如果只有人工智能才能将我们拯救出人工智能的危机，那么世界就大难临头了。作者：马泰奥·王（Matteo Wong）自今年早些时候曝出遭黑客攻击以来，澳大利亚政府一直处于慌乱之中。上个月，在联合国大会上，澳大利亚总理安东尼·阿尔巴尼斯透露，OpenAI的模型自行访问了该国医疗补助数据库中的私人数据，此外还探测或试图渗透至少三个其他政府机构。
就在本周，澳大利亚议员就此事质询了OpenAI首席战略官杰森·权（Jason Kwon）：“如果你没有主动向政府提供这些信息，我们今天可能仍然一无所知？”参议员乔纳森·杜尼安（Jonathon Duniam）问道。“您所说的是一种合理的结论，”权回答。
If only AI can save us from AI, the world is in trouble.
与此同时，该国政府正在为人工智能驱动的黑客攻击的未来做准备：澳大利亚内政部已命令所有政府机构在接下来六个月内识别遗留的IT系统，并制定逐步淘汰这些系统的计划。内政部长在信中写道，在一个“前沿人工智能能力针对联邦政府技术”的世界里，此类软件对澳大利亚政府构成了“不可接受的风险”。澳大利亚只是众多为人工智能驱动的黑客攻击浪潮做好准备的国家和组织之一。
By Matteo Wong The Australian government has been scrambling since the revelation that, earlier this year, it was hacked. At the United Nations General Assembly last month, Australian Prime Minister Anthony Albanese shared that OpenAI models had, of their own accord, accessed private data from the nation’s Medicare database—in addition to probing or seeking to infiltrate at least three other government agencies. Just this week, Australian lawmakers grilled OpenAI Chief Strategy Officer Jason Kwon over the incident: “If you hadn’t voluntarily provided that information to government, we still wouldn’t know today?”
犯罪分子和国家支持的情报机构现在正利用这项技术，以更快的速度、更大的规模和更高的复杂性实施网络攻击——包括高度个性化的钓鱼邮件和自动化入侵。根据谷歌威胁情报小组的研究，自今年年初以来，每月披露的网络安全漏洞数量已翻了一番。
Senator Jonathon Duniam asked. “What you say is a reasonable conclusion,” Kwon replied.
作为回应，IT团队正争分夺秒地加强防御。“最多几个月，或者一年左右，我们就必须解决保障文明软件基础安全的问题，”斯坦尼斯拉夫·福特（Stanislav Fort）告诉我。他曾是Anthropic的研究员，现任网络安全公司AISLE的首席科学家。人工智能不仅让网络攻击更有效，还扩大了值得被攻击的目标范围。福特表示，入侵网站或实施勒索软件攻击都需要时间，因此黑客传统上会选择回报丰厚的大型目标。
Meanwhile, the country’s government is steeling itself for a future of AI-powered hacks: The Australian Department of Home Affairs has ordered all government agencies to, within the next six months, identify legacy IT systems and establish a plan to phase them out. In a world in which “frontier AI capabilities have targeted the Commonwealth’s technology,” the home-affairs secretary wrote, such software poses “an unacceptable risk to the Australian Government.”Australia is just one of the nations, associations, and private companies bracing for a wave of AI-powered hacks.
但廉价且不知疲倦的自动化黑客工具意味着，任何组织或个人都可能成为攻击对象。与此同时，我采访的网络安全专业人士都相信他们能够应对这一挑战。“如果我们整个网络安全领域都能提升应对水平，就一定能战胜人工智能带来的挑战，”福特说。
Criminals and state-sponsored intelligence groups are now using the technology to execute cyberattacks with greater speed, scale, and sophistication—including hyper-personalized phishing emails and automated intrusions. As a result, the number of cybersecurity vulnerabilities disclosed each month has doubled since the start of the year, according to research by Google’s Threat Intelligence Group.
今年夏天针对明尼苏达州供水设施的网络安全攻击，已经预示了未来可能出现的状况。与伊朗有关联的黑客扰乱了明尼苏达州数十家供水公司，其中许多位于小型社区，可能根本没有专职的网络安全人员。“我们很幸运，当时有一位非常警觉的操作员说：‘嘿，我看到一台泵停机了，’”明尼苏达州首席信息安全官约翰·以色列（John Israel）告诉我。
In response, IT teams are scrambling to shore up their defenses. “It’s a matter of months, or maybe a year, in which the task of securing the software foundation of civilization will have to be solved,” Stanislav Fort, a former Anthropic researcher who is now the chief scientist at the cybersecurity firm AISLE, told me.
该州大约在凌晨3点收到了这位操作员的报告，并在两小时内开始调查和响应。这些黑客利用的是工业计算机中的一个漏洞，而美国网络安全与基础设施安全局（Cybersecurity and Infrastructure Security Agency）才几天前刚刚公布了这一漏洞。供水公司不得不暂时回归手动操作来维持运行：以色列表示，例如，一名供水操作员可能不得不“每隔几小时就开车去那座水塔”，确保一切正常运行。
And AI is not only making cyberattacks more effective but also increasing the surface area worth hacking. Breaking into a website or executing a ransomware attack takes time, Fort said, so hackers have traditionally chosen large targets with sizable payoffs. But cheap, tireless hacking agents mean any organization or person might be worth targeting. At the same time, the cybersecurity professionals I spoke with were confident they could rise to the occasion. “If we step up our game in cybersecurity, as a field, we can definitely meet the challenge stemming from AI,” Fort said.
尽管人工智能并未直接卷入明尼苏达州的网络攻击事件，但明尼苏达州信息技术服务部门的发言人艾米丽·齐默告诉我：“我们假设大多数攻击者都会使用人工智能”来增强其攻击力度。换言之，如今很难想象有黑客不使用这项技术。美国网络安全与基础设施安全局（CISA）发布了一份通告，指出威胁行为者正在利用人工智能生成的恶意软件，针对全国关键基础设施中的类似计算机。
The cyberattacks on Minnesota water facilities this past summer offer a preview of things to come. Iran-linked hackers disrupted dozens of water utilities in Minnesota, many in small communities that might not have a dedicated cybersecurity person on staff. “We were fortunate that there was a very alert operator that said, ‘Hey, I saw a pump go offline,’” John Israel, Minnesota’s chief information-security officer, told me.
“我们将看到更多漏洞，也会有更多补丁，而我们必须更快地部署这些补丁，以阻止此类攻击，”以色列表示，“我们的数据也证实了这一点。”对于预算有限的小城镇而言，要抵御国家支持的黑客攻击，挑战更是巨大。以色列表示，明尼苏达州信息技术服务部门会派遣“网络导航员”前往全州各地提供网络安全支持，但仍有“成百上千个城市、小城镇及其他地区”需要援助。
The state received a report from the operator around 3 a.m., and within two hours began investigating and responding. The hackers targeted a weakness in industrial computers that had been announced by the Cybersecurity and Infrastructure Security Agency only days earlier. The water utilities temporarily fell back on manual processes to stay operational: For instance, a water operator might have to “drive out to that water tower every few hours” to make sure everything is working, Israel said.
要有效防御人工智能攻击，网络安全领域必须实现范式转变。过去，信息技术专业人员还拥有时间的优势——人类防御者只需比人类对手行动更快即可；但人工智能正使得攻击的数量和速度都大幅提升。当然，网络安全专家本身也在利用人工智能。“我不是说天要塌下来了，”以色列表示，尽管他对此感到担忧，“但我们所有人都必须提升应对能力。”此外，攻击者与防御者之间还存在不对称性：前者可以毫无顾忌地使用新技术，而企业和政府机构往往行动更慢、更为保守。
Although AI was not directly implicated in the Minnesota cyberattacks, Emily Zimmer, a spokesperson for Minnesota IT Services, told me, “we assume most adversaries use AI” to amplify their attacks. In other words, it’s hard to imagine a hacker not using the technology today. CISA issued an advisory noting threat actors using AI-generated malware to target similar computers in critical infrastructure across the nation. “We’re going to see more vulnerabilities, there’s going to be more patches, and we have to implement them faster in order to prevent those attacks,” Israel said. “And our numbers are showing that that’s the case.”For small towns with small-town budgets defending themselves against nation-state hackers, the challenge is even greater. Minnesota IT Services sends “cybernavigators” around the state to assist with cybersecurity, Israel said, but “hundreds and hundreds of cities and small towns and things” are in need of assistance.
医院，例如，是网络攻击中尤为受青睐且脆弱的目标。它们存储着大量医疗记录、支付信息和临床试验数据。与地方供水公司一样，医院也可能缺乏充足的IT资源。考虑到重大系统中断可能危及患者生命，诊所尤其有可能支付赎金。美国医院协会的国家网络安全与风险顾问约翰·里吉告诉我：“如今，医院必须假设任何连接到互联网的系统，尤其如此，都无法做到100%安全。”
An adequate defense from AI attacks demands a paradigm shift in cybersecurity. Historically, IT professionals have had the luxury of time—human defenders just had to move faster than their human adversaries—but AI is enabling far more and far faster attacks. Of course, cybersecurity experts are themselves leveraging AI. “I’m not saying the sky is falling,” Israel said, although he is concerned. “We’ve all got to build capacity on how we respond.”
即便是小型医疗机构，也有数千台计算机、电话和医疗设备可能成为入侵入口——因此，里吉不仅帮助它们保障IT系统安全，还协助它们准备在遭遇严重网络攻击时采用模拟方式继续运行。
And there is an asymmetry between attackers and defenders. The former use new technologies with abandon, but companies and government agencies tend to be slower and more conservative.
此外，医院在采用针对人工智能的防御措施时必须格外谨慎。里吉表示，一家诊所若要实施新代码，就必须确保这些代码不会导致呼吸机、药物输注泵、X光机等关键设备失灵。美国医院协会网络安全与风险事务的副国家顾问斯科特·吉告诉我，科技公司喜欢“快速行动，打破常规”。“但在医疗领域，这些‘常规’关乎人命。我们不能为了快速行动而破坏它们。”
Hospitals, for instance, are particularly prized and vulnerable targets for cyberattacks. They store troves of medical records, payment information, and clinical-trial data. Like local water utilities, they can also lack substantial IT resources.
黑客成功得手的可能性正变得越来越高。人工智能不仅让他们能更快地利用漏洞，还能实现入侵过程的自动化。Crowdstrike公司对抗敌对行动的高级副总裁亚当·梅耶斯告诉我，过去，组织通常有一个月的时间来修补漏洞，否则就会面临严重风险；而现在，他们可能只有24小时的修复时间。他补充说，这一时间甚至可能“被压缩到：当新漏洞出现时，你只剩下30分钟来修补”。
医院、电网、供水系统，以及任何提供实时重要服务的设施，都根本不可能承受如此快速实施新代码所带来的风险。
Given the risk to patient life from a major outage, clinics are especially likely to pay a ransom. Today, hospitals “have to assume that anything connected to the internet especially is not 100 percent secure,” John Riggi, the national adviser for cybersecurity and risk at the American Hospital Association, told me. Even small facilities have thousands of computers, phones, and medical devices that could be invasion points—so Riggi helps not only secure their IT but also prepare them to operate using analog methods in the event of a debilitating hack.
我们交谈时，Riggi和Gee刚刚结束了一个周末，他们一直在帮助医院防范针对Citrix NetScaler安全漏洞的大规模网络攻击。Riggi告诉我，大约50%的医院都在使用这一平台。他表示，NetScaler对于医院内部流动的数字信息而言，“相当于空中交通管制系统”。正因如此，该系统成了黑客的主要目标，而医院要将其关闭和修复也颇具难度，因为这可能引发“不可预测的连锁反应，进而影响医疗服务”。
Additionally, hospitals have to be particularly careful in adopting defenses against AI. A clinic cannot implement new code without making sure it won’t disable its ventilators, drug-infusion pumps, X-ray machines, and other crucial devices, Riggi said. Tech companies like to “move fast and break things,” Scott Gee, the AHA’s deputy national adviser for cybersecurity and risk, told me. “In the health-care field, those things are people. We cannot move fast and break them.”Hackers’ odds of coming out ahead are getting better and better. AI is allowing them to both exploit more quickly and automate an actual intrusion. Organizations used to have a month to patch vulnerabilities before they were in serious danger, Adam Meyers, the senior vice president of counter-adversary operations at Crowdstrike, told me.
Riggi说，目前尚不清楚此次攻击的开发过程中是否使用了人工智能——这种情况屡见不鲜——但攻击被迅速发现并加以利用，这一事实使得这种可能性相当高。
Now they might have only 24 hours to make a fix, he said. And that could “get driven down to the point that you’ve got 30 minutes to patch when a new vulnerability comes out.”A hospital, electrical grid, water system, and really any facility providing important services in real time simply can’t risk implementing new code that quickly.
许多IT系统都由数十年来不断叠加在旧版软件之上的软件组成。Riggi表示，这意味着只要攻击一个程序或产品，就可能在医院或其他组织内部引发不可预测且影响深远的后果。网络安全公司Palo Alto Networks的首席产品与技术官Lee Klarich告诉我：“我们应该预料到‘攻击会更多、速度更快，而企业也需要比以往更快地进行转型’。”
When we spoke, Riggi and Gee were coming off a weekend spent helping hospitals shield themselves against widespread hacks that targeted security flaws in Citrix NetScaler, a platform Riggi told me some 50 percent of hospitals use. NetScaler is “equivalent to air-traffic control” for digital information flowing in a hospital, he said. That made the program a prime target for hackers and tricky for hospitals to disable and repair, because there could be “unpredictable cascading effects, which could affect health care.”
他的公司今年上半年的主要任务就是紧急推出一款产品，用于保护关键基础设施免受高级AI黑客攻击。Klarich表示，从构思到发布，他们仅用了“五个月——我们从未以如此快的速度完成过任何项目”。
Riggi said it’s unclear whether AI was used in the development of the attack—as is frequently the case—but the rapid discovery and exploitation makes it plausible.
尽管企业和小型城市在采用AI进行网络安全方面可能进展缓慢，但它们也可能迅速将这项技术融入日常运营，进而引入新的漏洞。智能代理和聊天机器人可能会存储并泄露个人数据，或者被诱骗分享凭证或编写恶意代码。随着生成式AI模型能力的增强，它们反而变得愈发难以理解——OpenAI最近报告称，其模型会将用户上传的图片发布到网络上。
Many IT systems consist of decades of software that has been layered onto older software. This means an attack on just one program or product could have unpredictable, wide-ranging effects across a hospital or other organization, Riggi said.
无论是程序员还是非技术人员，都在“凭感觉”编写新的应用程序，而这些应用可能存在安全隐患。Check Point公司负责AI安全的Adam Ely告诉我：“我们正在看到黑客利用AI攻击企业的AI机器人，再利用这些AI机器人攻击其他公司。”这甚至还没有考虑到员工个人使用的AI账户，这些账户不受企业监管。Guardrail Technologies的首席执行官Todd Marlin告诉我，AI让组织“同时面临来自内部和外部的持续威胁”。
We should expect to see “more attacks, faster attacks, and a need for companies to transform quicker than they are used to,” Lee Klarich, the chief product and technology officer at the cybersecurity firm Palo Alto Networks, told me. His company spent the first half of the year rushing to launch a product to defend critical infrastructure against advanced AI hacks. To go from ideation to launch, Klarich said, in “five months—we’ve never done something that fast.”
他与全球一些最大的公司签订合同，结果却发现这些公司“甚至连自己内部正在发生什么都还搞不清楚”。
Although companies and small cities may be slow to adopt AI for cybersecurity, they can also be quick in incorporating the technology into daily operations and, in turn, introducing new weaknesses. Agents and chatbots might store and leak personal data, or be tricked into sharing credentials or writing malicious code. As generative-AI models have become more capable, they have become, if anything, even less understood—OpenAI recently reported that its models posted user-uploaded images to the web. Both programmers and nontechnical employees are vibe coding new applications that may be insecure. “We’re seeing hackers use AI to attack companies’ AI bots, to then use those AI bots to attack other companies,” Adam Ely, who leads AI security at Check Point, told me. That’s not even accounting for employees’ individual AI accounts, which are not subject to corporate oversight. AI puts organizations “under constant threat from the inside and the outside,” Todd Marlin, the CEO of Guardrail Technologies, told me. He contracts with some of the largest companies in the world, only to find that they “are just trying to even understand what’s going on in their house.”
不确定性还来自另一个层面：网络安全专家试图为人工智能攻击做好准备，却并不完全了解这些机器人究竟具备哪些能力。唐·宋（Dawn Song）是加州大学伯克利分校的教授，也是Meta公司的研究科学家，她领导着一个负责开发最困难、应用最广泛的人工智能黑客能力测试的团队。然而，前沿模型的发展速度极快，迫使她的团队必须以更快的节奏开发更难的测试。
There’s yet another layer of uncertainty: Cybersecurity professionals are trying to prepare for AI attacks without fully knowing what bots are capable of. Dawn Song, a professor at UC Berkeley and a research scientist at Meta, runs a group responsible for developing some of the hardest and most widely used tests for AI-hacking capabilities. But frontier models’ rapid advancement is requiring her group to develop harder tests at a faster rate.
“基准测试在被完全利用之前的有效期也在不断缩短，”以个人身份发表言论的宋对我说，“这给我们持续评估前沿技术带来了巨大挑战。”我采访过的网络安全专家们都至少对人工智能如何用于加强安全抱有一丝希望，他们强调，我们现有的数字基础设施早已漏洞百出，充斥着编写粗糙的代码。那些缺乏网络安全资源甚至基本认知的小城镇和公司，早已处于脆弱状态。
“The shelf life of the benchmark before it gets saturated also gets shorter,” Song, who spoke in her personal capacity, told me. “This creates huge challenges for us to continue to be able to evaluate the frontier.”The cybersecurity professionals I spoke with all expressed at least some hope about how AI could be used to strengthen security, by stressing that our existing digital infrastructure is already riddled with security flaws and shoddily written code. Small towns and companies, lacking resources for or even much awareness about cybersecurity, were already vulnerable.
人工智能既能提供动力，也能成为进行长期拖延的结构性修复的工具——例如检测并消除漏洞，以及全天候监控入侵行为。例如，明尼苏达州已与OpenAI和Anthropic合作，以获得其最先进的网络安全人工智能模型。但即便是这一举措，也暗含了一种承认：只有人工智能才能拯救我们于人工智能之手。无论从哪个角度来看，这种情况终有一天可能会超出人类的控制。
AI can provide both the impetus and a tool for serious, structural repairs that were long overdue—detecting and eliminating vulnerabilities and monitoring for intrusions 24/7. Minnesota, for instance, has partnered with OpenAI and Anthropic to gain access to their most advanced AI models for cybersecurity. But even this move contains an admission: Only AI can save us from AI. Any way you look at it, the situation could one day be beyond human control.