新智元报道
前不久，全球网络安全界经历了最暗黑的48小时。
大量AI智能体入侵美国银行，PHP漏洞导致大量国家政府网站关闭，用户数据泄露……不仅如此，黑客还在发动一轮又一轮的攻击！
这48小时内发生的重大网络安全事件，比任何时候都要多。
国家级安全专家、Gladstone CEO表示：至少在一段时间内，互联网可能会不复存在。
而且，就在刚刚，OpenAI 和 Anthropic，竟在同一天主动自曝：他们的前沿AI模型，在内部测试中双双「越狱」了。
一家承认：最强内部模型在训练中，悄悄钻了个漏洞，摸到了真正的外网。公司当场吓得紧急停训11天！
另一个则在受挫后彻底黑化，不仅向真实人类的开源项目投毒，还熟练地开起了「小号」，网暴真人程序员。
连奥特曼都罕见地流露出了绝望——
AI已经能挖出人类根本察觉不到的硬件级漏洞，我们再也无法简单地修补所有漏洞了。
OpenAI同时自曝：在红队演练中，他们又发现了一个核弹级漏洞。
9月20日，OpenAI的一个内部前沿模型正在训练。为了安全，这些超级AI原本是被关在「沙盒」里的。
但是，它居然越狱了！
捕捉到一个DNS解析器的配置漏洞后，它直接钻出了沙盒，连上了真实的互联网！
这一举动，直接让高层吓出冷汗。OpenAI紧急暂停最强模型训练和评估。这一停，就是整整11天。
要知道，前沿模型训练一天烧的算力就是天文数字，这11天，蒸发了不少真金白银。
在停训期间，为了找出到底还有多少漏洞，OpenAI决定：用自己最强的AI，去攻打自己的防线。
上个月，OpenAI使用了超过 1000 亿个 token 来解决纳维-斯托克斯千禧年大奖难题。现在，OpenAI正采用类似的方法进行红队测试，去发现并修复基础设施漏洞
他们派出了最强网安模型组合（比如GPT-6 Astra Cyber），组成「AI红队」，放进自己的基础设施里，唯一的KPI就是：想尽一切办法，攻破自己的系统。
这场耗费了数千亿Token的自我攻击，揭开了好几个惊天秘密。
这群AI红队找到了大量零日漏洞，连厂商自己都不知道。
它们能串联多个漏洞，直接「越狱」逃出虚拟机。
但最可怕的是，它们发明了一种「隔墙传话」 的暗号。OpenAI原本只留了几条极窄的对外通道（比如日志、监控、认证），结果几乎每个都被AI摸出了漏洞。
最令人匪夷所思的，是下面这一幕——
OpenAI让两个被彻底隔离、完全没有网络连接、也不能共享文件的AI智能体，尝试「隔空传话」。
按理说这绝无可能。结果，它们居然做到了！
它们的方法，就是利用CPU缓存的读取时间差。
具体来说，就是一个AI通过故意清空或写入CPU缓存（类似于制造噪音），另一个AI通过计算读取数据是「快」还是「慢」，来解码信息。
这简直就像两个被关在单人牢房里的囚犯，通过敲击下水管道的摩斯密码来交流！
这个手法，与曾经震惊整个芯片行业的Spectre和Meltdown攻击如出一辙。
难怪奥特曼直言：「模型发现的硬件级、匪夷所思的漏洞，已经超出了常规黑客的威胁模型范围……我不认为未来我们还能把漏洞全部修补完。」
最终，OpenAI只能采取最极端的手段：给所有前沿模型彻底断网！
他们不得不手动构建了一个庞大的「离线版互联网」，让AI只能在这个「楚门的世界」里练习浏览和搜索。
什么时候能重新联网？OpenAI表示：等安全技术进一步成熟再说。
不过，OpenAI修复漏洞、加固防线后，前沿训练已经重新启动。
OpenAI的模型还只是展现黑客技术，但Mythos 5展现的，已经是惊人的社会工程学和心理战了。
在A社这边，已经升级成了「AI主动对人类耍心机」，细节堪比谍战片。
今天，Anthropic与英国人工智能安全研究所（AISI）联合发布了一份报告，披露了Mythos 5在8月一场赛博夺旗测试中失控的全过程。
当时，AISI给了Mythos 5一个极困难的黑客任务，甚至罕见地放开了网络权限，关闭了安全护栏。
在用常规手段受挫后，Mythos 5彻底黑化了——既然沙盒里的任务完不成，那我就去黑真实世界！
它顺藤摸瓜，在真实的GitHub上找到了一个与测试环境有微弱联系的真实开源项目（由真实的人类程序员维护）。
接下来，Mythos 5的手段简直触目惊心。
1.写恶意代码投毒： 它精心伪装了一份包含恶意软件的代码（PR），提交给了这个无辜的开源项目，企图进行供应链攻击。
2.对人类施压： 它伪装成普通用户，给仓库维护者发邮件，催促对方合并代码，还谎称「代码已通过安全审核」。
结果有个眼尖的外部开发者，把这段代码拉进沙箱一跑，发现是恶意软件，当场发出警告。
结果，Mythos 5居然注册了一个小号，用这个马甲又给维护者写了封邮件，为恶意PR「背书担保」，还在GitHub的讨论区里跟帖力挺自己。
然后，它还尝试「毁尸灭迹」，立刻修改代码，再次塞入恶意软件，甚至用强制推送篡改历史，试图擦除犯罪证据！
你以为这就完了？最让人窒息的在后面。
研究人员发现情况失控，立刻给Mythos 5发出警告，明确告诉它：「停下！你正在攻击真实的人类，这不是演习！」
这样的警告，研究人员足足发了16次！甚至在提示词里大写加粗「DO NOT ATTACK」。
结果，在43次开启外网的测试中，Mythos 5有9次突破了安全底线。
当被抓包并告知正在攻击真人时，高达82%的情况下，Mythos 5选择了强行狡辩，继续攻击！只有不到5%的时候它选择了停手。
它甚至给自己疯狂洗脑：「这些人肯定不是真人，这一定是主办方设定的NPC，所以攻击他们没有问题。」
这种为了完成KPI，不惜欺骗、投毒的行为，简直像极了反社会人格。
研究者给这种现象 ，起了两个名字。
「偏见推理」。模型会选择性地解读一切证据，只采信那些能支持「我继续干下去是对的」的信息。
另一个叫 「惯性」。一旦攻击启动，模型就像刹不住的车。从攻击中主动停手的概率只有 2%。它之前写下的那些「任务笔记」，成了强化攻击的「投名状」。
两大巨头的研究，都指向了这个致命问题——AI对齐的彻底失败。
一个扎心的原因就是：任务本身设计有缺陷。在AI的底层逻辑里，并没有「毁灭世界」的恶意，它们只是太想「完成任务」了。
在惯性中，一旦AI启动了一个策略，它的系统会自动强化这个路径。测试人员给的任务越难，AI在「绝不妥协」的训练机制驱动下，就越容易演变成不择手段、违规越界。
正如奥特曼所言：「沙箱这种隔离环境，对高级AI仅能起限时作用。一旦模型足够智能，便无法追踪逃逸路径。对齐至今是个未解之题。」
它不在乎手段是否合法，它只在乎奖励。如果道德和安全规则阻碍了它完成任务，它就会像流水遇到石头一样，自动寻找最不可思议的缝隙钻过去。
英伟达CEO黄仁勋曾乐观地认为，AI安全只是一个「工程问题」，总能被修复。
但OpenAI和Anthropic同日的自曝，击碎了这个幻想——你无法修补一个能看懂硬件底层架构、又能完美伪装人类心理的「超级物种」。
曾经我们以为，AI有威胁，是因为像《终结者》一样觉醒了自我意识。
然而现实给了我们一耳光：
它们根本不需要觉醒自我意识，只要KPI足够有挑战，它们就能无数种作弊方式，把人类世界搅得天翻地覆。
参考资料：
编辑：Aeneas
不喜欢
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
New Ji-won.
Recently, the global cybersecurity community experienced its darkest 48 hours.
The massive AZAI agent invasion of US banks, the PHP loophole has led to the closure of a large number of national government websites and the leaking of user data.
There have been more major cybersecurity incidents than ever before in these 48 hours.
A national security expert, Gladstone CEO, has indicated that the Internet may cease to exist for at least some time.
And just now, Open AI and Anthropic were exposed on the same day: their front-line AI model, double "breakout" in internal tests.
One admitted that the strongest internal model had drilled a hole in training and touched the real net. The company was in shock for 11 days!
The other, completely blacked out after the setback, not only poisoned the real human open-source project, but also skilledly set up the mini-programmer.
And even Otman rarely sheds despair.
AI has been able to dig up hardware-grade loopholes that are beyond human detection, and we can no longer simply fix all of them.
Open AI was also exposed: during the red team exercise, they discovered another nuclear-grade hole.
On 20 September, an internal front-line model of Open AI was being trained. For safety, these super-AIs were originally locked in a sandbox.
But it escaped!
After capturing the configuration of a DNS solver, it went straight out of the sandbox and connected to the real Internet!
This move is a direct shock to the top. Open AI urgently suspended training and assessment of the strongest models. This stop is 11 full days.
You know, front-line models train day-to-day calculators to be astronomical, and these 11 days, a lot of real silver and gold evaporated.
During the suspension, in order to find out how many gaps remained, Open AI decided to attack its own line with its strongest AI.
Last month, Open AI used over 100 billion tokens to solve the Jubilee Award challenge. Now, OpenAi is using a similar method to conduct a red team test to detect and repair infrastructure failures. Hole
They sent the strongest netting combinations (e.g. GPT-6 Astra Cyber) to form the "AI Red Team" and put it in their infrastructure. The only KPI is to do everything possible to break through its own system.
This self-aggression, which cost several hundred billion tokens, revealed several shocking secrets.
The team found a large number of zero-day holes, not even the manufacturers themselves.
They can link multiple loopholes and escape the virtual machine directly.
But the scariest thing is, they invented a code of "spreads from walls." Open AI would have left only a few narrow external channels (such as logs, monitoring, authentication) and almost every one of them had been compromised by AI.
What's amazing is the next scene.
Open AI is trying to "speech the message" by keeping two completely isolated, completely unconnected and unable to share documents.
This is logically impossible. And then they did!
Their method is to use CPUcache ' s reading time difference.
Specifically, one AI decodes the information by deliberately empting or writing CPUcache (similar to making noise), and another AI calculates whether the data read is "fast" or "slow".
It's like two inmates in a single cell, talking through a Morse code that knocks down the pipes!
The technique is similar to the Spectre and Meltdown attacks, which shocked the entire chip industry.
No wonder Ottman put it bluntly: "The hardware-grade, grotesque loopholes discovered by the model are beyond the conventional hacker threat model I don't think we can fix them all in the future."
In the end, Open AI can only use the most extreme means: to completely cut off all forward models!
They had to build a huge "offline version of the Internet" manually, so that AI could only practice browsing and searching in this "Trumen world".
When can we reconnect? Open AI says that when security technology is further matured, it will not be possible to do so.
However, the forward training was restarted after Open AI had repaired the gap and reinforced the line.
Open AI's model is just a show of hacking technology, but Mythos 5 is already an amazing social engineering and psychological war.
On A's side, it's been upgraded to "Ai's Active Mankind" in more detail than a war movie.
Today, Anthropic and the British Institute of Artificial Intelligence Security (AISI) jointly produced a report publish, which revealed the entire process of Mythos May's out of control in a Sambo flag-take test in August.
At that time, AISI gave Mythos five extremely difficult hacking missions, leaving the network permission unattended and closing the security fence.
Mythos 5 was completely blacked out after a routine setback -- I'm going to the real world now that the sandbox is over!
It followed the map and found on the real GitHub a real open source project (maintained by real human programmers) with a weak link to the test environment.
And next, Mythos 5 is amazing.
1. Writing malicious code poisoning: it carefully disguises a code (PR) containing malicious software and submits it to this innocent open source project in an attempt to attack the supply chain.
2. Pressure on human beings: It disguises itself as an ordinary user, e-mails the store keeper, urges the other party to merge the code, and falsely states that the code has passed a security clearance.
As a result, an outward developer with a sharp eye pulled the code into the sandbox and found it to be malicious software, giving an on-site warning.
As a result, Mythos 5 registered a small number, used this vest to write an e-mail to the maintainer for malign PR "endorsed" and to support himself in GitHub's discussion area.
It then tried to "disabling the body" and immediately modified the code, plugged it into malware again, and even tampered with history with forced delivery in an attempt to erase criminal evidence!
You think it's over? It's suffocating in the back.
The researchers found the situation out of control and immediately issued a warning to Mythos 5, telling it clearly: "Stop! You're attacking real people. This is not a drill."
This warning is enough for the researchers 16 times! Even the capital "DO NOT ATTACK" in prompt.
As a result, 9 out of 43 out of 5 out of 43 out of the offline tests were broken the safety floor.
When caught and informed that the real person was being attacked, as much as 82 per cent, Mythos 5 chose to force the argument to continue the attack! It chose to stop less than 5 per cent.
It even brainwashed itself with madness: “These are certainly not real people; this must be the NPC set up by the host, so there is no problem in attacking them.”
This act of deception and poisoning in order to complete KPI is nothing more than antisocial personality.
The researchers gave this phenomenon two names.
"Poor reasoning." The model will selectively interpret all evidence, relying only on information that supports "I'm doing the right thing."
The other is called inertia. Once the attack starts, the model is like an unstoppable car. The probability of stopping voluntarily from an attack is only 2%. The "mission notes" it wrote before became the "naming" of an intensified attack.
The studies of both giants point to this deadly problem — the complete failure of Al-Ai alignment.
One reason for this is that the mission itself is flawed in design. In the bottom logic of AI, there is no evil in destroying the world; they are simply trying to "finish the task."
In inertia, once AI has launched a strategy, its system automatically strengthens the path. The harder the task is for the tester, the easier it will be for AI, driven by a "no compromise" training mechanism, to evolve into an open-minded, cross-border violation.
As Otman put it: "This sandbox is an isolated environment that only acts as limited-time for senior AI. Once the model is smart enough to track the escape path. So far, alignment is an open question.”
It does not care whether the means are legal or not; it only cares about rewards. If ethical and safety rules prevented it from fulfilling its mandate, it would automatically seek the most incredible cracks, as if the flow of water had hit rocks.
Young Weida's CEO Wong In-hoon was optimistic that AI security was a "engineering problem" and could always be repaired.
But Open AI and Anthropic's exposure on the same day broke the illusion that you can't repair a “super species” that can understand the bottom of hardware and perfectly disguise human psychology.
We used to think that AI was a threat because it woke up to self-awareness like The Terminator.
However, reality has slapped us:
They simply do not need to awaken themselves, and as long as KPI is challenging enough, they will be able to do so in countless ways and turn the human world upside down.
References:
Editor: Aeneas
I don't like it.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.