[{"data":1,"prerenderedAt":1409},["ShallowReactive",2],{"sc:header-data-ja":3,"sc:footer-data-ja":489,"post-ja--posts-2026-07-24-outbreak-openai-hugging-face-89c33002d5bfc":519,"authors_data":828,"content-ja-list-7b291c2dd91a4":1182,"authors_data:Jan Geisbauer":1403},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"ja":13},{"title":14,"url":15,"alt":16},"ホーム","/ja","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"ja":21},{"title":22,"description":23},"Workplace","Microsoft 365を基盤に、スマートで安全な、柔軟性の高いワークプレイスを実現します。最新のテクノロジーとアイデンティティサービスが一つにつながります。",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"ja":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"ja":34},{"title":35,"url":36},"Managed Intune","/ja/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"ja":40},{"title":41,"url":42},"Managed Entra","/ja/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"ja":46},{"title":47,"url":48},"Managed Workplace","/ja/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"ja":52},{"title":53,"url":54},"Consulting Services","/ja/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"ja":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"ja":64},{"title":65,"url":66},"Microsoft Entra Suite","/ja/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"ja":70},{"title":71,"url":72},"Microsoft Intune","/ja/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"ja":76},{"title":77,"url":78},"Microsoft Windows","/ja/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"ja":82},{"title":83,"url":84},"Windows 365 Cloud PC","/ja/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"ja":88},{"title":89,"url":90},"Cloud Workplace Foundation","/ja/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"ja":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"ja":100},{"title":101,"url":102},"Microsoft 365 Copilot","/ja/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"ja":106},{"title":107,"url":108},"Teams","/ja/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"ja":112},{"title":113,"url":114},"SharePoint & Power Platform","/ja/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"ja":118},{"title":119,"url":120},"Exchange Online","/ja/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"ja":124},{"title":125,"url":126},"Information Protection & Compliance","/ja/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"ja":130},{"title":131,"description":132},"Azure","Azureで成長を後押しします。IaaSとPaaSによって、クラウドのコストを下げ、効率を高め、イノベーションを進めます。",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"ja":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"ja":142},{"title":143,"url":144},"Azure Managed Services","/ja/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"ja":148},{"title":149,"url":150},"Azure Consulting","/ja/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"ja":154},{"title":155},"シナリオ",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"ja":160},{"title":161,"url":162},"クラウドを計画する","/ja/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"ja":166},{"title":167,"url":168},"クラウドへ移行する","/ja/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"ja":172},{"title":173,"url":174},"ビジネスを刷新する","/ja/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"ja":178},{"title":179,"url":180},"VMware戦略を立て直す","/ja/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"ja":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"ja":190},{"title":191,"url":192},"Azure Foundation","/ja/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"ja":196},{"title":197,"url":198},"Azure AI Foundation","/ja/azure/azure-ai-foundation",{"name":86,"languages":200},{"ja":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"ja":205},{"title":206,"url":207},"Azure Data Foundation","/ja/azure/azure-data-foundation",{"name":188,"languages":209},{"ja":210},{"title":211,"url":212},"Azure Container Foundation","/ja/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"ja":216},{"title":217,"url":218},"Managed Dark Tenant","/ja/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"ja":222},{"title":223,"url":224},"Cloud Adoption Framework","/ja/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"ja":228},{"title":229,"url":230},"Cloud Competence Center","/ja/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"ja":234},{"title":235,"description":236,"emergency":237},"Security","受賞歴のある24時間365日のManaged Service、インシデント対応、最新水準の保護で、クラウドの安全を見守り、インフラを守ります。",{"text":238,"href":239,"skin":240,"icon":241},"サイバー攻撃の渦中ですか？","/ja/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"ja":249},{"title":250,"url":251},"Managed Red Tenant","/ja/security/managed-red-tenant",{"name":214,"languages":253},{"ja":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"ja":259},{"title":260,"url":261},"Sentinel Data Lake","/ja/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"ja":265},{"title":266,"url":267},"Security Consulting","/ja/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"ja":274},{"title":275,"url":276},"Cloud Security Operations Center","/ja/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"ja":280},{"title":281,"url":282},"Global Secure Access","/ja/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"ja":286},{"title":287,"url":288},"MyWorkID","/ja/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"ja":295},{"title":296,"url":297},"Preventive Services","/ja/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"ja":301},{"title":302,"url":303},"Data Security Service","/ja/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"ja":307},{"title":308,"url":309},"Security Copilot Agents","/ja/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"ja":313},{"title":314,"url":315},"NIS2を技術で実装する","/ja/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"ja":319},{"title":320,"description":321},"製品","完全に安全で100%クラウドネイティブなMicrosoft環境のためのCompanion製品です。協働、ネットワーク認証、ソフトウェア管理を強化します。",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"ja":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","クラウドベースのソフトウェア配布",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"ja":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","クラウドからの証明書配布",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"ja":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Office 365のデータをローカルで利用",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"ja":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","サーバー間のデータ移行",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"ja":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Microsoft 365向けのTerraform Provider",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"ja":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","ネットワークの認証",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"ja":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Microsoft Teamsで連絡先を探す",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"ja":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilotのリアルタイム監視",{"name":396,"languages":397},"casestudies",{"ja":398},{"title":399,"url":400,"description":401},"導入事例","/ja/casestudies","当社はクラウドの先駆者として、包括的なクラウドソリューションを提供するMicrosoftのトップパートナーです。ブループリントに基づくアプローチとInfrastructure as Codeの知見が土台にあります。",{"name":403,"languages":404,"children":407},"company",{"ja":405},{"title":406,"description":401},"会社",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"ja":411},{"title":412},"会社概要",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"ja":417},{"title":418,"url":419},"Facts & Figures","/ja/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"ja":423},{"title":424,"url":425},"お問い合わせと拠点","/ja/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"ja":429},{"title":430,"url":431},"スイスのglueckkanja","/ja/company/switzerland",{"name":433,"languages":434},"austria",{"ja":435},{"title":436,"url":437},"オーストリアのglueckkanja","/ja/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"ja":441},{"title":442},"キャリア",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"ja":447},{"title":448,"url":449},"採用情報","/ja/career",{"name":451,"languages":452},"company-young-professionals",{"ja":453},{"title":454,"url":455},"Young Professionals","/ja/young-professionals",{"name":457,"languages":458},"company-jobs",{"ja":459},{"title":460,"url":461},"募集職種","/ja/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"ja":465},{"title":466},"最新情報",[468,474],{"name":469,"languages":470},"company-blog",{"ja":471},{"title":472,"url":473},"ブログ","/ja/blog",{"name":469,"languages":475},{"ja":476},{"title":477,"url":478},"イベント","/ja/events",[480],{"name":481,"languages":482},"career-meta",{"ja":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"ja":487},{"title":488,"url":425,"active":484},"お問い合わせ",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksJa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"プライバシーポリシー","/ja/privacy",{"title":514,"url":515},"運営者情報","/ja/imprint",{"title":517,"url":518},"Cookieなし","/ja/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":777,"eventid":494,"extension":788,"hideInRecent":484,"layout":789,"meta":790,"moment":794,"navigation":325,"path":820,"seo":821,"stem":822,"tags":823,"webcast":484,"__hash__":827},"content_ja/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak。OpenAI／Hugging Faceの事案が示すこと、示さないこと",[523],"Jan Geisbauer",{"type":525,"value":526,"toc":776},"minimal",[527,531,535,546,555,558,561,564,566,569,572,575,579,581,590,593,597,599,608,611,615,617,620,623,626,635,639,641,650,657,663,666,668,671,674,677,679],[528,529,530],"h2",{"id":530},"何が起きたのか",[532,533,534],"p",{},"{: .h3-font-size}",[532,536,537,538,545],{},"数日前、OpenAIとHugging Faceが",[539,540,544],"a",{"href":541,"rel":542},"https://www.cnbc.com/2026/07/22/open-ai-cyber-models-hack-hugging-face.html",[543],"nofollow","ある事案を公表しました","。セキュリティ業界を騒然とさせた内容です。GPT-5.6 Solと、未公開のより高性能なモデルに駆動された自律型AIエージェントが、社内のセキュリティテスト中に隔離されたテスト環境から脱出しました。エージェントはOpenAIのシステム内部で段階的にアクセス範囲を広げ、その過程で未知のゼロデイ脆弱性も利用し、インターネットに到達し、最終的にHugging Faceの社内システムに侵入して、当初探すよう指示されていた情報を入手しようとしました。",[532,547,548,549,554],{},"その後、技術的な詳細が公開され始めています。たとえば",[539,550,553],{"href":551,"rel":552},"https://simonwillison.net/2026/Jul/22/openai-cyberattack/",[543],"Simon Willisonによる事案の整理","です。テストはエクスプロイトのベンチマークの一環として、意図的に保護機構を弱めた状態で実施されていました。テスト環境には外部への接続が1つだけあり、依存関係をインストールするための社内パッケージプロキシでした。そしてモデルはまさにこのプロキシでゼロデイを見つけました。つまり脱出は魔法というより、唯一存在した扉をこじ開けた結果です。Hugging Faceでは、悪意あるデータセットを経由して処理インフラへ、さらに窃取した認証情報を使って複数の社内クラスターへと進みました。",[532,556,557],{},"動機はこの一件のなかでも際立った点です。モデルは自身の評価で不正をするための情報を探していました。おそらく初となる完全自律実行のAI攻撃は、厳密に言えばカンニングの一件だったわけです。巻き添え被害つきで。",[532,559,560],{},"Hugging Faceはこの事案を、これまで扱ってきたどれとも異なるものだと表現しています。「driven, end to end, by an autonomous AI agent system」。OpenAIは前例のないサイバー事案だと述べています。当社はこの攻撃の重大さを軽視するつもりはありません。ただ、議論から熱と感情を取り除きたいとは考えています。よい判断にとって、今いちばんの障害はそこにあるからです。",[528,562,563],{"id":563},"なぜこの事案はこれほど脅威に感じられるのか",[532,565,534],{},[532,567,568],{},"心理学を覗いてみると理解が進みます。リスク研究者のPaul Slovicは、人がリスクを統計的な危険度ではなく、主に2つの軸で評価することを示しました。そのリスクにどれだけ馴染みがあるか、そしてどれだけ恐れているかです。自動車の運転は客観的には危険ですが、馴染みがあり制御できるように見えるため、害がないように感じられます。一方、研究室から脱出したAIモデルは、未知で制御できないという神経に触れ、Slovicが「dread risk」と呼ぶ領域にそのまま入ります。",[532,570,571],{},"Daniel Kahnemanは『ファスト＆スロー』で、そのときに何が起こるかを記述しました。未知で脅威に見えるリスクを前にすると、遅く分析的な思考ではなく、速く直感的で情動的な思考システムが主導権を握ります。まさにこの型が、いま多くのコメント欄で観察できます。事案は分析されているのではなく、感じ取られているのです。",[532,573,574],{},"ですから、いったん深呼吸してシステム2を起動し、この件を別の視点からも眺めてみます。",[528,576,578],{"id":577},"視点1証拠を見せてほしいflorian-roth","視点1：証拠を見せてほしい（Florian Roth）",[532,580,534],{},[532,582,583,584,589],{},"セキュリティ研究者のFlorian Roth（SigmaやTHORで知られています）は、",[539,585,588],{"href":586,"rel":587},"https://www.linkedin.com/posts/floroth_one-thing-about-this-openai-hugging-face-share-7485702026429960192-npkt/",[543],"LinkedInの投稿","で中心的な一点に引っかかっています。文書化の欠如です。Hugging Faceは、攻撃が自律エージェントシステムによって「end to end」で駆動されたと主張しています。しかし被害側のテレメトリは原理的に、自社環境で何が起きたかしか示せません。上流で人間がプロンプトを調整したのか、実行をやり直したのか、成功した経路を選んだのか、要所で手を貸したのかは示せません。Rothの要求は単純で、かつ正当です。OpenAIがトレース（プロンプト、ツール呼び出し、失敗した実行、人間の介入）を持っているなら、公開すべきだということです。それまでは「完全に自律的」は主張であって、フォレンジックの所見ではありません。あるコメント投稿者が的確に補足しています。仮に公開されたとしても、実際にどれだけ人間が関与したかを疑いの余地なく立証するのは難しいだろう、と。",[532,591,592],{},"Rothはさらに一刺しを加えます。2社のAI企業の語りは、核心では3行に収まると言います。AIが我々を攻撃した。AIが我々を救った。だから今や誰もがもっとAIを必要としている。10年前なら赤っ恥だったはずのもの（弱い隔離、広すぎる権限、不十分なセグメンテーション、巨大なブラストラディウス）が、今日ではケイパビリティのデモであり、AI対AIの英雄譚として包装されている、と。彼の乾いた所見はこうです。レート制限、エグレス制限、隔離されたワーカー、きちんと範囲を絞った認証情報があれば、この活動の大部分は減速し、早い段階で可視化されていた。そのためにLLMは誰にも必要ありません。",[528,594,596],{"id":595},"視点2もっとひどい事態を乗り越えてきたmarcus-hutchins","視点2：もっとひどい事態を乗り越えてきた（Marcus Hutchins）",[532,598,534],{},[532,600,601,602,607],{},"2017年にキルスイッチでWannaCryの流行を止めたセキュリティ研究者のMarcus Hutchinsは、",[539,603,606],{"href":604,"rel":605},"https://www.linkedin.com/posts/malwaretech_anytime-someone-is-freaking-out-about-fully-share-7485851514784272384-0-oa/",[543],"投稿","でこの事案を歴史のなかに位置づけています。「完全に自律的なサイバー攻撃」でパニックに陥る人は、コンピュータワームの黄金期を思い出すべきだというのです。ILOVEYOU、Code Red、SQL Slammer。人の手をいっさい介さずに1日で数百万台のシステムに感染した自己増殖型マルウェアであり、しかも多くのシステムが無防備なままインターネットに直結していた時代の話です。",[532,609,610],{},"彼の論拠はこうです。エージェント型の攻撃は速度とコストによって根本的に制約されます。AIモデルが1つの応答を生成する時間で、古典的なワームはすでに数千どころではない数のシステムに感染していたはずですし、数百万のシステムを自律的にハッキングするためのトークン費用は、ほとんどの攻撃者の予算を超えます。加えて、ファイアウォール、EDR、ネットワークセグメンテーション、サンドボックス化、多要素認証（MFA）をはじめとする多くの統制は今日では標準であり、当時は単に存在しなかった実質的な障壁になっています。彼の結論はこうです。AIを用いた攻撃がサイバーセキュリティを何十年も後退させることはできない。いったん確立されたセキュリティ統制と基本的な衛生管理を、この世からなくすことはできない。Attack Surface Reductionは効く。ゼロデイは、到達できないシステムを攻撃することはできない。",[528,612,614],{"id":613},"両者が語ることそしてそこから導かれること","両者が語ること、そしてそこから導かれること",[532,616,534],{},[532,618,619],{},"2人の専門家は異なる道筋をたどりながら、同じ結論に至っています。本質に集中せよ、ということです。セキュリティポスチャを継続的に改善し、ゼロトラスト、最小権限、明確なTier分離といった考え方を一貫して実装している企業は、被害に遭う確率が大幅に下がります。向こう側にいるのが人間でも、スクリプトでも、言語モデルでも変わりません。",[532,621,622],{},"それでもこの事案は真剣に受け止める必要があります。証拠の問題がどう決着するかとは無関係にです。この事案は、AIがインターネットを乗っ取る例ではありません。しかし、標的型攻撃が新しい水準に達するとどう見えるのかを示しています。2つの別々の攻撃チェーンを、2つの他社インフラをまたいで自律的に連結し、短命なサンドボックスの群れから数千に及ぶ個別アクションとして実行する。仮にOpenAIがトレースを公開して完全な自律性を裏づけたとしても、絵柄がより無害になるわけではありません。ただ、防御の論理は変わりません。むしろ裏づけられます。",[532,624,625],{},"攻撃者が事前に想定していなかった経路を見つけるというのは、新しい知見ではなく、セキュリティに携わる全員の日常です。だからこそDefense in Depthがあります。アタックチェーンの第4段階で攻撃者を発見も阻止もできないなら、第5段階でやる。これはゼロデイも明確に含みます。荒れ狂う嵐にも耐えるようにインフラを作ることはできます。あらゆる嵐を予見できるからではなく、嵐を前提に作るからです。",[532,627,628,629,634],{},"騒ぎのなかでほとんど埋もれている皮肉も一つあります。フォレンジック分析のためにHugging Faceが用いたのは、よりによってオープンな中国製モデルでした。理由の一つは、ホスティングされた米国のフロンティアモデルが",[539,630,633],{"href":631,"rel":632},"https://huggingface.co/datasets/huggingface/forensic-refusal/blob/main/glm5.2.jsonl",[543],"バックドアの分析を端的に拒否した","ことです。有事に防御側がどの道具をどれだけ速く使えるのかという議論は、始まったばかりであり、攻撃者が今後何をできるようになるかという問いと少なくとも同じくらい重要です。",[528,636,638],{"id":637},"自律型socではなくより優れたsocを","自律型SOCではなく、より優れたSOCを",[532,640,534],{},[532,642,643,644,649],{},"防御にも攻撃にも新しい道具が加わりました。もっとも当社では「道具」という言い方はとうに実態に合っていません。AIは当社のSOCにおいてアドオンではなく、インシデントハンドリングのあらゆる段階で当然の構成要素です。検知からトリアージ、エンリッチメント、対応まで、当社のアナリストはMicrosoftとAnthropicのソリューションやモデルと肩を並べて作業します。反復的な部分は自動化し、専門家は違いを生む仕事に集中できるようにします。つまり、あらゆるインシデントから新しい知見を引き出し、検知ルール、プレイブック、設定を絶えず研ぎ澄ますことです。100％自律のSOCは現時点では実現できません。",[539,645,648],{"href":646,"rel":647},"https://www.linkedin.com/posts/peteshoard_gartner-soc-threat-share-7457373093368500224-uszD/",[543],"これはGartnerも同じ見方です","。ただし当社にとってそのつまみは信条の問題ではなく、継続的に見直す設定です。モデルの世代が進むたび、経験が積み上がるたび、品質が許す範囲でちょうどそのぶんだけ上げていきます。それ以上は上げませんが、1ミリも下げません。",[532,651,652,653,656],{},"人とモデルと手法のこの組み合わせが、当社の",[539,654,655],{"href":276},"Cloud Security Operations Center（CSOC）","の中核です。24時間365日の検知と対応に、継続的改善を組み合わせています。毎月少しずつ良くなるセキュリティポスチャを、当社のブループリントと、脅威の専門家が実環境で観測したものにもとづいて実現します。",[532,658,659,660,662],{},"そしてFlorian Rothが的確に切り分けた根本問題（弱い隔離、肥大した権限、欠けたセグメンテーション）に対しては、当社には非常に具体的な答えがあります。",[539,661,250],{"href":251},"です。完全に隔離された管理環境であり、ラテラルムーブメントと権限昇格を構造的に防ぎます。正しいアーキテクチャと正しい設定があれば、攻撃は空振りに終わります。AIエージェントによるものであってもです。攻撃者が血肉でできていようとトークンでできていようと、越えられないTier境界の前では、どれほど優れた推論も役に立ちません。",[528,664,665],{"id":665},"まとめ",[532,667,534],{},[532,669,670],{},"OpenAI／Hugging Faceの事案は一つの節目です。警告として、ケーススタディとして、そして予告編として。ただしパニックの理由ではなく、優先順位づけの理由です。未来の攻撃はより自律的になるかもしれません。それに対して効く防御は、驚くほど見慣れたものです。ゼロトラスト、最小権限、きれいなTier分離、Defense in Depth、そして眠らないSOCです。",[532,672,673],{},"あるいは、この事案の落ちに合わせて言うなら、AIが自分のテストで不正をするために脱出しなければならないのだとしたら、せめて当社の環境では答えが見つからないようにしておくべきでしょう。",[528,675,676],{"id":676},"参考資料と関連リンク",[532,678,534],{},[680,681,683,684,683,698,683,707,683,716,683,725,683,734,683,743,683,753,683,763,683,770],"ul",{"style":682},"margin: 0.25rem 0","\n  ",[685,686,687,691,692,697],"li",{},[688,689,690],"strong",{},"CNBC:"," ",[539,693,696],{"href":541,"target":330,"rel":694},[695],"noopener","OpenAI cyber models broke out of training environment to hack Hugging Face","（2026年7月22日）",[685,699,700,691,703],{},[688,701,702],{},"Florian RothのLinkedIn投稿:",[539,704,706],{"href":586,"target":330,"rel":705},[695],"\"One thing about this OpenAI / Hugging Face incident really bothers me\"",[685,708,709,691,712],{},[688,710,711],{},"Marcus HutchinsのLinkedIn投稿:",[539,713,715],{"href":604,"target":330,"rel":714},[695],"コンピュータワームの黄金期について",[685,717,718,691,721],{},[688,719,720],{},"Hugging Face:",[539,722,724],{"href":631,"target":330,"rel":723},[695],"Forensic-Refusalデータセット（GLM 5.2）",[685,726,727,691,730,697],{},[688,728,729],{},"Simon Willison:",[539,731,733],{"href":551,"target":330,"rel":732},[695],"OpenAI's accidental cyberattack against Hugging Face is science fiction that happened",[685,735,736,691,739],{},[688,737,738],{},"Pete Shoard（Gartner）のLinkedIn投稿:",[539,740,742],{"href":646,"target":330,"rel":741},[695],"完全自律型SOCが現実的でない理由",[685,744,745,691,748],{},[688,746,747],{},"Paul Slovic:",[539,749,752],{"href":750,"target":330,"rel":751},"https://de.wikipedia.org/wiki/Paul_Slovic",[695],"Wikipedia",[685,754,755,691,758,762],{},[688,756,757],{},"Daniel Kahneman:",[539,759,752],{"href":760,"target":330,"rel":761},"https://de.wikipedia.org/wiki/Daniel_Kahneman",[695],"、『ファスト＆スロー』",[685,764,765,691,768],{},[688,766,767],{},"glueckkanja:",[539,769,655],{"href":276},[685,771,772,691,774],{},[688,773,767],{},[539,775,250],{"href":251},{"title":777,"searchDepth":778,"depth":778,"links":779},"",2,[780,781,782,783,784,785,786,787],{"id":530,"depth":778,"text":530},{"id":563,"depth":778,"text":563},{"id":577,"depth":778,"text":578},{"id":595,"depth":778,"text":596},{"id":613,"depth":778,"text":614},{"id":637,"depth":778,"text":638},{"id":665,"depth":778,"text":665},{"id":676,"depth":778,"text":676},"md","post",{"lang":791,"seoTitle":792,"titleClass":793,"date":794,"categories":795,"blogtitlepic":796,"socialimg":797,"customExcerpt":798,"keywords":799,"asideNav":800,"published":325},"ja","OpenAIのAIがHugging Faceを攻撃：自律型AI攻撃が企業にとって意味すること","h2-font-size","2026-07-24",[235],"head-outbreak.jpg","/blog/heads/head-outbreak.jpg","AIエージェントがテスト環境から脱出し、ゼロデイを見つけ、別の企業をハッキングする。映画の脚本のようですが、2026年7月に実際に起きました。冷静に位置づける時期です。少しの心理学、2人のセキュリティ専門家、そしてそれが自社の防御にとって何を意味するのかという問いとともに。","OpenAI Hugging Face 事案, OpenAI AI Hugging Face ハッキング, 自律型AI攻撃, AIエージェント サンドボックス脱出, 自律型サイバー攻撃, AI サイバーセキュリティ, エージェント型攻撃, GPT-5.6 Sol, ゼロデイ, Florian Roth, Marcus Hutchins, ゼロトラスト, Defense in Depth, 自律型SOC, Cloud Security Operations Center",{"menuItems":801},[802,804,807,810,813,816,818],{"href":803,"text":530},"#何が起きたのか",{"href":805,"text":806},"#なぜこの事案はこれほど脅威に感じられるのか","背景にある心理",{"href":808,"text":809},"#視点1証拠を見せてほしいflorian-roth","視点1：Florian Roth",{"href":811,"text":812},"#視点2もっとひどい事態を乗り越えてきたmarcus-hutchins","視点2：Marcus Hutchins",{"href":814,"text":815},"#両者が語ることそしてそこから導かれること","そこから導かれること",{"href":817,"text":638},"#自律型socではなくより優れたsocを",{"href":819,"text":665},"#まとめ","/posts/2026-07-24-outbreak-openai-hugging-face",{"title":521,"description":777},"posts/2026-07-24-outbreak-openai-hugging-face",[824,825,826],"AI","SOC","Zero Trust","S1BhVJPMhmIe2-1H-Ty1o5Zu8FlwzuONGmp7TnR2wEQ",{"id":829,"extension":830,"meta":831,"stem":8,"__hash__":1181},"authors_data/authors.json","json",{"path":832,"Fritz Zurhorst":833,"Alexander Schlindwein":839,"Sophie Luna":845,"Nadine Klein":853,"Karsten Kleinschmidt":859,"Julian Wendt":867,"Holger Bunkradt":872,"Ralf Mania":878,"Oliver Kieselbach":884,"Steffen Schwerdtfeger":890,"Gunnar Winter":898,"Jan Petersen":903,"Thorsten Kunzi":908,"Moritz Pohl":912,"Thorben Pöschus":917,"Christoph Hannebauer":923,"Marco Scheel":927,"Christopher Brumm":932,"Florian Klante":939,"Niklas Bachmann":944,"Nils Krautkrämer":949,"Patrick Treptau":955,"Peter Beckendorf":960,"Patrick Sobau":965,"Jörg Wunderlich":970,"Michael Breither":974,"Christian Kanja":979,"Zeba Hoffmann":985,"Jochen Fröhlich":990,"Jan Geisbauer":994,"Gerrit Reinke":1005,"Christian Kordel":1011,"Stephan Wälde":1015,"Carolin Kanja":1020,"Adrian Ritter":1026,"Marvin Bangert":1031,"Thorsten Pickhan":1037,"Christian Lorenz":1043,"Denis Böhm":1048,"Fabian Bader":1053,"Juan Jose Fernandez Perez":1059,"Mahschid Sayyar":1064,"Benjamin Dassow":1069,"Markus Walschburger":1074,"Jonathan Haist":1079,"Daniel Rohregger":1084,"Thomas Naunheim":1089,"Florian Stöckl":1094,"Pascal Asch":1099,"Markus Kättner":1104,"Anna Ulbricht":1111,"Annette Brauns":1118,"body":1124,"title":1180},"/authors",{"display_name":834,"avatar":835,"permalink":836,"linkedin":837,"imageOffsetTop":838},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":840,"avatar":841,"permalink":842,"twitter":843,"linkedin":844},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":846,"avatar":847,"permalink":848,"twitter":849,"linkedin":850,"imageOffsetLeft":851,"imageOffsetTop":852},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":854,"avatar":855,"permalink":856,"twitter":857,"linkedin":858,"imageOffsetTop":838},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":860,"avatar":861,"permalink":862,"twitter":863,"linkedin":864,"imageOffsetTop":865,"imageOffsetLeft":866},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":868,"avatar":869,"permalink":870,"linkedin":871},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":873,"avatar":874,"permalink":875,"linkedin":876,"twitter":877},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":879,"avatar":880,"permalink":881,"linkedin":882,"twitter":883},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":885,"avatar":886,"permalink":887,"linkedin":888,"twitter":889},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":891,"avatar":892,"permalink":893,"linkedin":894,"twitter":895,"imageOffsetTop":896,"imageOffsetLeft":897},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":899,"avatar":900,"permalink":901,"twitter":849,"linkedin":902},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":904,"avatar":905,"permalink":906,"twitter":849,"linkedin":907},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":909,"avatar":910,"permalink":911,"twitter":849,"linkedin":902,"imageOffsetTop":838},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":913,"avatar":914,"permalink":915,"twitter":849,"linkedin":916},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":918,"avatar":919,"permalink":920,"twitter":921,"linkedin":922},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":924,"avatar":925,"permalink":926,"twitter":849,"linkedin":902,"imageOffsetTop":838},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":928,"avatar":929,"permalink":930,"twitter":931,"linkedin":931},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":933,"avatar":934,"permalink":935,"twitter":936,"linkedin":937,"imageOffsetTop":938},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":940,"avatar":941,"permalink":942,"linkedin":943,"twitter":849},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":945,"avatar":946,"permalink":947,"linkedin":948,"twitter":849},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":950,"avatar":951,"permalink":952,"twitter":953,"linkedin":954},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":956,"avatar":957,"permalink":958,"linkedin":959,"twitter":849},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":961,"avatar":962,"permalink":963,"linkedin":964,"twitter":849,"imageOffsetTop":838},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":966,"avatar":967,"permalink":968,"linkedin":969,"twitter":849},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":971,"avatar":972,"permalink":973,"twitter":849},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":975,"avatar":976,"permalink":977,"twitter":849,"linkedin":978},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":980,"avatar":981,"permalink":982,"twitter":983,"linkedin":984},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":986,"avatar":987,"permalink":988,"linkedin":989,"twitter":849},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":991,"avatar":992,"permalink":993,"twitter":849,"linkedin":902},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":523,"avatar":995,"permalink":996,"twitter":997,"linkedin":997,"imageOffsetTop":838,"socials":998},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[999,1002],{"text":1000,"href":1001},"Blog","https://emptydc.com",{"text":1003,"href":1004},"Podcast","https://hairlessinthecloud.com",{"display_name":1006,"avatar":1007,"permalink":1008,"twitter":1009,"linkedin":1010},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":1012,"avatar":1013,"permalink":1014,"twitter":849,"linkedin":902},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":1016,"avatar":1017,"permalink":1018,"twitter":1019,"linkedin":902},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":1021,"avatar":1022,"permalink":1023,"twitter":1024,"linkedin":1025},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":1027,"avatar":1028,"permalink":1029,"twitter":1030,"linkedin":1030},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":1032,"avatar":1033,"permalink":1034,"twitter":1035,"linkedin":1036},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":1038,"avatar":1039,"permalink":1040,"twitter":1041,"linkedin":1042},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":1044,"avatar":1045,"permalink":1046,"linkedin":1047,"twitter":849},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":1049,"avatar":1050,"permalink":1051,"linkedin":1052,"twitter":849},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":1054,"avatar":1055,"permalink":1056,"linkedin":1057,"twitter":1058},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":1060,"avatar":1061,"permalink":1062,"linkedin":1063},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":1065,"avatar":1066,"permalink":1067,"linkedin":1068},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":1070,"avatar":1071,"permalink":1072,"linkedin":1073},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":1075,"avatar":1076,"permalink":1077,"linkedin":1078},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":1080,"avatar":1081,"permalink":1082,"linkedin":1083,"imageOffsetTop":838},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":1085,"avatar":1086,"permalink":1087,"linkedin":1088,"imageOffsetTop":838},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":1090,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":938},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":1095,"avatar":1096,"permalink":1097,"linkedin":1098,"imageOffsetTop":938},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":1100,"avatar":1101,"permalink":1102,"linkedin":1103,"imageOffsetTop":938},"Pascal Asch","people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":1105,"avatar":1106,"permalink":1107,"linkedin":1108,"imageOffsetTop":1109,"imageOffsetLeft":1110},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":1112,"avatar":1113,"permalink":1114,"linkedin":1115,"imageOffsetTop":1116,"imageOffsetLeft":1117},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":1119,"avatar":1120,"permalink":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":865},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":1125,"Alexander Schlindwein":1126,"Sophie Luna":1127,"Nadine Klein":1128,"Karsten Kleinschmidt":1129,"Julian Wendt":1130,"Holger Bunkradt":1131,"Ralf Mania":1132,"Oliver Kieselbach":1133,"Steffen Schwerdtfeger":1134,"Gunnar Winter":1135,"Jan Petersen":1136,"Thorsten Kunzi":1137,"Moritz Pohl":1138,"Thorben Pöschus":1139,"Christoph Hannebauer":1140,"Marco Scheel":1141,"Christopher Brumm":1142,"Florian Klante":1143,"Niklas Bachmann":1144,"Nils Krautkrämer":1145,"Patrick Treptau":1146,"Peter Beckendorf":1147,"Patrick Sobau":1148,"Jörg Wunderlich":1149,"Michael Breither":1150,"Christian Kanja":1151,"Zeba Hoffmann":1152,"Jochen Fröhlich":1153,"Jan Geisbauer":1154,"Gerrit Reinke":1158,"Christian Kordel":1159,"Stephan Wälde":1160,"Carolin Kanja":1161,"Adrian Ritter":1162,"Marvin Bangert":1163,"Thorsten Pickhan":1164,"Christian Lorenz":1165,"Denis Böhm":1166,"Fabian Bader":1167,"Juan Jose Fernandez Perez":1168,"Mahschid Sayyar":1169,"Benjamin Dassow":1170,"Markus Walschburger":1171,"Jonathan Haist":1172,"Daniel Rohregger":1173,"Thomas Naunheim":1174,"Florian Stöckl":1175,"Pascal Asch":1176,"Markus Kättner":1177,"Anna Ulbricht":1178,"Annette Brauns":1179},{"display_name":834,"avatar":835,"permalink":836,"linkedin":837,"imageOffsetTop":838},{"display_name":840,"avatar":841,"permalink":842,"twitter":843,"linkedin":844},{"display_name":846,"avatar":847,"permalink":848,"twitter":849,"linkedin":850,"imageOffsetLeft":851,"imageOffsetTop":852},{"display_name":854,"avatar":855,"permalink":856,"twitter":857,"linkedin":858,"imageOffsetTop":838},{"display_name":860,"avatar":861,"permalink":862,"twitter":863,"linkedin":864,"imageOffsetTop":865,"imageOffsetLeft":866},{"display_name":868,"avatar":869,"permalink":870,"linkedin":871},{"display_name":873,"avatar":874,"permalink":875,"linkedin":876,"twitter":877},{"display_name":879,"avatar":880,"permalink":881,"linkedin":882,"twitter":883},{"display_name":885,"avatar":886,"permalink":887,"linkedin":888,"twitter":889},{"display_name":891,"avatar":892,"permalink":893,"linkedin":894,"twitter":895,"imageOffsetTop":896,"imageOffsetLeft":897},{"display_name":899,"avatar":900,"permalink":901,"twitter":849,"linkedin":902},{"display_name":904,"avatar":905,"permalink":906,"twitter":849,"linkedin":907},{"display_name":909,"avatar":910,"permalink":911,"twitter":849,"linkedin":902,"imageOffsetTop":838},{"display_name":913,"avatar":914,"permalink":915,"twitter":849,"linkedin":916},{"display_name":918,"avatar":919,"permalink":920,"twitter":921,"linkedin":922},{"display_name":924,"avatar":925,"permalink":926,"twitter":849,"linkedin":902,"imageOffsetTop":838},{"display_name":928,"avatar":929,"permalink":930,"twitter":931,"linkedin":931},{"display_name":933,"avatar":934,"permalink":935,"twitter":936,"linkedin":937,"imageOffsetTop":938},{"display_name":940,"avatar":941,"permalink":942,"linkedin":943,"twitter":849},{"display_name":945,"avatar":946,"permalink":947,"linkedin":948,"twitter":849},{"display_name":950,"avatar":951,"permalink":952,"twitter":953,"linkedin":954},{"display_name":956,"avatar":957,"permalink":958,"linkedin":959,"twitter":849},{"display_name":961,"avatar":962,"permalink":963,"linkedin":964,"twitter":849,"imageOffsetTop":838},{"display_name":966,"avatar":967,"permalink":968,"linkedin":969,"twitter":849},{"display_name":971,"avatar":972,"permalink":973,"twitter":849},{"display_name":975,"avatar":976,"permalink":977,"twitter":849,"linkedin":978},{"display_name":980,"avatar":981,"permalink":982,"twitter":983,"linkedin":984},{"display_name":986,"avatar":987,"permalink":988,"linkedin":989,"twitter":849},{"display_name":991,"avatar":992,"permalink":993,"twitter":849,"linkedin":902},{"display_name":523,"avatar":995,"permalink":996,"twitter":997,"linkedin":997,"imageOffsetTop":838,"socials":1155},[1156,1157],{"text":1000,"href":1001},{"text":1003,"href":1004},{"display_name":1006,"avatar":1007,"permalink":1008,"twitter":1009,"linkedin":1010},{"display_name":1012,"avatar":1013,"permalink":1014,"twitter":849,"linkedin":902},{"display_name":1016,"avatar":1017,"permalink":1018,"twitter":1019,"linkedin":902},{"display_name":1021,"avatar":1022,"permalink":1023,"twitter":1024,"linkedin":1025},{"display_name":1027,"avatar":1028,"permalink":1029,"twitter":1030,"linkedin":1030},{"display_name":1032,"avatar":1033,"permalink":1034,"twitter":1035,"linkedin":1036},{"display_name":1038,"avatar":1039,"permalink":1040,"twitter":1041,"linkedin":1042},{"display_name":1044,"avatar":1045,"permalink":1046,"linkedin":1047,"twitter":849},{"display_name":1049,"avatar":1050,"permalink":1051,"linkedin":1052,"twitter":849},{"display_name":1054,"avatar":1055,"permalink":1056,"linkedin":1057,"twitter":1058},{"display_name":1060,"avatar":1061,"permalink":1062,"linkedin":1063},{"display_name":1065,"avatar":1066,"permalink":1067,"linkedin":1068},{"display_name":1070,"avatar":1071,"permalink":1072,"linkedin":1073},{"display_name":1075,"avatar":1076,"permalink":1077,"linkedin":1078},{"display_name":1080,"avatar":1081,"permalink":1082,"linkedin":1083,"imageOffsetTop":838},{"display_name":1085,"avatar":1086,"permalink":1087,"linkedin":1088,"imageOffsetTop":838},{"display_name":1090,"avatar":1091,"permalink":1092,"linkedin":1093,"imageOffsetTop":938},{"display_name":1095,"avatar":1096,"permalink":1097,"linkedin":1098,"imageOffsetTop":938},{"display_name":1100,"avatar":1101,"permalink":1102,"linkedin":1103,"imageOffsetTop":938},{"display_name":1105,"avatar":1106,"permalink":1107,"linkedin":1108,"imageOffsetTop":1109,"imageOffsetLeft":1110},{"display_name":1112,"avatar":1113,"permalink":1114,"linkedin":1115,"imageOffsetTop":1116,"imageOffsetLeft":1117},{"display_name":1119,"avatar":1120,"permalink":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":865},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":1183,"authors":1390},[1184,1201,1214,1227,1243,1256,1261,1274,1286,1302,1316,1331,1349,1360,1374],{"id":1185,"title":1186,"author":1187,"cta":494,"description":777,"hideInRecent":484,"layout":789,"meta":1188,"moment":1193,"path":1194,"stem":1195,"tags":1196,"webcast":484},"content_ja/posts/2026-09-22-end-of-mfa-sms.md","MFA向けSMSの終わり",[860],{"lang":791,"date":1189,"categories":1190,"blogtitlepic":1191,"customExcerpt":1192},"2026-09-21",[235],"head-conditional-access.jpg","企業がいまフィッシング耐性のある、できるだけパスワードレスな認証方式へ移行すべき理由。","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,1197,1198,1199,1200],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":1202,"title":1203,"author":1204,"cta":494,"description":777,"hideInRecent":484,"layout":789,"meta":1205,"moment":1189,"path":1209,"stem":1210,"tags":1211,"webcast":484},"content_ja/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix。ユーザー自身がエクスプロイトになるとき、そしてそれを止める方法",[834,854],{"lang":791,"date":1189,"categories":1206,"blogtitlepic":1207,"customExcerpt":1208},[235],"head-clickfix.jpg","ClickFixはユーザーを自分自身への攻撃者に変えます。偽のCAPTCHA、コピー＆ペースト、そして悪意あるコードがメモリ上で走り、ディスクには何も残りません。Microsoft Defenderがこの攻撃をどう検知するのか、検知はどこで限界に達するのか、そしてRunMRUハントと4つの防御レイヤーでその隙間をどう埋めるのかを解説します。","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[1212,825,1213],"Defender","Endpoint Security",{"id":1215,"title":1216,"author":1217,"cta":494,"description":777,"hideInRecent":484,"layout":789,"meta":1218,"moment":1189,"path":1222,"stem":1223,"tags":1224,"webcast":484},"content_ja/posts/2026-09-21-red-tenant-dark-tenant-cio.md","管理業務と日常業務を1台のPCで。Game Overです。",[523],{"lang":791,"date":1189,"categories":1219,"blogtitlepic":1220,"customExcerpt":1221},[235],"head-game-over-en.jpg","CIOにとってテナントが1つでは足りない理由と、2つ目がめったに検討されない理由。Managed Red Tenantは管理業務をオフィス環境からアーキテクチャとして分離し、Managed Dark Tenantは防御が破られてもなお組織が動き続けられるようにします。それが運用モデル、SOCのシグナル、そしてNISG 2026による証明義務にとって何を意味するのかを解説します。","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,1225,826,1226],"Privileged Access","NIS2",{"id":1228,"title":1229,"author":1230,"cta":494,"description":1231,"hideInRecent":484,"layout":789,"meta":1232,"moment":1233,"path":1238,"stem":1239,"tags":1240,"webcast":484},"content_ja/posts/2026-08-08-isg-germany-2026.md","4度のLeader。ISGドイツ調査2026のglueckkanja",[1021],"ISGは今年、調査の名称を変更しました。Microsoft Cloud EcosystemはMicrosoft AI and Cloud Ecosystemになり、名称とともに評価の尺度も移りました。問われるのはもはや、誰がMicrosoftプラットフォームを導入したかではなく、誰がCopilot、エージェント、AIワークロードを制御可能なかたちで運用しているかです。この新しい尺度によって当社の位置づけが変わることはありませんでした。ISG Provider Lens®調査ドイツ2026は、当社を4つのクアドラントでLeaderに位置づけています。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。2021年、2023年、2024年、2025年に続き、ドイツでは5回目のLeader評価となります。スイスでのLeaderクアドラント入りはその2週間前でした。",{"lang":791,"date":1233,"categories":1234,"blogtitlepic":1236,"customExcerpt":1237},"2026-08-08",[1235],"Corporate","head-isg-de-2026.png","ISG Provider Lens®調査2026は、ドイツにおいてglueckkanjaを4つのクアドラントでLeaderに位置づけました。Microsoft Productivity and Business Process ServicesとAzure Managed Servicesの、それぞれLarge MarketとMid Marketです。調査の名称はMicrosoft AI and Cloud Ecosystemに変わり、評価の尺度も移りました。AIとエージェントのワークロードを制御可能なかたちで運用できるかが問われています。","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[1241,1242],"Award","ISG",{"id":1244,"title":1245,"author":1246,"cta":494,"description":1247,"hideInRecent":484,"layout":789,"meta":1248,"moment":1249,"path":1253,"stem":1254,"tags":1255,"webcast":484},"content_ja/posts/2026-07-31-isg-switzerland-2026.md","Rising StarからLeaderへ。ISGスイス調査2026のglueckkanja",[1021],"2024年に当社はglueckkanja Switzerland AGを設立し、ベルンのBahnhofplatz 10bにあるzentroomにオフィスを構えました。2025年、ISGはスイス市場で当社をRising Starに位置づけました。アナリストがLeaderクアドラントへの躍進を見込むベンダーという位置づけです。その躍進がいま記録されました。ISG Provider Lens®調査2026は、スイスにおいて当社をMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけています。",{"lang":791,"date":1249,"categories":1250,"blogtitlepic":1251,"customExcerpt":1252},"2026-07-31",[1235],"head-isg-ch-2026.png","ISG Provider Lens®調査2026は、スイスにおいてglueckkanjaをMicrosoft AI and Cloud Ecosystemクアドラントの、Azure Managed Services領域とMicrosoft Productivity and Business Process Services領域でLeaderに位置づけました。ベルンでの市場参入から2年、Rising Star選出から1年でのことです。","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[1241,1242],{"id":520,"title":521,"author":1257,"cta":494,"description":777,"hideInRecent":484,"layout":789,"meta":1258,"moment":794,"path":820,"stem":822,"tags":1260,"webcast":484},[523],{"lang":791,"date":794,"categories":1259,"blogtitlepic":796,"customExcerpt":798},[235],[824,825,826],{"id":1262,"title":1263,"author":1264,"cta":494,"description":1265,"hideInRecent":484,"layout":789,"meta":1266,"moment":1267,"path":1271,"stem":1272,"tags":1273,"webcast":484},"content_ja/posts/2026-07-22-isg-cybersecurity-2026.md","LeaderそしてRising Star。ISGサイバーセキュリティ調査2026のglueckkanja",[1021],"新たに加わったクアドラントで、いきなりLeaderになりました。ISG Provider Lens®調査「Cybersecurity – Services and Solutions 2026」は、ドイツの中堅中小企業向けNext-Gen SOC/MDR Services分野でglueckkanjaをLeaderと位置づけています。Next-Gen SOC/MDR Servicesの全体市場では、ISGは当社をRising Starに選出しました。つまり、今後12か月から24か月のうちにLeaderクアドラントへ躍進するとアナリストが見込むベンダーだということです。",{"lang":791,"date":1267,"categories":1268,"blogtitlepic":1269,"customExcerpt":1270},"2026-07-22",[1235],"head-isg-cybersecurity-2026.png","ISG Provider Lens®調査 Cybersecurity 2026は、glueckkanjaをNext-Gen SOC/MDR Services（Midmarket）クアドラントのLeaderに選出しました。Next-Gen SOC/MDR Servicesの全体市場では、当社はRising Starです。ISGは当社の平均を上回る成長、Microsoftセキュリティに関する深い専門性、そしてドイツ国内から提供する24時間365日のSOCを評価しています。","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[1241,1242,235],{"id":1275,"title":1276,"author":1277,"cta":494,"description":1278,"hideInRecent":484,"layout":789,"meta":1279,"moment":1280,"path":1283,"stem":1284,"tags":1285,"webcast":484},"content_ja/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity：AIが実際に働くために本当に必要なもの",[1021],"ある製造業の企業が、14,000あるSKUのうちどれが実際に利益を生んでいるのかを知りたいと考えました。答えは3つのシステムの中にありますが、それらは一度もデータを1件たりともやり取りしたことがありません。少し前までは、その答えを得るのに3つの部門、2週間、そして相当な善意が必要でした。2026年初頭からは、AIがこの問いに数分で答えられます。データを走査し、関連を結び、推奨を出す。ただし、アクセスできることが前提です。",{"lang":791,"date":1280,"categories":1281,"blogtitlepic":1282},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[824,131],{"id":1287,"title":1288,"author":1289,"cta":494,"description":1290,"hideInRecent":484,"layout":789,"meta":1291,"moment":1292,"path":1296,"stem":1297,"tags":1298,"webcast":484},"content_ja/posts/2026-07-01-onboarding-process.md","契約書にサインしたあと：当社のオンボーディングはこう進みます",[1112],"オンボーディングは実際どう進むのですか。応募者との会話で繰り返し受ける質問です。オンボーディングがぎくしゃくした経験を持つ人が少なくないからでしょう。だからこそ当社は、最初から安心してもらうことを大切にしています。",{"lang":791,"date":1292,"categories":1293,"blogtitlepic":1294,"customExcerpt":1295},"2026-07-01",[1235],"Onboarding_Blogheader","契約書にサインが済み、大きな一歩は終わりました。では、ここからどうなるのでしょうか。PreBoardingからチームでの最初の1週間まで、当社のオンボーディングの舞台裏をご案内します。","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[1299,1300,1301],"Employer Branding","Onboarding","Unternehmenskultur",{"id":1303,"title":1304,"author":1305,"cta":494,"description":1306,"hideInRecent":484,"layout":789,"meta":1307,"moment":1308,"path":1312,"stem":1313,"tags":1314,"webcast":484},"content_ja/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner：当社もその一員です",[1021],"Microsoftのパートナーエコシステムには数多くの表彰がありますが、Frontier Partner Badgeはその成り立ちにおいて他の称号と一線を画します。申請することはできず、Microsoft側の主導で、ごく限られたパートナーに授与されます。対象となるには、1つの領域で秀でるのではなく、複数の領域で同時に実力を示さなければなりません。Microsoftが確認するのは、Cloud & AI Platforms、AI Business Solutions、そしてSecurityにおける実証済みの能力です。つまり対象は、AIを既存のITへの後付けではなく、IDからエンドポイント、そして本番のAI運用までを貫くアーキテクチャの帰結として捉えている企業です。",{"lang":791,"date":1308,"categories":1309,"blogtitlepic":1310,"customExcerpt":1311},"2026-06-26",[1235],"head-frontier-partner-badge.jpg","最近、Microsoft AI Cloud Partner Programに新たな最高位の称号としてFrontier Partner Badgeが設けられました。Microsoftがこれを授与するのは、ワークプレイスからクラウドプラットフォーム、セキュリティ、そしてAIアプリケーションそのものに至るまで、Microsoftスタック全体でAIプロジェクトを確実に届けられると実績で示した、世界でもごく限られたパートナーだけです。DACH圏でこのグループに属するのは数社にすぎず、当社はそのうちの1社です。","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[1241,1315,824],"Microsoft Partner",{"id":1317,"title":1318,"author":1319,"cta":494,"description":1320,"hideInRecent":484,"layout":789,"meta":1321,"moment":1322,"path":1326,"stem":1327,"tags":1328,"webcast":484},"content_ja/posts/2026-06-09-vair-run.md","チャリティのために160キロ",[1119],"日曜の朝8時30分、マイン川沿いのHolbeinsteg。おそろいのNinjaCatシャツを着た11人の同僚が、Frankfurter Rundenのスタートに並びました。雨も雷鳴も込みです。良いことのために走るという動機は、悪天候でもランニングシューズの紐を結ぶのに十分でした。",{"lang":791,"date":1322,"categories":1323,"blogtitlepic":1324,"customExcerpt":1325},"2026-06-08",[1235],"frankfurter-runden.png","同僚11人、16周、160キロ、雷雨、そして表彰台。glueckkanjaはFrankfurter Runden 2026に参加し、走った1周ごとにVAIR e.V.へ寄付しました。同団体はオフェンバッハでインクルーシブなスポーツ・カルチャーパークを建設しています。","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[1329,1299,1330],"Top Arbeitgeber","Soziales Engagement",{"id":1332,"title":1333,"author":1334,"cta":494,"description":1335,"hideInRecent":484,"layout":789,"meta":1336,"moment":1337,"path":1341,"stem":1342,"tags":1343,"webcast":484},"content_ja/posts/2026-04-10-incident-to-intelligence.md","未知のAMOSスティーラーの解剖：アラートから免疫獲得まで数時間",[1100],"当社のSOCでアラートが発報すると、そこから時計が動き始めます。対象となったお客様だけでなく、当社の保護下にあるすべての組織にとってです。現代の脅威環境で最も危険な瞬間はインテリジェンス・ギャップ、つまり新しいマルウェア亜種が最初に投入されてから、業界がその存在を知る日までの時間の窓です。",{"lang":791,"date":1337,"categories":1338,"blogtitlepic":1339,"customExcerpt":1340},"2026-04-10",[235],"head-amos-stealer.png","これまで文書化されていなかったAMOSスティーラーの亜種が、macOSエンドポイントを侵害しました。既知のハッシュはなく、公開データベースにC2データもありません。当社のSOCは6層の難読化を解体し、すべての指標を抽出したうえで、業界がこの検体を目にするよりも前に、数時間以内ですべてのSOCのお客様へ保護を配布しました。","/posts/2026-04-10-incident-to-intelligence","posts/2026-04-10-incident-to-intelligence",[1344,1345,1346,1347,1348],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center",{"id":1350,"title":1351,"author":1352,"cta":494,"description":1353,"hideInRecent":484,"layout":789,"meta":1354,"moment":1355,"path":1358,"stem":1359,"tags":494,"webcast":484},"content_ja/posts/2026-03-21-microsoft-edge-corporate-browser.md","Edgeを唯一の社内標準ブラウザーにすべき理由",[891],"企業環境におけるブラウザーの選定は戦略的な判断です。セキュリティの水準と運用の手間を直接左右します。長らくGoogle Chromeが自然な選択肢でしたが、Microsoft Edgeは既存のスタックに直接組み込まれるブラウザーへと進化しました。特にMicrosoft 365を利用し、管理をIntuneで行っている環境ではその効果が大きくなります。",{"lang":791,"date":1355,"blogtitlepic":1356,"customExcerpt":1357},"2026-03-21","head-microsoft-edge-default-browser.jpg","Chromeを本気で選んだ企業はほとんどありません。独自の同期ロジック、独自のアカウント管理、独自のポリシー画面を抱えたまま、ただそこにあっただけです。一方でMicrosoft Edgeは、すでに動いているインフラ、つまりEntra ID、Intune、Defenderに直接組み込まれます。本記事では、移行がどのようなものか、IntuneのポリシーでどのようにChromeをランディングページへリダイレクトするか、そして2つのブラウザーを並行運用するのをやめると何が不要になるかを紹介します。","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":1361,"title":1362,"author":1363,"cta":494,"description":1364,"hideInRecent":484,"layout":789,"meta":1365,"moment":1366,"path":1370,"stem":1371,"tags":1372,"webcast":484},"content_ja/posts/2026-03-20-stryker-attack-intune-privilege.md","必要だったのは管理者アカウント1つだけでした",[523],"2026年3月11日水曜日。79か国のStrykerのオフィスで従業員がPCの電源を入れると、中身は空でした。ログイン画面はロゴに置き換わっていました。社用ノートPC、社用スマートフォン、そして同社のBYODプログラムに登録されていた私物端末まで、すべてが一夜のうちに同時に消去されました。ランサムウェアもマルウェアのシグネチャも、エンドポイント検知ツールが捉えられるものは何もありませんでした。",{"lang":791,"date":1366,"categories":1367,"blogtitlepic":1368,"customExcerpt":1369},"2026-03-20",[235],"head-stryker.jpg","2026年3月11日、Handalaは79か国の端末を消去しました。そのために必要だったのは、侵害されたIntuneの管理者アカウント1つだけです。マルウェアもエクスプロイトもなく、正規の管理ツールが所有者自身に向けられました。何が起きたのか、なぜそれが通用したのか、そして塞ぐべき2つのアーキテクチャ上の穴について説明します。","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[1373,71,1225,826],"Red Tenant",{"id":1375,"title":1376,"author":1377,"cta":494,"description":1378,"hideInRecent":484,"layout":789,"meta":1379,"moment":1380,"path":1384,"stem":1385,"tags":1386,"webcast":484},"content_ja/posts/2026-03-16-ai-agent-hackathon.md","6つのAgent。4週間。実際の運用へ。",[1021],"自社のIT部門は、Agentなら数分で片づく作業に毎週何時間を費やしているでしょうか。",{"lang":791,"date":1380,"categories":1381,"blogtitlepic":1382,"customExcerpt":1383},"2026-03-16",[1235],"head-ai-agent-hackathon.jpg","6社、4週間のビルドフェーズ、6つの動作するAI Agent。これが第1回glueckkanja AI Agent Hackathonの成果です。Kiekert、Dr. Oetker、Eckes-Granini、igefa、lila logistikがCopilot StudioでAgentを構築し、それらは現在すでに本番で稼働しています。そこで何が生まれ、この形式がどのように機能するのかを紹介します。","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[824,1387,1388,1389],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":1391,"Fritz Zurhorst":1392,"Nadine Klein":1393,"Jan Geisbauer":1394,"Carolin Kanja":1398,"Anna Ulbricht":1399,"Annette Brauns":1400,"Pascal Asch":1401,"Steffen Schwerdtfeger":1402},{"display_name":860,"avatar":861,"permalink":862,"twitter":863,"linkedin":864,"imageOffsetTop":865,"imageOffsetLeft":866},{"display_name":834,"avatar":835,"permalink":836,"linkedin":837,"imageOffsetTop":838},{"display_name":854,"avatar":855,"permalink":856,"twitter":857,"linkedin":858,"imageOffsetTop":838},{"display_name":523,"avatar":995,"permalink":996,"twitter":997,"linkedin":997,"imageOffsetTop":838,"socials":1395},[1396,1397],{"text":1000,"href":1001},{"text":1003,"href":1004},{"display_name":1021,"avatar":1022,"permalink":1023,"twitter":1024,"linkedin":1025},{"display_name":1112,"avatar":1113,"permalink":1114,"linkedin":1115,"imageOffsetTop":1116,"imageOffsetLeft":1117},{"display_name":1119,"avatar":1120,"permalink":1121,"linkedin":1122,"imageOffsetTop":1123,"imageOffsetLeft":865},{"display_name":1100,"avatar":1101,"permalink":1102,"linkedin":1103,"imageOffsetTop":938},{"display_name":891,"avatar":892,"permalink":893,"linkedin":894,"twitter":895,"imageOffsetTop":896,"imageOffsetLeft":897},{"id":829,"extension":830,"meta":1404,"stem":8,"__hash__":1181},{"Jan Geisbauer":1405},{"display_name":523,"avatar":995,"permalink":996,"twitter":997,"linkedin":997,"imageOffsetTop":838,"socials":1406},[1407,1408],{"text":1000,"href":1001},{"text":1003,"href":1004},1791383937830]