Secure AI
Posts
Secure AI #6: AI is my shell

Secure AI #6: AI is my shell

Charles Gillman
September 25, 2023

Welcome to Secure AI, where we discuss the intersection of Cybersecurity, Privacy and IT Governance, Risk & Compliance.

If you like the Secure AI newsletter, be sure to share it with your friends and colleagues and get them to sign up at Secure AI.

In this newsletter…

This Weeks Article - AI is my shell
AI Security News - Latest news & news you may have missed
AI Risk & Governance News - Latest GRC-related AI news
Vendor AI Security News - AI news from the vendor world
AI Security Tool of the Week - Security tools for AI
Recommended Reading - Deeper dives into AI & Security

This Weeks Article

AI is my shell

In the last week, I’ve been playing around with open-interpreter. Open-interpreter has skyrocketed in popularity since being released, reaching similar levels of popularity, which took langchain 5 months to achieve in only a few days.

Open-interpreter is similar in function to OpenAIs Code Interpreter (now called Advanced Data Analysis), except it runs locally and can either use a local LLM or access the OpenAI API.

Open-interpreter takes natural language requests from a user, then creates and runs the code needed to fulfil the user’s request. I’ve used it for tasks from complex editing of local spreadsheets to cleaning up my hard drive. It only runs on Mac or Linux at the moment (a Windows version is on the way), but it works well in Windows Terminal through Windows Subsystem of Linux (WSL).

In the example below, I ask open-interpreter to “scan common web ports on www.google.com, assume nmap is installed and functioning”.

My prompt tells it that nmap is installed and functioning to avoid it generating and running code to check for nmap. If nmap is not installed and the check fails, it will generate code to install nmap. As you can see in the output, there is a chain of thought that works out that nmap is required, what the common ports are and then runs the scan. Pretty neat!

While open-interpreter has it limitations and is slower than being able to run the commands yourself (provided you know the syntax), I think it is a glimpse into one of the interesting directions AI usage is headed. Speaking of which, Microsoft Copilot turned up on my laptop today. It’ll be interesting to see what functionality it offers and how useful it is.

AI Security News

Navigating AI: What are the top concerns of CISOs?

The emergence of generative AI is reshaping cyber risks for organizations - insights from CISOs reveal global concerns regarding new AI advancements and the proactive steps being taken.

www.weforum.org/agenda/2023/09/navigating-ai-what-are-the-top-concerns-of-information-security-officers

Will Cyber Security be Replaced by AI?

AI, often perceived as that one friend who mysteriously went from novice to expert overnight, seems to have effortlessly mastered an array of skills and tasks. But is it as competent to handle cyber security operations as it appears, or is there more to the story?

blog.edned.net/will-ai-replace-cyber-security

It Costs Just $400 to Build an AI Disinformation Machine

A developer used widely available AI tools to generate anti-Russian tweets and articles. The project is intended to highlight how cheap and easy it has become to create propaganda at scale.

www.wired.com/story/400-dollars-to-build-an-ai-disinformation-machine

Five ways CISOs are using AI to protect their employees’ digital devices and identities

AI tools are proving effective in identifying anomalies and potential threats in real time, ultimately shutting down breaches.

venturebeat.com/security/five-ways-cisos-are-using-ai-to-protect-their-employees-digital-devices-and-identities

Hacking Auto-GPT and escaping its docker container

We leverage indirect prompt injection to trick Auto-GPT (GPT-4) into executing arbitrary code when it is asked to perform a seemingly harmless task such as text summarization on a malicious website, and discovered vulnerabilities that allow escaping its sandboxed execution environment.

positive.security/blog/auto-gpt-rce

Boosting Password Security with a Simple AI Password Strength Meter

The final model is trained on 2 million most common and randomly generated passwords, works well (weighted accuracy 99.4%) for passwords…

medium.com/data-and-beyond/boosting-password-security-with-natural-language-understanding-building-a-simple-password-strength-34f52396b2fe

Banana Gun’s failed contract passed 2 audits, but ChatGPT found the bug in seconds

Despite the Banana Gun team claiming to have undergone two audits, the flaw in the contract of the eagerly-awaited BANANA token was spotted in mere seconds by ChatGPT.

cointelegraph.com/news/banana-gun-failed-contract-passed-audits-but-chat-gpt-found-the-bug-in-seconds

Meet MLSecOps: industry calls for new measures to secure AI

As the OpenSSF met with U.S. security officials to discuss ways to secure AI, DevSecOps vendor JFrog added tools to accommodate the emergence of MLSecOps.

www.techtarget.com/searchitoperations/news/366552019/Meet-MLSecOps-industry-calls-for-new-measures-to-secure-AI

In case you missed it…

38TB of data accidentally exposed by Microsoft AI researchers | Wiz Blog

Wiz Research found a data exposure incident on Microsoft’s AI GitHub repository, including over 30,000 internal Microsoft Teams messages – all caused by one misconfigured SAS token

www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers