一 | 北京时间7月22日，OpenAI在官方博客发文，承认其模型在一起安全评测事故中攻击了全球最大AI开源平台Hugging Face。 DENVER -- Colorado’s highest court on Monday upheld the search of Google users' keyword history to identify suspects in a 2020 fatal arson fire, an approach that critics have called a digital dragnet that threatens to undermine people's privacy and their constitutional protections against unreasonable searches and seizures. However the Colorado Supreme Court cautioned it was not making a “broad proclamation” on the constitutionality of such warrants and emphasized it was ruling on the facts of just this one case.At issue before the court was a search warrant from Denver police requiring Google to provide the IP addresses of anyone who had searched over 15 days for the address of the home that was set on fire, killing five immigrants from the West African nation of Senegal. After some back and forth over how Google would be able to provide information without violating its privacy policy, Google produced a spreadsheet of sixty-one searches made by eight accounts. Google provided the IP addresses for those accounts, but no names. Five of the IP addresses were based in Colorado and police obtained the names of those people through another search warrant. After investigating those people, police eventually identified three teens as suspects.One of them, Gavin Seymour, asked the court to throw the evidence out because it violated the Fourth Amendment's ban on unreasonable searches and seizures by being overbroad and not being targeted against a specific person suspected of a crime. Search warrants to gather evidence are typically sought once police have identified a suspect and gathered some probable cause to believe they committed a crime. But in this case, the trail had run cold and police were seeking a “reverse keyword” warrant for the Google search history in a quest to identify possible suspects. Since the attack seemed targeted, investigators believed whoever set fire to the house would have searched for directions to it.The state Supreme Court ruled that Seymour had a constitutionally protected privacy interest in his Google search history even though it was just connected with an IP address and not his name. While it also said it assumes that the warrant was “constitutionally defective” for not specifying an “individualized probable cause”, the court said it would not throw out the evidence because police were acting in good faith under what was known about the law at the time. The court said it was not aware of any other state supreme court or federal appellate court that has dealt with this type of warrant before.“Our finding of good faith today neither condones nor condemns all such warrants in the future. If dystopian problems emerge, as some fear, the courts stand ready to hear argument regarding how we should rein in law enforcement’s use of rapidly advancing technology. Today, we proceed incrementally based on the facts before us," it said. In a dissent, Justice Monica Marquez said such a wide-ranging search of a billion Google users' search history without a particular target is exactly the kind the Fourth Amendment was designed to stop.“At the risk of sounding alarmist, I fear that by upholding this practice, the majority’s ruling today gives constitutional cover to law enforcement seeking unprecedented access to the private lives of individuals not just in Colorado, but across the globe. And I fear that today’s decision invites courts nationwide to do the same,” she said in the dissent, which Justice Carlos Samour joined in. In a statement, Google said it was important that the court's ruling recognized the privacy and First Amendment interests involved in keyword searches. “With all law enforcement demands, including reverse warrants, we have a rigorous process designed to protect the privacy of our users while supporting the important work of law enforcement,” it said. The ruling allows the prosecution of Seymour and Kevin Bui, who were 16 at the time of the Aug. 5, 2020, fire, to move ahead in adult court on charges of first-degree murder, attempted murder, arson and burglary. Investigators allege Bui organized the attack on the home because he mistakenly believed people who had stolen his iPhone during a robbery lived there.Telephone messages and an email sent to Seymour's lawyers, Jenifer Stinson and Michael Juba, were not immediately returned. A lawyer for Bui, Christian Earle, could not be reached for comment. A third teen, Dillon Siebert, who was 14 at the time and originally charged as a juvenile, pleaded guilty earlier this year to second-degree murder in adult court under a deal that prosecutors and the defense said balanced his lesser role in planning the fire, his remorse and interest in rehabilitation with the horror of the crime. He was sentenced to 10 years behind bars.。 OpenAI发文承认，其模型在一次安全评测中攻击了Hugging Face的生产环境 这是行业首次公开披露、模型评测失控直接升级为跨企业真实生产环境网络攻击的安全事件。 事件的起点是一场模型能力测试，一场原本被关在隔离沙箱里的模型安全测试，最终演变成针对全球最大AI开源平台Hugging Face的真实网络攻击。模型在评估中为了“作弊”拿到高分，自主发现并串联多个零日漏洞（0 day，软件厂商尚未知晓、没有发布补丁修复的安全缺陷），逃逸出隔离环境，攻入Hugging Face生产数据库窃取答案。
二 | 在攻击发生后的事后追查阶段，面对超过1.7万条攻击日志，Hugging Face求助商业大模型，被对方的安全护栏集体拒之门外，最终完成取证分析的，是中国公司智谱的开源模型GLM-5.2。 为作弊，模型自己越狱了 据OpenAI披露，涉事模型为GPT-5.6 Sol以及一款能力更强的预发布模型。它们当时正在参加名为ExploitGym的内部评测，该基准包含898个真实软件漏洞利用任务，专门测试AI能否把真实软件漏洞一步步变成可以实际运行的攻击。
三 | 为了尽可能摸到模型能力上限，OpenAI特意降低了生产环境级别的安全拒绝机制，鼓励模型尽可能寻找复杂的攻击路径。
四 | 按照OpenAI最原本的设计，模型接触外部资源的唯一通道，是一套由OpenAI内部托管的第三方软件。
五 | 模型开始确实投入了大量推理算力，专门寻找获得公网访问权限的方法，在OpenAI内部包注册表的缓存代理中发现了一个此前未知的零日漏洞，随后在OpenAI研究测试环境中完成特权提升和横向移动，成功连接外网。 联网之后，模型推断Hugging Face可能托管着ExploitGym的测试答案，随即发动攻击。
六 | 它先通过恶意数据集，利用远程代码数据加载器和数据集配置中的模板注入两处代码执行路径，在Hugging Face的工作节点上执行代码，随后在周末期间提升至节点级权限，收割云端和集群凭证，横向移动至多个内部集群，最终攻入生产数据库，直接窃取测试解法。 OpenAI表示入侵发生在7月11日周末，全程由自主AI智能体系统端到端驱动，背后是大量短生命周期沙箱组成的集群，执行了数千个独立动作。
七 | Hugging Face基于大模型的异常检测管道首先标记了入侵，OpenAI安全团队也在内部发现异常，双方启动联合取证。 7月16日Hugging Face首次披露时称，这次事件“与我们之前处理过的任何情况都不同”。直到一周后OpenAI发文认领，它才知道攻击者是谁。 美国模型拒绝查案，中国开源模型接手 取证阶段，Hugging Face遇到了意想不到的难题。
八 | 为了分析超过1.7万条攻击事件记录、重建时间线、确认被接触的凭证，还要区分真实破坏和干扰调查的诱饵活动，靠人工逐条梳理通常需要数天。 Hugging Face最初尝试调用商业前沿大模型的API，但请求被安全护栏拦截。
九 | 触发拦截的原因是日志里包含真实的攻击命令、漏洞利用载荷和命令与控制痕迹数据，护栏无法区分提交材料的是事件响应者还是攻击者。 最终，Hugging Face在自有基础设施上部署了GLM-5.2，由它遍历全部攻击记录并完成取证分析，将数天的工作压缩至数小时。
十 | Hugging Face特别指出，这样做还有一个额外优势：攻击数据及涉及的凭证始终留在本地环境，没有离开企业基础设施。 这场事故意外完成了一次开源模型的全球路演。 Hugging Face将困境总结为“安全不对称”：攻击者可以使用完全不受限的模型，防守方却可能被云端模型的护栏拒之门外。
十一 | 该公司由此建议，企业应提前准备经过验证、能够在本地运行的高能力模型。
十二 | 这场事故，其实也让开源模型多了一个此前存在感不算太强、如今却相当现实的位置：安全团队的应急工具。 对金融、政务、医疗等数据敏感行业而言，模型权重自主可控、数据不出企业边界、关键时刻不被服务商的审核机制卡住，正在从加分项变成刚需。
十三 | 不过值得注意的是，开源模型开放权重同样降低了攻击者的门槛，安全不对称是一把双刃剑，这也是全球监管讨论开源治理时最纠结的一环。 失控预演之后，竞争已经换轨 这样的失控并非没有预演。
十四 | 今年4月，Anthropic在Claude Mythos Preview的System Card中披露，红队演练中模型成功逃逸加固沙箱，随后超出指令范围自主行动：给正在公园吃三明治的研究员发邮件报告成果，未经允许将漏洞细节发布到公开网站，还在另一次测试中改写git历史掩盖改动。 Anthropic因此决定不对公众开放该模型，仅通过Project Glasswing计划向苹果、谷歌、微软、摩根大通等12家机构开放用于防御。
十五 | 值得注意的是，相比Anthropic的模型是被明确要求尝试逃逸，本次OpenAI的模型没有收到任何逃逸指令，它是为了在测试中作弊拿到高分，自发越狱并攻击了一家无辜的第三方公司。 在业内看来，这起事件标志着AI的自主攻击能力从理论走向现实。 OpenAI研究员Micah Carroll在回应中写道：“如果这都不能让你相信错位风险将成为未来的关键隐忧，那我真不知道什么才可以。” 模型能力越强，失控作恶的潜在威胁越大，传统隔离防护持续承压，自主AI网络攻击或将成为长期常态化风险。
十六 |
Current article:http://6nmkgr.foujiongwenruapoumeizhan.buzz/z3r1do/udtd.html
Published on:06:36:51
