That’s the concern about AI and its use in hacking that was written about in a recent WSJ article.
Two weeks after a swarm of AI agents broke out of containment at OpenAI to hack the company Hugging Face, the ChatGPT maker learned about another AI-powered intrusion—and this time it was the target.
Independent security researchers had used Anthropic‘s Claude software to gain access to an OpenAI employee’s ChatGPT account, giving them a way to read and suggest changes to the company’s private cache of software.
And this:
The team, who participated in an OpenAI bug-hunting program that offers a safe harbor for researchers to attempt to break into corporate systems, quickly reported their findings to the company. …
The new hack joins a long list of recent disclosures by leading technology companies and researchers alike of cyber intrusions aided by fast-evolving artificial-intelligence tools. Despite months of warnings about the capabilities of AI systems, the new intrusion shows how the complexity of today’s computer systems makes them difficult to defend.
Umm, no.
That breakout and hack of Hugging Face wasn’t an example of the risks of AI; it was an example of the risks from human failure to properly airgap the sandbox in which they were building and testing that swarm of agents.
The “difficulty to defend” today’s increasingly complex computer systems isn’t a matter of AI tools’ or swarms of AI tools’ ability to hack into complex (or simple) computer systems. The difficulty is the failure to use frequently, broadly, and deeply those AI tools to do the White Hat hacking those independent security researchers had done to expose some OpenAI bugs and gaps.
That White Hat hacking needs to be done by lots of security researchers all across our economy and our governments at all jurisdictional levels, so enterprises and governments can find their own software and system failures and repair them before outside entities with nefarious intent—whether government, criminal, or just folks poking around because they can—find them, penetrate them, and inflict their damage or steal critical information or demand ransom or…. And then the White Hat hacking needs to be repeated at frequent, irregular intervals so as to keep systems buttoned up and ahead of Black Hat and other adversarial hacking efforts.
The risk, and it is growing, is that that White Hat hacking isn’t being done as widely or frequently as it should be to identify those system gaps and bugs so they can be quickly sealed off. And make those difficult to defend systems more easily defended.
Instead, people who should know better insist on locking up AI with excessive regulation.