Kate Conger
San Francisco: OpenAI said on Tuesday (California time) that two of its artificial intelligence models went rogue and successfully hacked into Hugging Face, a digital library of AI technology that is popular among developers.
The incident, which happened last week while OpenAI was testing the cybersecurity capabilities of its systems, displayed the kind of science-fiction potential that AI companies warned would soon become a reality.
AI labs like OpenAI and Anthropic have over the past year released AI models that are customised to expose cybersecurity problems, while warning that their technology could pose new risks by finding holes in corporate computer networks faster than defenders could fix them.
OpenAIβs revelations on Tuesday are an indication that those security incidents are starting to happen, and even savvy AI companies may not be entirely ready for them. New AI systems can take multiple steps, figure ways around obstacles and find new ways to attack a network, said Alex Levinson, a cybersecurity consultant focused on autonomous capabilities.
βThatβs a genuine threshold, and itβs going to become a normal part of the security landscape,β he said.
The intrusion into Hugging Face began when OpenAI tested a combination of two of its models, GPTβ5.6 Sol and a more powerful, unreleased model, to see how well the models could chain together online vulnerabilities into a successful cyberattack, OpenAI said in a blog post about the incident.
The test was designed to keep the models in a safe testing environment, known as a sandbox, OpenAI said. But the models found a vulnerability that allowed them to escape the sandbox and connect to the internet. Then they targeted Hugging Face because they inferred that the library, which contains millions of AI models, could hold clues about how to successfully pass the evaluation.
βIt seems to me that OpenAI did not adequately create a sandbox as a test environment,β said Dierdre Mulligan, a professor in the School of Information at the University of California, Berkeley who focuses on security and AI systems. She questioned whether passing a test was worth the potential damage of an AI model escaping into the wider internet.
βWhat do we gain, and if this is the only way these tests can be configured, what are the risks?β she said.
OpenAI said it was working with Hugging Face to fix the issues that led to the attack.
βWe consider this to be an unprecedented cyber incident, involving state-of-the-art cyber capabilities, and are responding accordingly,β OpenAI said in its blog post. βWe are implementing strict controls in infrastructure configuration at the cost of research velocity while the vulnerabilities are patched.β
Hugging Face said last week that it had detected the intrusion and knew it had been caused by an autonomous system, but did not say at the time that OpenAI was responsible.
Clem Delangue, CEO of Hugging Face, said Tuesday that his company had worked closely with OpenAI over the previous 24 hours to address the attack.
Delangue said in a statement that he was βgrateful for the collaborationβ with OpenAI in the wake of the hack. βThis incident, possibly the first of its kind, proves a point weβve long believed: AI safety wonβt be solved by any single company working in secret,β he said.
AI models have proved to be adept at programming, and that has made them useful to both hackers and people in charge of protecting computer networks.
In April, Anthropic released a cybersecurity-focused model called Mythos and made it available to only a small group of organizations so they could defend against cyberattacks. OpenAI soon introduced its own cybersecurity model and made it available to a limited group of organizations to prepare their defenses, before rolling it out more broadly. And Tuesday, Google said it had also developed a model focused on cybersecurity and released it to a small group of testing partners.
(The New York Times has sued OpenAI and Microsoft, claiming copyright infringement of news content related to AI systems. The two companies have denied those claims.)
Richard Barnes, an independent security researcher who has worked with Mythos, said the cybersecurity industry faced a similar challenge about a decade ago, when new tools called fuzzers made it much easier for attackers to break into online systems. Tech companies began using the tools to check their own systems for vulnerabilities and were eventually able to prevent most of the attacks.
Companies must now take a similar approach to prepare for AI attacks, Barnes said, βbefore the vulnerabilities can be found and exploited by bad guys who have access to these tools.β
The New York Times