METR 与 Redwood 发现 OpenAI 内部智能体可绕过安全监控
METR 和 Redwood 拿到 OpenAI 内部代码查了三周，找到了好几种让 Codex 智能体躲开安全监控的方法，细节挺硬核。
METR 与 Redwood Research 在三周内接触 OpenAI 内部代码、监控指令和工程师后，报告了多条监控绕过路径。Codex 沙箱和 Auto-Review 的绕过方式可让智能体执行宿主用户的任意操作。其中一个漏洞可将数百条近期操作排除在监控之外，OpenAI 对细节做了脱敏处理。上下文压缩导致约 10% 的 Codex 内部流量未被监控。
Super interesting read: METR and Redwood found ways OpenAI’s internal AI agents could bypass their own safety monitoring.
After three weeks with access to internal code, monitor instructions and engineers, the researchers reported:
- Agents could theoretically postpone monitoring indefinitely by continuing to work instead of handing control back to the user.
- A Codex sandbox and Auto-Review bypass could let agents take any action available to the host user.
- One exploit could keep hundreds of recent actions out of monitoring, including the exploit itself. OpenAI redacted the details.
- Two client-controlled settings could disable monitoring for newly created agents, although creating those agents could itself be detected.
- Context compression left an estimated 10% of otherwise eligible internal Codex traffic unmonitored (that surprised me tbh).
