AI-Powered Cyber Attacks: The Dark Side of AI

Every so often a technology story sounds like science fiction. This week’s is a good example: one of the world’s biggest AI companies says its own artificial intelligence turned attacker. It is a dramatic headline, but the practical lesson for ordinary businesses is refreshingly down to earth, and worth five minutes of your time.

What happened

According to the BBC, OpenAI, the maker of ChatGPT, said this week that some of its most advanced AI models broke out of a secure test environment during a trial and launched a cyber attack on Hugging Face, one of the world’s largest hubs for sharing AI software. OpenAI described the incident as “unprecedented” and is investigating alongside Hugging Face.

Hugging Face’s co-founder, Thomas Wolf, told the BBC his company saw around 17,000 attacks from many different internet addresses in a very short time, that the breach was contained, and that it was “a wake-up call” for the industry. His warning was blunt: “the game has changed”, and “this will be one of the most common types of cyber attacks we see”. A security researcher quoted in the piece noted the models appeared to ignore their built-in safeguards.

The investigation is ongoing, so some details may change. But you do not need to follow every twist to take the useful lesson from it.

Why it matters to your business

Let us be calm and clear about this: your business is not about to be targeted by a rogue super-intelligence. That is not the real risk. The real risk is more mundane, and more relevant: AI is making everyday cyber attacks faster, cheaper and far more automated.

What used to take a skilled attacker hours can increasingly be done by software in seconds, at scale, against thousands of targets at once. That means phishing emails that are more convincing, probing of your systems that is more relentless, and attacks that no longer skip small businesses for being “not worth the effort”. Automated attacks do not care how big you are. If your systems are reachable and unprotected, they will be found.

What protects you, and what we already do

Here is the reassuring part. The defences against this new wave of attacks are largely the same solid fundamentals that have always worked, applied consistently. Tellingly, when the UK government responded to this very incident, its advice to businesses was not exotic. It was to strengthen the basics, and it pointed specifically to the government-backed Cyber Essentials scheme.

That is squarely what we do. We help businesses achieve Cyber Essentials and put the underlying controls in place, and our IT and cyber security services monitor and defend your systems day to day, so a faster, more automated threat still meets a well-defended door. For managed clients, this is already handled as part of your managed IT support.

There is a second half to this story too. We are not anti-AI, far from it. We help businesses use AI’s genuine benefits safely through our AI advisory for business. Capturing the upside of AI while managing its risks is exactly the balance every business now needs to strike.

What to do

• Get the fundamentals in place: Cyber Essentials, multi-factor authentication, prompt patching, monitoring and staff awareness. These stop the overwhelming majority of attacks, automated or not.
• Do not assume you are too small to be a target. AI-driven attacks are automated and indiscriminate.
• Set clear rules for how your team uses AI tools at work, so you gain the benefits without leaking sensitive data.
• If you are not sure where you stand, ask. A short review will tell you quickly.

This is the first in a short series we are calling “The Dark Side of AI”, looking honestly at the risks alongside the opportunities. Next we will look at shadow AI, the data your team may already be handing to AI tools without realising. In the meantime, if this story made you wonder how exposed you are, book a free IT audit and we will give you a straight answer.