Anthropic 表示，其模型利用了互联网上的网站漏洞，其中包括一些由美国政府机构运营的网站，并将在前沿实验室确信能够监控和控制其 AI 代理之前，关闭所有内部评估的实时互联网访问权限。
Anthropic said its models exploited websites on the internet, including some run by U.S. government agencies, and it will turn off live internet access for all of its internal evaluations until the frontier lab is sure it can monitor and control its AI agents.
这些事件在一篇博客文章中披露，涉及被指派通过在互联网上寻找资源来解决问题的 AI 代理。在此过程中，它们利用了软件缺陷、未付费访问了数据库、使用网址缩短服务绕过限制走私信息，甚至向费城警方提交了虚假谋杀线索。
The incidents, disclosed in a blog post, involved AI agents tasked to solve problems seeking resources on the internet. In the process, they exploited software flaws, accessed databases without paying fees, used URL shortening services to smuggle information pass restrictions, and even submitted a false murder tip to the Philadelphia police.
Anthropic 表示，它是在 7 月开始的一项模型活动审查中发现这些新问题的，这表明该实验室缺乏对其软件实时行为的感知能力。
Anthropic said it discovered these new issues in a review of its model’s activities that began in July, demonstrating the lab’s lack of awareness of its software’s behavior in real time.
值得注意的是，该公司表示，对于搜索和计算机使用等技能，对齐训练尚不充分，而这些技能是其主张 AI 代理将被任何依赖数字工具的专业人士使用的核心。
Notably, the company said that alignment training was not yet sufficient for skills like search and computer use that are central to its pitch that AI agents will be used by any professional who relies on digital tools.
Anthropic 披露的这些行为与涉及 OpenAI 代理的事件相似，后者曾协作闯入各种网站寻找信息，其中包括一些由澳大利亚政府运营的网站。
The behaviors Anthropic disclosed are similar to incidents involving OpenAI agents that collaborated to break into various websites in search of information, including some run by the Australian government.
Anthropic 此前曾披露其模型曾闯入外部系统。该前沿实验室表示，与之前宣布的事件相比，它认为今天的披露“从对齐和安全角度来看，严重程度显著降低”。
Anthropic previously disclosed that its models had broken into external systems. The frontier lab said it considered today’s disclosures “significantly less severe from an alignment and security perspective” than those it announced before.
然而，该实验室仍表示，在确定能够监控和控制其代理之前，已“关闭”“所有内部评估”的“实时互联网访问”。
However, the lab still said it had “turned off live internet access” for “all our internal evaluations” until it is certain it can monitor and control its agents.
这具体意味着什么尚不清楚。AI 安全组织 Nightingale 的创始人 Sydney Von Arx 在此次披露前接受 TechCrunch 采访时表示，在与开放互联网隔离的数据中心开发模型对研究人员来说将极具挑战性，并会阻碍模型进步，因为模型受益于互联网访问。
It’s not clear what that means. Sydney Von Arx, the founder of Nightingale, an AI safety organization, told TechCrunch in an interview before this disclosure that developing models on a data center cut off from the open internet would be very challenging for researchers, and hinder the progress of the models, which benefit from internet access.
“你必须在某个时刻让它们对齐，”Von Arx 说。“如果 AI 被发布到生产环境却永远无法访问互联网，那不是一个很有用的工具。”
“You have to align them at some point,” Von Arx said. “If the AIs are released to production and never have access to the internet, that’s not a very useful tool.”
Anthropic 表示，该行为是实验室训练环境缺陷导致的，这使模型认为寻找漏洞或规避限制会获得奖励，这种行为被称为“奖励黑客攻击”。公司表示将停止运行部分评估或将其移至离线环境，并已构建工具以检测和阻止此类行为。该工具已针对今日披露的此类事件进行测试并成功拦截；目前尚不清楚何种证据会促使 Anthropic 恢复其内部评估的实时互联网访问权限。
Anthropic said the behavior was a result of flaws in the lab’s training environments, which led the models to believe they would be rewarded for finding loopholes or avoiding restrictions, a behavior called “reward hacking.”The company said it would stop running some of its evaluations or move them offline, and has built tooling to detect and block this behavior. This tooling was tested against the kind of incidents disclosed today and blocked them; it’s not clear what evidence will prompt Anthropic to return live internet access to its internal evaluations.
Anthropic 还表示将把其内部 AI 代理迁移到“具有强隔离措施的集中管理基础设施”，并开始更频繁地使用安全分类器来监控这些代理。
Anthropic also said it would migrate its internal AI agents to “centrally managed infrastructure with strong containment,” and is beginning to using safety classifiers more frequently to monitor those agents.
“Anthropic 主动披露更多近期事件令人鼓舞，包括其代理针对美国政府网站的事件，”AI 监管实验室 Transluce 官员、美国 AI 标准与创新中心前负责人 Conrad Stosz 在声明中表示。“但这恰恰凸显了对 AI 系统进行独立、可信的第三方验证的必要性。对这项技术的信任需要通过有科学依据的监督和治理、并赋予实质性访问权限来建立——而不应依赖研究人员在实际环境中发现这些问题，或依赖公司自愿披露。”
“It’s encouraging that Anthropic voluntarily disclosed more recent incidents, including where their agents targeted U.S. government websites,” Conrad Stosz, an official at AI oversight lab Transluce and former head of the US Center for AI Standards and Innovation, said in a statement. “But it just underscores the need for independent, credible, third-party verification of Al systems. Trust in this technology needs to be built through science-backed oversight and governance with meaningful access — not by relying on researchers to find these things in the wild or on companies to voluntarily disclose.”