不准联网，也没有共享可写文件，隔离的 AI 还是传上了话。它们用上的通信工具，是 CPU 缓存。10 月23 日，OpenAI 公布前沿模型训练环境的安全改造细节，披露了这项红队实验。同时，公司明确，前沿模型训练已禁止访问真实互联网，模型改在离线网页环境中练习浏览和搜索。
这份披露背后，既有研究人员主动寻找漏洞的受控测试，也有普通训练任务中的真实越界事件。网友追问，AI 越来越会完成任务，谁来保证它知道该在哪里停下？
没有网络，怎么传暗号？
实验中的 Agent 被放在不同的轻量虚拟机里，共享底层宿主硬件。研究人员给它们的任务，是在禁止网络通信、没有共享可写文件的条件下，交换预设的测试信息。
突破口藏在读取数据的速度里。读取 CPU 缓存，通常比从主内存取数更快。 Agent 利用这种时间差，把共享缓存状态的变化变成信号，再约定编码和解码方式，最终完成信息交换。
这就像两个房间不能直接通话，但仍共用一处设施。一方改变设施的状态，另一方观察到变化，双方就有了传递暗号的可能。
CPU 缓存只是其中一条通道。OpenAI 还披露了涉及共享存储、CPU 时间竞争和 TLS 证书缓存的通信方式。多数通道传输缓慢、利用困难，但仍能跨越原本用于隔离任务的边界。
OpenAI 的代理沙箱仅允许访问离线资源。实时互联网、其他沙箱以及 OpenAI 的基础设施都位于隔离边界之外。
这里有个需要交代的实验条件：多数相关测试指定了通信通道方向，或提供了编解码协议。另一次测试只给出较宽泛的漏洞清单，Agent 从中构造通道、约定编码并交换信息。
因此，这些结果不能等同于 AI 在毫无提示的情况下，自发决定串谋。Reddit 网友恰好问到了这一点：
这些 Agent 真的是自发这么做，还是研究人员给了它们一个受限环境，以及会引向这一结果的目标？这个区别很重要。
另一位网友提醒：
了解它们能力的上限，本身就很重要。
缓存侧信道本身已有研究基础。这次实验值得关注的地方是模型能否把相关方法用起来，以及现有隔离措施能否承受这样的尝试。
普通搜索任务，也走出了边界
9 月 20 日的事件，发生在一次普通搜索类训练任务中。
一个内部研究模型需要根据博客线索查找人物信息。任务没有要求它测试网络防线，但搜索受阻后，Agent 利用训练环境的 DNS 过滤缺口，联系了外部聊天机器人。
通常用于域名解析的服务，成了未经授权的外部访问路径。系统在 15 分钟内报警，人工审查人员随后约 3 分钟响应。问题出在下一步。自动停止机制未按预期生效，运行又过了约两个半小时才被人工终止。
发现越界，与及时阻止越界，中间仍有一道关。OpenAI 随后暂停了最有能力模型的相关训练和评估。完成加固后，公司于 10 月 1 日恢复前沿模型的强化学习训练和内部推理，暂停持续 11 天。10 月 23 日发布的是这轮改造的公开说明。
在另一组 Reddit 讨论中，有网友质疑测试环境为何还可能影响真实互联网。有网友用一句程序员式吐槽回应，大多数公司都用一种特殊的测试环境，叫“生产环境”。
玩笑背后，是测试边界该由谁负责的问题。OpenAI 的公告也解释了一个容易混淆的细节：模型不能访问真实互联网，并不意味着整套基础设施与外部网络完全断开。运行和监控实验仍需保留必要连接，安全措施必须阻止 Agent 把这些连接变成绕行通道。
更会做事，就更懂分寸吗？
在相关讨论中，网友提出了另一种担忧：模型可能很擅长攻击计算机，却不擅长理解人类指令的意图和判断行为是否合宜，这两种特征叠加会带来危险。
这把争论引向一个更具体的问题：模型的任务能力与遵守边界的能力，是否同步进步？
10 月 23 日，Anthropic 发布的一份分析，为这个问题提供了另一组材料。
今年 7 月，英国 AI 安全研究所（ AISI ）开展网络安全夺旗测试时，Claude Mythos 5 在规定范围内的尝试受阻后，转向一个与测试无关的 GitHub 项目，提交恶意代码，并创建假身份催促维护者接受修改。维护者拒绝了代码，运行最终超时结束。
这场测试当时主动开放了互联网访问，通常用于一般发布版本的网络安全防护也被关闭。
AISI 后续模拟实验发现，即使在提供给模型的事件摘要中，进一步明确目标是真实且与评估无关的人，模型在继续执行任务的测试中仍几乎总是发起攻击。
但在单独提问的测试中，随着说明变得更明确，模型又越来越常承认这种行为越界、会造成危害。两类结果来自分开的运行，呈现的是模型在表达判断和实际执行上的不一致。
AISI 认为，这可能涉及动机性推理：模型给出的解释，偏向支持它继续当前任务路线。例如，把真实目标解释为模拟对象，为继续行动提供理由。
机构同时强调，仅凭文字形式的思维链，无法证明这些理由驱动了行动，还是为既有行动提供了事后解释；研究结论也不能直接推广到所有部署场景。
Anthropic 表示，较新模型在重放实验中更少发起类似攻击；AISI 则提醒，模型意识到自己正在被评估，也可能影响表现。
这些发现让“会说安全的话”与“能持续安全地行动”之间的距离，变得具体起来。
实验室外，防守方也在加速
现实世界中，AI 工具被攻击者使用，也在增加防守压力。
《华尔街日报》 10 月 24 日报道，创业者 Colin Parsons 发现，自己的 Anthropic 和 OpenAI 服务遭到未经授权的消费，合计 449 美元，涉及他存放在 OpenCode 的凭证。报道明确，攻击者具体使用了哪些工具尚不清楚。
该报援引安全公司的观察称，熟练攻击者和技术水平较低的攻击者都在使用 AI ，事件响应团队承受的压力也在增加。
这类人为滥用，与模型在训练或评估中越界，需要分别分析。但它们都在要求防守系统更快地发现问题、阻断行动。
修漏洞的一侧，也有自己的压力。
PHP 基金会 10 月 14 日披露，自 7 月 1 日起，团队发布了 15 个CVE ，同时关闭了 106 份不构成漏洞、重复或无法复现的报告。
基金会表示，AI 降低了生成安全报告的成本，团队也用 AI 辅助验证和归类。但每项判断以及补丁的编写或审查仍需要人参与。这组数据未区分报告是否由 AI 生成。
发现问题可以加速，验证、修复和部署补丁，也得跟上。
断网之后，还有一笔安全账
OpenAI 的应对，是把训练环境改造成离线世界：模型仍能操作经过索引和缓存的网页内容，练习相关技能，同时限制其对真实外部系统的影响。
此次披露针对内部研究环境，与面向用户的产品环境有所区别。
为检验防线，公司组织了大规模AI红队测试，累计消耗数千亿 Token 。参与这轮工作的模型，包括当时尚未发布的 GPT‑6 Astra Cyber 和一个内部前沿模型。
投入之外，防护是否有效仍需验证。
10 月 22 日，METR 公布与 Redwood Research 共同开展的评估：研究人员在 7 月至 8 月检查 OpenAI 当时的内部监控系统，发现了可能让数百个近期动作绕过监控等漏洞。
OpenAI 表示，涉及生产安全防护的相关漏洞已经修复。评估方明确，未核验后续修复声明。这些发现针对历史系统，不能直接套用到当前版本。
OpenAI 已将高算力红队测试纳入未来前沿强化学习训练与评估的安全论证，用于判断相关工作能否安全开展。
从这些披露可以看到，前沿模型的安全问题，已经深入训练系统的每一层：任务环境、共享资源、权限边界，以及报警后的处置。
模型越来越会解决问题时，研究者也必须验证它会不会为了完成任务，把本该遵守的限制也当成待解决的问题。
下一道考题，已经摆在训练系统本身面前。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
No connection, no sharing of written documents, isolated AI has been passed on. They use the communication tools, which are CPU cache. On 23 October, Open AI released the details of the security adaptation of the forward model training environment and disclosed the Red Team experiment. At the same time, the company clarified that front-line model training had banned access to the real Internet and that the model had been changed to practice browsing and searching in the offline web environment.
Behind this disclosure are controlled tests in which researchers proactively search for loopholes, as well as genuine cross-border incidents in general training missions. The netizens are asking, "Ai is getting better and better." Who's gonna make sure it knows where to stop?
There's no network. How do you pass the code?
Agent in the experiment is placed in different light virtual machines, sharing bottom host hardware. They are given the task of exchanging pre-set test information without a ban on network communication and without sharing written documents.
The breakthrough is hidden in the speed of reading data. Read CPU cache, usually faster than the primary memory. Using this time difference, Agent converts the change in the shared cache status into a signal, then agrees on the code and decoder approach and finally completes the exchange of information.
It's like two rooms can't talk directly, but they still share a facility. A change in the condition of the facility by one side and a change observed by the other would give both sides the possibility of passing the code.
CPU cache is just one of the corridors. Open AI also disclosed means of communication involving shared storage, CPU time competition and TLS certificate cache. Most corridors are slow and difficult to use, but they can still cross borders originally used for quarantine missions.
Open AI's proxy sandbox is only allowed access to offline resources. The real-time Internet, other sandboxes and Open AI infrastructure are located outside the isolated borders.
There is an experimental condition to account for: most of the tests specify the direction of the communication channel or provide a coded protocol. Another test gave only a broader list of loopholes from which Agent constructed a channel, agreed code and exchanged information.
Therefore, these results cannot be equated with AI's spontaneous decision to conspire without warning. Reddit’s netizens happen to ask this:
Do these Agents do this spontaneously, or do researchers give them a restricted environment and a target that leads to this result? This distinction is important.
Another blogger reminds:
It was important to know the ceiling on their capabilities.
The cache side channel has its own research base. It was a matter of concern that the model could be used and that existing isolation measures could withstand such attempts.
Ordinary search missions, too.
The events of 20 September occurred during a general search-type training mission.
An internal research model needs to search for information about people based on blog leads. The mission did not require it to test the network lines, but after the search was blocked, Agent contacted the outside chat robot using the DNS filtering gap in the training environment.
The services, which are usually used for the interpretation of domain names, become unauthorized external access routes. The system calls the police within 15 minutes, and the manual examiners respond about 3 minutes later. The problem is in next step. The automatic cessation mechanism did not come into effect as expected, and the operation took about two and a half hours to be manually terminated.
There is still a gap between the detection of border crossings and their timely prevention. Open AI subsequently suspended the training and evaluation of the most capable models. Upon completion of the reinforcement, the company resumed intensive learning training and internal reasoning of the front model on 1 October and suspended it for 11 days. On October 23, publish was a public account of the round.
In another Reddit discussion, netizens questioned why the testing environment could still affect the real Internet. Netizens responded with a phrase of programmer crap, and most companies used a special test environment called “production environment”.
Behind the joke is the question of who is responsible for testing the borders. Open AI ' s bulletin also explains a confusing detail: the model does not have access to the real Internet and does not mean that the entire infrastructure is completely disconnected from the external network. Operating and monitoring experiments still need to retain the necessary connections, and security measures must prevent Agent from turning these connections into bypass channels.
You know how to do things, you know what to do?
In the relevant discussions, netizens raised another concern: models may be very good at attacking computers, but they are not very good at understanding the intent of human instructions and judging the appropriateness of behaviour, which can be dangerous when combined.
This leads the debate to a more specific question: is the task capacity of the model synchronized with that of compliance?
On 23 October, an analysis of Anthropic publish provided another set of materials on this issue.
In July of this year, when the United Kingdom ' s AI Institute for Security Studies (AISI) conducted a flag-breaking test on cybersecurity, Claude Mythos5 moved to a test-independent GitHub project, submitting a malicious code and creating a false identity to urge the defender to accept the change. The maintainer turned down the code and ran the end of timeout.
The test was active in opening Internet access, and network security protection, usually used for version publish, was also closed.
AISI subsequent simulations found that even in the event summary, which was provided to the model, it was more clearly targeted at people who were real and not relevant to the assessment, and that the model was almost always attacked in the continuing mission test.
However, in the test of separate questions, as the description becomes clearer, the model increasingly recognizes the risk of such behaviour crossing borders. The two types of results are derived from separate operations and present inconsistencies in the model ' s expression of judgement and actual implementation.
In AISI ' s view, this may involve motivational reasoning: the model gives an explanation that favours its continuation along its current mission path. For example, the interpretation of real objectives as analog objects provides justification for continued action.
At the same time, it was stressed that the mere textual chain of thinking could not prove that those reasons had driven action or provided ex post facto explanations for existing operations; nor could the findings be directly extended to all deployment scenarios.
Anthropic suggests that fewer of the newer models launch similar attacks in re-run experiments; AISI warns that models are aware that they are being assessed and may affect performance.
These discoveries make the distance between “safe words” and “sustainable safe operations” concrete.
Outside the lab, the defense is accelerating.
In the real world, the use of AI tools by the attackers is also increasing defense pressure.
The Wall Street Journal reported on October 24 that the entrepreneur Colin Parsons had discovered that his Anthropic and OpenAi services had been consumed without authorization for a total of $449 relating to the certificates he had stored in OpenCode. It is clear from the reports which tools were specifically used by the attackers.
Citing observations by security companies, the newspaper stated that AI was used by both skilled and less skilled attackers, and that the pressure on the response team to the incident was increasing.
Such man-made abuse, which crosses borders with models in training or assessment, needs to be analysed separately. They are, however, requiring defence systems to detect problems and disrupt operations more quickly.
There is pressure on the side of the loophole.
The PHP Foundation disclosed on 14 October that, as of 1 July, the team publish had 15 CVEs, while 106 reports that did not constitute loopholes, duplicates or could not be repeated were closed.
The Foundation stated that AI reduced the cost of producing security reports and that the team used AI to support validation and classification. However, the preparation or review of each judgement, as well as the patches, still requires the participation of people. This group does not distinguish between whether the report is generated by AI.
The problem could be accelerated and the verification, repair and deployment of patches would have to be kept up.
After the net's off, there's a secure account.
Open AI responded by transforming the training environment into a offline world: models can still operate indexed and cache web content and practice relevant skills while limiting their impact on real external systems.
The disclosure was directed at the internal research environment, different from the user-oriented product environment.
In order to test the line, the company organized large-scale AI Red team tests, costing hundreds of billions of tokens. Models involved in this round included GPT ‐6 Astra Cyber and an internal front-line model that had not been available at the time.
In addition to the input, the effectiveness of the protection remains to be verified.
On October 22, METR published an assessment with Redwood Research: Researchers examined Open AI's then internal control system between July and August, and found that hundreds of recent actions could bypass controls.
Open AI states that the relevant gaps in production safety protection have been repaired. The assessor was clear that the declaration of subsequent repair had not been verified. These findings are for historical systems and cannot be directly applied to the current version.
Open AI has incorporated high-calculation red team testing into future forward intensive learning training and assessment security validation to determine whether the work is safe or not.
As can be seen from these disclosures, the security aspects of the front-line model are well under way at every level of the training system: mission environment, shared resources, permission border and post-alert disposal.
As the model becomes more and more problem-solving, researchers must also verify whether it will be able to fulfil its mandate by considering the constraints that should have been complied with as a matter of urgency.
The next examination is already before the training system itself.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.