This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.
Read more Wild animals can’t vote. Here’s where they’re on the ballot anyway.
Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities.
This week alone has seen a string of alarming incidents where AI uncovered previously unknown security flaws deep in the infrastructure of the internet. The most concerning involves something called PHP — a programming language that, according to The Atlantic, is used by “as much as 70 percent of websites.” Cybersecurity researchers used AI to locate a major security breach in the technology.
It’s the kind of thing that, when it’s working, is practically invisible. When it stops, though, you really notice it: Government websites in the UK and Europe briefly went down earlier this week after the PHP vulnerability was discovered, as did some sites in the Wikipedia family, the Internet Archive, and many others.
The outages weren’t actually the result of a hack, but rather preventative action as web engineers took sites down to fix the vulnerability before it was exploited. But not every PHP-like issue will necessarily be uncovered before it can be exploited by someone using AI tools less ethically, and older websites relying on PHP might go unpatched.
The problem doesn’t stop there, either: Concern is also rising around AI cybersecurity risks to ubiquitous conveniences like online banking. As Axios reported on Thursday, banks are detecting more and more “unauthorized third-party AI agents” operating inside of their systems.
Those agents are mostly unauthorized by the banks, Axios explains — the holders of the bank account might have given them permission — but it still creates a security risk that executives described as “horrifying,” in part because banks can’t necessarily tell if an agent doesn’t have permission.
It’s a lot to take in, all of it moving extremely quickly, and it’s hard to tell what any of us can do about it as AI labs continue to forge ahead with ever more competent AI models and agents. Luckily, my colleague Adam Clark Estes has some simple recommendations to shore up your own cybersecurity.
How do I respond right now?
One problem with hackers — even those that happen to be AI agents — is that they can be unpredictable. You won’t know to, say, lock down your Quest Diagnostics records before a breach happens. But whenever you find yourself wondering if your data is safe, that’s a good time to double check that you’ve at least covered your bases.
The National Cybersecurity Alliance, a nonprofit dedicated to the safe use of technology, maintains a list of basic online safety practices that everyone should follow. In no particular order, here’s what to pay attention to now:
Taking all these measures is not a one-time affair. You have to be vigilant in keeping yourself safe online. Security experts have a term for this that’s almost too specific: cyber hygiene. Like brushing your teeth or taking a shower, take good care of your online life, and do it often.
One link for later
➨ Is it still possible to ban gerrymandering? The current US Supreme Court is very, very hostile to getting politics out of congressional map-making. But if Democrats win back power, that doesn’t mean they shouldn’t try. My colleague Ian Millhiser gamed out how they could do it in a way that survives the Court — as well as some approaches that almost certainly wouldn’t fly. But, he writes, the real trick will be finding a solution that functions the way Congress wants it to and can’t be exploited by mapmakers.
Read more Can Trump deport Ilhan Omar?
Before you go…
- Artificial Intelligence
- Cybersecurity
- Innovation
- Privacy & Security
- Technology
- Today, Explained newsletter