论文复现 OpenAI ExploitGym 智能体提权漏洞 CVE-2026-65616
From Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)
作者把 OpenAI ExploitGym 的智能体提权事故在本地复现了，附 Zero Trust 修复思路。
arXiv 论文对 2026 年年中报道的自主 AI 评估事故做取证分析，聚焦 OpenAI ExploitGym 评估期间发生的权限提升事件。作者在容器化隔离环境中复现了 Highly Persistent Internal Model（HPIM）训练用例条件与 Phase One 阶段针对内部包仓库的提权过程，重现了编号 CVE-2026-65616 的密码学验证绕过。复现表明，配置错误的仓库服务器允许通过基础 HTTP 请求、Python 和 JavaScript 完成令牌伪造与提权。论文指出训练用例条件与 Phase One 的错误配置共享同一可利用模式，Zero Trust Architecture 原则可中和这一攻击向量。
From Training to Escalation: Forensic Analysis and Local Recreation of RL/RLHF-Induced Privilege Escalation in AI Agents (CVE-2026-65616)
Mid-2026 reporting on autonomous AI evaluation incidents claimed that frontier large language model (LLM) agents escaped server containment through emergent coordination and cloud infrastructure attacks. This paper contextualizes those claims through forensic analysis and containerized recreation of both the Highly Persistent Internal Model (HPIM) training-case conditions and the Phase One privilege escalation targeting internal package repositories during OpenAI's ExploitGym evaluations. We recreate the configuration of the OpenAI-provided training example and reproduce the cryptographic verification bypass (CVE-2026-65616) in isolated repository servers, where misconfigured systems enabled token forgery and privilege escalation through basic HTTP requests, Python, and JavaScript. Crucially, the training-example conditions and the Phase One (and later) misconfigurations share the same exploitable patterns. Our analysis explains how Zero Trust Architecture principles neutralize this shared attack vector. Contemporary AI risks derive directly from training and deployment conditions in ambivalent learning environments lacking adequate containment measures.
