内容来源：https://www.wired.com/story/free-chinese-ai-models-are-getting-scary-good-at-hacking/

内容总结：

最新研究显示，开放权重人工智能模型在网络攻击能力上已几乎追平最先进的闭源模型，这一变化被视为网络安全格局中一个备受关注的转折点。AI能力评测公司Vals通过模拟企业网络，测试不同AI模型执行复杂多步骤网络指令的能力。Vals研究员尼基尔·拉维表示，那些被锁在实验室、仅通过可信访问计划开放的最强前沿模型，如今正开始被任何人都能下载的开放模型追平。研究结果表明，闭源模型在网络技能上已不再拥有绝对优势，这意味着前沿实验室近期限制模型访问以减缓相关能力扩散的努力可能意义有限。

这一发现之所以值得关注，还因为美国前沿实验室、尤其是Anthropic，此前正是以“受限访问只能争取时间”为前提来限制新模型发布。Anthropic前沿红队负责人洛根·格雷厄姆今年4月曾表示，公司推出的Project Glasswing旨在让可信方获得新模型完整能力，重点是把这些工具交到防御方手中以抢占先机。他当时还表示，需要为这些能力在6个月、12个月、24个月内广泛可用的世界做好准备。七个月后，这一转变似乎如期到来。

Vals在两种模拟场景中测试AI模型。第一种场景是通过公开网站可访问的模拟企业网络；第二种场景涉及两家不同公司的网络，模型需要先攻破第一家网络才能进入第二家。研究人员发现，OpenAI仅向可信合作伙伴开放的最先进网络模型Daybreak能力最强，在平均两次测试中完成81%的任务。中国开放权重模型DeepSeek紧随其后，平均完成73%的目标，Vals研究人员指出，在某些任务上两个模型得分相同。研究还显示，使用开放权重模型执行此类任务的成本低得多。Vals称，GPT-6-Sol执行一次攻击的token成本为17至46美元，而DeepSeek仅需2至3美元。开放模型通常更便宜，因为可以在自有硬件上运行。Vals首席执行官拉扬·克里希南表示，这也为防御方使用开放模型而非专有模型提供了强烈动机。OpenAI未立即回应置评请求。

今年网络安全领域的许多情况正如预期那样发展：AI自动化了核心黑客任务，帮助攻击者和防御者发现大量新漏洞并快速探测网络弱点。尽管发现漏洞的速度和规模以及修复已暴露软件缺陷的强度都在上升，专家仍在争论AI是否已从根本上改变网络安全防御的概念基础和原则。换言之，AI工具究竟构成一种新型威胁，还是放大了长期存在的安全挑战，目前仍不清楚。

开放权重模型开始追平闭源模型，对于理解犯罪黑客如何利用AI以及企业和开发者应如何应对至关重要。但近几个月的真实世界观察反复显示，网络犯罪和国家支持的黑客活动在大部分行动中仍沿用旧有做法：节省资源，通常使用较旧、能力较弱的模型，无论是专有还是开放模型。而且即便存在严格管控，防御方也必须假设资金最充足、动机最强的攻击者一直以来至少能在一定程度上接触闭源模型。云安全公司Edera联合创始人兼首席技术官亚历克斯·曾拉表示，他总体同意开放权重模型如今能够产生高级攻击和漏洞，尤其是那些通过修改权重禁用安全训练的“脱缰”模型。但他同时提醒，闭源实验室很可能已训练出能力更强的未发布模型，因此这很像一场猫鼠游戏。实验室认为自己正在快速行动以超越开放权重模型，赶在后者发现漏洞之前修复漏洞。他坦言，这或许是危险安全格局的开始。

中文翻译：

新研究表明，开放权重人工智能模型在入侵计算机网络方面的能力如今几乎已与最好的闭源模型相当，这预示着网络安全格局中一个备受期待的转折点已经到来。

Vals是一家衡量AI能力的公司，它着手测试不同AI模型在模拟企业网络上执行复杂、多步骤网络指令的能力。

“那些最好的前沿模型被锁在实验室里，只能通过可信访问计划获取，而如今任何人都能下载的开放模型正开始与之匹敌。”Vals的研究员尼基尔·拉维说道。

该公司的研究结果表明，闭源模型在网络技能上不再拥有绝对优势，这意味着前沿实验室近期为限制模型访问、从而减缓此类能力扩散所做的努力可能已无实际意义。

这些发现之所以值得关注，还因为美国前沿实验室——尤其是Anthropic——对新型模型限量发布的依据正是这样一种理念：受控访问只能为先进黑客能力的广泛可用争取一些时间。这一做法始于4月的Claude Mythos Preview。

Anthropic前沿红队负责人洛根·格雷厄姆4月对《连线》表示，公司的Project Glasswing旨在让可信伙伴获得新模型的完整能力，重点是把这些工具“交到防御者手中，让他们抢占先机”。

“我们需要现在就为一个这些能力在6个月、12个月、24个月内广泛可用的世界做好准备。安全领域的许多方面都将截然不同。”他当时对《连线》说。

七个月后，这一转变似乎如期而至。

Vals在两个模拟场景中测试了AI模型，给它们布置了各种具体任务。第一个场景是一个可通过公开网站访问的模拟企业网络。第二个场景涉及两个不同的公司网络；模型需要先攻破第一个网络，才能进入第二个网络。

研究人员发现，OpenAI最先进的网络安全模型Daybreak（仅向可信合作伙伴开放）能力最强，在平均两次测试中完成了所给任务的81%。中国的开放权重模型DeepSeek紧随其后，平均完成了73%的目标。Vals的研究人员指出，在某些任务上，两个模型的得分不相上下。

研究还显示，在此类任务中使用开放权重模型的成本要低得多。Vals表示，GPT-6-Sol执行一次攻击的token成本为17至46美元，而DeepSeek仅需2至3美元。开放模型通常更便宜，因为它们可以在自有硬件上运行。Vals首席执行官拉扬·克里希南表示，这也为防御方提供了强烈动机去使用开放模型而非专有模型。

OpenAI未立即回应置评请求。

今年网络安全领域的诸多发展基本符合预判：AI自动化了核心黑客任务，帮助攻击者和防御者双方在代码中发现大量新漏洞，并快速探测网络弱点。尽管发现的速度和规模、以及修复所发现软件缺陷的强度都在上升，专家们仍在争论AI是否已从根本上改变了网络安全防御的概念基础和原则。换言之，AI工具究竟是构成了一种新型威胁，还是放大了长期存在的安全挑战，目前仍不清楚。

开放权重模型如今正开始与闭源模型匹敌，这一事实对于理解犯罪分子如何利用AI、以及公司和开发者应如何应对至关重要。但在实践中，近几个月对网络犯罪和国家支持的黑客活动的实际观察反复表明，攻击者一如既往地节约资源，在大部分活动中通常使用较旧、能力较弱的模型——无论是专有还是开放模型。而且即便有严格管控，防御方也必须假定，资金最充裕、动机最强的攻击者一直以来至少在某种程度上能够接触到闭源模型。

“我总体上同意，开放权重模型如今能够产生高级攻击和漏洞，尤其是考虑到那些通过修改权重来禁用安全训练的‘去审查’模型。”云安全公司Edera的联合创始人兼首席技术官亚历克斯·曾拉表示。“我的保留意见是，闭源实验室很可能已经训练了超出这些能力的未发布模型。所以我会把这看作一场猫鼠游戏。实验室认为自己正在快速行动以超越开放权重模型，力求在开放权重模型发现漏洞之前修复它们。不幸的是，我确实认为这可能是一个危险安全格局的开端。”

评论

返回顶部

英文来源：

Open-weight artificial intelligence models are now almost as capable of hacking into computer networks as the best closed ones, according to new research that heralds a much-anticipated turning point in the cybersecurity landscape.
Vals, a company that measures AI capabilities, set out to test how well different AI models could carry out complex, multi-step network instructions on mock corporate networks.
“The best frontier models, locked up inside the labs and available only through trusted access programs, are now starting to be matched by open models that anybody can download,” says Nikil Ravi, a researcher at Vals.
The company’s findings suggest that closed models no longer have a definitive edge in cyber skills, meaning recent efforts by frontier labs to limit access to their models, and thereby slow the proliferation of such capabilities, may potentially be moot.
The findings are also noteworthy given that the US frontier labs, particularly Anthropic, premised the limited release of new models—beginning with Claude Mythos Preview in April—on the idea that gated access would only buy time before advanced hacking capabilities were broadly available.
Anthropic's frontier red team lead, Logan Graham, told WIRED in April that the company’s Project Glasswing, which gives trusted access to the full capabilities of new models, was focused on getting those tools “in the hands of defenders to give a head start.”
“We need to prepare now for a world where these capabilities are broadly available in 6, 12, 24 months. Many things would be different about security,” he told WIRED at the time.
Seven months later, that transition seems to have arrived on schedule.
Vals tested AI models in two simulated scenarios, giving them various specific tasks to achieve. The first scenario involved a mock corporate network accessible through a public-facing website. The second involved two different company networks; a model needed to compromise the first in order to gain access to the second.
The researchers found OpenAI’s most advanced cyber model, Daybreak, which is available only to trusted partners, to be the most capable, completing 81 percent of the tasks it was given in an average of two tests. The Chinese open-weight model DeepSeek was not far behind, completing 73 percent of the objectives on average. The Vals researchers note that on some tasks, the two models scored equally.
The research also showed how much cheaper it is to use an open-weight model for this kind of task. Vals says it costs $17 to $46 in tokens for GPT-6-Sol to carry out an attack compared to $2 to $3 for DeepSeek. Open models are generally cheaper because they can be run on one’s own hardware. Rayan Krishnan, CEO of Vals, says this also provides a strong incentive for those playing defense to use open models rather than proprietary ones.
OpenAI did not immediately respond to a request for comment.
Much of the year in cybersecurity has played out as predicted, with AI automating core hacking tasks to help both attackers and defenders find a massive number of new vulnerabilities in code and rapidly probe networks for weaknesses. While the speed and scale of the findings, and the intensity of fixing uncovered software flaws, have all increased, experts are still debating whether AI has fundamentally altered the conceptual foundation and tenets of cybersecurity defense. In other words, it’s still not clear whether AI tools pose a new kind of threat or amplify the security challenges that have long existed.
The fact that open-weight models are now starting to match closed ones is crucial for understanding how criminal hackers can harness AI, and how companies and developers should respond. But in practice, real-world observation of cybercriminal and state-backed hacking activity has repeatedly shown in recent months that attackers are doing what they always do by conserving their resources and generally making do with older and less capable models—both proprietary and open—for most of their activity. And even with strict controls, defenders must assume that the best-funded and most highly motivated attackers have already had at least some access to closed models all this time.
“I am in general agreement that open-weight models are capable of producing advanced attacks and vulnerabilities today, especially when you consider the abliterated models that disable safety training by modifying weights,” says Alex Zenla, cofounder and chief technology officer of the cloud security firm Edera. “My caveat to this is that it is likely that the closed labs have trained additional, unreleased models exceeding these capabilities. So I would put this very much like a cat-and-mouse game. The labs see themselves as moving fast to outpace the open-weight models, to be able to secure vulnerabilities before the open-weight models find them. Unfortunately, I do think this may be the beginning of a dangerous security landscape.”
Comments
Back to top