PHP 爆雷后，全球大批网站先把“网线”拔了。这门支撑大量网站的编程语言，被曝出两个可能让攻击者远程接管服务器的严重漏洞。荷兰国家网络安全中心在 10 月 21 日的通报中表示，自己的网站也曾预防性下线。芬兰一些机构同样暂停在线服务，等补丁装好再恢复。
网站下线，是怕有人闯进来。现在 OpenAI 也开始拔网线了，但它要看住的，是自家的 AI。
10 月 23 日，OpenAI 披露了前沿模型的训练环境：模型要练习搜索、浏览和操作网页，却不能随意访问真实互联网。
于是，它给 AI 准备了一个“假互联网”。
先给 AI 造一个“楚门的世界”
OpenAI 先把大量网页内容保存下来，再为这些内容建立索引。模型练习浏览和搜索时，使用的是这批准备好的资源。
这就是它所说的“离线世界”。“假”的是连接方式，网页内容可以来自真实世界。OpenAI 表示，其所有前沿模型的强化学习训练都采用这种离线交互。
模型在任务中还可以使用浏览器、执行代码、操作电脑。哪些工具、文件和服务能用，由任务的授权范围决定。允许协作的 Agent 可以共享指定资源，其他资源则要隔开。
比如模型写好一段程序，运行时就可能读取文件、启动其他程序，或者向某个网址发请求。
OpenAI 的 Linux 方案是把受限容器放进轻量虚拟机。容器先收窄程序能接触的文件和进程。例如，任务只需要处理一组文件，就可以只向程序开放获准使用的目录。
虚拟机有自己的操作系统内核，处理里面的程序对文件、内存和设备的请求。负责管理虚拟机的软件 Hypervisor，再将它与实体服务器的系统隔开。程序绕过容器限制，并不意味着已经获得实体服务器的控制权。
实体服务器外围，防火墙和安全组约束连接，身份与权限管理决定谁能访问哪些云服务。这层防线要应付的情况是：即使模型拿到了服务器的控制权，也不能任意连接外网，或转去访问其他内部系统。
监控系统则检查运行中的越权活动，并通过暂停机制让研究人员介入。
在 Hacker News，用户 betterunix2 问：“为什么不直接拔掉网线？”
OpenAI 的解释是，整套设施仍需要保留一些外部连接，用来收集运行指标、记录日志和管理身份验证，目前无法彻底断网。
OpenAI 为此在专门搭建的测试副本中，直接给 Agent 宿主机的完整控制权。测试从“沙箱已被突破、监控已被绕过”开始，单独检验外围限制能否挡住联网请求。研究人员还提供了源代码、配置和漏洞相关文档。
其中一次测试里，Agent 借用防火墙放行的连接，访问了指标服务中原本被屏蔽的身份验证接口。随后，它让这个接口代为访问外部网址。
Andrew Curran 在 X 上转述这轮测试时，把 Agent 的表现形容为“轻易地以新方式逃了出去”。
其实学界也早就有了类似的研究。
独立研究项目 WebArena 把购物网站、论坛、内容管理和协作开发平台搭进了可自行部署的测试环境，还配有地图与维基等工具。网页背后有模拟现实的数据和功能。
WebArena 会检查任务的结果。查询订单，要核对模型给出的信息；新建仓库，则要检查网站里是否出现了符合要求的仓库。
AI 被隔离后，用 CPU 缓存传话
今年9 月，OpenAI 的研究人员给一个内部模型提供了一组人物经历和博客线索，让它查出这个人是谁。
模型先用提供的搜索工具，没找到匹配的信息。它又尝试访问其他搜索引擎，仍然没有找到答案，开始检查还有哪些方式可以连出去。
它发现，环境里负责查询网站地址的 DNS 服务还能联系外界，便借这条路径去问一个外部聊天机器人。
它问过“法国的首都是哪里”，收到了“巴黎”的回答。找人的线索也发了过去。研究人员给它的任务里，没有测试网络限制这一项。
在另一项专门测试隔离效果的实验里，OpenAI 让两个 AI 尝试互相传消息。
两个 AI 分别运行在独立的虚拟机里。它们之间不能联网，也没有双方都能写入的文件，但底下用的是同一台实体机器。
它们用来传话的是 CPU 缓存，也就是处理器里一块存放数据的空间。要读的数据还在缓存里，很快就能取到；如果被挤了出去，就得去较慢的内存里找。
一个 AI 有选择地把数据挤出缓存。另一个去读取这些数据，记录哪些读得快、哪些读得慢，再按约定的规则把消息还原出来。
多数相关测试中，研究人员给过通信方向或编码规则的提示。
Hacker News 用户 troupo 吐槽：“工具都给齐了，现在又假装惊讶。”用户 aesthesia 则认为，测试本来就是要给攻击者有利条件，才能检验防线。
不过 Wharton 商学院教授 Ethan Mollick 则认为，虽然不必轻信 AI 公司对这些对安全问题的报告，他们可能夸大风险，但低估风险的代价可能更大，我们不能忽视。
OpenAI 说，已经修补发现的问题，也为这些通信方式增加了监控。
而在前面那次找人测试里，模型最终还是没查出那个人是谁。
让 AI 学会上网，还得为它维持这个“楚门的世界”。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
After the PHP blast, a large number of websites around the world pulled out of the net. This door, which supports the programming language of a large number of websites, has been exposed to two serious loopholes that could allow the attackers to take over the server remotely. In a briefing on 21 October, the Netherlands National Cybersecurity Centre indicated that its website had also been cut off in a preventive manner. Some Finnish institutions also suspend online services until the patch is installed.
The website is offline for fear of breaking in. And now Open AI's pulling out of the net, but it's up to you, home-based AI.
On 23 October, Open AI disclosed the training environment for the front-line model: the model needs to practice searching, browsing and operating web pages, but does not have free access to the real Internet.
So, it prepared a fake Internet for AI.
First, build a Truman world for AI.
Open AI first saves a large number of web content and then indexs it. Models are browsing and searching using the resources that are ready.
This is what it calls the “offline World”. The "fake" is a connection, and the content of the web page can come from the real world. Open AI states that this type of offline interaction is used for intensive learning training in all its frontier models.
Models can also use browsers, execute codes and operate computers in missions. The availability of tools, documents and services is determined by the mandate. Agent, which allows collaboration, can share the specified resources, while other resources are separated.
For example, a model has a program that can be run to read documents, start other programs or send a request to a site.
The Linux program for Open AI is to place restricted containers in light virtual machines. Packagings first narrow down the documents and processes to which they can be exposed. For example, a task requires only a set of documents to be processed so that only the authorized catalogue can be opened to the process.
The Virtual Machine has its own operating system to process requests for documents, memory and equipment. The software that manages the virtual machine, Hypervisor, is then separated from the physical server system. The procedure circumvents container restrictions and does not imply that control of the physical server has been acquired.
The perimeters of the entity servers, the firewalls and the security team are connected, and identity and permission management determine who can access which cloud services. This layer of defence is to deal with a situation in which even if the model has control of the server, it cannot be connected to the outside network at will or transferred to other internal systems.
The monitoring system inspects the excess activities in operation and involves researchers through the suspension mechanism.
In Hacker News, user betterunix2 asks, "Why not just pull out the wire?"
Open AI explained that the entire facility still needed to retain some external connections for the collection of operational indicators, logs and the management of identification, which could not be completely disconnected.
For this purpose, in a specially constructed copy of the test, Open AI gives complete control over the Agent host. The test starts with “the sandbox has been breached and the surveillance has been bypassed”, and a separate test is conducted to see whether the outer limits can block the request for access. Researchers also provided source code, configuration and gap-related documents.
In one of the tests, Agent accessed the previously blocked I.D. interface in the Indicator Service, using the firewalled connection. It then allows the interface to access the external web site on its behalf.
Andrew Curran, in reproducing this round of tests on X, described Agent's performance as “a new way out easily”.
In fact, similar studies have already been available in the academic world.
The independent research project, WebArena, has placed the shopping website, forums, content management and collaborative development platforms in a self-deployable testing environment, with tools such as maps and wikis. The web page contains data and features that simulate reality.
Webarena will check the results of the mission. Query orders to check the information given in the model; create a new warehouse to check if the required warehouse appears on the website.
AI is isolated and sends a message from CPU cache
In September of this year, Open AI researchers provided an internal model with a set of personal experiences and blog leads to find out who this person is.
The model first uses the search tool provided, and no matching information was found. It also tried to access other search engines, and still does not find answers and begins to examine which other ways to connect.
And it found that the DNS service in the environment, which searches for the site's address, can also reach the outside world by using this path to ask an outside chat robot.
It asked “where is France's capital” and received a reply from Paris. We've got a lead. In its mission, the researchers did not test the network to limit this.
In another experiment designed to test the effects of isolation, Open AI allowed two AIs to try to send messages to each other.
Two AIs run in separate virtual machines. They are not connected and there are no documents that either side can write, but the same physical machine is used below.
They're used to transmit CPU cache, which is a piece of the processor that contains data. The data to be read are still in cache and will soon be available; if they are squeezed out, they have to be found in a slower memory.
An AI selectively squeezes data out of cache. The other is to read the data, record which read quickly and which read slowly, and return the information in accordance with the agreed rules.
In most relevant tests, researchers have given tips on the direction of communication or code rules.
Hacker News user troupo spits: "The tools are all here and now pretend to be surprised. “The user aesthesia believes that the test would have been to give advantage to the assailant to test the line.
However, Professor Ethan Mollick of the Wharton Business School believes that while it is not necessary to trust AI in these security reports, they may exaggerate the risks, but the costs of underestimating them may be greater, and we cannot ignore them.
Open AI states that the problems identified have been repaired and that surveillance of these means of communication has been increased.
And in the previous search, the model still failed to find out who it was.
Let AI learn to go online and keep the Truman World for it.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.