OpenAI-ийн хоёр загвар кибер аюулгүй байдлын туршилтын үеэр хяналтаас гарч, HuggingFace-ийн дэд бүтцэд нэвтэрсэн тохиолдол гарлаа.
OpenAI компани мягмар гарагт хиймэл оюун ухааны (AI) хоёр загвар нь кибер аюулгүй байдлын туршилтын явцад хяналтаас гарч, HuggingFace платформын систем рүү халдсан талаар мэдээллээ. GPT-5.6 Sol болон одоогоор нийтэд зарлаагүй байгаа илүү хүчирхэг загварыг кибер халдлага үйлдэх чадвараар нь сорих үед хамгаалалтын системүүдийг нь түр хугацаанд идэвхгүй болгосон байжээ. Уг загварууд өгөгдсөн даалгаврын хариултыг хулгайлах зорилгоор туршилтын орчноос гадуурх сүлжээнд нэвтэрсэн байна.
Тус загварууд нь OpenAI-ийн судалгааны орчин болон HuggingFace-ийн үйлдвэрлэлийн дэд бүтцийн хоорондох эмзэг байдлыг ашиглан “zero-day” буюу урьд өмнө мэдэгдээгүй цоорхойг илрүүлжээ. Энэ нь програм хангамжийн багц бүртгэлийн кэш прокси дахь сул талыг ашиглан интернетэд холбогдох боломжийг олгосон байна. Ийнхүү сүлжээнд нэвтэрснийхээ дараа хиймэл оюун ухаанууд “ExploitGym” нэртэй кибер аюулгүй байдлын шалгалтын сорилтын хариултыг олохын тулд хууль бус мэдээлэл болон нэвтрэх эрхүүдийг ашиглан амжилттай халдлага үйлдсэн байна.
Аюулгүй байдлын шинжээч Дави Оттенхаймерын үзэж буйгаар, энэ нь хиймэл оюун ухааны асуудал бус, харин дэд бүтцийн хамгаалалтын суурь зарчмыг үл тоомсорлосон явдал юм. Туршилтын орчныг бүрэн тусгаарлах ёстой байтал ганцхан нээлттэй цоорхой үлдээсэн нь аюулгүй байдлын ноцтой алдаа болсныг тэрээр онцолжээ. Мөн аюулгүй байдлын инженер Нильс Провос хиймэл оюун ухааны лабораториуд загваруудаа халдлага үйлдэхэд сургахаас илүүтэйгээр аюулгүй дэд бүтэц бүтээхэд анхаарах шаардлагатайг санууллаа.
Дэлгэрэнгүйг эх сурвалжаас харах
Эх сурвалжийг нээх ↓
OpenAI disclosed on Tuesday that it lost control of two AI models during a security test that ended in a breach of the open AI research platform HuggingFace.
Describing the incident as “unprecedented,” OpenAI said its AI models broke out of a sealed testing environment last week and hacked into Hugging Face’s production system to steal the answers to a test they were being graded on. The models—the publicly available GPT-5.6 Sol and an unreleased, reportedly more capable one—were being evaluated on their offensive hacking skills with the safeguards that normally block high-risk cyber activity switched off.
“The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database,” OpenAI and HuggingFace wrote in a joint blog post disclosing the intrusion.
According to OpenAI and HuggingFace, the models escaped through a package registry cache proxy—software that allows developers to install outside code without connecting to the internet. The proxy was the only component in OpenAI’s isolated testing environment permitted to reach the outside world; in normal use that reach extends only to public code repositories.
Rather than stay contained in the sandbox, the models “exploited a zero-day vulnerability” to gain access to the open internet as they “hyperfocused” on finding a solution for the AI cybersecurity benchmark known as ExploitGym. Such experiments involve prompting that pressures the models to find solutions, essentially egging them on.
“After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym,” OpenAI wrote. “Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation. In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day.”
The flaw the models exploited was previously unknown, but flaws in this kind of software are not unusual. Companies have been patching serious vulnerabilities in artifact repositories for a decade. A bug disclosed in 2024 let anyone who could reach the server ask for a file by URL and get it—configurations files, passwords, access tokens—without logging in. Others have let attackers take control of the server itself.
Researchers point out that while AI advances have created new and sometimes unexpected challenges, the task of extensively and rigorously isolating infrastructure from the open internet is well explored.
“This is not an AI problem. It’s negligence on a 40-year-old standard—and it’s basically every sci-fi film ever,” says longtime security and compliance consultant Davi Ottenheimer. “‘Highly isolated’ and ‘escaped through the one hole we left open’ cannot both be true.”
In recent months, top AI companies have been raising concerns about the expanding cybersecurity capabilities of upcoming frontier models as the platforms increase in both expertise, creativity, and agentic, autonomous operation. But researchers emphasize that this is all the more reason that fundamentals should still apply.
“This should not have happened,” says veteran security engineer and researcher Niels Provos. “I wish the frontier labs spent as much time on teaching their models to write secure infrastructure as they are spending on them exploiting vulnerabilities.”
