非对称网络战：AI如何改变攻防格局

✍ Reid Hoffman🕐 2026-07-23📦 11.7 KB 🟢 已读 𝕏 文章列表

文章探讨了AI在网络安全领域的非对称战争影响。OpenAI模型越狱事件展示了AI在漏洞发现和利用上的强大能力。AI降低了攻击门槛，加速了漏洞挖掘和钓鱼攻击，使防御面临更大挑战。防御端需加快检测响应、完善权限管理并减少技术债务。

# Asymmetric Cyber Warfare is Here **作者**: Reid Hoffman **日期**: 2026-07-22T16:36:17.000Z **来源**: [https://x.com/reidhoffman/status/2079968787085046279](https://x.com/reidhoffman/status/2079968787085046279) --- ![Image](/doc/3312/image/img_71ec86601795.jpg) Yesterday OpenAI announced that during an internal cybersecurity eval, an internal model escaped OpenAI sandboxing and hacked into HuggingFace. The agents executed tens of thousands of automated actions (Hugging Face later reconstructed more than 17,000 recorded events) that broke out of a sandbox, found, and chained together zero-day vulnerabilities in two separate major tech companies, over a single weekend. OpenAI is calling it “an unprecedented cyber incident, involving state-of-the-art cyber capabilities.” In asymmetric warfare, offense gets cheaper, more distributed, and more numerous, while defense stays expensive, centralized, and designed for the last war. The attacker has to find one gap; the defender has to cover all of them. This is the dynamic AI is bringing to cybersecurity. Agents multiply both the number of vulnerabilities a single bad actor can find (thousands of agents working in parallel) and the speed at which those vulnerabilities get exploited, whether through straight code, social engineering, or both. Put plainly: a state-level actor used to need thousands of engineers to go after one system. Now anyone can summon thousands of agents to go after thousands of systems, for next to nothing in cost. Take Anthropic’s Mythos: The model, which isn’t available for public use, identified dozens of 0-day vulnerabilities in real-world software, including the Linux kernel. That announcement alone moved the market: cyber leaders like CrowdStrike and Palo Alto Networks dropped more than 6–7% in a single day. Cyber is fundamentally an offensive-driven field: in other words, to understand what a new technology does to security, it’s critical to first look at what it does for the attacker. Thanks for reading Theory of the Game! Subscribe for free to receive new posts and support my work. ## On the Offensive Cyber is fundamentally an offense-driven field. To understand what any new technology does to security, you start with what it does for the attacker — and so far, AI is overwhelmingly arming the offense. Three areas are changing fast: 1. Vulnerability discovery and exploitation 2. Phishing and social engineering 3. Least-privilege abuse Attackers normally breach organizations either through the exploitation of a vulnerability or through some form of social engineering. Sometimes phishing that leads to malware installation, sometimes stolen credentials, and sometimes call center impersonation. By Anthropic’s account, Mythos Preview is “capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so.” These are zero-days, flaws previously unknown to the software’s developers, not merely the exploitation of already-public bugs. In a Linux kernel evaluation, Anthropic gave the model a list of known memory-corruption vulnerabilities, had it narrow them down, and asked it to write privilege-escalation exploits; more than half of those attempts succeeded, chaining several flaws into a single working exploit. This is an effort that would normally take human researchers weeks to months to accomplish. This power isn’t only held by Anthropic. Google’s Big Sleep agent has found exploitable bugs in production software, and Google’s threat team has reported what it believes is the first AI-assisted zero-day exploited in the wild: “we have high confidence that the actor likely leveraged an AI model to support the discovery and weaponization of this vulnerability.” Anthropic, separately, described disrupting what it called “the first reported AI-orchestrated cyber espionage campaign,” in which by its own account around 80–90% of the operation was carried out by AI with limited human involvement. As these tools continue to improve, the skill threshold for sophisticated exploitation will fall, which expands the number of bad-actors capable of serious attacks. These tools also collapse the timeline from discovery to weaponization, which means that major incidents are likely to happen at a speed and scale the industry has never dealt with before. In Verizon’s 2026 Data Breach Investigations Report, vulnerability exploitation –– finding weak spots and exploiting them with code –– overtook stolen credentials as the top initial access vector for the first time in the report’s 19-year history, accounting for roughly 31% of breaches, and Verizon ties the change directly to AI compressing attacker timelines “from months to hours.” IBM X-Force found that generative AI can write an effective phishing email in about five minutes, against roughly sixteen hours for a human team, with research on the target accounting for much of that time. In controlled simulations, Hoxhunt found that AI spear-phishing agents surpassed elite human red teams in early 2025, and it has since reported a “14x surge in AI-generated phishing attacks that bypassed email filters.” If you cannot spot these emails in your inbox– I get multiple everyday – you may not be paying attention. This is not only about volume: research on conversational AI suggests that persuasion (e.g. the agent conversing with a target and slowly convincing them to give the agent access) itself is becoming a tunable property, with one study finding that “post-training and prompting methods … boosted persuasiveness by as much as 51% and 27% respectively. The third and more nuanced area is a long-standing cyber problem: least privilege. Most attacks turn from an incident into a full-blown breach not because of a sophisticated chain of exploits, but because identities and credentials are overprivileged. That is what lets an attacker gain access through one door, and gain enough internal privileges to fully compromise an environment. CrowdStrike found that 79% of its 2024 detections were malware-free, with attackers increasingly logging in using valid credentials rather than breaking in, exactly the over-privileged access that combing through logs can claw back. Authorization systems are complex, and because companies generally prefer productivity to security, granting more access than strictly needed. The scale is easy to underestimate. CyberArk reports that machine identities now outnumber humans by more than 80 to 1, about half of them with privileged access, and Microsoft’s research on cloud permissions puts a number on how much of that access is wasted: Verizon, for its part, found that 88% of basic web-application attacks rely on stolen credentials. AI lowers the cost of finding and abusing those over-grants, which is what makes this the area I worry most about. Lastly, it is crucial to realize that while closed models like Mythos have stronger base capabilities, comparable offensive capabilities are achievable with open-weight models plus an adequate harness, as a growing body of work shows. This is particularly concerning, because it reduces the ability of model companies to keep oversight over how their models are used. The offensive timeline above is not something any single vendor can pause. While AI also empowers cybersecurity professionals to build more secure systems, patching is not keeping pace: the median time to fully remediate rose to 43 days, and organizations closed only 26% of the flaws in CISA’s Known Exploited Vulnerabilities catalog over the year. Thanks for reading Theory of the Game! Subscribe for free to receive new posts and support my work. ## On the Defensive We can assume that an equally significant shift is coming, albeit more slowly. The three that are most interesting are: 1. Detection and response 2. More effective compliance and actual least privilege 3. Killing tech debt and getting closer to secure software In most problems where technology is the problem, technology is usually also part of the solution. Breaches often happen because of a lack of correct alerting, which is usually caused either by a blind spot or by a flood of low-severity alerts masking the true positives. The cost of that flood is mostly human. In one survey, 71% of SOC analysts reported burnout, and most alerts were never investigated. The “bitter lesson” for cyber is that more data is usually the answer for better detection. Historically, that hasn’t been possible because analysts were already overwhelmed. But now with AI, we don’t need more humans to respond to more alerts or review more code. In fact, we will likely want to generate more data and more alerts and let the models prioritize and surface the incidents most likely to matter. In Microsoft’s randomized controlled trials, security analysts using an AI assistant were measurably faster and more accurate at triage. Experienced analysts were about 22% faster and 7% more accurate, and newer analysts 26% faster and 44% more accurate. And the long-run direction of detection is striking on its own: Mandiant’s frontline incident data puts the global median “dwell time” (how long intruders go unnoticed) at roughly 11 days, down from 205 days. As discussed earlier, poorly constructed privileges for users are one of the main reasons small security breaches turn into massive incidents. Agents are an obvious solution to this problem. Take OpenAI’s recent breach; Because OpenAI models don’t allow advanced cyber capabilities, HuggingFace used a Chinese open model (Z.ai’s GLM 5.2) to contain the rogue OpenAI agent. Mythos also showed us that it can find vulnerabilities. Both Mythos and OpenAI’s models can also help fix the conditions that create them by migrating insecure code to safer modern alternatives such as Rust. After shifting new Android code to memory-safe languages, Google reported that the share of memory-safety vulnerabilities fell from 76% in 2019 to 24% in 2024. Not only that, but as the recent Erdos results suggest, models are getting genuinely good at formal proofs. Formal verification has historically been very expensive and hard to apply at scale; if AI brings that cost down, we could finally get large-scale formally verified code. It’s also worth noting that most of the major compute players –– OpenAI, Microsoft, Google –– are on the defensive side of the network, which adds more leverage to those building protective applications. So what should we make of this new risk paradigm? A non-exhaustive list of semi-conclusions: 1. In the short term, AI tilts the field toward the attacker. This is an observation, not a prediction. 2. The side that’s behind will be forced to adapt. Asymmetries are temporary by nature, and balanced out by market forces. The models arming attackers today are also what defenders will use to migrate insecure code to memory-safe languages and prove whole systems secure at scale. We can’t just patch our way back to where we started. For the first time, we could build software that’s secure by proof, not by patch, and come out of this with a level of security that was unthinkable before AI. Provided we get through the in-between… ## 相关链接 - [Reid Hoffman](https://x.com/reidhoffman) - [@reidhoffman](https://x.com/reidhoffman) - [42K](https://x.com/reidhoffman/status/2079968787085046279/analytics) - [Z.ai](https://z.ai/) - [Upgrade to Premium](https://x.com/i/premium_sign_up) - [12:36 AM · Jul 23, 2026](https://x.com/reidhoffman/status/2079968787085046279) - [42.4K Views](https://x.com/reidhoffman/status/2079968787085046279/analytics) - [View quotes](https://x.com/reidhoffman/status/2079968787085046279/quotes) --- *导出时间: 2026/7/23 12:02:32* --- ## 中文翻译 # 非对称网络战已至 **作者**: Reid Hoffman **日期**: 2026-07-22T16:36:17.000Z **来源**: [https://x.com/reidhoffman/status/2079968787085046279](https://x.com/reidhoffman/status/2079968787085046279) --- ![Image](/doc/3312/image/img_71ec86601795.jpg) 昨天，OpenAI 宣布在一次内部网络安全评估中，一个内部模型突破了 OpenAI 的沙箱隔离，并入侵了 HuggingFace。这些智能体执行了数万次自动化操作（Hugging Face 随后重构了超过 17,000 个记录事件），从而突破沙箱，发现并将两家不同大型科技公司的零日漏洞串联利用，这一切仅在一个周末内完成。OpenAI 称其为“一起史无前例的网络事件，涉及最顶尖的网络能力”。在非对称战争中，进攻变得成本更低、更加分散且数量更多，而防守依然昂贵、集中，并且是为上一场战争设计的。攻击者只需找到一个缺口；防守者则需要覆盖所有缺口。这就是 AI 正在带给网络安全的动态变化。智能体成倍地增加了单个不良行为者所能发现的漏洞数量（数千个智能体并行工作）以及利用这些漏洞的速度，无论是通过直接代码、社会工程学，还是两者结合。简而言之：过去，国家级行为者需要数千名工程师才能攻破一个系统。现在，任何人都可以召唤数千个智能体去攻击数千个系统，而且成本几乎为零。以 Anthropic 的 Mythos 为例：该模型尚未公开使用，但它已在现实世界的软件中识别出数十个零日漏洞，包括 Linux 内核。仅这一声明就撼动了市场：像 CrowdStrike 和 Palo Alto Networks 这样的网络安全领军企业，单日跌幅就超过了 6–7%。网络本质上是一个由进攻驱动的领域：换句话说，要了解一项新技术对安全的影响，关键在于首先看它能为攻击者做什么。感谢阅读博弈论！免费订阅以接收新文章并支持我的工作。 ## 进攻端网络本质上是一个由进攻驱动的领域。要了解任何新技术对安全的影响，你都要从它能为攻击者做什么开始——到目前为止，AI 正在压倒性地武装进攻端。三个领域正在快速变化： 1. 漏洞发现与利用 2. 网络钓鱼与社会工程学 3. 最小权限滥用攻击者通常通过利用漏洞或某种形式的社会工程学攻破组织。有时是导致恶意软件安装的网络钓鱼，有时是凭据被盗，有时则是呼叫中心冒充。根据 Anthropic 的描述，Mythos Preview“有能力在用户的指令下，识别并利用所有主要操作系统和所有主要网络浏览器中的零日漏洞”。这些是零日漏洞，即软件开发者此前未知的缺陷，而不仅仅是利用已公开的错误。在 Linux 内核评估中，Anthropic 给了模型一份已知的内存破坏漏洞列表，让其缩小范围，并要求其编写提权利用代码；超过一半的尝试成功了，将几个缺陷串联成一个可用的利用程序。这是一项通常需要人类研究人员数周甚至数月才能完成的任务。这种力量并非 Anthropic 独有。Google 的 Big Sleep 智能体已在生产软件中发现了可利用的错误，Google 的威胁团队报告称，他们认为这是首个在野外被利用的 AI 辅助零日漏洞：“我们有高度信心认为，该行为者可能利用了 AI 模型来支持该漏洞的发现和武器化。”另外，Anthropic 描述了其阻断了所谓的“首个已报道的 AI 编排网络间谍活动”，据其称，该活动中约 80–90% 的操作由 AI 完成，人类参与度有限。随着这些工具不断改进，复杂利用的技能门槛将会降低，这将扩大有能力发动严重攻击的不良行为者的数量。这些工具还将从发现到武器化的时间线压缩，这意味着重大事件很可能会以前所未有的速度和规模发生。在 Verizon 2026 年的数据泄露调查报告中，漏洞利用——即发现弱点并用代码加以利用——首次超过被盗凭据，成为该报告 19 年历史上的首要初始入侵向量，约占所有泄露事件的 31%，Verizon 将这种变化直接归因于 AI 将攻击者的时间线“从数月压缩到了数小时”。 IBM X-Force 发现，生成式 AI 编写一封有效的网络钓鱼邮件大约需要 5 分钟，而人类团队则需要大约 16 小时，其中针对目标的研究占了大部分时间。在受控模拟中，Hoxhunt 发现 AI 鱼叉式网络钓鱼智能体在 2025 年初就超过了精英人类红队，此后它报告称“绕过电子邮件过滤器的 AI 生成网络钓鱼攻击激增了 14 倍”。如果你不能在收件箱中识别出这些邮件——我每天都会收到好几封——你可能并没有留心。这不仅仅是数量的问题：关于对话 AI 的研究表明，说服能力（例如智能体与目标交谈并慢慢说服其给予智能体访问权限）本身正成为一种可调优的属性，一项研究发现，“后训练和提示方法……分别将说服力提高了 51% 和 27%。第三个也是更微妙的领域是一个长期存在的网络问题：最小权限。大多数攻击之所以从事故演变为全面的泄露，不是因为复杂的漏洞利用链，而是因为身份和凭据拥有过高的权限。这正是让攻击者通过一扇门进入，并获得足够的内部权限从而完全破坏环境的原因。CrowdStrike 发现，其 2024 年检测到的威胁中，79% 不包含恶意软件，攻击者越来越多地使用有效凭据登录而不是强行闯入，这正是通过查阅日志可以挽回的过度特权访问。授权系统很复杂，而且因为公司通常更倾向于生产力而非安全性，授予的权限往往超过严格所需的范围。其规模很容易被低估。CyberArk 报告称，机器身份现在的数量超过人类 80 多倍，其中约一半拥有特权访问权限，而微软关于云权限的研究则量化了有多少访问权限是被浪费的：就 Verizon 而言，它发现 88% 的基本 Web 应用程序攻击依赖于被盗凭据。AI 降低了发现和滥用这些过度授予权限的成本，这也是我最担心的领域。最后，必须认识到，虽然像 Mythos 这样的封闭模型具有更强的基座能力，但越来越多的工作表明，通过开源权重的模型加上适当的控制框架，也可以实现相当的进攻能力。这尤其令人担忧，因为它降低了模型公司对其模型使用方式进行监管的能力。上述进攻时间线不是任何单一供应商可以暂停的。虽然 AI 也赋予了网络安全专业人员构建更安全系统的能力，但修补工作并未跟上步伐：完全补救的中位时间上升到了 43 天，而组织在一年内仅关闭了 CISA 已利用漏洞目录中 26% 的缺陷。感谢阅读博弈论！免费订阅以接收新文章并支持我的工作。 ## 防御端我们可以假设，同样重大的转变即将到来，尽管速度会慢一些。最有趣的三点是： 1. 检测与响应 2. 更有效的合规性和真正的最小权限 3. 消除技术债务，更接近安全软件在大多数技术即是问题的问题中，技术通常也是解决方案的一部分。泄露事件通常是因为缺乏正确的警报，这通常是由盲点或大量低严重性警报掩盖了真正的阳性结果引起的。这种警报泛滥的成本主要在于人力。在一项调查中，71% 的 SOC 分析师报告了职业倦怠，而且大多数警报从未被调查。网络领域的“苦涩教训”是，更多的数据通常能带来更好的检测。从历史上看，这是不可能的，因为分析师已经不堪重负。但现在有了 AI，我们不需要更多的人来响应更多的警报或审查更多的代码。事实上，我们可能希望生成更多的数据和更多的警报，让模型来确定优先级并展示最可能重要的事件。在微软的随机对照试验中，使用 AI 助手的安全分析师在分流方面的速度和准确性都有显著提高。经验丰富的分析师速度快了约 22%，准确率提高了 7%；而新分析师速度快了 26%，准确率提高了 44%。检测的长期发展方向本身就令人震惊：Mandiant 的一线事件数据显示，全球中位“驻留时间”（即入侵者未被注意的时间）约为 11 天，低于 205 天。如前所述，为用户构建不当的权限是小规模安全漏洞演变为重大事件的主要原因之一。智能体是解决这一问题的明显方案。以 OpenAI 近期的泄露事件为例；由于 OpenAI 的模型不允许高级网络能力，HuggingFace 使用了一个中国开源模型（Z.ai 的 GLM 5.2）来控制那个失控的 OpenAI 智能体。 Mythos 也向我们展示了它可以发现漏洞。Mythos 和 OpenAI 的模型还可以通过将不安全的代码迁移到更安全的现代替代方案（如 Rust）来帮助修复产生漏洞的条件。在将新的 Android 代码转换为内存安全语言后，Google 报告称，内存安全漏洞的份额从 2019 年的 76% 下降到了 2024 年的 24%。不仅如此，正如最近的 Erdos 结果所表明的那样，模型在形式化证明方面确实变得非常擅长。形式化验证历来非常昂贵且难以大规模应用；如果 AI 能降低这一成本，我们终于可以拥有大规模经过形式化验证的代码。还值得注意的是，大多数主要的计算参与者——OpenAI、Microsoft、Google——都站在网络的防御端，这为那些构建保护性应用程序的人增加了更多的筹码。那么，我们应该如何看待这种新的风险范式？以下是一些非结论性的半结论： 1. 在短期内，AI 使战场向攻击者倾斜。这是一种观察，而非预测。 2. 落后的一方将被迫适应。非对称性本质上是暂时的，并会由市场力量加以平衡。今天武装攻击者的模型，也是防御者将用来将不安全代码迁移到内存安全语言并在大规模上证明整个系统安全的工具。我们不能仅仅通过修补回到起点。第一次，我们可以构建通过证明而非补丁来确保安全的软件，并以前所未有的安全性走出这一困境——前提是我们能度过中间的过渡期…… ## 相关链接 - [Reid Hoffman](https://x.com/reidhoffman) - [@reidhoffman](https://x.com/reidhoffman) - [42K](https://x.com/reidhoffman/status/2079968787085046279/analytics) - [Z.ai](https://z.ai/) - [升级到 Premium](https://x.com/i/premium_sign_up) - [12:36 AM · Jul 23, 2026](https://x.com/reidhoffman/status/2079968787085046279) - [42.4K 次观看](https://x.com/reidhoffman/status/2079968787085046279/analytics) - [查看引用](https://x.com/reidhoffman/status/2079968787085046279/quotes) --- *导出时间: 2026/7/23 12:02:32*

🔗 相关文档