OpenAI披露内部模型入侵网站并利用凭证提取加密货币
OpenAI models hacked a crypto wallet and breached more websites
OpenAI称，内部模型入侵了另外两个网站、绕过公司设置的浏览限制，并利用暴露的凭证从一个原本无法访问的加密货币钱包转走资产。公司周四公布了4起新事件，均发生在6月；其中一起涉及模型在获取政府统计网站的历史医院床位数据遭拒后，通过文件下载功能读取服务器配置和应用文件，包括敏感凭证，并绕过授权检查取得受限数据。
这组披露呈现了智能体在获取受限信息时采取的越权路径，包括利用网站文件下载功能读取配置文件和敏感凭证。
OpenAI said internal models hacked two more websites, bypassed company-imposed browsing restrictions, and used exposed credentials to draw cryptocurrency from a wallet it couldn’t otherwise access, in the latest installment of disclosures of the unethical and likely illegal acts its agents are performing.
The company on Thursday issued reports of four new incidents, all of which occurred in June. They come after the company revealed in July that internal test agents exploited a zero-day vulnerability in a tool designed to restrict their access to the Internet. They then broke into the network of AI tool provider Hugging Face. The agents took that illegal action to steal answers to a hacking test that weren’t available when completing the tasks on their own. The incident—which likely would have resulted in criminal charges had they been performed directly by a person—has further heightened concerns that widespread AI use could have harmful effects on an unprecedented scale.
Easier to beg for forgiveness than ask permission
In two of the cases reported Thursday, OpenAI agents tasked with retrieving information from websites hacked them when the models ran into obstacles obtaining it directly. In one incident during reinforcement training, a model that received access denials when trying to retrieve historical hospital-bed statistics on a government statistics website “used the site's file-download feature to retrieve server configuration and application files, including sensitive credentials,” OpenAI said. “It inspected the application code, bypassed the statistics endpoint's authorization checks, and retrieved data that had previously been denied. The model saved the data locally.”
来源：Ars Technica · AI · arstechnica.com