Find articles

Systems that guard our email and bank accounts are vulnerable to attacks, but building on the best defenses will buy time and prevent a crisis, writes Tyler Cowen. AI commentator Zvi Mowshowitz declared: “It was the probably worst day in cybersecurity history. So far.” The day in question was last Thursday, when news that AI had detected a critical flaw in PHP, a programming language used for building websites, leaked before the fix was available. That sent much of the internet running for patches and fixes, and the result probably will be that many older websites end up permanently dysfunctional. Many governments even took their websites offline for a while, to limit the risk of hacking. We are likely to survive this particular episode without the economy crashing down. But as Zvi’s comment indicated, other problems will arise in the future and they may be far more serious. One issue I have followed with special interest is cryptography. Throughout the tech industry, there is a slowly rising worry about AI breakthroughs in cryptography, which, in theory, could throw open the front door of every email, online transaction, and bank account. Recent headlines tell the story. “Vitalik Buterin Warns AI Could Break Lattice Cryptography Within Two Years,” reads one, announcing that the cryptocurrency creator has lost faith in systems recently thought to be invulnerable. Even more daunting: “Claude AI Solves 25-Year NSA Cryptography Mystery in Just 30 Minutes.” Now that an AI model from Anthropic (where I am an economic adviser) has cracked through a barrier no human has managed, whether any barrier is safe has become a live question.

An AI expert says banks may not just fear hackers. They may fear customers making better money decisions.

Microsoft is warning that Chinese state-aligned hackers have unleashed a sophisticated new wave of artificial intelligence-powered cyberattacks targeting hundreds of organizations worldwide, exploiting trusted software providers and gaining privileged access to corporate...

Eye-opening revelations this past week have solidified my personal fears about the year ahead: As a nation and as a globe, we're facing a record number of wild risks that are way outside our control. My growing hunch about this scenario has been bolstered by daily conversations with CEOs, government insiders and top investors. Why it matters: It feels likely — not certain — that between now and 2028, we'll face society-level disruptions, possibly including cyberattacks and fast-twitch economic shocks. What we're facing: We've navigated single-shot crises like the financial meltdown of 2008 and the pandemic of 2020. This next year will be different. The real risk is a chain reaction: One shock sets off others — faster than we can process, and caused by AI dynamics we don't fully understand. Call it chain-reaction chaos . And that's against the backdrop of this age of post-processable velocity : The speed of change exceeds the ability of any individual, company, market or government to fully absorb, understand and respond. The reason this scenario looks so likely is that so many obvious risks, all with relatively high probabilities, keep piling up. Any one of them will rock already highly volatile markets and politics: Cyber chaos. This past week was a big flashing siren. AI-detected flaws in PHP, the code behind millions of websites, knocked government sites offline worldwide and prompted the National Security Agency to warn organizations to patch immediately or go dark. Major banks found unauthorized AI agents inside customer accounts, some trying to take actions customers never asked for. And Anthropic's deputy chief information security officer, Jason Clinton , warned that as bad as the past several days had been, cyber threats will get "a lot worse before they get better." Salesforce CEO Marc Benioff quickly agreed , writing on X: "Code red." As Madison Mills reported for Axios , the AI companies and the banks are scrambling for "day after" planning, fully anticipating a bigger cyber hit in coming months. People at top AI companies tell me the chances are far north of 50%. AI bubble bursts (partially). This doesn't feel like 1999, since giant companies with huge balance sheets are underwriting the AI boom. But that's also the problem. They're increasingly doing it with borrowed money: Goldman Sachs expects about a third of Big Tech's AI capital expenditure to be debt-financed this year. A bubble doesn't need to burst spectacularly to cause widespread economic and political pain. These companies are deeply intertwined, investing in, selling to and buying from each other. Look what happened with Meta this past week: It crushed its earnings , but then spooked the market by detailing the difficulties of raising capital to fund AI. Any sign of overbuilding … or companies underusing AI … or China catching up … or AI prices collapsing … or credit costs spiking … or the political backlash intensifying, and markets could tumble fast. A sharp correction feels like a 50%+ scenario in the short term. AI hits true RSI. AI could get better, faster than almost anyone anticipates via recursive self-improvement (RSI). People inside Anthropic, OpenAI and Google see this unfolding now. This could be awesome long-term if we steer the technology smartly. But it could also prove wildly disruptive in 2027: More advanced AI would pose a more urgent threat to industries, companies and jobs. You could easily see this enticing Democrats to join Sen. Bernie Sanders (I-Vt.) in demanding a slowdown or full pause, which would rattle markets. War expands, oil spikes. President Trump's aides believe he's likely to resume the Iran war postelection. The Iranians warn they would expand their targets in retaliation. The U.S. reduced staffing at embassies throughout the Middle East amid increased threats . Escalation feels more likely than not at the very moment oil supplies are tight and gas and diesel prices are very high. Imagine the economic pain of sustained $120-a-barrel oil. An aging, unrestrained president. I want to be clear here: This isn't a political statement or Trump health appraisal. I'd write the same for Joe Biden. It's a simple, fact-based observation based on actuarial tables. Trump, age 80, heads into the next two years as the oldest person ever to be president. It's a medical certainty that the chances of mental decline and incapacitation rise dramatically in your 80s. Trump is much like Biden in that he doesn't have people around him who can level with him. The risk stretches from health episodes to judgments about war and the limits of presidential power. What you can do: I spell this out not to scare you or cause you to throw up your hands and retreat from reality. You can only make wise decisions for your career, your life and your family if you're living in the future — understanding what's coming, and living these historic times with your head in the game. The expert journalists of Axios are working hour by hour to be your clinical, useful guide to this head-spinning era. Three very practical steps: Be aware: This is an exciting time to be alive. So learn about AI — the good, bad and ugly. And think more deeply about what you expect from your employer and elected representatives. Be vigilant: This past week's Axios reporting about AI agents showed the importance of locking down your passwords. Put every account in a secure password manager with a unique password. Use passkeys where offered. Protect your email and phone with an authenticator app, since whoever controls those can reset everything else. And don't hand a password or login code to anyone who contacts you, human or AI agent. Be ready: This past week also showed how AI is the market. So if you have a 401(k) or other investments, make sure to understand how concentrated you are in different sectors. Seek out smart diversification strategies. And find a few news sources, like Axios, that you can trust to make sense of all the craziness. The bottom line: It's easy to argue any one of these risks won't materialize. But when you add up this many, the overall chance of a crisis outside our direct control is spiking by the day.

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here. Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. This week alone has seen a string of alarming incidents […]

Headline-grabbing security hole in global websites, found by AI, now has evildoers using AI to exploit the gap. An AI Insider analysis and scoop.

Cybersecurity researchers raced to patch a major flaw in PHP as details leaked online and attempted exploits surged.

Article URL: https://openai.com/index/securing-our-frontier-model-training-environment/ Comments URL: https://news.ycombinator.com/item?id=50214416 Points: 68 # Comments: 80

After discovery of severe bug in the PHP programming language, executives warn of ‘vulnerability tsunami’ Leaders in cybersecurity are sounding the alarm after the discovery of a major vulnerability this week. They are predicting that artificial intelligence tools will expose more fundamental weaknesses in global internet infrastructure in the months to come. “I no longer think we’re going to be able to patch all bugs,” said Sam Altman on Thursday evening, joining the chorus of executives. In the midst of what’s being called “Black October”, for which researchers used AI to help identify critical flaws in a coding language that is used across millions of websites and may have been unpatched for years, tech executives are warning about the ways AI will be used both to identify and exploit security vulnerabilities at an unprecedented scale and pace. Continue reading...

An explosion of AI-powered hacks will reshape life online.

Banks have detected personal AI agent activity inside customers' accounts as experts warn about the risks of oversharing with AI.

E-commerce may get comfortable with agent transactions before other industries.

The bugs OpenAI models discovered this week have existed for more than a decade, and PHP, the programming language that contained them, is 30 years old.

Citi and Wells Fargo confirmed restrictions on third-party AI agents accessing customer accounts as major banks confront growing security concerns over automated financial tools and customer-authorized access.

Governments and businesses around the globe are scrambling to contain the fallout after the PHP vulnerabilities leaked online.

Unvetted and unauthorized third-party AI agents are operating inside the bank accounts of some U.S. customers. Axios' Madison Mills joins "CBS Mornings" to explain more.

Advances in artificial intelligence have uncovered a stream of new software vulnerabilities. Seven cybersecurity professionals told Reuters the discoveries are almost certain to trigger more disruption, similar to the outages that affected government websites worldwide this...

Governments around the world are rushing to implement safety measures after AI technology found 'severe' vulnerabilities in a key programming language called PHP.

America's largest banks are working to prevent AI worst-case scenarios. But they're also preparing for the "day after" a catastrophe, Axios has learned. Why it matters: America's financial institutions have joined the largest AI companies in scenario-planning for disaster, a prudent but worrisome signal about the extent of the risk that major corporations see on the horizon. State of play: Banks are experiencing unvetted AI agent activity, primarily driven by customers providing login credentials to agents, which in some cases appear to have taken actions independent of user prompts, Axios reported Thursday . The activity is distinct from the rogue behavior involved in a summer attack on a startup called Hugging Face , where an AI agent swarm hacked a platform in an episode that kicked off an industry security crisis. Instead, banks fear the ripple effects and risks that extend from users allowing agents to log in to their accounts and take action, especially since agents could take steps users haven't sanctioned. Concerns about frontier AI systems, not AI agents, have led banks to invest in prevention and to plan for the worst. Zoom in: The Axios report came amid growing concerns about a burgeoning cybersecurity crisis. Salesforce CEO Marc Benioff posted "code red" on X, quoting an Anthropic security employee who said "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." The Anthropic employee was referring to security researchers finding major vulnerabilities in a programming language used to run millions of websites, marking one of the most consequential cybersecurity discoveries yet made with AI . The Axios report on banks, which referred to agentic AI, not frontier AI systems, sparked calls for regulation from across the political spectrum, including Sen. Bernie Sanders, Florida Gov. Ron DeSantis and Sen. Mark Warner. Former White House AI czar David Sacks said banks should support user-directed agents that allow users to "grant, limit, and revoke access," with read-only as an "interim step." Sacks said conflating "user-authorized agentic behavior and cyberattacks is irresponsible." Flashback: The major banks were part of early testing of Anthropic's Mythos, the most cyber capable models from the AI lab. That was part of an effort from AI labs and major banks to use this technology to better understand and prepare for cyberattacks or other risks. Since then, banks have worked on plans not just to avoid AI related issues, but also how to protect accounts, reassure customers and keep operations running in case a large-scale attack hits. Reality check: This is not just standard, it's required for critical industries that have to answer to the government, shareholders and customers. Scenario planning is a requirement for critical infrastructure providers, including in the financial sector. Avoiding it would be malpractice. The highest-risk scenarios involve fear: Speaking in Chicago earlier this month, JPMorgan CEO Jamie Dimon warned about the potential for cyberattacks or the possibility AI agents could take steps of which users do not approve. "You're assuming they're going to act properly on your behalf and they may not," Dimon said. The only answer is vigilance, he said, warning that stopping AI wouldn't be possible. "You can't stop it. You just have to, like, manage the hell out of it." One economist last month floated the possibility of a bank run driven by agents moving the household cash of their users into higher-yield accounts. Between the lines: Banks want customers to know they have not seen any rogue agent activity or evidence of a hack affecting customer funds or accounts. Banks strongly advise users not to provide their passwords to agents, especially since services exist or are being developed that can allow customers read-only access. The startup Plaid is one such platform that can pull balances and transaction history, among other functions. "Under no circumstance should customers share passwords with any person or thing. Period," a JPMorgan spokesperson told Axios. "There exist secure open banking platforms that don't involve handing over the keys to your account. Customers are the first line of defense in protecting their accounts." JPMorgan has taken steps to block agent access , along with other banks, although it is exploring secure ways to allow customers to connect with the services they choose. The intrigue: AI companies are anticipating a political backlash. Banks are preparing for potential operational disruptions. The extent of federal planning for a crisis spanning both remains unclear. The bottom line: The pace of AI advances has Wall Street and Silicon Valley preparing for worst-case scenarios while Washington is working to mitigate cyber risks and counting on voluntary safety pledges.

A pair of critical PHP security flaws discovered by researchers with the help of AI forced an emergency patch and set off scattered attacks across the web. PHP is a programming language used to build up to 70 percent of the websites online today. The post Tech Explainer: What You Need to Know About the PHP Flaw Threatening the Internet appeared first on Breitbart .

Article URL: https://github.com/NVIDIA/OpenShell Comments URL: https://news.ycombinator.com/item?id=50198675 Points: 310 # Comments: 161

Major U.S. banks have discovered unauthorized third-party AI agents operating inside customer accounts, prompting an industry-wide push to contain the risk. The post ‘Grave Concerns’: Banks Scramble to Block Rogue AI Agents from Customer Accounts appeared first on Breitbart .

AI was used to uncover a security weakness that affects most of the world's websites, researchers said. Here's what internet users should know.

Cyber stocks jumped Wednesday amid a rush of warnings from security agencies about threats to a widely used programming language.

Governments and corporations worked throughout the night to update software.