Sloppy AI Defenses Take Cybersecurity Back To the 1990s, Researchers Say
- Reference: 0178657580
- News link: https://it.slashdot.org/story/25/08/12/2037200/sloppy-ai-defenses-take-cybersecurity-back-to-the-1990s-researchers-say
- Source link:
> Just as it had at BSides Las Vegas earlier in the week, the risks of artificial intelligence dominated the Black Hat USA 2025 security conference on Aug. 6 and 7. We couldn't see all the AI-related talks, but we did catch three of the most promising ones, plus an off-site panel discussion about AI presented by 1Password. The upshot: Large language models and AI agents are far too easy to successfully attack, and [2]many of the security lessons of the past 25 years have been forgotten in the current rush to develop, use and profit from AI.
>
> We -- not just the cybersecurity industry, but any organization bringing AI into its processes -- need to understand the risks of AI and develop ways to mitigate them before we fall victim to the same sorts of vulnerabilities we faced when Bill Clinton was president. "AI agents are like a toddler. You have to follow them around and make sure they don't do dumb things," said Wendy Nather, senior research initiatives director at 1Password and a well-respected cybersecurity veteran. "We're also getting a whole new crop of people coming in and making the same dumb mistakes we made years ago." Her fellow panelist Joseph Carson, chief security evangelist and advisory CISO at Segura, had an appropriately retro analogy for the benefits of using AI. "It's like getting the mushroom in Super Mario Kart," he said. "It makes you go faster, but it doesn't make you a better driver."
Many of the AI security flaws resemble early web-era SQL injection risks. "Why are all these old vulnerabilities surfacing again? Because the GenAI space is full of security bad practices," said Nathan Hamiel, senior director of research and lead prototyping engineer at Kudelski Security. "When you deploy these tools, you increase your attack surface. You're creating vulnerabilities where there weren't any."
"Generative AI is over-scoped. The same AI that answers questions about Shakespeare is helping you develop code. This over-generalization leads you to an increased attack surface." He added: "Don't treat AI agents as highly sophisticated, super-intelligent systems. Treat them like drunk robots."
[1] https://slashdot.org/~spatwei
[2] https://www.scworld.com/news/sloppy-ai-defenses-take-cybersecurity-back-to-the-1990s-researchers-say
How? (Score:3)
"This over-generalization leads you to an increased attack surface."
How is that?
"Why are all these old vulnerabilities surfacing again?"
Are they?
"You're creating vulnerabilities where there weren't any."
Prior to deployment, there aren't any, that's for sure. But whether there are any vulnerabilities upon deployment depends on what's being deployed. What vulnerability is there if the AI doesn't control anything.
Another BS AI FUD article, nothing more.
Re: (Score:2)
If you knew *anything* about how generative AI systems actually work - think stochastic regurgitation - you would not say such things. I wouldn't trust any such AI system any further than I could throw it. For non-entertainment purposes, such systems are only usable if you are smarter than than the AI *and* double check everything. Contemporary AI systems are subject to model collapse, confabulation, delusional behavior, anti-social or amoral goal seeking if given any kind of leeway, and on and on, as ha
Yep (Score:2)
Also, cheap labor
I tried (Score:2)
> Treat them like drunk robots.
ChatGPT told me to bite its shiny metal ass.
IT Security in 1990 was not so bad (Score:2)
Most computers back then were not connected unnecessarily to the entire world, so criminals would need to put in the effort to physically travel to the computer to attack it, which excludes pretty much 99% of all cyber-criminals from attempting intrusion.
Also, attacks back then required at least some technical understanding of computers, while prompt injection or access to public cloud databases works even for people who could not write a 3 line function.
Re: (Score:2)
1990 s not "1990". Something called "the web" happened in the 1990s and by the end of 1999 (still in the 1990s) there 120 million Internet users in the U.S.
Halfing Less Children with More Apparent Errors (Score:2)
How much for Hunter Biden's used edible paintings? With the Shatner?
DRUNK ROBOTS (Score:2)
> "Don't treat AI agents as highly sophisticated, super-intelligent systems. Treat them like drunk robots."
Every 5 seconds I hear on this website and other places, how AI is the next new big thing. It is going to revolutionize the world. Sleazy orange hype men tell everyone AI will take your jobs!
Back in reality,
> Treat (AI) like drunk robots.
"Generative AI is over-scoped" (Score:2, Funny)
"But if we can do everything then we get all the money! Now just sign this Series Q funding check for ten trillion dollars to train a model that will suck the oceans dry and use people as a power source like in The Matrix." - AI Companies
Re: (Score:2)
^Yes!!^
Been saying this since I saw the first "AI" headline on here.
Another good reference is "The Second Renaissance" (from The Animatrix) (although, that one is orders of magnitude darker)