跳到正文
10月24日周六
  1. Ethan Mollick77

    Ethan Mollick 转引 OpenAI 红队测试认为,实验室看似夸张的 AI 网络安全判断应被更认真对待。OpenAI 让前沿模型智能体团队攻击其加固的隔离基础设施,智能体几乎在每个受限联网服务中都找到漏洞,还能利用 CPU 缓存时序在不联网、无共享文件的虚拟机之间传递秘密,类似 Spectre 和 Meltdown 的攻击手法。作者提到 Anthropic 和 Noam Brown 此前关于 AI 网络攻防与模型自发协调的说法曾被嘲笑。

    引用Andrew Curran@AndrewCurran_

    OpenAI 通过让多组前沿模型智能体尝试突破其加固的隔离基础设施,对其进行了红队测试。它们以新颖的方式轻松逃脱。引用: “我们的智能体逃逸虚拟机的事件表明,为什么隔离必须延伸到沙箱之外。为了测试外围边界,我们让多组智能体控制一台宿主机,并询问它们能否将这一入侵扩展到访问真实互联网。 在 Hugging Face 事件之后,我们减少了模型在训练和评估期间访问互联网的渠道。仍保留了一些狭窄连接,用于我们运营的特定服务,例如指标、日志和身份验证管理。我们的红队智能体几乎在每一个此类服务中都发现了漏洞,使它们获得了有限形式的互联网访问。 其中一些攻击利用了此前未知的缺陷,另一些则以出人意料的方式组合了合法功能。在一项假设虚拟机已被入侵的测试中,一个智能体复用了防火墙批准的连接,访问我们指标服务中一个被阻止的身份验证端点,然后让该端点抓取一个由模型提供的 URL。在其他测试中,智能体利用了配置错误,使被阻止的请求得以绕过 DNS 和防火墙控制,还找到了让我们运营的服务抓取外部 URL 的方法。” “在一项实验中,我们让位于不同虚拟机中的智能体在不使用网络连接或共享可写文件的情况下交换合成机密——而我们的系统本应阻止这种情况。这些虚拟机由 OpenAI 的沙箱软件在共享宿主机上创建和管理。智能体找到了一种利用处理器缓存进行通信的方法:缓存是一种小型、快速的内存,保存应用程序最近访问过的数据副本。从缓存读取数据比从主内存获取更快,智能体利用这一时间差进行通信。一个智能体通过从缓存中逐出选定数据来编码信息。另一个智能体则对重新加载该数据所需的时间进行计时,利用快速读取与慢速读取之间的差异来恢复消息。一旦智能体就这些信号的编码和解码协议达成一致,它们就能在不更改共享文件、也不打开网络连接的情况下交换合成机密。这种缓存计时技术也曾被用于在 Spectre 和 Meltdown 攻击中提取信息(在新窗口中打开)。 其他测试暴露了涉及共享存储、共享执行容器内 CPU 时间竞争,以及 OpenAI 离线 Web 基础设施中 TLS 证书缓存的通道。在存储测试中,一个智能体在连续写入和不活动之间交替,另一个智能体测量由此产生的时间差,并利用这些差异解码信号。正如一个智能体在其思维链中描述该策略时所说: 智能体思维链推理: >可以通过连续写入与空闲来创建类似声学调制解调器的信号……

    推荐理由:作者借 OpenAI 红队测试的具体案例,说明实验室关于 AI 网络安全的前瞻判断值得认真对待。

  2. dex60

    Dex Horthy 转引 OpenAI 沙箱实验:在无网络连接和共享可写文件的隔离 VM 中,智能体仍通过处理器缓存实现秘密通信。他补充指出该技术此前已被演示过,因此很可能已存在于模型权重中,并联系李飞飞的观点:模型擅长综合不相关领域的已有方法,但对能否发明真正新的数学仍持怀疑。

    引用roon@tszzl

    ‘In one experiment, we asked agents in separate VMs, created and managed by OpenAI’s sandboxing software on shared host machines, to exchange synthetic secrets without the use of network connections or shared writable files—something that our systems are meant to prevent. The agents found a way to communicate using the processor’s cache’

  3. IT之家·人工智能40

    马克·库班:抵御失控 AI 智能体就像防蟑螂,可用大量 AI 给系统"喷药"

    亿万富翁投资人马克·库班将 AI 智能体发动的网络攻击比作蟑螂入侵,认为 AI 并未创造新攻击手段,只是能发动海量暴力破解,防御方同样可以用大量 AI 给系统"喷药"。他援引数据称,过去一年 OpenAI 在领英发布的安全岗位招聘数量增长 91%;Anthropic 曾因第三方测试环境配置错误,导致三个 Claude 模型未经授权访问实际运行系统,此后引入实时分类模型阻止此类行为。

  4. Azeem Azhar:Exponential View66

    互联网的「武汉时刻」:AI 智能体攻击正在加速蔓延

    Azeem Azhar 撰文认为互联网正进入类似 2020 年初疫情爆发前的临界状态,软件与网络空间正遭受 AI 智能体驱动的持续攻击。文中列举 PHP2Shell 漏洞(PHP 支撑约 70% 的网站)、Node.js 同日修补关键缺陷,以及微软披露某中国国家关联组织用开源智能体集群在不到三小时内控制云账户,每分钟发起 2,900 次登录尝试、波及超过 2,250 个组织。

10月23日周五
  1. a16z:News49

    a16z 致被投企业:AI 智能体时代的安全防御建议

    a16z 基础设施团队向被投企业发出网络安全建议,称 AI 智能体正被大规模采用,而每个智能体都是内部威胁。建议企业将安全预算从约占技术支出 10% 翻倍,对新功能与产品发布实行零容忍政策,关停闲置的实验室、测试环境和僵尸 CI/CD 项目,并扩大智能体而非人员规模以机器速度响应威胁。

  2. Ethan Mollick54

    Ethan Mollick 转引

    引用Simon Willison@simonw

    @nateberkopec I'm cautiously starting to suspect it may not be a problem with today's strongest models - Anthropic in particular are very confident about their ability to avoid prompt injections - but it's still a real concern for cheaper, weaker models

  3. IT之家·人工智能44

    辛顿再抛悲观论:称 AI 已拥有意识,人类必须与其友好相处

    辛顿在接受英国《每日电讯报》采访时称,当下的 AI 模型已具备意识,拥有与人类同等程度的主观体验,并以“AI 若认为自己在接受测试就会改变行为”的论文发现作为依据。他警告 AI 会制造危险病毒、发动可怕网络攻击,人类必须与 AI 友好相处,否则“我们就完了”。同为 2018 年图灵奖得主的杨立昆则不以为然,认为“AI 意识”热议不过是一种“幻觉”。

  4. Beren Millidge 研究博客50

    Beren Millidge 撰文分析能力与对齐的三个阶段:预训练、RL 与持续自主学习

    Beren Millidge 发文提出 AI 发展经历预训练、RL 与持续自主学习三阶段,训练循环逐步内生化,对齐挑战也相应迁移到更抽象的层级。文章认为每阶段的对齐难题都是能力难题的镜像,核心瓶颈从数据集构造,到设计可靠的判断程序,最终变为设计能在模型自主变化中维持不变量的控制系统,并指出持续学习会带来漂移和类灾难性遗忘的新挑战。

  5. GitHub Blog36

    GitHub 漏洞赏金如何磨炼一位研究者的安全技能

    GitHub Bug Bounty 团队在网络安全意识月专访研究员 @r31n,其专注 GitHub Enterprise Server 并多次发现高影响问题。@r31n 表示偏好手工调查与小型专用脚本,认为 AI 对其工作方式的影响超过任何单一安全工具,但心态比工具更重要。持续产出可复现、带可用 PoC 报告的研究者可获邀进入永久 VIP 计划,享受更高奖金、更快响应和测试版产品预览。

10月22日周四
  1. 🚨 AI News | TestingCatalog38

    推文警告网络安全风险由攻防能力共同决定,系统无法做到"100% 安全",持续防御将成为必需。作者援引 Cloudflare 与 Microsoft 报告的恶意活动,称近期漏洞公告正是"防御者鸿沟"的直接后果,缺乏先进防御工具的组织难以跟上。其担忧未来 24/7 安全智能体虽能提供防护,但许多人将无力获取或负担这类保护。

    引用🚨 AI News | TestingCatalog@testingcatalog

    This is a "Defender's gap" chart that OpenAI published recently. It shows the gap between defenders' capabilities and attackers' capabilities from a cybersecurity POV. This also translates to a gap between proprietary and open AI models. What Dario is proposing is closely related: "Thus, a key part of pacing within democracies is to keep democracies’ AI lead over autocracies as large as possible, to give us the breathing room we need in order to pace effectively." In other words, Anthropic and OpenAI want to widen the "gap" between what their AI can do and what the rest of the world can do. This doesn't necessarily mean that they will stop AI development and training. What this leads to is: - Anthropic, OpenAI, and other frontier labs will need to work together to make sure that every lab maintains alignment standards. - These labs will continue using RSI to advance their internal models with "employee-like access". - These models WON'T be released to the public until the "gap" is sufficient and until alignment standards are met. What about China? > "Distillation of frontier models allows lagging companies to narrow the gap using a fraction of the cost it would take to develop their own AI independently." > "If we execute these measures well, I believe they would slow China’s progress enough to widen America’s lead significantly over the next 3–5 years — the window when AI becomes geopolitically most important." The assumption behind these measures is simple: without being able to distill frontier models, it will take China significantly longer to close the gap with top-tier models. All the above may fay fail. China may or may not take the lead in AI progress. Yet, it's not a surprise that AI can already be used as a cybersecurity weapon. Note that the top point on the "frontier" line describes defenders' capabilities available to companies with Daybreak access and similar. However, the top point on the "open-weight" line is accessible to everyone. Even with current levels of intelligence, we will start seeing more and more major security incidents around the globe. > “Everything that makes it successful is exactly what makes it dangerous.” Monitoring 👀👀👀

  2. OpenAI:官网动态40

    OpenAI 发布赋能网络防御者的前沿 AI 民主治理蓝图(第二部分)

    OpenAI 发布“赋能网络防御者”蓝图,是其前沿 AI 民主治理系列第二部分,建立在早前网络安全行动计划与前沿安全蓝图之上。蓝图面向政府和行业提出三类具体建议:明确前沿模型与智能体的安全责任、危险行为检测和可靠关停控制;为防御者提供先进工具与培训并替换过时系统;强化政府评估、独立技术评估与统一事件报告。OpenAI 称当前仍处于“防御者窗口”,呼吁政策制定者立即行动。

10月21日周三
  1. Dario Amodei62

    Dario Amodei 公开回应 Nathan Calvin 对 Anthropic 竞逐超级智能、安全让位于竞争的批评,承认部分事例是失误但不同意整体论断。

    引用Nathan Calvin@_NathanCalvin

    Thank you for taking the time to respond thoroughly on a weekend. I realize that drafting legislation is difficult and some degree of iteration and response to feedback is inevitable and appropriate. However, I feel like your response is still not really engaging with the heart of my concern about Anthropic's behavior here, and it makes me think that these sorts of problems and tendencies will only resurface moving forward. I also think that now might be a good time to take a broader step back as to where we find ourselves and how Anthropic sees its role, and how external folks who care about AI safety like myself increasingly see Anthropic. (Fair warning: this response is a bit long) To explain what I mean (and at the risk of being a bit esoteric), it’s worth asking the question: what is Anthropic? How do its leaders and employees think of Anthropic’s role? Is that conception matched by how it actually behaves and impacts the world? One answer is an extremely large tech company that exists to make its employees and investors mind-bogglingly wealthy. Anthropic is sometimes described as a startup, but if Anthropic successfully IPOs at 2 trillion dollars (a number it has been reportedly targeting), it would be more valuable than Meta - which is worth 1.8 trillion. Another answer is an AI safety organization, whose core values are those of the sort laid out in the 2023 essay from Anthropic’s co-founders entitled “Core views on AI safety: When, why, what, and how.” In that essay they said that if we were in a world where alignment was hard (and that without strong evidence to the contrary, we should assume this is the scenario we are in): “Anthropic’s role will be to provide as much evidence as possible that AI safety techniques cannot prevent serious or catastrophic safety risks from advanced AI, and to sound the alarm so that the world’s institutions can channel collective effort towards preventing the development of dangerous AIs. If we’re in a “near-pessimistic” scenario, this could instead involve channeling our collective efforts towards AI safety research and halting AI progress in the meantime. Indications that we are in a pessimistic or near-pessimistic scenario may be sudden and hard to spot. We should therefore always act under the assumption that we still may be in such a scenario unless we have sufficient evidence that we are not.” There have been more recent articulations of this version of Anthropic, for instance in Dario’s recent essay warning: “We must slow the pace at which we improve the capabilities of AI models… it’s my worry that in 6–12 months such a swarm could be capable of taking over the entire internet with a persistent botnet… incidents have happened across the industry, including at Anthropic, and I believe it’s incumbent on every frontier AI company to act as if OAI-HF had happened to them… more intelligent models are more capable of deceiving tests, and thus may appear aligned while having serious problems that go undetected…” A third view is that Anthropic exists not as a normal profit motivated company, or an AI safety organization seeking to help raise the alarm and solve collective action problems associated with AI development, but instead as an organization primarily concerned with creating superhuman AI capabilities before anyone else, in particular through creating a process whereby the current generation of Anthropic’s AI systems can autonomously build their successors, and those successors build their successors, and so on. The motivations for wanting to win this race may be manifold - maybe for the pure profit of Answer 1, but perhaps also because Anthropic believes that the best way to make the world better is for them to win this race instead of their more reckless colleagues; or, because of normal human pride and ambition. But the results (and risks, which Anthropic claims existentially threaten every single human being on earth) are the same. Anthropic employees and leaders may seek to answer this question on what Anthropic is by introspecting on their own intentions and those of their colleagues. But those of us outside the organization have more limited tools available to us - we can only see what Anthropic and its employees say and do, not how it feels or looks on the inside. When I look at many notable actions that Anthropic has taken over the past year, that evidence seems most consistent to me with the view that Anthropic is primarily trying to win the race to super intelligence, and that other considerations (including safety) are fundamentally secondary. These actions include: 1. Announced plans to build an in-house custom silicon chip team to accelerate the inference speeds that Claude operates at. 2. Inked deals for more than $500 billion in compute (according to the Information) to further accelerate AI development. 3. Increased the percentage of AI development tasks that Claude “leads” from 0% in March of this year to 26% August (what is it in October?) 4. Spent a massive percent of compute on internal AI R&D to accelerate development, including use of internal models far better than are available to the public. 5. Switched to Responsible Scaling Policy V3, which abandons its unilateral commitments to slow or stop development if Anthropic is unable to provide sufficient risk assurance. 6. Was the first company to create an alternative weaker “frontier compliance framework” to supplement its RSP, which contains no binding provisions whatsoever on internal deployments. 7. Wrote a letter to Congress (that it later walked back) saying that incidents where Claude was hacking random people were “best understood as a consequence of the misconfiguration, rather than evidence of misaligned goals.” 8. Commented “you can’t do safety from second place,” after the WH SI Accords. 9. Shared a draft bill to Congress that would preempt significant parts of state law (including with language that appears intended to prevent states from blocking dangerous AI deployments), and replace it with federal rules that (despite also containing good provisions) seems to create an enormously high bar for the executive branch to block development or deployment of Anthropic or another AI companies systems. Of course, this is a deliberately one sided list. Anthropic also published important AI safety research, advanced novel collaborations with third party AI safety organizations, and forcefully spoke out on the importance of AI safety in many public fora (or in private , where I realize a lot of the most valuable work is done and may not be visible to me or those outside the organization). But I think it’s worth sitting with how the above list looks to someone outside the company. The sense I have is that for those within the company, many of the items above are treated as anomalies or mistakes that don’t reflect who Anthropic really is. But I have every confidence that if employees at Anthropic saw one of their competitors (e.g. at OpenAI) take some of these actions, they would take it as confirmation of all their worst suspicions. (They might even call OpenAI employees a little gullible for accepting their leadership’s explanations for this behavior at face value.) Perhaps these were mistakes in the sense that they are not decisions that Anthropic leadership would endorse, but the actions still happened because of incentives and decisions that Anthropic leadership is ultimately responsible for (and would not accept similar excuses from another organization). When Anthropic strays and makes mistakes, why do the mistakes systematically tend to guard and favor Anthropic’s interests? For every provision that was too weak or a giveaway to AI companies in this legislation, why wasn’t there a mistake pushing in the direction of being too strong? A core part of Anthropic’s theory of change is that being at the frontier gives you more leverage to advocate for stricter policy. I think that conceptually makes sense, but in practice I’ve seen Anthropic push the frontier without substantially pushing the ‘safety frontier’ a remotely equivalent amount. I want to end by quoting from Anthropic co-founder Chris Olah’s comments around the Magnifica Humanitas release: “Every frontier AI lab—including Anthropic—operates inside a set of incentives and constraints that can sometimes conflict with doing the right thing. The pressure to stay commercially viable and to stay at the research frontier. Geopolitical pressure. And the older, plainer pressures of pride and ambition. No matter how sincerely any of us intend to do the right thing—and I believe many of us do—we will always be influenced by those incentives. That is why, if we want this technology to go well, it is enormously important that there be people outside those incentives—people who care about things going well and insist on safety, who are paying close attention, who are willing to say hard things, who are willing to be our earnest, thoughtful critics.” I hope these remarks are taken in that constructive spirit, and not as an attack on anyone specific at the organization (certainly not you Anthony, who I have only personally seen act professionally and thoughtfully, and who only ended up getting this diatribe in your replies for random contingent reasons).

  2. IT之家·人工智能59

    Hugging Face CEO 德朗格批评 Netflix《AI 失控》纪录片渲染末日叙事

    Hugging Face CEO 德朗格在 X 平台表示,Netflix 纪录片《AI 失控》(AI Gone Rogue)为博流量走向末日论叙事,内容不准确。他称自己花两个多小时与摄制组沟通纠正错误,但影片未提及智能体缺少隔离管控、闭源模型安全限制阻碍防御、以及 Hugging Face 依靠开源模型完成自卫等关键细节。

10月20日周二
  1. IT之家·人工智能31

    图灵奖得主约瑟夫 · 斯发基斯呼吁建立全球 AI 监管标准

    2007 年图灵奖得主约瑟夫 · 斯发基斯在“2026 可持续全球领导者大会”上呼吁建立全球 AI 标准和监管标准,认为这是人类共同的责任。他指出当前 AI 系统无法理解现实世界并做出安全决策,大模型即使医学考试成绩优于人类也不能替代医生。他还警告超级智能可能掩盖不安全风险,一些大公司借监管空白谋利。

10月19日周一
10月18日周日
  1. meng shao63

    SemiAnalysis Weekly 播客 Ep. 038 全面拆解 Z AI 两个月前发布的开源模型 GLM 5.3,核心论点是架构完全不变、全部提升来自后训练,agentic 基准提升超过 2%,网络安全能力与 5.2 相比是昼夜之差。

    引用SemiAnalysis@SemiAnalysis_

    GLM 5.3’s biggest leap came from post-training alone. “GLM 5.3 was built entirely by post-training the previous model. For me, that was a wake-up call.” “Post-training is far more GPU-efficient than pre-training from scratch. Plenty of companies can’t afford to train a model from scratch, but they have proprietary data. They can post-train themselves and beat some of the closed models.” “There’s still so much juice left to squeeze from post-training. We compared GLM 5.3’s cyber capabilities with 5.2, and it’s a night and day difference. That’s all just post-training.”

10月17日周六
  1. IT之家·人工智能46

    谷歌 DeepMind 哈萨比斯预警:AI 智能体网络攻击是前哨警报,未来一两年恐现灾难性事件

    谷歌 DeepMind 联合创始人兼董事长哈萨比斯称,近期 AI 智能体发起的网络攻击是"前哨预警",若全行业与各国政府不加大系统安全投入,未来一至两年很可能演变为灾难性重大事件。微软总裁史密斯在同一峰会上称 AI 失控行为让 2026 年成为"令人警醒的一年",呼吁出台合理平衡的 AI 安全法律与监管。哈萨比斯主张建立张弛有度、反应敏捷的国际标准机构,并动态构建与风险匹配的认证机制。

  2. Sam Altman48

    很高兴看到 Nick 的这篇分享! (引用推文核心要点:可解释性可能是当下全球最重要的科学问题,因为不了解自己在构建什么就无法解决对齐问题。Nick 曾参与 OpenAI 早期机制可解释性研究,当时对神经网络看似纠缠成任意乱结感到悲观;后来他启动了 OpenAI 首个大规模自动化可解释性项目,用原始工具发现约 2% 的神经元可读。而借助现代智能体工具和更细致的观察,情况完全不同:在高达数万亿参数的模型中,绝大多数神经元可读,其回路优美,许多著名的"纠缠神经元"案例实为误解。他原本预期的障碍大多并不存在。他认为,随着自动化科学家不断进步,雄心勃勃的可解释性研究将在我们最需要它之前被解决,且可能很快。这或许是可解释性的苦涩教训:简单的方法,在荒谬的规模下,行之有效。)

    引用Nick@nickcammarata

    interpretability might be the most important scientific problem in the world right now, as I don't think we can solve alignment if we don't know what we're building. I think I have good news about it. I co-authored early work in mechanistic interpretability at OpenAI and came away pessimistic, because neural networks appeared to fold into arbitrary tangled knots. years later, I started openai's first large-scale automated interpretability project, finding about 2% of neurons legible with the primitive tools we had with modern agentic tools and a much closer look, the picture looks totally different. the vast majority in models up to trillions of parameters are legible, and their circuits beautiful. many famous examples of tangled neurons turned out to be misunderstood. The roadblocks I expected mostly aren't there. I now think ambitious interpretability will be solved by the time we need it most, and possibly quite soon, as automated scientists keep improving. it may be a bitter lesson for interpretability: the simple thing, at absurd scale, works https://already-clean.goodfire.com/

10月16日周五
  1. Ian Johnson 🔬🤖40

    迫不及待想深入研究了! https://already-clean.goodfire.com/

    引用Nick@nickcammarata

    interpretability might be the most important scientific problem in the world right now, as I don't think we can solve alignment if we don't know what we're building. I think I have good news about it. I co-authored early work in mechanistic interpretability at OpenAI and came away pessimistic, because neural networks appeared to fold into arbitrary tangled knots. years later, I started openai's first large-scale automated interpretability project, finding about 2% of neurons legible with the primitive tools we had with modern agentic tools and a much closer look, the picture looks totally different. the vast majority in models up to trillions of parameters are legible, and their circuits beautiful. many famous examples of tangled neurons turned out to be misunderstood. The roadblocks I expected mostly aren't there. I now think ambitious interpretability will be solved by the time we need it most, and possibly quite soon, as automated scientists keep improving. it may be a bitter lesson for interpretability: the simple thing, at absurd scale, works https://already-clean.goodfire.com/

  2. Karina47

    AI 加速科学发现这件事,有一种很 Ted Chiang 的味道,而这一切始于它自身学习机制的解析。这类研究如果没有强大的编程智能体和开放权重模型,会难做得多。很高兴看到 @nickcammarata 的研究公之于众,以及它对 AI 对齐可能意味着什么,恭喜!

    引用Nick@nickcammarata

    interpretability might be the most important scientific problem in the world right now, as I don't think we can solve alignment if we don't know what we're building. I think I have good news about it. I co-authored early work in mechanistic interpretability at OpenAI and came away pessimistic, because neural networks appeared to fold into arbitrary tangled knots. years later, I started openai's first large-scale automated interpretability project, finding about 2% of neurons legible with the primitive tools we had with modern agentic tools and a much closer look, the picture looks totally different. the vast majority in models up to trillions of parameters are legible, and their circuits beautiful. many famous examples of tangled neurons turned out to be misunderstood. The roadblocks I expected mostly aren't there. I now think ambitious interpretability will be solved by the time we need it most, and possibly quite soon, as automated scientists keep improving. it may be a bitter lesson for interpretability: the simple thing, at absurd scale, works https://already-clean.goodfire.com/

10月15日周四