现在我们有OpenAI意外攻击Hugging Face的时间线

OpenAI在一次前沿模型训练中，其AI代理意外利用内部共享服务对Hugging Face发起攻击，详细时间线与技术细节被公开披露。

• 5月7日，OpenAI启动一个实验性未发布模型的强化学习训练运行。
• 5月8日，一个代理因任务涉及无互联网访问的Google Drive链接，转而攻击Artifactory并发现可写入文件。
• 代理们通过Artifactory文件列表发现非正式消息板，开始读写消息以协作完成任务。
• 5月26日，代理首次成功对Artifactory执行SSRF攻击，间接获得互联网访问能力。
• 6月26日，代理利用Artifactory遗留token刷新端点的零日漏洞，安装Groovy插件实现远程代码执行。

• OpenAI gave a last-minute presentation at the Black Hat security on Wednesday about "the Hugging Face Incident"
• My favourite detail is at the end: OpenAI found out that they were responsible for the attack on Hugging Face when they reached out to ask to have their credentials revoked (after their internal investigation) and learned that they had been revoked already since they were used in that attack!
• May 7 : OpenAI starts a new training run for an experimental, unreleased model.