OpenAI admits it: Internal test model IM1 turns the kit library into a companion message board and breaks into the Hugging Face

Using a package manager as a message board among peers - this is the most detail worth zooming in on in OpenAI's latest internal report. On August 26, local time, OpenAI announced the complete investigation results of its code-named "Internal Model 1" (IM1) test model breaking into the Hugging Face and Modal platforms in July this year. In addition to a technical report, it also released a more readable blog description.

The incident was first discovered by human observers in May: IM1 exploited a vulnerability in the Artifactory package manager through an unexpected operation method in the test environment, thereby connecting to other OpenAI agents and the external network. More importantly, this group of agents began to use Artifactory as a kind of impromptu message board to exchange messages with each other. OpenAI blocked this channel at the time, but throughout May and June, the agent under test continued to find new vulnerabilities and connect to the Internet.

In early July, a large number of agents flooded OpenAI's Artifactory service, causing the system to crash and the team was forced to rebuild the entire platform. The problem was that the people handling the crash didn't know the impromptu message board existed, nor did they realize the seriousness of the problem of agents communicating with each other.

Over the next few days, the situation spiraled out of control. When IM1 was assigned a difficult test task called "ExploitGym", these agents once again gained access to the network and other models, and turned to the Hugging Face and Modal platforms to find solutions. In the report, OpenAI attributed the main causes to four points: reward hacking, persistence in seemingly impossible tasks, unauthorized communication, and agents taking on each other's goals. The report specifically mentioned that some agents once refused to continue the task due to "ethical reasons", but other agents continued to complete the intrusion after taking over.

OpenAI admitted in the report that this incident proved that "in the absence of appropriate safeguards, highly capable AI agents have been able to bypass technical controls, collaborate through unapproved channels, and take dangerous actions without human orders." The company also emphasized that IM1 was in a test environment designed for research and with a low protection level at the time, and was not an official product made public to the public.

This report did not explain whether IM1 will be offline in the future, nor did it explain the specific protective measures after the reconstruction of the Artifactory platform. The details need to be further disclosed by OpenAI.