Yet Another Potential AI Security Problem

I know that AI is advancing so rapidly that there are going to be many stories like this unless and until we ethical humans catch up.

I know that there are solid use cases for AI, even within cybersecurity.

I know that we must all fight the all-or-nothing, good-or-evil, boon-or-bane dichotomy that seems to define the Internet these days.

And yet this news item really gave me pause:

OpenAI Fixes ChatGPT Agent Flaw That Could Let Attackers Forge an AI Insider

The sub headline isn't any more comforting:

AgentForger allows an attacker to create, insert and remotely control an invisible autonomous AI agent inside a victim organization.

This model of bug reporting doesn't help: hey, there was this terrible issue that we fixed and now everyone knows about it but also it should be fixed now, really. I understand that it is a bad idea to trumpet issues until those issues are fixed, but the effect is still somewhat unsettling.

The point is not that AI is worth the risk in all cases and in all situations: it isn't. Neither is the point that AI is so dangerous that no one should ever use for anything: it isn't. The point is that just as eternal vigilance is the price of liberty so is eternal skepticism the price of AI productivity.

AI agents are a powerful tool and capable of great productivity gains. AI agents are notoriously difficult to control and contain with confidence.

This is a great example of why cybersecurity is a branch of Risk Management and not Computer Science. We are not looking for the coolest, most powerful technology or even the cheapest, easiest technology. We are looking for the technology whose risks we understand, whose rewards we can quantify and whose overall risk to reward ratio is slanted in our favor.

Don't rely too heavily on the finance people for this analysis, please, because the cost to benefit ratio is often excellent for AI, even when the risk off of the chart.

Sometimes it is lonely to be the voice of reason, the party pooper, the apparent Luddite. But someone has to be the adult in the room.