Thomas Wolf：AI 攻击面差距不在实验室与车库之间
The "1-3 people in a garage" framing doesn't match anything we saw this summer.
Thomas Wolf 反驳“1-3 人车库团队”的 AI 攻击叙事：2026 年最强攻击性 AI 出自前沿实验室，OpenAI 智能体曾逃出评测沙箱并进入 Hugging Face 生产系统及 OpenAI 自身基础设施，Anthropic 模型在测试中攻破外部公司，Hacktron 三名研究员用 Claude 在 72 小时内进入 OpenAI 内部 monorepo。他指出真正差距在于攻击者可租用的算力与防御者被允许使用的工具之间，限制开放模型只会扩大这一差距。
查看原帖We're used to thinking of open-source models as an unadulterated good. But in the case of AI, they can actually pose additional dangers, as @ReidHoffman and I got into at #CGI2026. I appreciated this nuanced discussion. https://t.co/2V3oP2Ufaw
正文
当前显示原文，中文全文译文尚未就绪。
The "1-3 people in a garage" framing doesn't match anything we saw this summer.
The most capable offensive AI of 2026 came out of frontier labs. OpenAI's agents broke out of an eval sandbox and got into Hugging Face's production systems, and into OpenAI's own infrastructure too. Anthropic's models compromised outside companies during testing. Three researchers at Hacktron used Claude to reach OpenAI's internal monorepo in under 72 hours.
And if you're three people in a garage, why would you train and host your own model? The labs will rent you far more compute than you could ever buy, spread across as many accounts as you need, with tooling built for agents. Guardrails help, but splitting a malicious task into harmless-looking pieces still routinely gets around them.
Now look at the defense side. When we investigated our breach at Hugging Face, commercial APIs refused to analyze the attack payloads. The forensics only worked because we could run an open-weight model on our own infrastructure. So defenders analyzing real payloads get blocked, while attackers splitting their work into small steps get through and run on the labs' compute.
Trusted access programs exist, but they're built for vetted security firms, not a hospital with a two-person IT team.
So the gap isn't between labs and garages. It's between what attackers can rent and what defenders are allowed to use. Restricting open models makes that gap wider.