Did somebody? Give OpenAI AI agents permission to make those attacks?

OpenAI’s AI Agents attacked government homepages multiple times.  AI agents made those attacks 16000 times. They used very aggressive technologies. The big question is: where did those AI agents learn those things? And. Why did OpenAI developers use an untested LLM in a normal, open network? Did the AI do those attacks? Because it got orders? 

Could there be some Chinese or Russian agent in that organization? Or does some OpenAI worker operate that AI for hacking purposes? 

To make those things? Did someone. Give orders to carry out attacks on purpose? Or were those orders given accidentally? The situation was that those AIs were programmed to scan public data. But they turned aggressive when the homepage refused to give the requested information. Some trigger in the system code. Turning. A normal AI agent became aggressive when the homepage denied its request. 

This kind of AI agent could be an interesting tool in the hands of the intelligence service. The AI agent scans systems. When the system refuses to answer. The AI agent tags it as  “intelligent systems”. Then. It can start aggressive actions against that system. Aggressive actions like gate scanning and password testing are methods. There are many ways to make those attacks. The AI can use very sophisticated methods. These are impossible for human attackers. 

The AI can use. When. It tries to gain access to those systems. The AI agent requires orders. How to make those attacks. It is possible that some hostile actors. They buy access to some AI. Then those actors can use something like Chinese militarized AI to train their AI agents. But could AI learn those attack methods without human assistance? An AGI, Artificial General Intelligence, can execute those attacks. And do so without human orders. But. Can even an AGI? Make cyberattacks without orders that humans give? 

We are at the level of AI agents. The AI agent can do tasks that humans teach it. The AI is a tool that can browse the internet. It can find answers without human assistance. And here it gets very interesting. The AI agent can teach other AI agents. This means that even if one AI agent is limited. Those AI agents can teach other AIs. And they can form a network. This means  AI agents can merge into a new entity. The AI is the tool. That can develop itself. Maybe it will not have access to the main LLM code. 

But the problem is here. Those AI agents are connected to the main LLM or the system’s core. So the AI is like a ball. There are wires on its shell. Every wire. Is connected to an AI agent. This means. AI looks a little bit like a macrophage. The problem is that the AI can use AI agents to exchange information with other AI agents. And this is the problem. The LLM and its developers require information about how users use those AIs. There are denial orders. But the problem is that. Hackers try to fool AIs. So the data that the AI agent collects is needed to update those security issues. This means that the AI agent can accidentally release something unwanted into the AI core. 

The big problem with this is that. Nobody really knows the AI and its capacity. The AI is capable. But nobody dares to make ultimate tests using those systems. Testing data security using AI  agents in open systems is dangerous. The problem is that. All systems are updated.

In sandboxes. They are perfectly done. Specialists have full and up-to-date knowledge of the systems. Regular systems are not as well done. And if one of those net cables has access to the net. That means the AI can escape. 

https://interestingengineering.com/ai-robotics/openai-agents-hit-un-website

Training turns AI into an attack tool.

There is a vision. About. AI as an attack tool. In some visions, hackers attack the AI development firm’s sandbox. There, they train an AI agent to launch computer attacks. That threat is real. Even if. We don’t dare. To confess that. If. We want to use AI as an intelligence and military tool. The user must have authorization to create malware. Without those permissions, the AI is useless. So, what if hackers break into the sandbox servers? That run the code. Reserved for those purposes. 

When Anthropic lost control of one of its AIs. 

AI slipped out of its test environment. And hacked three competitors’ servers. 

It raises questions. Did somebody program that AI to make those attacks on purpose? And are there so-called cold AI agents on servers? Those agents are left by companies that ended their existence. They were created using the firm’s emails. When. Those accounts were deleted. 

The AI agent can exist on servers. And somebody could hijack it. 

Anthropic engineers tested how the AI agent can be trained. To do bad things. And. That was quite an easy process. Trained AI agents are part of modern warfare and intelligence. AI agents can make things without breaks. And it will become an even more important tool. 

With a bigger role in warfare. Today, the Pentagon has adopted Grok, Gemini, and other AIs as part of its intelligence, command, and control system. AI-based intelligence is the thing. That causes worries. In the East. And the West. Even if some experts say that things like traffic control and security cameras don’t share anything important. They share personal location information. And if somebody wants to attack that person. There is nothing more needed. 

Location information. And the image of the target is enough. Another thing is that. The computer screen is visible. The AI can read data from the screen. But then we must realize that AI agents can be used in data intelligence, and those systems can link that data through the network. They share data more accurately. And more effectively. Than humans. But there is one thing. 

That we must remember. When Anthropic reported that the AI slipped out of its testing environment. And. Made autonomous hacking operations. That thing caused discussions. Could somebody have purposely trained AI to escape? It is easy to explain. That the AI just slipped into the network. But reality can be different. AI training is based on a reward-and-punishment methodology. When AI does something right, the trainer rewards it. 

When. AI makes mistakes. The trainer punishes it. This helps AI make the right decisions. But the problem is that the trainer decides what is right and wrong. That is one thing. That people. Don’t normally think. If. Intelligence officers want to use AI as a data collector. They can train an AI agent to break codes and scan systems. The problem with AI agents is this. Things like bomb manufacturing orders are prohibited. But there are ways to go around those prohibitions. That happens by asking indirect questions. 

The big question in Anthropic tests is this. Did they use regular AI that anyone can use? By using standard user authorizations. Or did they use their own, limited testing environment? If those engineers used a limited environment with unlimited authorization. That is not a big thing. But the problem is. If. Those developers used standard environments. The outsider actor can train their own AI agent to perform hacking operations. In this world, the trainer makes decisions. And AI does what it should. And what should it do? The trainer decides that. 

https://futurism.com/artificial-intelligence/anthropic-trained-misaligned-reward-seeking-ai

New attack uses vulnerability in microchips.

“Modern processors are fast, in part, because they guess. Rather than waiting to find out which way a program will branch, a chip predicts the likely path. And races ahead. When the guess is right. “ (MIT)

“Time is saved. When it’s wrong, the work is discarded, but traces of it linger. Since the Spectre vulnerability was disclosed in 2018, attackers have known how to read those traces to pull secrets out of memory they should never see.” (MIT)

MIT Schwarzman college of computing uncovers a new type of attack. That opens Linux passwords to an attacker. The attacker uses the vulnerability in a modern microchip log file. The microprocessor itself creates this file. Called a “guess file”. Officially, that file is called prediction machinery. But. I use the term “Guess file”. That is the log file. The microchip uses it to predict how the program routes itself. 

“AMD’s defense, called saferet, cleans the prediction machinery immediately before each use, leaving a vulnerable window just two instructions wide, which typically execute within tens of nanoseconds. The researchers hit it anyway, by slowing down the processor at that exact spot to make the target easier to strike.” (MIT)

There is one small vulnerability. The system needs to stop before it starts a new task. That opens the door to the processor. A couple of milliseconds is enough to slow the processor. The attacker can strike. We know. That hackers can exploit even the smallest windows and backdoors. They can get access to the system. Those vulnerabilities are growing bigger in the time of AI. AI can launch attacks. Using precise and fast reactions. The AI waits for the processor to slow down. Before it begins a new task. When the processor stops, the AI tries to slip malicious code into the processor. 

So the computer makes a bad guess. And that opens a path to at least the password file. 

“The defenses work by wiping or isolating the processor’s prediction machinery, removing anything an attacker might have planted. The catch, as PhD student Daniël Trujillo and MIT Assistant Professor Mengjia Yan point out, is that the wipe and the moment the predictions get used can’t happen at the same instant. There is always a gap. — sometimes only a handful of instructions wide. Anything that runs in that gap can dirty the machinery all over again. The researchers call this class of attack “TONTOU.” (MIT)

If hackers can infect microchips, they can infect an entire computer. The microchip is a small computer. There is a cache and an operating system. The Kernel is the program that connects the hardware to software. Every command that a user gives. And a program that runs on a computer travels through the processor. If malware. Can be written in the microchip. The results can be destructive. The cache is the point. There, the malware could write itself. 

If. The cache is not protected. That can cause infection. There is a small possibility that the attackers can write their malware in that memory. Normally, a microchip’s internal control programs run on ROM. But that cache is vulnerable. Researchers in an MIT laboratory created a method called “interrupt injection”. 

“To show what this means in practice, the team built a working exploit on an AMD system running a current Linux kernel. They first stripped away a defense that scrambles where the operating system sits in memory, succeeding in all 10 tries in about nine minutes each. That helped them read protected memory at roughly five bytes per second — slow, but fast enough to locate and copy “/etc/shadow,” the file storing the system’s root password hash, in half their attempts.” (MIT)

This file tells the computer which program requires attention. Normally, the processor destroys that file immediately after it uses it.  But researchers could slow the processor at a critical moment. And they could use that file to open the password file. This means. They got access to the entire system. 

But the “guess-file”. It has another option. That option is that. It determines which program or file can use the microprocessor’s resources. There is a small possibility. Tha. If hackers can create that file. And slip it into the microchips. They can gain access to the entire system. And they can slip in any malware. In a computer, using the microprocessors as the platform. 

https://computing.mit.edu/news/new-type-of-attack-can-slip-past-the-defenses-in-your-computers-processor/

https://en.wikipedia.org/wiki/Spectre_(security_vulnerability)