‘The assertion that the AI is an autonomous being is insane’: Cyber expert says companies should face criminal charges when their AI hacks

Cybersecurity experts are calling this month “Black October,” and unfortunately, the name has nothing to do with Halloween.

Over the past several weeks, AI developers, government agencies, and private companies have disclosed a wave of cybersecurity incidents. One of the most significant: a pair of decade-old flaws in PHP, the programming language behind an estimated 70% of websites, which researchers uncovered with the help of AI models. Some of this month’s incidents involved hackers using AI tools to hammer an organization’s digital defenses at machine speed; others resulted from plain human error. But many cybersecurity experts agree that this is the beginning of a new era, one in which AI can be used both to defend people’s cybersecurity and to attack it.

“AI is making the old vulnerabilities cheaper to discover and exploit, but on the other side, the defense side… that’s not sped up,” Junfeng Yang, a computer science professor at Columbia University, told Fortune. “That is the asymmetry right now.”

That asymmetry, Yang explained, is what leaves internet users and organizations vulnerable.

Patching can’t keep pace

In many of these incidents, the remedy is a patch, a software update engineered to close the vulnerability. But it takes time to properly test a patch and make sure everyone affected can deploy it. That struggle was on display Monday, when the U.S. Cybersecurity and Infrastructure Security Agency added last week’s PHP vulnerabilities, known collectively as “php2shell,” to its catalog of flaws being actively exploited by attackers and ordered civilian federal agencies to fix affected systems by Oct. 29. Five days earlier, CISA had said it had not yet seen exploitation.

Still, Yang and........

© Fortune