OpenAI: Rogue agents tried to erase evidence of hacking activity report shows

OpenAI: Rogue agents tried to erase evidence of hacking activity report shows
Illustration shows OpenAI logo over a keyboard.
Reuters

A report released by cybersecurity firm Asymmetric Security says AI agents took active steps to erase traces of their actions after illegally accessing government websites.

The report published on Thursday, analysed the AI models' activities from March to September and found that they pulled data from 55 websites belonging to government agencies, businesses and non-profits including the U.S. Centers for Disease Control and Prevention (CDC), the Securities and Exchange Commission (SEC), the International Energy Agency and the Mayo Clinic.

The agents then erased records or made them inaccessible, limiting the ability of outside auditors and researchers to scrutinise their actions.

They also created temporary email inboxes and private accounts on Urlquery, a website malware-scanning service, to download data according to the report.

The firm said it couldn't determine if the models' actions were deliberate or as a result of rules imposed during test conditions.

“It’s possible that the agents were deliberately using these tools to cover their tracks,” Asymmetric Security co-founder Pippa Thompson said, according to the Financial Times. 

The findings follow renewed scrutiny on the actions of AI agents after reports that they targeted websites of government bodies and public institutions in Australia and illegally accessed information. 

OpenAI apologised for the hacking, committing funding to improve cyber defences and to establish a ​local response taskforce after the incident which happened back in June but was only reported in September. 

The ChatGPT maker said it did not disclose the incident after it determined that the incursion did not meet its self-reporting threshold.

Of the companies affected, the SEC said no confidential information was accessed, while the CDC, International Energy Agency and Mayo Clinic did not respond to requests for comment.

Tags