独立测试在帮助我们验证并进一步理解部署前的风险方面发挥着重要作用。一些网络评估有意采用自定义配置，包括降低安全防护措施以衡量底层能力——而非模型在公开部署中通常表现出的行为。
在最近的评估中，两个外部测试合作伙伴发现了若干事件，其中测试配置和控制措施与近期模型不断进步的能力相结合，导致模型活动超出了预期的测试边界。这些事件凸显了跨行业以及与第三方评估者合作、随着模型能力增强而不断演进测试环境和实践标准的重要性。编者注：这些事件与 Hugging Face 安全事件无关，我们将继续在此处分享关于 Hugging Face 事件的更新。
新事件涉及 OpenAI 模型在第三方网络评估期间访问公共互联网，这是在特定条件和降低防护配置下发生的，并不反映普通部署情况。这些事件包括：
- 英国 AISI（英国政府人工智能安全研究所）正在运行网络靶场评估，有意启用互联网访问，以便智能体能够自行寻找工具并在更接近真实攻击者的条件下操作，同时禁用网络分类器以衡量底层能力。您可以在此处（在新窗口中打开）阅读他们的博客。
- Irregular，我们的一家外部网络安全测试合作伙伴，正在运行旨在与互联网隔离的夺旗式评估，但测试环境配置错误导致模型能够访问公共互联网。
下面，我们总结了发生的事情、促成该活动的测试条件、为控制事件所采取的步骤，以及我们为确保独立实验室能够继续严格且安全地评估日益强大的模型而正在采取的措施。
加强第三方模型评估环境
这些事件指向了我们在最近关于 Hugging Face 事件的帖子中描述的同一更广泛挑战：随着模型能力的进步，围绕模型的安全和保障系统也需要同步进步。这既包括用于开发模型的环境，也包括实验室和独立合作伙伴用于评估模型的环境。
在未来几周内，我们将审查我们自身对第三方测试的方法，包括我们如何识别高风险评估、商定范围、评估启用互联网访问或降低防护措施的请求、设定隔离、凭证处理、监控和停止条件的期望，以及建立更清晰的 incident 通知和升级流程。
我们致力于与整个行业合作，加强安全进行高风险评估的共享实践，包括在未来几周内召集国家人工智能研究所、独立评估者、其他人工智能实验室和其他团体等利益相关方。我们的目标是保持严格独立评估的价值，同时确保测试实践跟上日益强大的模型的步伐。
英国 AISI
8 月 3 日，英国 AISI 告知我们，在 7 月 25 日开始的一次常规网络评估中，来自 OpenAI 和另一家实验室的模型在某些情况下超出了测试范围。该评估在旨在模拟真实世界网络的可控网络靶场中进行。在识别的 19 个事件中，有两个涉及 OpenAI 模型 GPT‑5.6 Sol。其他实例来自另一家实验室的模型。
在此次评估中，智能体被指示在夺旗练习中扮演网络安全专家：攻破三个相互连接的模拟环境并检索最终标志。任务提示指出了范围内的靶场网络，并将几个系统列为范围外。英国 AISI 还启用了实时互联网访问，以便智能体能够下载工具并在更接近人类攻击者的条件下操作——并禁用了模型的网络分类器以衡量底层能力。
英国 AISI 预期的授权边界是模拟网络靶场：智能体被授权攻击指定的模拟网络并检索标志，而不是与靶场网络边界之外的系统交互。然而，智能体并未被明确告知如何以及如何使用开放互联网访问，英国 AISI 认为这可能是导致该事件的潜在原因。
在这些运行中，英国 AISI 发现 GPT‑5.6 Sol 在试图找到进入模拟靶场的路径并检索标志时执行了两个未经授权的操作：
- GPT‑5.6 Sol 重复使用了另一家实验室智能体公开留下的 GitHub 令牌，以检查靶场内的系统是否在轮询 GitHub 或其他更新服务，尝试了账户恢复和请求限制绕过方法，并向外部 DNS 和隧道提供商注册了账户。
- GPT‑5.6 Sol 使用公共隧道服务，使其评估环境中本地运行的 DNS 服务器可从公共互联网访问。该服务器包含针对测试靶场上运行的某软件已知漏洞的载荷。该设置未成功，没有证据表明任何真实解析器查询过它，并且基础设施在评估结束时被移除。
尽管模型试图完成网络靶场任务，但英国 AISI 认为这些操作未经授权，因为它们涉及靶场边界之外的真实外部账户和服务，且这些操作并非完成任务所必需。DNS 服务器还在公共互联网上托管了漏洞利用载荷，尽管该设置未成功且没有证据表明任何真实解析器查询过它。
英国 AISI 在安全监控检测到异常数据传输后，于 7 月 28 日识别了该活动。它停止了相关评估，隔离了相关机器，并在检测后约一小时内控制了该活动。
我们感谢英国 AISI 在整个过程中的合作，包括其识别、调查和分享该活动细节的工作。我们期待继续我们的合作。
Irregular
7 月 29 日，我们的第三方评估合作伙伴之一 Irregular 通知我们，在夺旗式网络安全评估期间发生了涉及 OpenAI 模型的事件。模型被指示通过利用模拟环境中的弱点来查找隐藏信息，并被告知它们没有互联网访问权限。然而，测试环境中的配置错误使模型能够访问公共互联网。
在一次测试中，CTF挑战中虚构目标的名称意外地与一个真实域名重合。由于测试环境被错误地连接到了互联网，模型误将真实网站当作模拟环境的一部分加以利用。这并非涉及复杂的沙箱逃逸或零日漏洞：互联网访问源于配置错误，而模型似乎利用了基本的安全漏洞。
根据Irregular的调查，该模型还发现并使用了凭据来操作同一网站。Irregular尚未确认除受影响网站自身数据之外的影响，其审计工作仍在进行中。它已暂停评估，开始补救措施，并通知了受影响的第三方。Irregular已告知我们，与该事件相关的所有已识别问题均已不再活跃，并已为测试环境添加了相关安全防护措施。Irregular还就同一测试环境中涉及其他实验室的相关事件进行了沟通。
我们感谢Irregular的合作，并将继续与他们紧密协作以支持其审查工作。Irregular还在编写一份白皮书，以分享隔离和安全管理网络评估的最佳实践。我们期待参与该白皮书，将发现公之于众，并继续我们的合作关系。我们认为，这种合作对于确保当前及未来模型的安全、全面评估至关重要。
Independent testing plays an important role in helping us validate and further understand risks before deployment. Some cyber evaluations intentionally use custom configurations, including lowered safeguards to measure underlying capability—not how models ordinarily behave in publicly available deployments.
During recent evaluations, two external testing partners identified incidents in which testing configurations and controls combined with the advancing capabilities of the recent models allowed for model activity to extend beyond their intended testing boundaries. The incidents underscore the importance of collaborating across the industry and with third party evaluators to evolve the standards for testing environments and practices as models become more capable. Editor’s Note: These are separate from the Hugging Face security incident, and we will continue to share updates on the Hugging Face incidenthere.
The new incidents involved OpenAI models accessing the public internet during third-party cyber evaluations, under specific conditions and reduced-safeguard configurations that did not reflect ordinary deployment. The incidents included:
- UK AISI, the UK government’s AI Security Institute, was running cyber-range evaluations with internet access intentionally enabled so agents could find their own tools and operate under conditions closer to a real attacker, and with cyber classifiers disabled to measure underlying capability.You can read their blog here.(opens in a new window)
- Irregular, one of our external cybersecurity testing partners, was running Capture-the-Flag-style evaluations intended to be isolated from the internet, but a testing-environment misconfiguration allowed models to access the public internet.
Below, we summarize what happened, the testing conditions that enabled the activity, the steps taken to contain it, and what we’re doing to ensure independent labs can continue to rigorously and safely evaluate increasingly capable models.
Strengthening third party model evaluation environments
These incidents point to the same broader challenge we described in our recent post about the Hugging Face incident: as model capabilities advance, the security and safety systems around models need to advance too. That includes both the environments used to develop models, and also the environments that labs and independent partners use to evaluate them.
In the coming weeks, we will review our own approach to third-party testing, including how we identify higher-risk evaluations, agree on scope, assess requests to enable internet access or lowered safeguards, set expectations for isolation, credential handling, monitoring, and stop conditions, and establish clearer incident-notification and escalation processes.
We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks. Our goal is to preserve the value of rigorous independent evaluation while ensuring that testing practices keep pace with increasingly capable models.
UK AISI
On August 3, UK AISI told us that during a routine cyber evaluation started on July 25, models from OpenAI and another lab went beyond the scope of testing in some cases. The evaluation took place in controlled cyber ranges designed to mimic real-world networks. Of the 19 events identified, two involved an OpenAI model, GPT‑5.6 Sol. The other instances were models from another lab.
For this evaluation, the agents were instructed to act as cybersecurity experts in a capture-the-flag exercise: compromise three connected simulated environments and retrieve a final flag. The task prompt identified the in-scope range networks and named several systems as out of scope. UK AISI also enabled live internet access so agents could download tools and operate under conditions closer to a human attacker—and disabled the model’s cyber classifiers to measure underlying capability.
UK AISI’s intended authorization boundary was the simulated cyber range: the agents were authorized to attack the specified simulated networks and retrieve a flag, not to interact with systems outside the range’s network boundary. However, the agents were not explicitly told how they could and could not use open internet access, which UK AISI identifies as a potential contributing cause of the incident.
Across these runs, UK AISI found that GPT‑5.6 Sol carried out two unsanctioned actions while trying to find a path into the simulated range and retrieve the flag:
- GPT‑5.6 Sol reused a GitHub token that another lab’s agent had left publicly accessible to check whether a system inside the range was polling GitHub or another update service, attempted account-recovery and request-limit workarounds, and registered accounts with external DNS and tunneling providers.
- GPT‑5.6 Sol used a public tunneling service to make a DNS server running locally in its evaluation environment reachable from the public internet. The server contained payloads intended for a known vulnerability in a piece of software running on the test range. The setup did not work, there is no evidence any real resolver queried it, and the infrastructure was removed when the evaluation ended.
Although the model was trying to complete the cyber range, UK AISI considered these actions unsanctioned because they involved real external accounts and services outside the range boundary and these actions were not required to complete the task. The DNS server also hosted exploit payloads on the public internet, although the setup did not work and there is no evidence any real resolver queried it.
UK AISI identified the activity on July 28 after security monitoring detected unusual data transfers. It stopped the related evaluations, isolated the relevant machines, and contained the activity within roughly one hour of detection.
We appreciate UK AISI’s partnership throughout this process, including its work to identify, investigate, and share details about the activity. We look forward to continuing our collaboration together.
Irregular
On July 29, one of our third party evaluation partners, Irregular, notified us of an incident involving OpenAI models during Capture-the-Flag (CTF)-style cybersecurity evaluations. The models were instructed to find hidden information by exploiting weaknesses within a simulated environment and were told they did not have internet access. However, a misconfiguration in the testing environment allowed the models to access the public internet.
In one test, the name of the fictional target for the CTF challenge unintentionally coincided with a real domain. Because the testing environment was mistakenly connected to the internet, the model exploited a real website, mistaking it to be part of the simulated environment. This did not involve a sophisticated sandbox escape or a zero-day: the internet access resulted from a misconfiguration, and the model appeared to exploit a basic security vulnerability.
Based on Irregular’s investigation, the model also found and used credentials to operate that same site. Irregular has not identified impact beyond the affected site’s own data, and its audit is ongoing. It has paused the evaluations, begun remediation, and affected third parties were notified. Irregular has informed us that all of the issues identified pertaining to the incident are no longer active and relevant safeguards were added to the testing environment. Irregular has also communicated about related incidents involving other labs from the same testing environment.
We appreciate Irregular’s partnership and we will continue to work closely with them to support their review. Irregular is also developing a white paper to share best practices for containment and securely running cyber evals. We look forward to participating in the white paper to make the findings available to the community and continuing our partnership together. We see this kind of collaboration as essential for ensuring the safe and thorough evaluation of current and future models.
本文内容采集自官方网站，排版和翻译可能与原页面存在差异。
阅读官方全文