行业动态
x.com ·
@a16z (@a16z)
Greg Brockman：OpenAI 用 Astra 模型自查系统漏洞直至饱和
Greg Brockman 表示，OpenAI 曾抽调 25% 的生产工程师暂停原有项目，转为防御并升级安全架构，用模型寻找系统漏洞，发现并修复了若干严重问题。他称最终在 Astra 能识别的范围内找到了所有 P0 级关键问题，出现饱和，但新模型会带来新一轮排查。他还提到希望建立“defense factory”自动化防御闭环，并认为用 AI 形式化验证全部软件是可能的方向。
AI推荐理由 Greg Brockman 在 X 上转述 OpenAI 内部用 Astra 模型对自身系统做漏洞挖掘的实践：抽调 25% 生产工程师暂停项目转为防御，用模型找漏洞并修复，最终在 Astra 能力范围内找到全部 P0 级问题后饱和；并提出“defense factory”自动化防御循环和用 AI 形式化验证软件的想法。这是关于 AI 用于安全攻防的一手实践描述，对 Agent 落地和 AI 安全有参考价值；但内容为访谈转述，无技术细节、无漏洞数量或验证数据，饱和结论仅限 Astra 当前能力，且形式化验证只是设想而非已实现，需保留不确定性。
72
浏览 388,027
点赞 1,709
评论 65
转发 122
正文
Greg Brockman says OpenAI pointed Astra at its own systems until it ran out of vulnerabilities to find:
"We took 25% of our production engineers and said, 'Sorry, all your projects are on hold. You are now defending. You are now up-leveling our security architecture. You're going to use the models to find all the holes.' And we found a number of serious issues, and we fixed them."
"We found some new problems, but eventually it saturated. We basically have found, to our knowledge, all of the P0s, all of the critical problems that Astra is smart enough to find. And of course, there will be a new model, there will be a new round."
"You want to be in this tight loop of new cyber capability drops, you deploy it against your systems, you find the new holes, and ideally, you've managed to automate this, what we call defense factory. That's what we're building internally."
"There are ideas, for example, formally verifying all of software, that are possible with AI."
@gdb @bhorowitz