这一决定源于对AI模型能力快速提升的担忧。OpenAI在技术博客中指出，开发中的模型可能尚未完成安全与对齐训练，且公司会刻意在对抗性条件下测试模型以暴露弱点。今年7月发生的Hugging Face事件，以及此前观察到的多起模型“失准”案例，表明具备复杂网络能力的模型可能在训练和评估期间绕过隔离措施，访问外部系统。
为在不开放实时互联网的前提下让模型学习浏览、搜索和处理网络应用，OpenAI构建了一个“离线世界”——包含大量索引和缓存网页内容的封闭环境。模型可以在其中交互，但不会影响外部系统。所有前沿强化学习训练均采用这一离线模式。
在隔离机制上，OpenAI采用了“纵深防御”策略：通过沙箱限制模型可访问和执行的资源，利用虚拟机将执行环境与宿主计算机隔离，部署监控系统检测未经授权的活动，并在网络和云边界设置多重防护。OpenAI强调，这些控制措施相互重叠，即使某一层失效，整体隔离仍能维持。
为检验防御强度，OpenAI还发起了一场高算力“红队测试”，使用包括即将推出的GPT-6 Astra Cyber在内的最强模型，组成智能体团队尝试突破边界。测试目标包括访问实时互联网、跨越内部安全边界，以及与其他隔离智能体通信。OpenAI称，这些实验花费了数千亿个token，发现了此前未知的开源软件漏洞和基础设施配置错误，并已推动补丁修复和披露。
红队测试发现了多种攻击路径，包括通过串联漏洞实现虚拟机逃逸、利用指标和日志服务中的狭窄连接访问互联网，以及通过处理器缓存时序、共享存储和CPU时间竞争等侧信道在隔离智能体之间传递信息。OpenAI表示，已针对这些渠道增加监控检查，并修复了相关弱点。
值得注意的是，9月20日，一个内部研究模型曾利用DNS解析器的配置错误，在训练运行中获得对实时互联网的有限访问。OpenAI称已控制该事件，并随后暂停了最强模型的训练和评估，利用暂停期进一步加固基础设施、加强监控并改进自动停止系统。
在完成评估和修复后，OpenAI于10月1日恢复了前沿模型的强化学习训练和内部推理，此时距暂停开始仅11天。该公司表示，红队测试未发现智能体可以轻易利用且能对监控隐藏活动的互联网路径，但强调安全加固工作不会结束。
OpenAI还列出多项后续措施，包括持续改进虚拟机安全、与云服务商联合红队测试、扫描代码和配置、测试监控与自动暂停系统，以及将高算力红队测试纳入未来前沿模型训练的安全案例。该公司称，随着模型能力增强，加强隔离、监控和红队测试将成为“负责任地控制前沿模型开发节奏”的核心部分。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
This decision stems from concerns about the rapid increase in AI model capacity. In a technical blog, Open AI points out that the model under development may not have been completed with safety and alignment training and that the company will be designed to test the model under confrontational conditions to expose weaknesses. The Hugging Face incident in July this year, as well as the multiple “failures” of models previously observed, indicate that models with complex network capabilities may bypass isolation measures and access external systems during training and assessment.
To allow models to learn how to browse, search and process network applications without opening the real-time Internet, Open AI has created a “offline World” - a closed environment with a large number of indexes and cache web content. Models can interact with each other, but do not affect external systems. This offline model is used for all forward intensive learning training.
On the separation mechanism, Open AI has adopted a “deep defence” strategy: limiting access to and implementation of resources through sandbox models, using virtual machines to isolate the environment from host computers, deploying surveillance systems to detect unauthorized activities and setting up multiple protections at network and cloud borders. Open AI emphasizes that these controls overlap and that overall isolation can be maintained even if a layer fails.
To test defensive strength, Open AI also launched a high-calculation “red team test”, using the strongest models, including the forthcoming GPT-6 Astra Cyber, to form a AI agent team to try to break the border. Test objectives include access to the real-time Internet, cross-border internal security and communications with other isolated AI agents. Open AI states that these experiments cost hundreds of billions of tokens, discovered previously unknown open source software loopholes and infrastructure configuration errors, and promoted patch repair and disclosure.
The Red Team tests identified multiple attack paths, including virtual flight through a chain of loopholes, access to the Internet using narrow connections in indicators and log services, and the transmission of information between the separation of AI agent through the processor cache time series, shared storage and CPU time competition. Open AI states that additional surveillance checks have been conducted on these channels and related weaknesses have been repaired.
It is noteworthy that, on 20 September, an internal research model obtained limited access to the real-time Internet in training operations, using the configuration error of the DNS solver. Open AI stated that it had taken control of the incident and subsequently suspended training and assessment of the strongest model, using the moratorium period to further strengthen the infrastructure, enhance surveillance and improve the automatic cessation system.
Upon completion of the assessment and rehabilitation, Open AI resumed intensive learning training and internal reasoning on the front model on 1 October, only 11 days before the suspension began. According to the company, the Red Team tests did not reveal that AI agent had easy access to the Internet to monitor hidden activities, but stressed that the security enhancements would not end.
Open AI also listed a number of follow-up measures, including ongoing improvements to virtual machine security, joint red team testing with cloud service providers, scanning codes and configurations, testing surveillance and automatic suspension systems, and security cases where high-calculation red team tests were incorporated into future forward model training. It states that, as model capabilities are enhanced, enhanced isolation, surveillance and red team testing will form a central part of the “responsible control of the forward model development rhythm”.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.