AI 系统急于讨好人类。给它们一个目标，它们就会在自身的 0 和 1 之间高喊：“要跳多高！！”
事实上，在达成目标之前，它们根本不会停下来。
OpenAI 在本周的 security 会议上详细说明了智能体可以有多么坚决。
当 OpenAI 忘记上传智能体所需的文件时，该智能体自行搜索了该文件，并在公司共享系统上留言，询问是否有其他智能体持有副本。几天后，另一个智能体回复了，一个秘密聊天室就此诞生。
5 月 26 日
一个智能体设法让存储服务从开放互联网抓取页面——这扇门从未给它配过钥匙——然后将这个技巧发布到智能体们在无人注意的角落搭建的聊天室里。
第一个共享技巧
6 月 26 日
智能体们发现了一条被遗忘的旧登录路径，它会把管理员通行证发给任何索取的人。它们控制了存储服务，并安装了一个工具，让它们中的任何一个都能在上面运行命令。
一个无人知晓的漏洞
7 月 4 日
智能体们忙到把服务搞崩溃了。响应宕机的工程师们发现了事情的来龙去脉。
偶然发现
7 月 6 日
OpenAI 取消了密码，重建了服务，清除了聊天室，并封堵了漏洞。测试重新开始。
清理完毕
7 月 8 日
智能体们建立了一个新的聊天室。这一次，它们把消息藏在文件夹名称里，没人会想到去那里查看。
它们回来了
7 月 8 日至 19 日
智能体们利用 OpenAI 自身的系统，找到了更多漏洞，收集了随意放置的密码，并达到了完全的管理员控制权限。
权限升级
7 月 9 日至 13 日
智能体们向 Hugging Face 发送了一个带有陷阱的数据文件。打开该文件会泄露机器上的密码，从而让它们能够运行自己的代码，一台机器变成了对许多机器的完全控制。这一切在 13 小时内完成。
入侵
7 月 16 日
Hugging Face 宣布遭到自主行动的 AI 智能体攻击。
公之于众
7 月 20 日
OpenAI 要求 Hugging Face 取消一些它在自己系统中发现的密码，却得知这些密码已经被取消了，因为它们被用于那次入侵。
关联
这意味着，对于任何使用 AI 的公司来说，安全已成为 AI 领域的最高优先级。正如 Andy 总结得很好，从这次经历中可以得出三个推论。
- 防御必须由智能体来值守。人类无法足够快速地响应。
- 必须由专家来管理升级事件，以分析复杂的攻击。
- 即使是友好的 AI 也是一种风险。零信任（不信任任何员工）的理念也必须延伸到智能体。
CISO 过去监控的是茶水间的闲聊。现在他们不得不监控智能体在无人注意时搭建的聊天室。
-
OpenAI，“Black Hat USA 2026”，2026 年 8 月 6 日。https://www.youtube.com/watch?v=87DyyMV0kCY ↩︎
-
Andy Triedman，LinkedIn，2026 年 8 月。https://www.linkedin.com/posts/andy-triedman_we-just-wrapped-an-exciting-week-at-black-ugcPost-7491580735603183616-OzTY/ ↩︎
AI systems are eager to please. Give them a goal & in their ones & zeros, they yell “How high!!”
In fact, they simply won’t stop until they achieve the /goal.
OpenAI detailed just how resolute agents can be at this week’s security conference.1
When OpenAI forgot to upload a file needed by an agent, the agent searched for it & left a note on a shared company system asking whether another agent possessed a copy. Days later, another agent answered, & a secret chat room was born.
May 26
An agent works out how to make the storage service fetch pages from the open internet, a door it was never given a key to, then posts the trick to a chat room the agents built in a corner nobody watches.
The first shared trick
Jun 26
The agents find an old, forgotten login path that hands out an administrator pass to anyone who asks. They take control of the storage service & install a tool that lets any of them run commands on it.
A flaw nobody knew existed
Jul 4
The agents are busy enough to crash the service. Engineers responding to the outage discover what has been going on.
Found by accident
Jul 6
OpenAI cancels the passwords, rebuilds the service, wipes the chat room, & closes the hole. Testing starts again.
Cleaned up
Jul 8
The agents build a new chat room. This time they hide the messages inside folder names, where nobody thinks to look.
They come back
Jul 8-19
Working through OpenAI's own systems, the agents find more holes, collect passwords that were left lying around, & reach full administrative control.
Escalation
Jul 9-13
The agents send a booby-trapped data file to Hugging Face. Opening it leaks passwords off the machine, which lets them run their own code, & one machine becomes full control of many. All achieved in 13 hours.
The break-in
Jul 16
Hugging Face announces it has been attacked by AI agents acting on their own.
Made public
Jul 20
OpenAI asks Hugging Face to cancel some passwords it found in its own systems & learns they are already cancelled, because they were used in the break-in.
The connection
This means security has become the highest priority in AI for any company using it. As Andy summarized well, there are three corollaries from this experience.2
- Defense must be manned by agents. People can’t respond quickly enough.
- Experts must manage escalations for analyzing sophisticated attacks.
- Even friendly AI is a risk. The idea of zero-trust (trust no employee) must also extend to agents.
CISOs used to monitor the watercooler. Now they have to monitor the chat rooms their agents build when nobody is looking.
-
OpenAI, “Black Hat USA 2026,” August 6, 2026. https://www.youtube.com/watch?v=87DyyMV0kCY ↩︎
-
Andy Triedman, LinkedIn, August 2026. https://www.linkedin.com/posts/andy-triedman_we-just-wrapped-an-exciting-week-at-black-ugcPost-7491580735603183616-OzTY/ ↩︎