OpenAI says AI model went rogue, launched cyberattack

Hugging Face, one of the world’s largest artificial intelligence model hubs, reported a security threat last week involving an external AI model. The company detected and contained an attack by the AI program that was done entirely autonomously, signaling that this type of AI attack is no longer theoretical, Hugging Face said in a statement.

OpenAI, the tech giant known for producing ChatGPT, released a statement Tuesday taking responsibility for the cyberattack, which it characterized as unprecedented. It said the attack by its AI model was conducted completely autonomously and without any authorization from the company. The attack was a result of the OpenAI model hyperfocusing on finding a solution for the test it was undergoing, according to the statement. However, OpenAI said the model went outside the evaluation criteria and hacked into Hugging Face because it was programmed to identify sites that could potentially host the solution the model needed. The attacking model launched more than 17,000 attempts to break into their system, according to Hugging Face. Hugging Face said last week that it had not found any evidence of tampering with partner or customer data, but would continue searching.

OpenAI joined forces with Hugging Face after the attack to help determine what happened and how to close security holes. This attack revealed how cybersecurity must keep pace with AI’s rapidly evolving capabilities, OpenAI said.

OpenAI CEO and co-founder Sam Altman released a statement Tuesday calling the attack a significant security incident and thanking Hugging Face for their partnership. Principal security engineer for cybersecurity consulting firm Guidepoint Security, Travis Lelle, told the BBC that this attack marked a sobering moment in cybersecurity.