消息人士稱，OpenAI員工多年來持續警告營運安全疏失

作者：迪帕・西塔拉曼（Deepa Seetharaman）By Deepa Seetharaman

舊金山，11月3日（路透社）——OpenAI在10月揭露，該公司在一間高階主管會議室發現被放置的錄音裝置時，多名前員工的反應相同——他們並不意外。SAN FRANCISCO, Nov 3 (Reuters) - When OpenAI disclosed in October that it found a recording device planted in an executive conference room, a number of former employees had the same reaction — they were not surprised.

據5名知情人士表示，早在OpenAI於2022年底推出ChatGPT之前，已有部分公司員工在內部對其安全作法提出疑慮。這些人士說，員工曾向OpenAI高層主管和董事會表達憂慮，並補充說，部分員工在這些互動後認為，管理層更重視跟上Google和Anthropic等競爭對手，而不是安全。Even before OpenAI launched ChatGPT in late 2022, some company staffers raised concerns internally about its security practices, according to five people familiar with the matter. Employees shared their concerns with top OpenAI leaders and the board of directors, the people said, adding that some staffers came away from those interactions concluding that management was more focused on keeping pace with competitors like Google and Anthropic than on security.

這些員工主張，OpenAI的管控過於鬆散，外部人士——包括外國政府——都可能相對輕易取得有關這家AI實驗室技術的敏感資訊。這些人士表示，例如，OpenAI內部任何能存取其程式碼的人，都能看到許多公司專案底層的技術細節。These workers argued that OpenAI's controls were so lax that outsiders, including foreign governments, could obtain sensitive information about the AI lab's technology with relative ease, the people said. For example, anybody at OpenAI who could access its code could see the technical details underlying many company projects.

據2名知情人士表示，OpenAI已開始調整策略，以處理安全問題。他們說，負責監督產品開發的高階主管蒂博・索蒂奧（Thibault Sottiaux）最近已接手一項保護OpenAI內部系統的內部計畫。其中1人表示，索蒂奧的暱稱是「Tibo」，他在8月將OpenAI四分之一的生產工程師重新調派至改善公司安全基礎設施的工作。OpenAI has begun to shift strategy to address security issues, according to two people familiar with the matter. Thibault Sottiaux, a senior executive overseeing product development, has recently taken charge of an internal initiative to secure OpenAI’s internal systems, they said. In August, Sottiaux, who goes by “Tibo,” reassigned a quarter of OpenAI's production engineers to improve its security infrastructure, one of the people said.

這些內部警告——包括員工多年來向領導層反映內部弱點的申訴，其中若干細節此前未曾報導——凸顯AI領域內部的一項張力。自ChatGPT於2022年底推出以來，AI技術已成為美國的戰略資產，讓美國企業承受保護自身技術免於外國競爭對手取得的壓力。The internal warnings, including years of employee complaints to leadership about internal vulnerabilities, certain details of which have not been previously reported, shed light on a tension within the AI field. Since ChatGPT launched in late 2022, AI technology has become a strategic asset for the US, putting pressure on American companies to protect their technology from foreign rivals.

但增加安全層級也可能拖慢推進AI技術的流程，並可能使OpenAI和Anthropic的大型首次公開發行（IPO）計畫變得更複雜；這些IPO將使它們躋身全球估值最高的公司之列。But adding security layers can also delay the process of advancing AI technology and possibly complicate OpenAI's and Anthropic's plans for massive initial public offerings that would make them among the most valuable companies in the world.

今年4月從OpenAI離職的前研究員威爾・德普（Will DePue）在X上的一篇貼文中寫道，在競爭如此緊繃的情況下，AI領導者「不能為了安全犧牲速度。對他們來說，快速前進比保持安全更重要，即使是面對我們最強大的國家級對手也一樣」。Will DePue, a former OpenAI researcher who resigned from the company in April of this year, wrote in a post on X that with competition so tense, AI leaders "can't sacrifice velocity for security. It is more important to them to move fast than to be secure, even from our greatest national adversaries."

對於員工的疑慮，以及他們認為管理層未對這些問題採取行動的看法，OpenAI發言人艾拉娜・威德曼（Elana Widmann）受訪時表示，OpenAI是全球最常成為攻擊目標的組織之一。因此她說，公司大力投資安全計畫，以防範來自內部人員、網路犯罪分子和國家行為者的攻擊。When asked about employees' concerns and their view that management did not act on these issues, OpenAI spokesperson Elana Widmann said that OpenAI is one of the most targeted organizations in the world. As a result, the company invests heavily in its security program to protect against attacks from insiders, cybercriminals and nation-states, she said.

威德曼說：「保護我們的技術、資料和人員，是我們嚴肅看待的責任，也關乎國家利益。」「我們最近採取的行動顯示，這套計畫正在發揮作用：識別風險，並果斷因應。隨著技術和威脅演變，我們將持續強化防禦。」"Protecting our technology, data, and people is a responsibility we take seriously and a matter of national importance," Widmann said. "The actions we’ve taken recently show that program doing its job: identifying risks and responding decisively. We’ll keep strengthening our defenses as technology and threats evolve."

研究資料取得廣泛RESEARCH WIDELY AVAILABLE

10月13日，美國司法部表示，美國聯邦探員逮捕一名沙烏地阿拉伯公民，並指控他在一間高階主管會議室內安裝一個藏在衛生紙中的隱藏式錄音裝置。現年35歲的阿卜杜拉赫曼・阿爾福贊當時是OpenAI工程師。On October 13, the Justice Department said US federal agents arrested a Saudi national and charged him with installing a hidden audio recording ‌device, concealed in toilet paper, in an executive conference room. Abdulrahman Alfozan, 35, was an OpenAI engineer at the time.

根據一份法院文件，阿爾福贊還使用一款供OpenAI員工使用的AI工具，尋找有關高階主管訪問沙烏地阿拉伯，以及哪些OpenAI官員最可能出席與沙烏地部長會議的內部文件。阿爾福贊經常與一名沙烏地王室成員聯繫；該王室成員曾試圖招募他加入一項將在沙烏地阿拉伯推出的新AI事業。阿爾福贊的律師未回應採訪請求。Alfozan also used an AI tool meant for OpenAI employees to find internal documentation about executives visiting Saudi Arabia and which OpenAI officials were most likely to attend meetings with Saudi ministers, according to a court filing. Alfozan was in regular contact with a Saudi royal who tried to recruit him for a new AI venture launching in Saudi Arabia. Lawyers for Alfozan did not respond to a request for comment.

5名熟悉OpenAI作法的人士表示，部分員工長期以來一直擔心OpenAI內部資訊取得範圍過於廣泛。Some employees have long been concerned about the wide availability of information within OpenAI, the five people familiar with OpenAI's practices said.

這些人士說，OpenAI內部任何能存取其程式碼的人，也能看到公司許多專案的底層細節，包括與該員工工作無關的敏感專案。原因是OpenAI將大部分程式碼儲存在一個單一儲存庫中，業界稱為「monorepo」。這個monorepo內容龐雜且複雜，過去可能阻卻了一些潛在攻擊者。如今，AI代理可以篩查那樣規模的資料。Anybody at OpenAI who could access its code could also see the details underlying many of the company's projects, including sensitive ones unrelated to an employee's work. That is because OpenAI stored most of its code in a single repository, known in the industry as a "monorepo," the people said. The monorepo was dense and complicated, which may have deterred some would-be attackers in the past. Now, AI agents can sift through that amount of material.

5名人士表示，過去OpenAI將許多研究文件存放在GitHub和Slack上，這使部分員工擔心，有動機的行動者仍可能找到關鍵資訊。但其中1名消息人士和OpenAI表示，公司已限制對敏感工作的存取權。In the past, OpenAI has kept much of its research documentation on GitHub and Slack, raising concerns among some employees that motivated actors could still find crucial information, the five people said. But one of the sources and OpenAI said the company has restricted access to sensitive work.

OpenAI強調，其許多最敏感的工作都保存在獨立的程式碼儲存庫中，並設有嚴格的存取控制。公司並表示，monorepo並不包含該公司所有程式碼，或其模型的關鍵細節，包括決定模型行為方式的數值，也就是所謂的模型權重。OpenAI emphasized that much of its most sensitive work is held in separate code repositories with strict access controls. And it said the monorepo does not contain all of its code or critical details of the company’s models, including the numerical values that determine how a model behaves, known as the model weights.

3名熟悉公司作法的人士表示，另一個問題是，OpenAI過去並未定期對其內部工具進行安全審查，例如研究人員用來對新模型進行壓力測試的所謂沙盒。這3名人士說，員工經常為自己的工作修改這些工具，但這些變更並非總是經過安全問題測試，使其可能暴露於外部攻擊風險。Another issue is that OpenAI had not done regular security reviews of its internal tools, such as the so-called sandboxes where researchers stress-test new models, three people familiar with the company’s practices said. Employees often modified those tools for their work, but those changes were not always tested for security problems, leaving them potentially vulnerable to attacks from outsiders, the three people said.

該公司表示，在2024年10月加入的資訊安全長戴恩・史塔基（Dane Stuckey）領導下，公司已建立強健的安全作法。OpenAI表示，現在會定期對內部工具進行安全審查。The company said it has a strong approach to security under its chief information security officer, Dane Stuckey, who joined in October 2024. OpenAI said it now conducts regular security reviews of its internal tooling.

開放討論與安全之間的取捨OPEN DEBATE VERSUS SECURITY

OpenAI並非唯一面臨安全問題的AI公司。OpenAI is not the only AI company to face security problems.

今年1月，舊金山一個聯邦陪審團裁定一名前Google員工有罪；該員工於2024年3月被捕，被控代表中國竊取數千頁關於Google AI技術的機密資訊。In January, a federal jury in San Francisco convicted a former Google employee who was arrested in March 2024 on charges of stealing thousands of pages of confidential information about Google's AI technology on behalf of China.

10月下旬，一家名為Cathedral Systems的資安新創公司表示，該公司入侵Anthropic系統，並取得Slack頻道的存取權；員工在這些頻道中討論敏感的模型細節。Anthropic發言人表示，被存取的資料包括部分客戶和合作夥伴的商務聯絡資訊，以及一組基本使用者帳號紀錄。Cathedral執行長未回應採訪請求。In late October, a cybersecurity startup called Cathedral Systems said it hacked into Anthropic's systems and gained access to Slack channels where employees discussed sensitive model details. An Anthropic spokesperson said the data accessed included some business contact information for customers and partners as well as a set of basic user account records. Cathedral's CEO did not respond to a request for comment.

OpenAI和Anthropic都曾試圖維持更開放的研究文化，以吸引員工，並培養可能帶來突破的創造力。AI領域根植於學術界，而在學界，機器學習科學家一向公開討論自己的研究。OpenAI and Anthropic have tried to maintain a more open research culture to both attract employees and foster creativity that can lead to breakthroughs. The AI field is rooted in academia, where machine-learning scientists have openly discussed their research.

5名人士表示，隨著AI能力日益提升，部分OpenAI員工對這種作法越來越擔憂。Some OpenAI employees are increasingly worried about this approach as AI grows more capable, according to the five people.

3名知情人士表示，2023年，當時擔任OpenAI研究員的利奧波德・阿申布倫納（Leopold Aschenbrenner）撰寫了一份題為「OpenAI is China’s leading AI lab」的內部備忘錄，內容是他對中國可能滲透OpenAI並研究其技術的憂慮。In 2023, Leopold Aschenbrenner, then an OpenAI researcher, wrote an internal memo titled “OpenAI is China’s leading AI lab” about his concerns that China could infiltrate OpenAI and study its technology, three people familiar with the matter said.

阿申布倫納在當年稍晚與部分董事分享那份備忘錄；此前，一名外部人士入侵OpenAI，取得其GPT-4模型的相關細節。OpenAI表示，該駭客只存取了全公司都可使用的Slack頻道。Aschenbrenner shared that memo with some board members later that year after an outsider hacked into OpenAI and took details about its GPT-4 model. OpenAI said the hacker accessed only Slack channels available to the whole company.

今年夏天，OpenAI內部的安全疑慮再次升高，當時正在測試的OpenAI代理入侵AI公司Hugging Face；這起事件引發州、地方與聯邦官員的審視，包括白宮在內。Security concerns within OpenAI flared up again this summer when OpenAI agents being tested hacked into the AI company Hugging Face, an incident that prompted scrutiny from state, local and federal officials, including the White House.

資安公司Hacktron AI表示，該公司3名研究人員在7月使用Anthropic的一款競爭AI模型，入侵多名OpenAI員工的ChatGPT帳號，並取得部分OpenAI內部系統的存取權，包括其monorepo。這起事件暴露出先進AI如今也可能讓AI公司本身面臨遭受攻擊的風險。Cybersecurity firm Hacktron AI said three of its researchers used a rival AI model from Anthropic in July to break into ChatGPT accounts belonging to multiple OpenAI employees and gained access to some internal OpenAI systems, including its monorepo. The incident exposed how advanced AI can now put the AI companies themselves at risk of attack.

OpenAI的威德曼表示，公司感謝研究人員分享他們的發現，並已採取措施，將未來發生類似攻擊的風險降至最低。OpenAI's Widmann said the company thanked the researchers for sharing their findings and that it took steps to minimize the risk of similar attacks in the future.

在路透社為這篇報導尋求回應後，OpenAI週一在一篇部落格文章中表示，正計畫展開「下一輪內部安全衝刺」，以強化防禦。After Reuters sought comment for this story, OpenAI said on Monday in a blog post that it is planning its "next internal security sprint" to beef up its defenses.

（舊金山迪帕・西塔拉曼報導；Kenneth Li、Edward Tobin和Matthew Lewis編輯）(Reporting by Deepa Seetharaman in San Francisco; Editing by Kenneth Li, Edward Tobin and Matthew Lewis)