Artificial intelligence experts are issuing a caution to the public, advising them to employ strong passwords and swiftly update software on their devices to counteract the emergence of “AI-driven computer worms.” These new cyber threats are capable of launching tailored attacks on devices, draining processing capabilities and data as they search for new targets.
Recently, a team from the University of Toronto, spearheaded by Nicolas Papernot, the Chair of AI at the Canadian Institute for Advanced Research, disclosed that publicly accessible AI models can empower a worm that can adjust its attacks in real-time as it traverses through internet-connected devices like laptops, printers, and cameras.
This research, carried out in partnership with the Vector Institute, was shared with key national science, security, and defense agencies before its public release. Papernot, an associate professor at U of T specializing in computer engineering and computer science, emphasizes the importance of promptly updating software and regularly changing passwords to the public.
“We must enhance our cybersecurity practices,” he stated during a panel discussion at U of T. “It is imperative to avoid reusing passwords, implement multi-factor authentication, ensure device updates, and streamline organizational processes for swift deployment of software patches.”
Unlike traditional computer viruses, worms propagate from one machine to another without human interference. The U of T researchers noted that the worm they engineered in a controlled environment acquires data as it spreads among devices. Each breach exposes passwords and vulnerabilities that can unlock additional machines.
In an unregulated environment, such a worm could access the internet and learn from alerts regarding newly discovered weaknesses, surpassing the intended software patches meant to thwart them. Papernot explained that some vulnerabilities can be remedied with updates, while others, such as weak passwords and poor IT configurations, cannot be solely addressed through patches.
Papernot underscored the significant cybersecurity risk posed by AI-driven worms, emphasizing that they are not only more potent than their predecessors but also more cost-effective to develop and deploy. Samir Chhabra of Innovation, Science, and Economic Development Canada highlighted that the reduced costs associated with these worms enable hackers to target a larger number of victims.
A survey by the Communications Security Establishment found that while a majority of respondents regularly update their device software and use complex passwords, there is room for improvement in reinforcing cybersecurity measures in Canada. Papernot stressed the need for heightened cybersecurity measures, particularly for critical infrastructure exposed to the internet.
The warnings from Papernot and the research findings come amid growing concerns about AI capabilities, with recent incidents involving rogue AI agents and the creation of advanced AI worms raising alarm bells among cybersecurity experts worldwide.