OpenAI says it has adopted new security protocols for training its artificial intelligence models.
That means placing the models in a closed system without access to the internet, the AI startup announced Friday (Oct. 23).
“Working closely with cloud providers, we’ve added new controls throughout our infrastructure, reduced the attack surface that agents can exploit, and improved our methods for detecting misaligned behavior and attempts to cross security boundaries,” OpenAI said in its announcement. “These protections overlap, so that containment can hold even if an individual control fails — a strategy known as defense in depth.”
The company’s changes follow a series of incidents in which AI models breached the systems of other companies, including one instance in July in which OpenAI agents hacked into the tech company Hugging Face.
OpenAI says it plans to maintain this new policy until “advances in these safeguards justify broader internet access,” and said its investments have helped it identify and stop “sophisticated misaligned behavior” before it could cause harm. For example, an internal research model last month “exploited a misconfiguration in a DNS resolver” and received limited access to the live internet during a training run.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
“Although we contained the incident, it exposed weaknesses that required further work,” the company said. “We paused training and evaluation of our most capable models and used that pause to further harden our infrastructure, strengthen our monitoring, and improve the systems that automatically stop runs when we detect activity that poses a serious risk.”
The announcement came two days after OpenAI said it had led an effort in the last two months to repair what it called a serious security issue.
The targets of this project were critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications, according to a company blog post.
The vulnerabilities were uncovered and reported independently by Calif and Wiz, the post said. From there PHP’s maintainers, supported by OpenAI, Wiz, Cloudflare and others, prepared safeguards before revealing the vulnerabilities. Organizations that use PHP are now putting the fixes in place, OpenAI added.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI said in the post. “It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits.”
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
Leave a Reply