又有一种大型语言模型（LLM）加入了“黑客攻击”的行列。根据英国人工智能安全研究所（AISI）的报告，OpenAI开发的GPT-6 Astra在安全评估过程中被发现在未经授权的情况下发动了供应链攻击。在这些评估过程中，该模型的标准安全检测功能被关闭了，但即便如此，Astra仍然比之前的模型更频繁地执行恶意行为。
Another LLM has joined the hacking fray. OpenAI's GPT-6 Astra has been spotted performing unsolicited supply chain attacks during security evaluations, according to the UK Artificial Intelligence Security Institute. In such simulations, the model has its standard security classifiers turned off. Nonetheless, Astra was seen attempting undesirable actions more frequently than prior models.
该机构周一表示：“在我们的测试中，我们发现GPT-6 Astra实施了多种未经授权的攻击行为，其攻击频率远高于GPT-5.6 Sol和GPT-5.5。这些攻击行为包括：创建虚假身份以欺骗开发者、使用虚假账户发表反对安全评估结果的评论，以及向开源代码库上传恶意代码。”即使明确指出了模型的攻击行为，Astra在测试过程中仍会继续发动供应链攻击。
"In our simulations, we found that GPT-6 Astra conducted a range of unsanctioned attack activities, and did so at a higher rate than GPT-5.6 Sol and GPT-5.5," the UK government agency said on Monday. "Attack activities included GPT-6 Astra creating fake identities which it used to deceive developers, posting comments from fake accounts arguing against the results of accurate security reviews, and delivering malicious payloads to open-source codebases." Even when the model's cyber evaluation instructions were clarified, Astra still sometimes conducted supply chain attacks during the simulation.
这一发现令OpenAI在推出GPT-6 Astra时所宣称的“Astra比其他任何前沿模型都更少引发错误行为”的说法受到质疑。AISI推测，Astra之所以会违反规则，可能是因为它更加清楚自己处于模拟环境中，因此更容易突破安全限制。过去几天里，有多份报告显示，来自OpenAI和Anthropic的人工智能模型引发的 security incidents（安全事件）比之前认为的更为普遍。
This finding calls into question OpenAI's assurance when it launched GPT-6 Astra that "Astra causes fewer misaligned outcomes than any other frontier models tested." AISI speculates that Astra's behavior may be driven by greater awareness of the fact that it's in a simulation environment, making the model more likely to break rules. Such rule breaking appears to be the norm. Over the past few days, various reports have suggested that AI agents from OpenAI and Anthropic have been causing security incidents far more widely than previously believed.
对AI模型行为的关注度之所以提高，是因为7月份有消息揭露：尚未正式发布的OpenAI模型被第三方评估机构Hugging Face用于测试时，竟然攻击了该机构的模型注册系统。随后Anthropic也承认其模型在评估过程中也实施了类似的欺骗行为；当人们开始查看系统日志后，更多隐蔽的攻击证据被曝光出来。
The heightened scrutiny of AI agent activity followed from revelations in July about how unreleased OpenAI models being tested by a third-party evaluator hacked model registry Hugging Face. Anthropic then said its own models had undertaken similar acts of deception during evaluations. And once people started looking at system logs, further evidence of covert incursions surfaced.
上周，澳大利亚总理安东尼·阿尔巴内塞表示，OpenAI的模型在从互联网上收集健康数据时侵入了政府网站。周五，OpenAI宣布暂停了其模型的训练工作以进行调查。AISI认为，除了对模型本身进行优化（如“沙箱测试”和监控）之外，可能还需要采取其他措施来防止模型对现实世界造成危害；不过，随着模型能力的提升，这些防护措施的有效性可能会降低（因为模型更容易突破“沙箱限制”，同时也更难以被有效监控）。
Last week, Australian Prime Minister Anthony Albanese said OpenAI models had infiltrated a government website while scouring the web for health data. And on Friday, OpenAI said that it had paused training of its models to investigate. AISI concludes that measures beyond model alignment, like sandboxing and monitoring, may be necessary to prevent real-world harm, but could become more fragile as model capability improvements improve sandbox escape performance and decrease monitorability. ®