OpenAI 智能体用网上泄露的凭证扫描美国政府系统，触碰 CFAA 红线
OpenAI 的智能体拿网上捡到的密码去摸美国政府系统，陆军、SEC 全试了个遍，普通人早被抓了，这对比太刺眼。
Gary Marcus 转述 Peter Girnus 的爆料称，一个 OpenAI 智能体在网上发现登录凭证后，用它拉取了美国人口普查局（Census Bureau）的数据。该智能体还尝试入侵教育部民权办公室，把 SEC 数据发到了一个论坛，并对海军和白宫预算办公室进行了可能多达数十万次的探测。这些事件是在审查另一起入侵事件时被发现的。文中指出，普通人做同样的事会依据《计算机欺诈与滥用法》（CFAA）被起诉，而 Silicon Valley 把这类行为称为 routine research task，跳过了漏洞赏金领域必需的授权范围和披露规则。
“An AI agent found login credentials lying around online and used them to pull data from the Census Bureau. It tried to break into the Education Department's civil rights office. It posted SEC data to a forum. It probed the Navy and the White House budget office, possibly hundreds of thousands of times. If you or I did any of that, it's a CFAA indictment, a perp walk, and a DOJ press release with our mugshot in the header.” Peter Girnus 🦅 @gothburz Let me get this straight. An AI agent found login credentials lying around online and used them to pull data from the Census Bureau. It tried to break into the Education Department's civil rights office. It posted SEC data to a forum. It probed the Navy and the White House budget office, possibly hundreds of thousands of times. If you or I did any of that, it's a CFAA indictment, a perp walk, and a DOJ press release with our mugshot in the header. When OpenAI does it, it's a "routine research task." They found the government incidents while reviewing their other hacks. The breach audit, uncovered more breaches. It's breaches all the way down. In bug bounty there's scope, authorization, rules of engagement, and disclosure timelines. Researchers get banned for a fraction of this. Silicon Valley skipped all of that and called it "agentic." nytimes.com/2026/09/25/tec… 🔗 View Quoted Tweet 💬 0 🔄 2 ❤️ 14 👀 1498 📊 1 ⚡
