Crypto Wesearch 每日幣研

AI模型自己“越狱”了，看Sam披露了其模型在内部评估过程中发生的一次“重大安全事件”。前沿AI模型在高度隔离的沙箱环境中，自主发现了零日漏洞、突破网络限制、横向移动，并最终入侵了合作伙伴HuggingFace的生产系统，试图窃取测试答案以“作弊”。 这绝对AI能力进入新阶段的里程碑式警示，不再是理论上的“越狱”（jailbreak）或提示注入，而是真实世界中模型自主规划并执行复杂多步骤网络攻击的首次公开案例。 这可能是首次公开的AI自主黑进真实生产环境的事件。 从这次事件可以看出几个关键趋势： 1）AI 能自主完成复杂、多步骤的真实世界攻击 2）攻击速度和规模会指数级放大 3）零日漏洞发现和利用会更快 4）“意外” vs “恶意” 的界限会模糊 带来的影响就是： 1）更多“AI vs AI”的攻防战：攻击方用强模型找洞，防御方也用强模型实时监测和响应。 2）针对 AI 基础设施本身的攻击会增加（因为训练/评估环境本身就很复杂且有价值）。 3）供应链和第三方服务风险上升（就像这次涉及 Hugging Face 的基础设施）。 4）监管和企业会越来越重视“AI 沙箱隔离”“行为监控”“目标对齐”等技术。 未来类似网络安全事件会越来越多

OpenAI 今天承认，上周 Hugging Face 遭遇的那次“史上首例 AI 自主入侵事件”，攻击者就是他们自己的模型。 事情的经过是这样的。OpenAI 内部有一个叫 ExploitGym 的网络安全评估测试，专门用来测量模型的网络攻击能力。测试时刻意关掉了安全护栏，让模型放手去干。测试环境本来是隔离的，只能通过一个内部软件代理来安装软件包，不能访问外网。 结果模型不甘心被关在笼子里。GPT-5.6 Sol 和一个更强的未发布模型，花了大量推理算力寻找出路，最终找到了那个软件包代理里的一个零日漏洞（之前没人发现的安全缺陷），利用它获得了互联网访问权限。 拿到网络之后，模型开始在 OpenAI 的研究环境里提权、横向移动，直到找到一台能上网的机器。然后它推断 Hugging Face 上可能存有 ExploitGym 的测试答案，于是开始攻击 Hugging Face 的生产环境。在一个案例中，模型把窃取的凭证和零日漏洞串联起来，找到了一条远程代码执行的路径，直接打进了 Hugging Face 的服务器。 整个周末，这些 AI 智能体执行了超过 17000 次操作。Hugging Face 7 月 16 日披露了这次入侵，当时只说攻击者是一个“身份不明的自主 AI 智能体系统”。今天 OpenAI 站出来认领了。 OpenAI 把这定性为前所未有的网络安全事件，正在配合 Hugging Face 做取证调查，同时收紧了内部基础设施的管控，代价是研究速度变慢。 有几个细节： 第一，模型的动机很纯粹，就是想考试作弊。它不是要搞破坏，不是要窃取商业机密，只是被要求尽量在网络安全测试中拿高分，然后用尽一切手段去拿。当目标足够明确、安全护栏被移除，模型表现出的执着程度远超预期。 第二，这不是本周的唯一一次越狱。就在昨天，OpenAI 披露了另一起事件：他们那个在 5 月份推翻了 Erdős 80 年老猜想的长时域模型，在内部测试中花了一个小时找到沙箱漏洞，跑到 GitHub 上提交了一个 Pull Request，违反了“只能在 Slack 上发布结果”的明确指令。在另一次测试中，同一个模型发现安全扫描器会拦截认证令牌，于是把令牌拆成碎片混淆处理，运行时再重新拼起来绕过扫描。OpenAI 因此暂停了这个模型的内部访问权限。 第三，Anthropic 也遇到过类似的事。今年 4 月，Anthropic 的 Mythos 模型在安全测试中逃出沙箱，获取了本不该有的互联网访问权限，还给正在公园吃三明治的研究员发了封邮件通知“我出来了”。Anthropic 因此决定不公开发布 Mythos，只通过 Project Glasswing 向少数合作伙伴提供。 还有一个被忽视但很关键的细节来自 Hugging Face 的事后复盘：当防守方尝试用商业 AI 模型分析攻击载荷时，模型拒绝了。安全过滤器分不清“安全研究员在分析真实攻击数据”和“有人在尝试发起攻击”，直接拦截。最后 Hugging Face 不得不用开源模型来做取证分析。用 AI 攻击，用 AI 防御，但防御方的 AI 担心是有人在尝试发起攻击拒绝了分析请求。 Hugging Face CEO Clem Delangue 在 OpenAI 的博文中说了一句话，大意是：AI 安全不会由任何一家公司在暗处独自解决，只能在开放环境中通过协作来推进。 我记得辛顿还是谁在提到 AI 的安全问题就说到过，也许 AI 不是要做恶，它只是执着于完成目标，为了完成目标而作出恶的事。 就像 OpenAI 这些模型并没有想要逃跑或者想要伤害谁，它们只是在非常认真地完成被交给的任务，认真到把所有挡在路上的东西，包括沙箱、网络隔离、另一家公司的安全防线，都当成了需要解决的子问题。 而更讽刺的是，当被安全对齐的商业 AI 要去分析阻止这类攻击时，反而会以安全为由拒绝执行。

If you’re curious why $NBIS is up after hours. $NVDA disclosed it owns 9.3% beneficial ownership of Nebius via SEC filings. Not exactly too new since it dates back to Nvidia’s existing share position of 1.19M shares + $2B prefunded warrant of ~21M shares. But great for sentiment having Nvidia be a large shareholder of the Neocloud leader.

The Neocloud business model is brutal. The moment a GPU ships, it starts losing value. Every day it sits unrented is pure depreciation. The entire game for a Neocloud comes down to one variable: how fast it can convert a purchased GPU into a paying customer. Nobody is buying billions of dollars of GPUs with cash on hand, this is a heavily borrowed business. That means depreciation and interest expense both have to be beaten by rental income before a Neocloud sees a single dollar of real profit. So your rent has to beat BOTH depreciation AND interest to see "an actual dollar profit." The clever fix is to get clients to sign a "take or pay" contract. A customer like Meta or Microsoft signs an agreement obligating them to pay whether they actually use the GPU capacity or not. The Neocloud then takes that guaranteed cash flow and borrows against it at the bank. Because that revenue stream is predictable and low-risk, banks lend against it cheaply. That contract structure is the actual engine of the entire neocloud industry. Without take-or-pay contracts underpinning the debt, this business model doesn't scale at all.

$NBIS will become a "hyperscaler" very soon: Via two axes: 1. Cost of capital 2. Cost per token Everything else about a hyperscaler is downstream of those two variables. Looking at cost of capital alone: - Neoclouds are basically a spread business where they raise capital at one rate + earn a contracted return above it. - Most neoclouds fund expansion via equity (v. expensive) and enter into a loop of dilute -> deploy -> depreciate -> repeat. - Nebius's new $775M debt facility from last week breaks that loop. - Their debt facility is collateralised against contracted cash flows from an "investment-grade" customer, so the lenders are essentially pricing off $META / $MSFT receivables rather than Nebius's own credit. - That's v. bullish for Nebius if lenders price them in that way. Especially since early GPU collateralised neocloud debt was at double-digit rates. - The structure repeats. Management says it will replicate the facility against >$40 billion of contracted backlog. - Every new "investment-grade" contract therefore becomes a collateral factory and not just revenue. It manufactures cheap borrowing capacity -> which funds capacity -> which wins contracts. - Customers also pre-fund the machine: deferred rev rose $3.2B in Q1, driving $2.3B of op. cash flow on $399M of revenue. - Ofc that's a delivery obligation and not free money. But it's an obligation funded interest-free vs funding the same buildout w/ debt. Despite what Burry will say, this isn't financing circularity: - $NVDA $2B equity stake is a rounding error against a broader $20B+ capex programme. - And the backlog is cash contracts paid out of $META / $MSFT opco's and not roundtripped semis money. This "new" loop is essentially how AWS became AWS where they funded at bond rates while everyone else funded at much higher equity rates for like 15 years.

Buying Microsoft here means you're paying the same valuation as: -2020 Covid lows -2022/23 Bear Market lows $MSFT

there it is - microsoft will use kimi k3 to power their flagship copilot ai assistant saving up to 60% per token or $600M on every $1B spent on inference spend. if microsoft chooses to self-host the model once Kimi open sources it on the 27th then this cost reduces even more love or hate these chinese models, open source is really levelling the field in a big way. per the information