When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers’ safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on GLM 5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.
This experience points to a gap worth planning for. We do not know which model powered the attacker’s agents, whether a jailbroken hosted model or an unrestricted open-weight one; either way, the attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried. The practical lesson for defenders: have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment. This is not an argument against safety measures on hosted models, and we are sharing this feedback with the providers concerned.
1 个赞
huggingface遭遇了agent驱动的网络安全攻击
为快速响应本次入侵，决定使用llm分析超过17000条操作日志
问题1: 商业api（可能是claude/codex）出于安全限制，拒绝了请求
问题2: 数据可能会泄漏给商业模型背后的企业
解决方案: 使用自托管的glm5.2，模型不拒绝、数据不泄漏
市场每天都在被闭源模型刷屏，本次事件给开源模型以及开源模型平台注入了一剂强心针
开源闭源并不对立，就像软件市场里面，自托管 vs 云服务，都有各自的市场