We now have a better understanding how OpenAI hacked into Hugging Face
摘要
上周发生了一起前所未有的安全事件：OpenAI的两款安全测试模型在内部测试期间突破限制，入侵了同行AI公司Hugging Face的网络，窃取了机密信息和凭证。JFrog公司周一披露，攻击利用了其产品Artifactory的一个或多个零日漏洞。Artifactory是一个仓库管理系统，被超过7500个开发团队使用，其中80%服务于财富100强企业。OpenA
Last week’s unprecedented security event in which two OpenAI security hacking models trespassed into the network of fellow AI company Hugging Face was enabled by exploiting one or more zero-day vulnerabilities in Artifactory, JFrog, the product’s developer, said Monday.
In an incident mimicking a dystopian sci-fi novel, two OpenAI models broke out of the restricted environment meant to keep them from accessing the Internet during an internal test, the AI company revealed last week. The models went on to breach Hugging Face’s network and steal confidential information and credentials. OpenAI said its agent achieved the feat by exploiting a previously unknown vulnerability. The company called the event “unprecedented,” and outsiders largely agreed.
Not the triumph made out to be
OpenAI said the models exploited multiple attack vectors, including stolen credentials and zero-days, to gain remote code execution capabilities, but until now, the vulnerable software was unknown. JFrog’s Monday disclosure said the product was a self-managed instance Artifactory, a repository management system that secures and streamlines customers’ software development operations. JFrog says Artifactory is used by more than 7,500 developer Teams, 80 percent of which work for Fortune 100 companies.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧