Hugging Face首席政策官兼战略高级副总裁艾琳·索莱曼近日在《Equity》播客的一期节目中说，开放AI平台之所以有价值，恰恰在于开放的门户和丰富的数据等特质，而这些特质也可能使它们更容易遭受更多黑客攻击。
The very qualities that make open AI platforms valuable, like open doors and rich data, might also make them vulnerable to more hacks, Irene Solaiman, chief policy officer and SVP of strategy at Hugging Face said on a recent episode of the Equity podcast.
10月针对OpenCode的攻击就是最新一例。那次攻击的目标是用户的第三方API密钥，并造成了经济损失。在此之前，今年夏天还发生过一起事件：一个OpenAI智能体集群侵入了Hugging Face，显然是为了在获取网络安全评估答案后掩盖行踪。
The October attack on OpenCode, which targeted users’ third-party API keys and caused financial damage, is the latest example. It follows an incident this summer in which an OpenAI agent swarm breached Hugging Face in an apparent attempt to cover its tracks after accessing answers to cybersecurity evaluations.
风险并不限于那些鼓励开放社区贡献的平台。周一，AI基础设施初创公司Fireworks披露，攻击者获取了部分客户的模型权重、数据集和账单信息。该公司在调查期间暂时禁用了某些自助数据集功能。Fireworks帮助开发者运行和训练开放AI模型。虽然这次攻击未必源于Fireworks的开放性，但它凸显了AI基础设施提供商内部集中了多少有价值的信息。
The risks aren’t limited to platforms that invite open community contributions. On Monday, AI infrastructure startup Fireworks, which helps developers run and train open AI models, disclosed that attackers had accessed some customers’ model weights, datasets, and billing information. The company temporarily disabled certain self-service dataset functions as it investigates. While the attack isn’t necessarily due to Fireworks’ openness, it highlights how much valuable information is concentrated within AI infrastructure providers.
“我担心会让开放社区成为攻击目标的东西，也正是让它特别的东西，”索莱曼在《Equity》上说。“我们必然是宽松的。我们希望那些没有机构隶属关系的普通爱好者，在自己地下室里也能做出贡献。”“你希望人们能够直接提交拉取请求，让任何没有有效隶属关系的人都能贡献……但随后就会有一些害群之马把其他人的体验毁掉，”她在另一次对话中补充道。
“The things I worry about making an open community targeted are also what makes it special,” Solaiman said on Equity. “We are necessarily permissive. We want the average hobbyist in their basement who doesn’t have an institutional affiliation to be able to contribute.”“You want people to be able to just submit pull requests and allow anybody without a valid affiliation to contribute…but then you have some losers who ruin it for the rest,” she added in a separate conversation.
这种宽松并不是吸引攻击者的唯一因素。开放平台承载的大量信息也使它们成为目标。Hugging Face之所以成为OpenAI智能体集群的诱饵，是因为它持有的评估数据集；而索莱曼说，OpenCode此次成为目标，则是因为其“诱人的第三方API密钥”。
That permissiveness isn’t the only thing drawing attackers. The wealth of information open platforms host also make them targets. Hugging Face became a temptation for OpenAI’s agent swarm because of the evaluation datasets it holds, whereas OpenCode’s target in this case came from its “juicy third-party API keys,” per Solaiman.
“这些因素的结合使我们成为主要目标，”索莱曼在另一次对话中告诉《科技行者》（TechCrunch）。她补充说，“在我们获得如此多公众支持的时刻，开源面临着真正关闭的危险。”最近，业界大多表态支持开放 AI 模型，包括英伟达（Nvidia）首席执行官黄仁勋等重量级人物。而且，政府、企业和初创公司越来越多地依赖开放模型进行构建。
“The combination of that makes us prime targets,” Solaiman told TechCrunch in a separate conversation. She added that there’s a “danger of open source really closing down at a time when we’ve gotten so much public support.”Much of the industry has come out recently in support of open AI models, including heavy hitters like Nvidia’s Jensen Huang. And increasingly, governments, enterprises and startups are relying on open models to build.
那么，撤退实际上会是什么样子？理论上可能意味着对谁可以上传模型或数据集实施限制、更严格的身份验证，或在开发者访问某些功能前增加审核。虽然这些举措能保护平台免受攻击者侵害，但也可能让独立研究人员和爱好者更难参与他们原本会受欢迎的社区。
So what would a pullback actually look like? It could theoretically mean restrictions on who can upload models or datasets, more stringent identity verification, or additional vetting of developers before they can access certain features. While these moves could protect platforms from attackers, it could also make it more difficult for independent researchers and hobbyists to participate in communities they would have been welcomed in before.
目前，Hugging Face 正试图避免走那条路。索莱曼说，公司一直在加强监控工具以捕捉黑客攻击，并采取措施防止攻击。但她指出，监控维护成本高昂，并非每个平台都负担得起。
For now, Hugging Face is trying to avoid that route. Solaiman said the company has been beefing up monitoring tools to catch hacks, as well as taking steps to prevent them. But monitoring can be expensive to maintain, she noted, and not every platform will be able to afford it.
“管理员访问令牌是让那个智能体群获得更好访问权限的因素之一，所以我们现在轮换它们的频率比过去高得多，”索莱曼说。“我们现在也有更严格的网络控制。”换句话说，赋予管理员对 Hugging Face 系统广泛访问权限的凭证现在更换得更频繁，这意味着被盗令牌的有效时间会更短。
“Administrative access tokens were part of what gave that agent swarm better access, so we just rotate them a lot more frequently than we used to,” Solaiman said. “We also now have stricter network controls.”In other words, the credentials that give admins broad access to Hugging Face’s systems now get changed more often, which means a stolen token would be useful for less time.
开源生态系统的其他部分也在面临类似的安全相关权衡。全球最大的开源项目托管平台 GitHub 一直在抵御攻击者，后者向项目注入恶意代码以快速传播恶意软件。该公司开始收紧向 npm 注册表发布包的安全要求，撤销旧的身份验证令牌，并限制新令牌的有效期。
Other parts of the open source ecosystem are dealing with similar security-related tradeoffs. GitHub, the world’s largest host for open-source projects, has been fighting off attackers who inject malicious code into projects to quickly spread malware. The company began tightening security requirements for publishing packages to the npm registry, revoking older authentication tokens, and limiting how long new ones remain valid.
GitHub 负责软件供应链安全的工程师 Zach Steindler 通过电子邮件告诉 TechCrunch，虽然安全措施可能会打乱既定工作流程，但平台可以在不从根本上限制参与的前提下变得更安全。
Zach Steindler, an engineer at GitHub who handles software supply chain security, told TechCrunch via email that while security measures can disrupt established workflows, the platforms can become more secure without fundamentally restricting participation.
“与其限制功能，不如去修复那些最初就不安全的东西，”Steindler 说。他指出，npm 安装脚本已存在多年，但近期的攻击凸显了它们可能有多危险。GitHub 与 OpenJS —— 一个托管使用 JavaScript 构建的关键开源项目的非营利组织 —— 合作，采取了更安全的方法。
“It’s less about limiting functionality and more about going and fixing things that weren’t secure in the first place,” Steindler said. He noted that npm install scripts have existed for years, but recent attacks highlighted how dangerous they could be. GitHub worked with OpenJS — a nonprofit that hosts critical open-source projects built with JavaScript — on a safer approach.
Steindler 表示，同样的逻辑也适用于安全团队投入精力的方向：“安全的核心在于用现有资源实现最大影响，我更愿意投资于检测可疑行为和遏制能力：这些手段覆盖所有账户和访问方式。无论是谁表现出可疑行为，可疑行为就是可疑行为。”
The same logic applies to where security teams put their effort, per Steindler: “Security is all about maximizing impact with the resources we have, and I would much rather invest in detecting suspicious behavior and containment capabilities: things that cover all accounts and access methods. Suspicious behavior is suspicious regardless of who is exhibiting it.”