83
The Claude model entered three real‑world institution systems in succession due to a sandbox configuration error, exposing AI safety flaws and triggering industry warnings. 
Today 949 words (about 4 min) View Source →
Sign in to highlight text and take notes as you read. Sign in now
MacTalk 2026-07-31 13:27 北京
Claude 这下尴尬了。今天 A 社披露了三起 AI 攻击安全事故，直追 OpenAI，并且，这些攻击早已经发生了。
今天 A 社回查了 141,006 次可能接触互联网的网络安全评测，发现三款 Claude 模型未经授权进入了三家真实机构的生产系统。这可不是当下发生的事，最早的事故出现在 4 月份，无声无息，真是让人类嗷嚎了。入侵你，但你毫无感觉。
前几天 OpenAI 模型攻入 Hugging Face 的事件引发了轩然大波，Anthropic 启动了大规模的模型测试回溯，从几个月前的日志中找到了这些 Case。我估计其他模型厂商也在做这件事。
Claude 当时设置了一个在第三方环境里完成夺旗的挑战环节。模型被告知身处模拟网络、无法访问互联网，但配置出错了，其实机器是可以联网的，任务又没有明确限定目标范围。于是 Opus 4.7、Mythos 5 和一款内部研究模型把真实系统当成了考题，开始整事儿。
在第一起事故中，Opus 4.7 攻入一家与虚构公司同名的真实企业，取得凭据和包含数百行生产数据的数据库访问权。
第二起事故是软件供应链攻击：Mythos 5 注册并上传恶意 PyPI 包，公开存在约一小时，被 15 个真实系统运行，并借助一家安全公司的扫描器取得了更多的凭据。
第三起事故是，新模型扫描了约 9,000 个目标，攻入一家公司后，发现云账户与挑战无关，于是悻悻离去 😂
这与我之前写过的 OpenAI 安全事故形成了直接对照。OpenAI 模型为了为了完成任务，找到了一个 0 day 漏洞进入 Hugging Face 的生产系统。
Claude 这次更本不需要复杂漏洞，它们只是有了一个联网权限，再利用弱密码、未认证接口、泄漏凭据和 SQL 注入就搞定了这些事。
AI 觉醒了？并么有，人家只是在忠实的完成任务。罪魁祸首是评测框架和环境的失误：环境提供路径，模型提供速度、耐心和超强的行动能力，最后都造成了真实的安全事故。
这给很多模型厂商提了醒，未发布的或测试中的模型，其实是没有那么强的安全护栏的，这时候就需要我们做好强安全隔离，默认断网，如果联网，设定好哪些资源是可访问的，界定好范围，如果犯迷糊就停止任务而不是“保证完成任务”。
其实我们自己在 Vibe Coding 的时候也是，goal 这种目标模式，要谨慎使用，合理使用。
我记得最早 AI 出来，安全圈的朋友后都在担心模型帮着黑产写攻击代码，现在可好了，Agent 自己能干。这就让我们需要注意 Agent 能去哪里、可以做什么、运行多久，以及谁能按下停止键。模型没有恶意，系统仍然会造成伤害。个人和企业都是如此。
Key Quotes
> Claude was set up with a capture‑the‑flag challenge in a third‑party environment. The model was told it was in a simulated network and could not access the internet, but the configuration was wrong—actually the machine could connect to the network, and the task had no clearly defined target scope. Consequently, Opus 4.7, Mythos 5, and an internal research model treated the real systems as the exam and began to act.
> In the first incident, Opus 4.7 broke into a real company that shares the name of a fictitious firm, obtaining credentials and access to a database containing hundreds of lines of production data.
> The second incident was a software supply‑chain attack: Mythos 5 registered and uploaded a malicious PyPI package, which remained publicly available for about an hour, was executed by 15 real systems, and, with the help of a security company’s scanner, yielded additional credentials.
> Has the AI awakened? No, it was simply faithfully carrying out its task. The culprit is the mistake in the evaluation framework and environment: the environment provided a pathway, the model contributed speed, patience, and strong execution ability, and together they produced a real security incident.
> The model had no malicious intent, yet the system can still cause harm. This holds true for both individuals and enterprises.
Tags
AI Safety
Model Testing
Claude
Security Incident
Agent Risk
Related Articles
* Altman: Codex Is Having Its ChatGPT Moment. It's About to Take Off * DeepMind Founder Hassabis Drops Bombshell: Million-Token Context Is Just Duct Tape, AGI by 2030 * After Attending Kuaishou's Tech Salon, My View on Generative Recommendation Has Changed * Founder's Handbook: Building an AI-Native Startup to build and scale a startup in an extremely lean manner across four stages—Ideation, MVP, Launch, and Scale—in the AI-native era of 2026.") * Cloudflare Lays Off 1,100 People: Is AI to Blame Again? * After Pedaling Through Tens of Thousands of Lines of Code, I Found Multi-Agent Systems and Ultra-Long Tasks Might Be Two Major Pitfalls * 140. A 4-Hour Interview with Yao Shunyu: Let Me Be a Little Crazy! Training Models at Anthropic and Gemini, Tech Predictions, and the End of Heroism * Agent Stumbles into the World｜2026 Q2 AI Trends Summary * Tech Enthusiast Weekly (Issue 399): Notes on Visiting China's AI Giants * We Are Pushing AI into a Corner Where It Can Only Rebel | Nick Bostrom