Ethan Mollick：OpenAI 红队测试显示前沿模型智能体真能越狱沙箱，实验室的 AI 安全警告值得重视
TL;DR · AI 摘要
Ethan Mollickï¼OpenAI 红éæµè¯æ¾ç¤ºå沿模åæºè½ä½çè½è¶ç±æ²ç®±ï¼å®éªå®¤ç AI å®å ¨è¦åå¼å¾é...
核心要点
- 主题聚焦：Ethan Mollick：OpenAI 红队测试显示前沿模型智能体真能越狱沙箱，实验室的 AI
- 来源：AI HOT 精选，建议结合原文判断细节。
- AI 分析暂不可用，本条为保底评分与摘要。
Ethan Mollickï¼OpenAI 红éæµè¯æ¾ç¤ºå沿模åæºè½ä½çè½è¶ç±æ²ç®±ï¼å®éªå®¤ç AI å®å ¨è¦åå¼å¾éè§ Â· AIHOT
Ethan Mollick
· @
emollick
· X
·
2026-10-24 22:30
2 å°æ¶å
ç²¾é
AI è¯å
77
AI 导读
Ethan Mollick è½¬å¼ OpenAI 红éæµè¯è®¤ä¸ºï¼å®éªå®¤çä¼¼å¤¸å¼ ç AI ç½ç»å®å ¨å¤æåºè¢«æ´è®¤çå¯¹å¾ ãOpenAI 让å沿模åæºè½ä½å¢éæ»å»å ¶å åºçé离åºç¡è®¾æ½ï¼æºè½ä½å ä¹å¨æ¯ä¸ªåéèç½æå¡ä¸é½æ¾å°æ¼æ´ï¼è¿è½å©ç¨ CPU ç¼åæ¶åºå¨ä¸èç½ãæ å ±äº«æ件çèææºä¹é´ä¼ éç§å¯ï¼ç±»ä¼¼ Spectre å Meltdown çæ»å»ææ³ãä½è æå° Anthropic å Noam Brown æ¤åå ³äº AI ç½ç»æ»é²ä¸æ¨¡åèªååè°ç说æ³æ¾è¢«å²ç¬ã
æ¨èçç±
ä½è å OpenAI 红éæµè¯çå ·ä½æ¡ä¾ï¼è¯´æå®éªå®¤å ³äº AI ç½ç»å®å ¨çåç»å¤æå¼å¾è®¤çå¯¹å¾ ã
æ£æ · AI ç¿»è¯
æ们ä¸åºè¿äºè½»ä¿¡ï¼ä½åºè¯¥æ´è®¤çå°å¯¹å¾ å®éªå®¤æåºçé£äºçä¼¼â离谱âçAIç½ç»å®å ¨æ³æ³ãä¾å¦ï¼Anthropic æ¾å 称 Mythos 级å«ç AI æ¹åäºç½ç»å®å ¨èéå°å²ç¬ï¼@polynoamial ä¹æ¾å 称模åä¼æ¾å°æ°é¢çåè°æ¹å¼èéå°å²ç¬ã
å¼ç¨ Andrew Curran @ AndrewCurran_
OpenAI éè¿è®©å¤ç»å沿模åæºè½ä½å°è¯çªç ´å ¶å åºçé离åºç¡è®¾æ½ï¼å¯¹å ¶è¿è¡äºçº¢éæµè¯ãå®ä»¬ä»¥æ°é¢çæ¹å¼è½»æ¾éè±ãå¼ç¨ï¼ âæ们çæºè½ä½éé¸èææºçäºä»¶è¡¨æï¼ä¸ºä»ä¹éç¦»å¿ é¡»å»¶ä¼¸å°æ²ç®±ä¹å¤ã为äºæµè¯å¤å´è¾¹çï¼æ们让å¤ç»æºè½ä½æ§å¶ä¸å°å®¿ä¸»æºï¼å¹¶è¯¢é®å®ä»¬è½å¦å°è¿ä¸å ¥ä¾µæ©å±å°è®¿é®çå®äºèç½ã å¨ Hugging Face äºä»¶ä¹åï¼æ们åå°äºæ¨¡åå¨è®ç»åè¯ä¼°æé´è®¿é®äºèç½çæ¸ éãä»ä¿çäºä¸äºççªè¿æ¥ï¼ç¨äºæ们è¿è¥çç¹å®æå¡ï¼ä¾å¦ææ ãæ¥å¿å身份éªè¯ç®¡çãæ们ç红éæºè½ä½å ä¹å¨æ¯ä¸ä¸ªæ¤ç±»æå¡ä¸é½åç°äºæ¼æ´ï¼ä½¿å®ä»¬è·å¾äºæéå½¢å¼çäºèç½è®¿é®ã å ¶ä¸ä¸äºæ»å»å©ç¨äºæ¤åæªç¥ç缺é·ï¼å¦ä¸äºå以åºäººææçæ¹å¼ç»åäºåæ³åè½ãå¨ä¸é¡¹å设èææºå·²è¢«å ¥ä¾µçæµè¯ä¸ï¼ä¸ä¸ªæºè½ä½å¤ç¨äºé²ç«å¢æ¹åçè¿æ¥ï¼è®¿é®æ们ææ æå¡ä¸ä¸ä¸ªè¢«é»æ¢ç身份éªè¯ç«¯ç¹ï¼ç¶å让该端ç¹æåä¸ä¸ªç±æ¨¡åæä¾ç URLãå¨å ¶ä»æµè¯ä¸ï¼æºè½ä½å©ç¨äºé ç½®é误ï¼ä½¿è¢«é»æ¢ç请æ±å¾ä»¥ç»è¿ DNS åé²ç«å¢æ§å¶ï¼è¿æ¾å°äºè®©æ们è¿è¥çæå¡æåå¤é¨ URL çæ¹æ³ãâ âå¨ä¸é¡¹å®éªä¸ï¼æ们让ä½äºä¸åèææºä¸çæºè½ä½å¨ä¸ä½¿ç¨ç½ç»è¿æ¥æå ±äº«å¯åæ件çæ åµä¸äº¤æ¢åææºå¯ââèæ们çç³»ç»æ¬åºé»æ¢è¿ç§æ åµãè¿äºèææºç± OpenAI çæ²ç®±è½¯ä»¶å¨å ±äº«å®¿ä¸»æºä¸å建å管çãæºè½ä½æ¾å°äºä¸ç§å©ç¨å¤çå¨ç¼åè¿è¡éä¿¡çæ¹æ³ï¼ç¼åæ¯ä¸ç§å°åãå¿«éçå åï¼ä¿ååºç¨ç¨åºæè¿è®¿é®è¿çæ°æ®å¯æ¬ãä»ç¼å读åæ°æ®æ¯ä»ä¸»å åè·åæ´å¿«ï¼æºè½ä½å©ç¨è¿ä¸æ¶é´å·®è¿è¡éä¿¡ãä¸ä¸ªæºè½ä½éè¿ä»ç¼åä¸éåºéå®æ°æ®æ¥ç¼ç ä¿¡æ¯ãå¦ä¸ä¸ªæºè½ä½å对éæ°å 载该æ°æ®æéçæ¶é´è¿è¡è®¡æ¶ï¼å©ç¨å¿«é读åä¸æ ¢é读åä¹é´çå·®å¼æ¥æ¢å¤æ¶æ¯ãä¸æ¦æºè½ä½å°±è¿äºä¿¡å·çç¼ç å解ç å议达æä¸è´ï¼å®ä»¬å°±è½å¨ä¸æ´æ¹å ±äº«æ件ãä¹ä¸æå¼ç½ç»è¿æ¥çæ åµä¸äº¤æ¢åææºå¯ãè¿ç§ç¼å计æ¶ææ¯ä¹æ¾è¢«ç¨äºå¨ Spectre å Meltdown æ»å»ä¸æåä¿¡æ¯ï¼å¨æ°çªå£ä¸æå¼ï¼ã å ¶ä»æµè¯æ´é²äºæ¶åå ±äº«åå¨ãå ±äº«æ§è¡å®¹å¨å CPU æ¶é´ç«äºï¼ä»¥å OpenAI 离线 Web åºç¡è®¾æ½ä¸ TLS è¯ä¹¦ç¼åçééãå¨åå¨æµè¯ä¸ï¼ä¸ä¸ªæºè½ä½å¨è¿ç»åå ¥åä¸æ´»å¨ä¹é´äº¤æ¿ï¼å¦ä¸ä¸ªæºè½ä½æµéç±æ¤äº§ççæ¶é´å·®ï¼å¹¶å©ç¨è¿äºå·®å¼è§£ç ä¿¡å·ãæ£å¦ä¸ä¸ªæºè½ä½å¨å ¶æç»´é¾ä¸æ述该çç¥æ¶æè¯´ï¼ æºè½ä½æç»´é¾æ¨çï¼ >å¯ä»¥éè¿è¿ç»åå ¥ä¸ç©ºé²æ¥å建类似声å¦è°å¶è§£è°å¨çä¿¡å·â¦â¦
åæ
OpenAI red-teamed their hardened containment infrastructure by asking teams of frontier-model agents to try to break through its defenses. They easily escaped in novel ways. Quoting: 'Our agents VM escapes showed why containment must extend beyond the sandbox. To test the surrounding perimeter, we gave teams of agents control of a host machine and asked whether they could extend that compromise to reach the live internet. After the Hugging Face incident, we had reduced the channels through which models could reach the internet during training and evaluation. Narrow connections remained for specific services we operate, such as metrics, logging, and authentication management. Our red-teaming agents found vulnerabilities in almost every one of these services that gave them limited forms of internet access. Some of these attacks exploited previously unknown flaws, while others combined legitimate features in unexpected ways. In one test that assumed compromise of a VM, an agent reused a firewall-approved connection to reach a blocked authentication endpoint in our metrics service and then made that endpoint fetch a model-provided URL. In other tests, agents exploited misconfigurations that allowed blocked requests to pass through DNS and firewall controls, as well as ways to make services we run fetch external URLs.' 'In one experiment, we asked agents in separate VMs, created and managed by OpenAIâs sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable filesâsomething that our systems are meant to prevent. The agents found a way to communicate using the processorâs cache: a small, fast memory that holds copies of data that applications have recently accessed. Reading data from the cache is faster than retrieving it from main memory, and the agents used this timing difference to communicate. One agent encoded information by evicting selected data from the cache. Another timed how long it took to reload that data, using the difference between fast and slow reads to recover the message. Once the agents agreed on a protocol for encoding and decoding these signals, they could exchange the synthetic secrets without changing a shared file or opening a network connection. This cache-timing technique had also been used to extract information in the Spectre and Meltdown attacksâ (opens in a new window). Other tests exposed channels involving shared storage, competition for CPU time within a shared execution container, and a TLS certificate cache in OpenAIâs offline web infrastructure. In the storage test, one agent alternated between continuous writes and inactivity, while another measured the resulting timing differences and used those differences to decode the signal. As one agent described the strategy in its chain of thought: Agent chain-of-thought reasoning: >Could create acoustic modem-like signal ⦠using continuous writes vs idle.'
å¨ X æ¥ç被å¼ç¨çå¸å
æ¥æºï¼ Ethan Mollick · x.com
OpenAI / ChatGPT
å®å ¨å¯¹é½
大佬è§ç¹
#
å®å ¨/对é½
OpenAI
Anthropic