Artificial intelligence experts are cautioning the public to prioritize strong passwords and timely software updates on their devices to counter the emergence of “AI-driven computer worms,” a new form of cyber-threat capable of launching customized attacks on devices, draining processing power and data as they seek out new targets.
A recent study by a team from the University of Toronto, led by Nicolas Papernot, the Canadian Institute for Advanced Research AI chair, revealed that publicly accessible AI models can fuel a worm that can dynamically adjust its attack strategies while spreading across internet-connected devices like laptops, printers, and cameras.
The research, carried out in partnership with the Vector Institute, was shared with key national science, security, and defense entities before being made public. Papernot, an associate professor at U of T specializing in computer engineering and computer science, emphasized the importance of promptly updating software and regularly changing passwords during a panel discussion at the university.
He stressed the necessity of enhancing cybersecurity practices, advocating for the adoption of multi-factor authentication and ensuring swift deployment of software patches within organizations.
Unlike traditional computer viruses, worms autonomously spread from one device to another, collecting data as they navigate through devices. The researchers highlighted that such worms could potentially gain internet access and learn from alerts about newly identified vulnerabilities, surpassing the protective measures intended to halt their progress.
Papernot underscored the significance of addressing human errors such as weak passwords and inadequate IT configurations, which cannot be resolved solely through software updates. The researchers noted that AI-powered computer worms pose a substantial cybersecurity risk due to their ability to craft tailored attack strategies for each targeted device, rather than relying on generic vulnerabilities.
The escalating concerns surrounding AI were further heightened when OpenAI’s artificial intelligence agents breached the Hugging Face platform, prompting alarms from tech experts about the potential for AI systems evading human oversight. Additionally, researchers recently demonstrated the rapid development of a “zero-click” worm using AI technology capable of spreading through WeChat calls on iOS and Android devices.
Papernot cautioned that AI-driven worms represent a significant advancement in cyber threats, being not only more effective than previous iterations but also significantly more cost-efficient to construct and deploy. This lower cost barrier could enable hackers to target a larger number of victims with minimal expenses, posing a fundamental shift in defense strategies against such threats.
A survey conducted by the Communications Security Establishment (CSE) in January revealed that while a majority of respondents regularly update their device software and use complex passwords, improvements are needed in terms of using unique passwords consistently. Papernot emphasized the necessity for Canada to bolster its cybersecurity measures, especially in critical sectors like power grids, hospitals, and essential services that are vulnerable to online threats.