"To stop our all powerful AI that will go rogue you need to buy our all powerful AI"
This is the textbook definition of racketeering.
This is the textbook definition of racketeering.
This is like telling that bank vaults always were breachable, and giving out explosives to everyone just made them get breached sooner.
(edit: fact of existance of a vulnerability is not a binary yes/no. the amount of effort needed to exploit even known vulnerabilities is usually staggering, requiring months from very capable individuals with very specific skillset.)
The covid was not a lot deadlier and not a lot more contagious than normal seasonal flu. That "not a lot" overloaded hospitals and caused global shutdown.
The increase in rate at which software is being breached right now in in no way "not a lot". Devs were overloaded even without this deluge. We can tank one such php exploit. Then another one. But for how long? If all your smartcards, secure elements, cloud providers, wireless protocols, drivers, government registries etc etc will be having weekly breaches of this magnitude, won't the effect be systemic?
Let's all recall old times when vulnerabilities of this magnitude were discovered - windows defender had some nice ones, linux kernel did, a lot of software did. They got discovered, communicated to vendor, patches were made, people updated.
Now? You have HOURS from discovery to full-out campaign. You published a patch? HOURS before it is disassembled, all fixed bugs PoC-ed and full out campaign started. You cannot update anything meaningfully in that window of time.
Yes, exactly, that is my premise (minus the "working with researchers" bit). The current rate of exploitation is direct consequence of actions of Anthropic, OpenAI, Alibaba and whoever else is making these things. How can I know my false premise is true? By looking at the situation just a year ago, that is how!
You are focused on the binary: vulnerability exists or it does not. It can be exploited or it can not.
That is not what is causing the issues!
That being the case, the outcomes we're looking at here with respect to vulnerabilities are largely foregone conclusions.
In any case, what I want to say is this: All technology has tradeoffs but this has shown we are locked in a game theory mechanic not dissimilar to extortion AND the security implications are part of that.
- We have to build AI or someone else will.
- You need our tools to protect yourself from our tools or similar ones
- You need to use AI or someone using AI will take your job.
Many examples but it is very "i created the disease to sell you the cure". If this were any other technology, we would expect more reasonable mitigations, extraneous factors like software bugs existing aside. It speaks to a fundamental lack of control on the part of the labs that we take for granted: they simply don't have control of the PRODUCT, much less how it is even used.
Finding vulnerabilities that already exist in code can't be "creating the disease", for obvious reasons.
You are the QA head and the new model could literally find and exploit ANY bug? Would you release the model? Genuinely curious. Its not totally science fiction. I think there is a difference in a couple smart people punishing 1 sloppy company that underinvested in security. The internet is a stack of protocols, hardware, infrastructure, applications etc. It could be the case that almost everyone has capabilities on par with yours. Great you say, security will improve! However, there will be a meltdown in the middle where potentially digital currency is exploited, exchanges, banks, utilities. It isn't just a team working for 3 months, finding some issues in a company.
Or is this way overblown?
At this point I don't know what will be worse for the global economy the AI Bubble bursting, or the gigantic crash all this vulns might bring if they force the stop because we went too far and everything came crumbling down...
No. Even if we ignore the people newly enabled to slop out vulnerable software without having a clue about security, the AI powered supply chain hacks inserting vulnerabilities, the influx of AI contributions that drown out improvements in FOSS security, and the industry pressure to ship faster while reducing quality or be left behind -- all because of AI -- security through obscurity has historically been the most effective security.
I don't think your argument holds under theory or (especially) practice.
Security through mathematical impossibility is the most effective. AI-assisted brute-force vulnerability search is revealing that what we considered obscure a year ago is no longer hidden and was never secure.
Fast-forward a few years of this, I wonder whether they will have found all the low-hanging fruits (from AI perspective) and the situation will settle down; or it will keep getting worse - with AI development never reaching a plateau - until we admit that all existing software and hardware are hopelessly vulnerable and likely compromised already.
Since we are entering a new age, maybe it's time to revisit the question. But ultimately I think we will land in the same place, in fact even firmer than before.
So why don't we just lock up all the whitehats and people behaving suspiciuosly and probing things? Why can't we achieve cybersecurity in this way when it seems to be a common thing in physical security?
And the answer I think is quite simply that there are too many attackers and they are too far away. When the russians and chinese come knocking there isn't much we can do to shoo them away. Their governments will not cooperate in detaining the criminals. Entirely blocking such countries from the internet isn't viable either. And that's why we arrived where we did. Victim blaming because it was the only effective strategy.
And how does AI change this? I think it just creates even more hard to trace or block attackers. If ChatGPT or Claude doesn't find the vulnerability then Deepseek will. That's why using legal weapons will not succeed and why using AI to find and plug holes is necessary.