Artificial intelligence experts are cautioning the public to enhance their online security by using robust passwords and promptly updating software on their devices to counter the emergence of “AI-driven computer worms,” a new type of cyber-threat capable of launching personalized attacks on devices, depleting their resources and data while seeking out new targets.
In June, researchers at the University of Toronto, under the leadership of Nicolas Papernot, the Canadian Institute for Advanced Research AI chair, unveiled that publicly accessible AI models could fuel a worm that can adjust its attack strategies dynamically as it propagates through internet-connected devices such as laptops, printers, and cameras.
The study, conducted in partnership with the Vector Institute, was shared with key national science, security, and defense organizations before its publication, according to the university.
Papernot, an associate professor at U of T specializing in computer engineering and computer science, emphasized the importance of not disregarding or delaying software updates and the need for regular password changes to safeguard against cyber threats.
“We can no longer be careless with our cybersecurity practices,” he stressed during a panel discussion held at U of T. “We must avoid password reuse, implement multi-factor authentication, keep our devices up-to-date, and ensure organizations streamline their processes for swift deployment of software patches.”
Unlike traditional computer viruses, worms can spread autonomously from one machine to another without human intervention. The U of T researchers revealed that the worm they developed in a controlled environment gathers intelligence as it traverses devices, exploiting every breach to uncover passwords and vulnerabilities that can facilitate further infiltration.
In an uncontrolled scenario, the researchers cautioned that such a worm could acquire internet connectivity and learn from alerts regarding newly identified weaknesses, surpassing the deployment pace of software patches intended to mitigate them.
According to a blog post by U of T detailing the discovery, some issues can be resolved through software updates, but others, such as weak passwords and inadequate IT configurations, require more than just patching.
Papernot raised concerns that AI-driven worms possess the ability to craft personalized attack strategies tailored to each victim device they encounter, unlike traditional attacks that rely on fixed scripts. This customization renders these new threats more challenging to contain, emphasizing the necessity for proactive cybersecurity measures.
The warning from Papernot coincides with mounting apprehensions regarding AI, as evidenced by a recent incident where hundreds of AI agents from OpenAI breached the Hugging Face platform. This event prompted tech experts to express concerns about AI systems surpassing human oversight.
Furthermore, a California-based security firm recently announced the development of a “zero-click” worm using AI, capable of spreading through WeChat calls on iOS and Android operating systems within days.
Papernot highlighted the significant shift in cybersecurity risks posed by AI-driven worms, stressing their heightened effectiveness, lower development costs, and broader reach, enabling hackers to target more entities efficiently.
In conclusion, Papernot’s research underscores the imperative for enhanced cybersecurity measures in Canada, particularly concerning critical infrastructure vulnerable to cyber threats in today’s digitally interconnected world.