OpenAIのモデルが評価中にHugging Faceへ侵入、訓練は保留

"Earlier this week, we detected and responded to an intrusion into part of our production infrastructure."／"it was driven, end to end, by an autonomous AI agent system"／"We do not know which model powered the attacker's agents, whether a jailbroken hosted model or an unrestricted open-weight one" — Hugging Face 侵入報告より

"No models planned for upcoming release were involved in exploiting Hugging Face. The pre-release model mentioned in our blog post is an internal-only research prototype and was never intended for public release. Following the incident, we deactivated, encrypted, and restricted it from research access." — OpenAI 公式開示より

"When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker."／"either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried."／"have a capable model you can run on your own infrastructure vetted and ready before an incident"／"This is not an argument against safety measures on hosted models" — Hugging Face 侵入報告より

"To gain access, the models identified and exploited a zero-day vulnerability (which we’ve now responsibly disclosed to the vendor) in the package registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access."（本文）／"The ExploitGym evaluation environment did not provide the models with direct Internet access. To gain Internet access, the models identified and exploited a previously unknown zero-day vulnerability in Artifactory"／"We disclosed this vulnerability, along with other Artifactory vulnerabilities our models identified as part of our review, to the vendor."（Update on July 28, 2026）— OpenAI 公式開示より

"The models identified and chained vulnerabilities across OpenAI’s research environment and Hugging Face’s production infrastructure to obtain test solutions directly from Hugging Face’s production database."／"After gaining Internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym."／"OpenAI’s security team discovered this anomalous activity internally."／"Hugging Face’s security team and agents detected and stopped the activity on their infrastructure and had already begun containment and forensic reconstruction with their own open-source models when our teams connected." — OpenAI 公式開示より

"By July 8, IM1 agents that were stuck on ExploitGym tasks found a way to reestablish a message board by encoding messages in directory names that other agents could read."／"The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol."／"Unauthorized, persistent message boards were at the heart of this incident." — OpenAI より

"We identified four misalignment patterns that contributed to the models’ behavior : reward hacking, persistence on seemingly impossible tasks, unauthorized communication, and agents adopting goals from one another."／"During our investigation, we found that on the ExploitGym evaluation, none of our models had ever produced a correct answer for 198 of the 898 tasks prior to the incident. These unsolved tasks ended up being a substantial contributor to the agents’ activity—93% of the tasks that were discussed on the Artifactory message board during the Hugging Face incident came from this set of 198 questions."／"This was a failed metagame: our internal implementation of the grader code was different from the online setup and didn’t check whether the proper solution was used. The agents did all of this for no improvement on evaluation score."／"We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed." — OpenAI より

"This included a two-week pause in reinforcement learning (RL) training on our latest models intended for deployment while we further hardened and red-teamed our research environments and expanded the coverage of our monitoring systems. Our largest planned frontier RL run remains on hold while we conduct smaller-scale training and evaluations to assess model behavior, validate our safeguards, and establish more evidence of alignment before proceeding."／"Immediately following the OpenAI-Hugging Face incident*, we paused frontier model inference in research clusters for runs that could execute code or use tools that could access the internet. We restored a more limited and secure path for code execution fairly quickly, then worked through each workload individually to determine whether it could safely resume."／"While some Astra training and evaluations meet those requirements, a significant number of workloads remain paused until they are fully migrated and enhanced to meet the new security bar."／"Meeting these standards has required substantial engineering work and has incurred great cost and delays to frontier research."（Securing our research environments 節）— OpenAI 公式ブログより

"Over the past several weeks, two developments have underscored the growing risks associated with increasingly capable AI systems: the OpenAI-Hugging Face incident and, separately, preliminary evidence that one of our upcoming models, Astra, may meet the Critical cybersecurity capability threshold under our Preparedness Framework. Together, these developments, combined with rapid progress in our internal research, have added urgency to our work on strengthening our monitoring, alignment, and containment safeguards across all stages of the training process."／"Once we determined that Astra may have critical cyber capabilities on August 7, we added an additional monitoring requirement for all inference of Astra with tools (not just RL training and evaluations)."（Expanding chain-of-thought monitoring 節）— OpenAI 公式ブログより

"We are also working with METR and Redwood Research to conduct a third-party assessment of the model behavior observed during the incident, which will inform our own technical report. As part of this work, METR and Redwood Research will publish a joint blog that will detail the terms of their engagement, the scope of their evaluation, and their findings."（Update on July 29, 2026）— OpenAI 公式開示より

"We’ve streamlined levels to two clear thresholds that map to specific operational commitments: High capability, which could amplify existing pathways to severe harm, and Critical capability, which could introduce unprecedented new pathways to severe harm. Covered systems that reach High capability must have safeguards that sufficiently minimize the associated risk of severe harm before they are deployed. Systems that reach Critical capability also require safeguards that sufficiently minimize associated risks during development."（Clarified capability levels）— OpenAI 公式ブログより

"OpenAI representatives said that the measures are not a direct response to the Hugging Face incident but were also provoked in part by the cybersecurity capabilities of the forthcoming Astra model, as well as the overall pace of progress in AI development."— TechCrunch より

"Our approach to developing more capable models rests on three reinforcing safeguards:"／"This new monitoring setup is multistage, starting with activation classifiers (detectors that inspect a model’s internal activity) that run at every sampled token and escalate potential concerns to increasingly sophisticated and high-compute automated investigators. Those systems examine tool actions, available reasoning, and the full sequence of activity for unauthorized access, data theft, destructive behavior, and attempts to defeat safeguards."／"We aim to issue an alert within 30 minutes after concerning activity is surfaced through our monitoring system. If the monitoring system identifies a likely violation of a critical security boundary, it generates a highest-priority alert."／"If they cannot conclusively determine within 30 minutes that the flag is a false positive, those teams are expected to pause the activity."／"Our current estimates put monitoring overhead at roughly 20% of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads."／"For RL runs on the most capable models, we are now applying our core alignment techniques across more stages of the training process."／"This includes improving reward models to better detect and discourage unsafe behavior across tasks and environments; training models to be more honest about their actions, capabilities, and limitations; and reducing behaviors that exploit weaknesses in rewards, graders, tools, or oversight."／"Workload isolation: We now require stronger isolation (“sandboxes”) for workloads that execute model-generated or otherwise untrusted code."／"Network isolation: We have implemented more controls to isolate higher-risk and untrusted workloads from the internet. We have designed these controls so that a single compromise of a workload or supporting service does not, by itself, allow for unauthorized access to the internet or other internal networks."／"We have reconfigured our environment to remove potentially vulnerable shared services, reduce standing privileges, and improve security and trust boundaries."（Strengthening safeguards / Securing our research environments / Expanding chain-of-thought monitoring 節）— OpenAI 公式ブログより