HabitableZone

Geek Speak » Not a good day to be responsible for IT security

What this post has said

Written by Arrell on , and edited 1 time since. Newest first.

Not a good day to be responsible for IT security

A lot of websites were shut down until they can be patched...

The Habitablezone.net site is based on a different framework, and so it isn't compromised by this latest Zero-day vulnerability...

Unfortunately the vulnerability was publicized before the fixes could be released, so it became a high-speed war - hackers trying to exploit the vulnerability before the IT people could patch it...

Apparently the vulnerability existed for years and no one realized it ... until an AI caught it... and some idiots announced it publicly before a fix was in hand...

We can expect a LOT more incidents like this- apparently they simply asked an AI 'Can you find security vulnerabilities in this?' and 30 minutes later the AI revealed the flaw to them...

The barrier to entry for sophisticated cyber-attacks is disappearing... think about it- I know nothing about building websites, or coding applications for the web, but 'I' built this site and the Orrery with complete ease...

I probably could have built a passable discussion board on my own if I had lots of free time and wanted to spend it learning how to code a website... it would not be anywhere near as functional as this site is- but with enough time I could have made something... but the Orrery? No way I could have done that unless I spent MANY months devoting all my time to learning coding and trying to get the Orrery to work... it just wouldn't have happened

Even with the 2025 AIs assistance I could NOT have done this even a year ago... but the past month or so I have done this easily- only exceeding my monthly subscription fee of $20 a few times...

I have been using these new capabilities for 'good'... but it's become more and more clear just what potential for massive damage there is with these powerful tools available to anyone... a malicious actor could get instruction to do terrible damage from these online models- they would have to be careful about triggering the AI's guardrails, but if you are clever you can often get the AI to give you the information you want via indirect means...

I have already posted here about how the local AI models that have had their guardrails removed are happy to explain in as much detail as they can how to make WMD... or hack a website...

These local AIs can be run by anyone with a computer system powerful enough... I can run some of the largest since I built my system with 192GB RAM before RAM prices increased almost 10x...

And these Local AI will continue to increase their capabilities at a super-exponential rate. Moore's law about doubling the number of transistors on a chip every 18 months is an example of an exponential rate... but with AI the time to double in capabilities is constantly growing shorter... and the rate at which this time constant is becoming shorter is ALSO accelerating... If we are still here in 18 months, the AI available then will be unimaginably more advanced... as will the capabilities available to malicious actors.

Not a good day to be responsible for IT security
(no text)