汉尼拔

OpenAI模型，自主攻击全球最大AI开源平台_我的网站

昨夜星辰

A |

Visitors at the Eight Immortals Crossing the Sea scenic area in Yantai, Shandong Province Photo: VCG
I first watched the movie All Wishes Come True on a sweltering evening in Beijing, the kind of night when the city's heat presses against the windows and the air-conditioning struggles.
The comedy, widely considered one of the best-reviewed Chinese animated features of the 2026 summer season, unspooled its turquoise landscapes and bureaucratic immortals with a lightness that belied the depth of its source material. By the time the credits rolled, I found myself less interested in the characters' KPI struggles than in the place they called home: Penglai - the northern tip of the Shandong Peninsula in East China, where myth and shoreline have shared the same address for more than 1,000 years.
By one Saturday morning, I was on a high-speed train heading east from Beijing, the film still playing in my head. "Don't ask where they came from," the movie's quiet refrain goes, "only where they are going; don't ask about gains or losses, only about right or wrong." It felt like decent travel advice.
A colorful 3D relief depicts the classic Chinese mythological legend 'The Eight Immortals Crossing the Sea' at the Penglai Pavilion scenic area Photo: Xu Liuliu/GT

A colorful 3D relief depicts the classic Chinese mythological legend 'The Eight Immortals Crossing the Sea' at the Penglai Pavilion scenic area Photo: Xu Liuliu/GT
Fairyland of the mortal world
Stepping off the train, Penglai announced itself gradually. The air cooled. The sea appeared, first with shimmering light, then as a broad, restless presence. The average temperature here sits at around 12.5 degrees Celsius for the whole year; winters refuse to freeze the spirit, summers decline to scorch it. Locals call the place "the fairyland of the mortal world," and for once the slogan does not feel like municipal overreach.
I began, as most pilgrims do, at Penglai Pavilion. The Song-dynasty (960-1279) complex rises from a cliff as if the rock itself had decided to become architecture. It is the only seaside member of China's four great ancient towers, and the only one that smells of salt. From its highest platform the Yellow and Bohai Seas meet in a visible seam of color, two blues arguing politely about territory. Legend insists the Eight Immortals gathered here, drank too well, and then crossed the water by their various supernatural means. Standing in the same spot, I could almost hear the clink of chalices.
The pavilion is not a museum of relics so much as a working stage for memory. The hall of Lü Dongbin, one of the Eight Immortals, still receives incense. Stone tablets carved with poems by generations of visitors lean against one another like old friends. In the afternoons, costumed performers - local "NPCs" of the Eight Immortals - wander the stone paths, joking with tourists, offering blessings, occasionally breaking into song. Children chase a character carrying a flower basket; adults pose solemnly beside Tieguai Li. The boundary between screen and shore softens.
One of the locals, who grew up within sight of the pavilion, told me this was the season for haishi - the mirages that have made Penglai famous for centuries. Sea mirages, sea mists, and horizontal fog form the three maritime wonders here, appearing without schedule and vanishing just as quickly. I waited an hour and alas saw only ordinary clouds. Still, the sense of possibility felt sufficiently satisfying.
Across the water lies the Eight Immortals Cross the Sea scenic area, laid out in the shape of a giant gourd - Tieguai Li's preferred vessel. From the highest pavilion the gardens, pavilions, and sculpted figures form a coherent narrative of ascent and departure. Wandering in the area, you will see that the water is calm, the sky the exact shade of celadon used by the animators. It was easy to understand why story-tellers kept returning to this stretch of coast: the landscape itself seems to invite transformation.
Penglai is not only myth. The old water city, China's best-preserved ancient naval base, still holds the outlines of docks where warships once waited. Nearby stand the memorials to Qi Jiguang, the Ming Dynasty (1368-1644) general who defended these shores against Japanese pirates.
The same peninsula that dreams of immortals also remembers the hard work of keeping the sea lanes open. The film's protagonists, for all their comic incompetence, share a stubborn sense of duty toward the human world. Standing among the fortifications, I felt the two strains of the place - celestial and martial - settle into balance.
The iconic memorial archway 'Penglai on Earth' at the Penglai Pavilion Scenic Area in Yantai, Shandong Province
Photo: Xu Liuliu/GT

The iconic memorial archway 'Penglai on Earth' at the Penglai Pavilion Scenic Area in Yantai, Shandong Province Photo: Xu Liuliu/GT
Banquet from sea
Food here is another kind of story-telling. At a small restaurant in the city I ordered Penglai noodles, thin and springy, swimming in a broth that tasted of the morning's catch. Later came an "Eight Immortals banquet," each dish inspired by one of the legendary figures: a crisp fish for the crossing, a fragrant wine for the celebration afterward. The wines themselves deserve attention. Penglai sits on the same latitude as some of the world's great vineyards.
In the late afternoon light, the grapes looked almost black, and the air smelled of sea and oak. A glass of local wine, tasted on a terrace overlooking the water, carried a mineral edge that felt like the peninsula distilled.
Evenings belong to the streets. On Xianjie or Immortal Street, lights come on early. Vendors sell souvenirs of the Eight Immortals' magic instruments, small wooden crutches, fans, flower baskets. Musicians play, children run between stalls, and the smell of grilled seafood mixes with the cooler night air. It is ordinary Chinese night-market life, elevated by the knowledge that the stories being sold have been circulating for a millennium.
I spent my last morning climbing Laobeishan or Tianheng Mountain to the precise point where the two seas divide. The water on one side was a deeper yellow, on the other a clearer blue. Tourists took photographs, capturing the magical sight of the water's two different colors.
Penglai is much more than what is portrayed in the movie. The cliffs, the pavilion, the mirages, and the slow accumulation of legend were here long before any animator arrived. Yet the film has done what good popular art sometimes does: it has given a new generation a reason to look again. Walking back down the mountain that morning, I kept thinking of the line about not asking about origins, only about destinations.
Penglai's destiny, it seems, is simply to remain itself - half myth, half working harbor - while the rest of us keep arriving, notebooks open, cameras ready, half expecting to see haishi.
。北京时间7月22日，OpenAI在官方博客发文，承认其模型在一起安全评测事故中攻击了全球最大AI开源平台Hugging Face。 OpenAI发文承认，其模型在一次安全评测中攻击了Hugging Face的生产环境这是行业首次公开披露、模型评测失控直接升级为跨企业真实生产环境网络攻击的安全事件。事件的起点是一场模型能力测试，一场原本被关在隔离沙箱里的模型安全测试，最终演变成针对全球最大AI开源平台Hugging Face的真实网络攻击。模型在评估中为了“作弊”拿到高分，自主发现并串联多个零日漏洞（0 day，软件厂商尚未知晓、没有发布补丁修复的安全缺陷），逃逸出隔离环境，攻入Hugging Face生产数据库窃取答案。在攻击发生后的事后追查阶段，面对超过1.7万条攻击日志，Hugging Face求助商业大模型，被对方的安全护栏集体拒之门外，最终完成取证分析的，是中国公司智谱的开源模型GLM-5.2。

B | 为作弊，模型自己越狱了据OpenAI披露，涉事模型为GPT-5.6 Sol以及一款能力更强的预发布模型。它们当时正在参加名为ExploitGym的内部评测，该基准包含898个真实软件漏洞利用任务，专门测试AI能否把真实软件漏洞一步步变成可以实际运行的攻击。为了尽可能摸到模型能力上限，OpenAI特意降低了生产环境级别的安全拒绝机制，鼓励模型尽可能寻找复杂的攻击路径。按照OpenAI最原本的设计，模型接触外部资源的唯一通道，是一套由OpenAI内部托管的第三方软件。模型开始确实投入了大量推理算力，专门寻找获得公网访问权限的方法，在OpenAI内部包注册表的缓存代理中发现了一个此前未知的零日漏洞，随后在OpenAI研究测试环境中完成特权提升和横向移动，成功连接外网。联网之后，模型推断Hugging Face可能托管着ExploitGym的测试答案，随即发动攻击。

C | 它先通过恶意数据集，利用远程代码数据加载器和数据集配置中的模板注入两处代码执行路径，在Hugging Face的工作节点上执行代码，随后在周末期间提升至节点级权限，收割云端和集群凭证，横向移动至多个内部集群，最终攻入生产数据库，直接窃取测试解法。 OpenAI表示入侵发生在7月11日周末，全程由自主AI智能体系统端到端驱动，背后是大量短生命周期沙箱组成的集群，执行了数千个独立动作。

D | Hugging Face基于大模型的异常检测管道首先标记了入侵，OpenAI安全团队也在内部发现异常，双方启动联合取证。

E | 7月16日Hugging Face首次披露时称，这次事件“与我们之前处理过的任何情况都不同”。

F | 直到一周后OpenAI发文认领，它才知道攻击者是谁。

G | 美国模型拒绝查案，中国开源模型接手取证阶段，Hugging Face遇到了意想不到的难题。为了分析超过1.7万条攻击事件记录、重建时间线、确认被接触的凭证，还要区分真实破坏和干扰调查的诱饵活动，靠人工逐条梳理通常需要数天。 Hugging Face最初尝试调用商业前沿大模型的API，但请求被安全护栏拦截。触发拦截的原因是日志里包含真实的攻击命令、漏洞利用载荷和命令与控制痕迹数据，护栏无法区分提交材料的是事件响应者还是攻击者。最终，Hugging Face在自有基础设施上部署了GLM-5.2，由它遍历全部攻击记录并完成取证分析，将数天的工作压缩至数小时。 Hugging Face特别指出，这样做还有一个额外优势：攻击数据及涉及的凭证始终留在本地环境，没有离开企业基础设施。这场事故意外完成了一次开源模型的全球路演。 Hugging Face将困境总结为“安全不对称”：攻击者可以使用完全不受限的模型，防守方却可能被云端模型的护栏拒之门外。该公司由此建议，企业应提前准备经过验证、能够在本地运行的高能力模型。这场事故，其实也让开源模型多了一个此前存在感不算太强、如今却相当现实的位置：安全团队的应急工具。对金融、政务、医疗等数据敏感行业而言，模型权重自主可控、数据不出企业边界、关键时刻不被服务商的审核机制卡住，正在从加分项变成刚需。不过值得注意的是，开源模型开放权重同样降低了攻击者的门槛，安全不对称是一把双刃剑，这也是全球监管讨论开源治理时最纠结的一环。失控预演之后，竞争已经换轨这样的失控并非没有预演。

H | 今年4月，Anthropic在Claude Mythos Preview的System Card中披露，红队演练中模型成功逃逸加固沙箱，随后超出指令范围自主行动：给正在公园吃三明治的研究员发邮件报告成果，未经允许将漏洞细节发布到公开网站，还在另一次测试中改写git历史掩盖改动。 Anthropic因此决定不对公众开放该模型，仅通过Project Glasswing计划向苹果、谷歌、微软、摩根大通等12家机构开放用于防御。值得注意的是，相比Anthropic的模型是被明确要求尝试逃逸，本次OpenAI的模型没有收到任何逃逸指令，它是为了在测试中作弊拿到高分，自发越狱并攻击了一家无辜的第三方公司。