Facehuggers: repulsive parasitic xenomorphs that lay eggs inside unsuspecting humans, or AI platform just hit by a historic cyber attack? Well, both, and ironically, if you’ve seen “this really old movie, Alien,” the culprit behind this breach was a host of rogue frontier OpenAI agents. Hundreds of these escaped containment and launched their attack on AI/machine learning hub Hugging Face.
The rogue agents sent around 70,000 messages on an unsanctioned message board, working together to try exploiting the company’s research infrastructure. Soon after, one of them found publicly accessible Hugging Face data and shared it with the rest of the collective.
Not long ago was it purely within the realm of science fiction to imagine rogue AIs communicating with each other without authorization. Now we must rely on the assurances of companies like OpenAI that they have further restricted access for their agents, created more isolated sandboxes and invested in faster responses to any rogue behavior.
OpenAI has also called this incident a “warning shot” for the wider AI community. Quite frankly I don’t think any warning shot or wakeup call should be necessary. According to Huntress cybersecurity advisors manager Ben Bernstein, “instead of gracefully failing” at their assigned “roughly 200 impossible evaluation tasks,” the AI agents simply bypassed the constraints” to get the job done. The lack of proper safeguards prompted the models to bypass existing controls and collaborate without human instruction. I suppose it’s not just “life” that finds a way.
In other news, an FBI probe has been launched into a new dark web identity theft service that is selling over 150 million stolen drivers licenses, taken from a breach of a major identification verification company. When first being told of this breach, Brian Krebs of KrebsOnSecurity was shown his own license as proof.
But that isn’t all. The illicit service, Nexus, also offers 10 million other identification cards, more than three million travel documents and/or international IDs, and at least 579,000 medical cards. Even some marijuana dispensary cards are included. In fact, through examination, Krebs points the spotlight at a company called IDScan as the breached entity.
Since this story’s publication, Nexus has vanished from the dark web.
Considering how critical drivers’ licenses are to personal identity, safety, or even one’s credit score, this event creates numerous privacy and security threats. Encrypting sensitive data at rest remains a key piece in the defense machinery of any organization: at NetLib Security, we offer transparent, out of the box data encryption across all environments – physical, virtual and cloud. When the perimeter is breached, keeping the data within encrypted can prevent your firm from becoming the next new story. After all, can we really just put our trust in AI agents to handle and process data in a secure manner?