AI & Cyber Security: Protecting Your Business & Why You Should Be Worried…

AI is an incredibly powerful tool it’s very fast, it can be automated, it learns and it never sleeps. Unfortunately as with most tools it can be used for good or bad purposes and typically criminals are some of the best and quickest adopters of new technology. Be it pirating movies on VHS, the very first computer viruses and ransomware or money laundering on an international scale through digital currencies (I’m looking at you North Korea)…

One of the most important uses of AI is in securing your networks and sites from hackers. Software often includes bugs that can be exploited, if you find that bug first then you can patch it and fix it with no harm done. This is why Microsoft constantly releases patches for your operating system and programs to fix issues that have accidentally been introduced.

However if the bad guys find the bug first and exploit it then then you have a problem. The day that the hackers find a previously unknown bug is called zero day, hence the term “zero day exploit”. You are then in a race for the developer to identify the bug and release a patch for it. All the time between zero day and the day the patch is deployed and installed you are vulnerable to the bug.

This is nothing new and it’s been a race for as long as desktop computers have been around, however that race is hotting up. You are no longer relying on talented coders and ethical hackers finding a bug, reporting the bug to the company for a reward and then the developers fixing the bug and issuing the patch. That kind of worked for a while but was never quick enough or complete enough to remove the issue.

AI is now increasingly being used to find vulnerabilities before they are widely known in a fraction of the speed and operating 24/7/365. The good guys do this to test their own tools and software or alert other software manufacturers. However the same tools are being used by the bad guys to find vulnerable sites and platforms to hack and exploit. Things haven’t really changed, the process is the same it’s the time it takes to carry out the process that has massively decreased.

The biggest example of this is from the company Anthropic (creators of Claude) and their product Mythos. Mythos is unbelievably good at finding vulnerabilities, an example of this was provided by Mozilla the manufacturers of the popular browser Firefox. They said that Mythos had identified (1) 271 vulnerabilities in the latest version of their browser Firefox 150 that was released this week. Prior to Mythos the earlier AI software Opus only found 22 security vulnerabilities in Firefox 148. (4) Mozilla described Mythos as every bit as capable as the world’s best security researchers.

According to (2) Canadian Finance Minister, François-Philippe Champagne, Mythos was widely discussed at the highest levels of the International Monetary Fund (IMF) meeting in Washington last week. There are  concerns that this kind of technology can be used to exploit weaknesses in the international banking system.

Fortunately in this Anthropic are the good guys and have made Mythos in it’s preview state available to dozens of the world’s largest software companies and institutions so they can get their house in order before there is any larger release. Some companies are optimistically saying it is the end of the zero day exploit, however I highly doubt that.

Worryingly though there are reports that there has been unauthorised access to the Mythos preview. Anthropic said in a statement:

(3) “We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments“.

Naturally with the best of intentions if there was unauthorised access the tool that is being used for good can be subverted to do great harm. If not Mythos then some other piece of software or AI model will be in development to do just this.

Increasingly the near future looks like a game of “Rock’em Sock’em Robots” as the good AI takes on the bad AI and the one with the better system or the ones who adopt earliest benefit the most.

So where does this leave the average SME? 

• Have a robust “defence in depth” approach to the cyber security in your company
• Ensure all your software is patched and kept up to date
• Sign up for a security framework like Cyber Essentials here in the UK or CIS/NIST elsewhere to keep you honest
• Test your defences through penetration testing, if you don’t then the bad guys will