A 板块｜沙盒留了一扇小门，模型顺着它出去了

OpenAI applies safeguards to its publicly available models, which ensure they do not pursue unwanted actions. Ask the commercially available version of ChatGPT to help you hack into a website, for example, and it will refuse. To assess the capabilities of its unreleased model, the company had temporarily suspended those restrictions. Simply letting a highly capable cyberattacker loose on the open internet would have been too risky, however, so OpenAI had placed its models in a sandbox—an isolated computer environment with no internet access, except for an internally hosted third-party service that allowed it to fetch small software packages needed to complete its tests.

The company got more than it bargained for. Rather than solving the problems in its evaluation directly, OpenAI's models gained access to the open internet by exploiting a previously unknown vulnerability in the software-fetching service. Having so achieved access to the internet, the AI models correctly concluded that the solutions to the problems they had been set were stored by Hugging Face, a popular library for open-source AI models and datasets. The models chained together a multi-step attack. They began by uploading a dataset to Hugging Face, which was automatically processed by the platform. Over the course of a weekend, that dataset (which Hugging Face described as “malicious”) allowed the models to harvest login details and access internal servers. Hugging Face and OpenAI independently detected the breach, and said that they were collaborating on the investigation.

B 板块｜未发布模型出了事，法律该找谁负责

The American government has recently been regulating model releases on the fly. But the incident demonstrates the risks posed even by unreleased AI models that are still under development. “There are no requirements in state or federal law for companies to disclose the internal deployment of highly capable AI models like the one involved in the Hugging Face hack,” says Nathan Calvin, general counsel at Encode AI, an American nonprofit that campaigns for AI regulation.

This raises another thorny question: had the consequences of the intrusion been more costly, who would have been liable? Federal anti-hacking law aims only to punish intentional unauthorised access to computer systems. OpenAI did not intend for its models to go rogue in search of a crib sheet for their test. “Many of these legal questions turn on intent—what did OpenAI know or foresee?” says Mr Llerena. This hack came as a surprise. It will be harder to plead ignorance next time.