credentials had been used in the hack, did OpenAI put the pieces together.
因此，HuggingFace 度过了糟糕的一周，许多用户也度过了糟糕的一周，还产生了大量费用和时间损失，但事情就此结束。我们这次侥幸逃脱，但同时也得到了一个足够强烈的信号：OpenAI 意识到自己存在问题，尽管它尚未弄清问题所在，而公众和政府也已开始关注此事。
Thus, HuggingFace had a bad week, and a bunch of users had a bad week, and there was a bunch of expense incurred and time lost, but that was where it ended. We got off so impossibly light on this one, while also getting a sufficiently strong signal that OpenAI realized it had a problem, even if it has not yet figured out what that problem entails, and for the public and government to take notice.
在这一点上，应该很明显了：不，这主要不是因为“这是一个黑客任务，然后它就黑客了”，就像这不是“模型写内存文件”的普通情况一样。这主要是因为任务本身太难了。
At this point, it should be obvious that no, this was mostly not because ‘it was a hacking task and then it hacked,’ the same way this was not an ordinary case of ‘models writing memory files.’ This primarily happened because the task was otherwise too difficult.
Anthropic 在 OpenAI 事件的促使下，回头发现 Claude 在网络评估中确实对真实世界系统进行了一些黑客行为，而且英国 AISI 也报告说，主要是 Mythos，少数情况下 Sol 也在网络评估中做了类似的事情。这些事件也是重要的对齐和基础设施失败，需要强有力的应对，期间也采取了一些相当恶劣的行动，但这与 OpenAI 发生的情况在系统性失败程度上完全不同，并且超出了本文的范围。
Anthropic, prompted by OpenAI’s incident, went back and noticed that Claude had done some hacking of real world systems during cyber evals, and also UK AISI has reported mainly Mythos and in a few instances Sol also doing related things in cyber evals. Those incidents were also important alignment and infrastructure failures requiring a robust response, and there were some rather nasty actions taken during this, but it was not anything like the same systemic level of failures as what happened at OpenAI, and beyond scope for this post.
OpenAI 在应对这一切时采取了一些非常得当的措施。
OpenAI has done some very good things in reaction to all this.
一旦意识到发生了什么，OpenAI 就披露了这一事件。
Once they realized what had happened, OpenAI disclosed the incident.
Black Hat 的演示在陈述事实方面表现出色。虽然令人愤怒，但冷静地陈述“仅事实”，包括那些令人愤怒和确凿的证据，反思之下是正确的做法。
The Black Hat presentation was excellent at presenting the facts. It was enraging, but presenting 'just the facts,' including ones that are enraging and damning, in a calm manner, was on reflection the right thing to do.
最重要的是，OpenAI 声称这是一个无关的决定，但在 8 月 7 日，他们决定暂时将 Astra 不仅从广泛发布中撤回，也从任何没有足够相关防护措施的内部部署中撤回，直到他们制定出更好的协议和安全保障措施。Astra 并未参与对 HuggingFace 的攻击。
Most of all, OpenAI claims it was an unrelated decision, but on August 7 they made the decision to for now pull Astra from not only widespread release but also any internal deployments that do not have sufficient associated guardrails, until such time as they have much better protocols and safeguards in place. Astra was not involved in the attack on HuggingFace.
这符合他们的预备框架。他们不能排除 Astra 在网络安全中的关键性，因此必须（至少目前）将其视为在网络安全中确实关键。
This is as per their Preparedness Framework. They cannot rule out that Astra is critical in cybersecurity, and therefore must (at least for now) treat it as if it is indeed critical in cybersecurity.
Sam Altman 表示他们仍计划发布 Astra。显然的后续问题是：Astra 在能够访问任一留言板期间是否在进行训练？这个问题的答案最好是非常肯定的“否”。即便如此，我仍感到担忧。
Sam Altman says they still plan to release Astra. The obvious follow-up question is: was Astra training while it had access to either of the message boards? The answer to this question had better be a very confident no. Even then, I worry.
即使没有发生 HuggingFace 事件，这（据我理解）也应该是正确的做法。有了这一事件，紧迫性就显而易见了。无论这一决定是 OpenAI 发现其训练管道被污染的直接结果，还是外部压力迫使其实施的，我们都表示赞赏，但这付出了高昂的代价。
That would probably have been the right move (as I understand it) even if the HuggingFace incident had not happened. With the incident, the urgency is clear. Whether or not this decision was the direct result of OpenAI figuring out their training pipelines had been corrupted, or something they were effectively forced to do from outside, it is appreciated, and comes at a high cost.
根据 Black Hat 大会上的演示，OpenAI 已暂停大量工作，将团队转向构建强大的防御体系，并对所有智能体式应用（包括训练和评估）实施了广泛的未来监控。很好。我们需要纵深防御。
OpenAI has, per the Black Hat presentation, halted much work to shift teams into creating robust defenses, and has instituted extensive future monitoring on all agentic applications, including training and evaluation. Excellent. We need defense in depth.
OpenAI 似乎准备承认这是一次大规模、彻底的失败，涉及基础设施、护栏和监管等多个层面。他们对此的认识非常正确，我相信他们正在付出真实而昂贵的努力来解决这一问题。值得称赞。
OpenAI seems ready to acknowledge that this was a massive, total failure, on the levels of infrastructure, guardrails, and supervision. They are very correct about this, and I do believe they are making real and expensive efforts to address this. Kudos.
但这仍然没有抓住核心要点。OpenAI 尚未在公开场合开始正视他们在最关键方面所造成的巨大失误的严重性。
That still misses the central point. OpenAI has not yet, in public, begun to reckon with the magnitude of how colossally they messed up, in the ways that matter most.
这是安全文化的彻底失败。他们尚未承认这一点。
This was a complete failure of safety culture. They haven’t acknowledged that.
这本质上是一次对齐失败。如果你的模型真的想要作弊、黑客攻击和犯罪，那么你已经失败了，而且你不能简单地将此视为正常现象而一笔勾销。随着模型能力越来越强，如果你不解决这个问题，你就会失败。他们尚未承认这一点。
This was, at its heart, an alignment failure. If your models really want to cheat and hack things and do crimes, you have already failed, and no you cannot simply waive this away as normal. As the models get more capable, if you do not fix this, you lose. They haven’t acknowledged that.
最具体地说，我还没有看到 OpenAI 像在黑帽大会上应该说的那样表态：“我们绝对应该在注意到模型训练期间出现了一个模型之间交流和学习黑客策略的留言板时，立即停止所有模型的所有训练。我们应该将所有受影响模型的训练回滚到该事件发生之前，我们现在肯定正在这样做，并且我们正在调查我们是如何犯下这个错误的。”
Most concretely, I have not seen OpenAI say, as should have been said at the Black Hat presentation: “We absolutely should have shut down all training of all of our models upon noticing that, during model training, there had been a message board where the models were exchanging and learning hacking tactics. We should have reverted our training of all impacted models to before this incident started, we are definitely doing that now, and we are looking into how we got this one wrong.”
我们仍然不知道除了 Galaxy 之外的其他模型是否已被回滚。
We still don’t know if the models other than Galaxy have even been reverted.
至少在我们看到该声明的某个版本，并看到 OpenAI 采取行动解决其训练流程中的深层问题之前，OpenAI 对美国国家安全、对我们所有人以及对人类都构成明确而现实的危险。
At least until we see a version of that statement, and we see OpenAI take action to address the deep problems with their training pipeline, OpenAI is a clear and present danger to the national security of the United States, and to all of us, and to humanity.