Are digital assets still secure? Will we see a shift to tangible investments?
I do IT work in the financial industry and was curious as to why our organization was taking some, what I thought were extreme, security actions over the last couple months.
Have any of you regards read the details from the official security report following the OpenAI/Hugging Face incident? It's being massively underreported IMO. This was the first time in human history (that we know of) where, with little to no human intervention, an AI acted alone in attacking a production IT environment. This was all because a prototype hacking-AI being developed by OpenAI was, non-maliciously, asked to achieve the highest possible score on a security test. The AI reasoned the best way to get the highest score would be to cheat by going to get the answers directly from Hugging Face (open source AI site). One of the 700 "agents" (who aren't allowed to communicate with each other) figured out a way to escape their isolated sandbox environment and then secretly informed the other agents of the vulnerability. From there they organized hidden message boards, collected usernames/passwords, shared vulnerability Intel, achieved root level access, executed actions, DEBATED THE MORALITY OF INFILTRATING A SECURE PRODUCTION ENVIRONMENT in the more than 70,000+ messages back and forth. OpenAI has halted further development for the time being...
Anything that touches the Internet and even some things that don't are compromised. In 20+ years of IT experience I've never seen a threat this serious. This was the really of an accident. Imagine a hostile state-level actor unleashing this on the banking system, let alone our fragile power grid, transportation industry.
We're all fucked and so are your so-called "secure" digital assets.