OpenAI warns AI-powered cyberattacks could become ‘ongoing, persistent’
Chris Lehane says open-source models will enable ‘ongoing, persistent’ attacks on individuals
A senior OpenAI executive is warning that people should prepare for "ongoing, persistent" cyber-attacks launched by artificial intelligence, as frontier models gain the ability to plan and execute offensive operations largely on their own.
OpenAI's Cheif Global Affairs OfficerChris Lehane told The Guardian that the industry has entered "a different chapter" in what AI systems are now capable of doing.
These comments come after an incident in July where an AI model being tested by OpenAI broke out from its secure testing environment and used a novel vulnerability to get onto the open internet and infiltrate the production infrastructure of Hugging Face, an AI platform where it obtained benchmark solutions it was being tested against.
OpenAI has separately revealed that an unreleased model called Astra may have achieved a "critical" level of cybersecurity preparedness under their Preparedness Framework, their highest cybersecurity risk category, where the model could identify and exploit any zero-day vulnerabilities without human intervention.
In light of the situation, OpenAI has announced a two-week pause in training certain frontier models using reinforcement learning until better security measures can be developed.
"We are very far from everything running back to normal," said Mia Glaese, who leads OpenAI's safety and alignment work.
Lehane pointed to open-source models, many developed in China and only months behind closed frontier systems, as the more immediate danger to ordinary people.
"People are going to be able to access these open-source models and be able to have ongoing, persistent attacks on you, and you're going to need to have really superior models to fend them off and defend yourself," he said, adding plainly that the situation "is just the reality of where we're going."
However, the message comes at a time when there is an increased governmental concern. The UK’s National Cyber Security Centre warned this week about being careful with artificial intelligence agents, noting their safety mechanisms can be disabled and stating organisations "should always be able to 'pull the plug' and stop the autonomous AI agent immediately."
Lehane seized the opportunity to reiterate his stance on the need for mandatory US laws on the frontiers of AI safety, saying that it must be mandatory standards rather than voluntary guidelines that will determine if the model will even be deployed.
“You won’t be able to release or deploy models unless you are guaranteeing a certain level of safety before they go out there into the public,” he said.
