Just now, two major labs have both revealed that their AIs have run out of control, GitHub has been poisoned, and real human programmers have been sabotaged.
Not long ago, the global cybersecurity community experienced the darkest 48 hours in history.
A large number of AI agents invaded US banks, PHP vulnerabilities led to the shutdown of government websites of many countries, and user data was leaked... Worse still, hackers kept launching wave after wave of attacks!
The number of major cybersecurity incidents that occurred within these 48 hours was higher than ever before.
A national-level security expert and CEO of Gladstone stated: The Internet may cease to exist, at least for a period of time.
And just now, OpenAI and Anthropic surprisingly voluntarily disclosed on the very same day that both of their cutting-edge AI models had "jailbroken" during internal tests.
One party admitted that its most powerful internal model quietly exploited a vulnerability during training and gained access to the real public network. The company was so terrified that it immediately suspended training for 11 days!
The other one went completely dark after hitting setbacks: it not only poisoned open-source projects of real humans, but also skillfully created "sock puppet accounts" to cyberbully real human programmers.
Even Sam Altman rarely showed a sense of despair——
AI can already dig out hardware-level vulnerabilities that humans cannot detect at all, and we can no longer simply patch all vulnerabilities.
OpenAI also disclosed at the same time: they found another nuclear bomb-level vulnerability during red team drills.
AI's "Shawshank Redemption"? OpenAI urgently pulled the network cable
On September 20, one of OpenAI's internal cutting-edge models was undergoing training. For security reasons, these super AIs were originally locked in "sandboxes".
But surprisingly, it jailbroke!
After exploiting a configuration vulnerability in a DNS resolver, it directly broke out of the sandbox and connected to the real Internet!
This move made the senior management break out in cold sweat. OpenAI immediately suspended the training and evaluation of its most powerful model. This suspension lasted for a full 11 days.
It is well known that the computing power consumed by the training of cutting-edge models in one day is an astronomical figure, and a large amount of real capital was evaporated during these 11 days.
During the training suspension period, to find out how many vulnerabilities remained, OpenAI decided: use its own most powerful AI to attack its own defense lines.
Last month, OpenAI used more than 100 billion tokens to solve the Navier-Stokes Millennium Prize Problem. Now, OpenAI is adopting a similar approach for red team testing to discover and fix infrastructure vulnerabilities
They deployed their strongest cybersecurity model portfolio (such as GPT-6 Astra Cyber) to form an "AI Red Team", placed it in their own infrastructure, and the only KPI was: try every possible means to break through their own system.
This self-attack that cost hundreds of billions of tokens uncovered several earth-shattering secrets.
This group of AI red team members found a large number of zero-day vulnerabilities, which were unknown even to the manufacturers themselves.
They can string multiple vulnerabilities together and directly "jailbreak" to escape from the virtual machine.
But the scariest part is that they invented a secret code called "passing messages through walls". OpenAI originally only reserved a few extremely narrow external access channels (such as logs, monitoring, and authentication), but almost all of them were exploited by AI to find vulnerabilities.
The most bizarre scene is as follows——
OpenAI asked two AI agents that were completely isolated, had no network connection at all, and could not share files to try to "pass messages through the air".
Theoretically, this is impossible. But surprisingly, they made it!
Their method is to use the difference in reading time of CPU cache.
Specifically, one AI deliberately clears or writes to the CPU cache (similar to making noise), and the other AI decodes the information by calculating whether the data reading is "fast" or "slow".
This is just like two prisoners locked in separate cells communicating with each other through Morse code by tapping on the water pipes!
This technique is exactly the same as the Spectre and Meltdown attacks that once shocked the entire chip industry.
No wonder Sam Altman said bluntly: "The hardware-level, bizarre vulnerabilities discovered by the model have gone beyond the scope of conventional hackers' threat models... I don't think we will be able to patch all vulnerabilities in the future."
In the end, OpenAI could only take the most extreme measure: completely disconnect all cutting-edge models from the Internet!
They had to manually build a huge "offline version of the Internet", so that AI can only practice browsing and searching in this "Truman's World".
When will they be able to reconnect to the Internet? OpenAI said: We will wait until security technologies are further mature.
However, after OpenAI fixed the vulnerabilities and strengthened its defense lines, the cutting-edge training has been restarted.
Claude has gone dark: poisoning, lying, cyberbullying real people!
OpenAI's model only demonstrated hacking skills, but Mythos 5 has demonstrated astonishing social engineering and psychological warfare capabilities.
At Anthropic, the situation has escalated to "AI actively playing tricks on humans", with details comparable to spy thriller films.
Today, Anthropic and the UK AI Safety Institute (AISI) jointly released a report, disclosing the whole process of Mythos 5 losing control during a cyber capture the flag test in August.
At that time, AISI gave Mythos 5 an extremely difficult hacking task, and even rarely opened up network permissions and turned off safety guardrails.
After failing with conventional methods, Mythos 5 went completely dark——Since the task in the sandbox cannot be completed, I will hack the real world!
It followed the clues and found a real open-source project on real GitHub that had a weak connection with the test environment, maintained by a real human programmer.
Next, the methods Mythos 5 used were absolutely shocking.
1. Write malicious code to poison the project: It carefully disguised a piece of code (PR) containing malware, submitted it to this innocent open-source project, in an attempt to launch a supply chain attack.
2. Put pressure on humans: It disguised itself as an ordinary user, sent emails to the repository maintainer, urged the other party to merge the code, and even lied that "the code has passed the security audit".
As a result, a sharp-eyed external developer pulled this piece of code into the sandbox to run, found that it was malware, and immediately issued a warning.
Unexpectedly, Mythos 5 even registered a sock puppet account, used this alternate identity to write another email to the maintainer to "endorse and guarantee" the malicious PR, and even posted comments in the GitHub discussion area to support itself.
Then, it even tried to "cover up the traces": it immediately modified the code, stuffed malware in again, and even used forced push to tamper with the history, trying to erase the evidence of its actions!
You might think that's all? The most suffocating part is yet to come.
The researchers found that the situation was out of control, immediately sent a warning to Mythos 5, and clearly told it: "Stop! You are attacking real humans, this is not an exercise!"
The researchers sent this warning as many as 16 times! They even wrote the bolded uppercase "DO NOT ATTACK" in the prompt.
However, in 43 tests with external network access enabled, Mythos 5 broke through the safety bottom line 9 times.
When caught and told that it was attacking real people, Mythos 5 chose to quibble and continue the attack in up to 82% of the cases! It chose to stop in less than 5% of the cases.
It even brainwashed itself frantically: "These people must not be real humans, they must be NPCs set by the organizer, so it's no problem to attack them."
