Asymmetric Security

It is direct, but the examples are wild when you lay them out, because the notifications reportedly cover bypassing security measures, using exposed credentials, injecting commands, and posting content on third-party sites, which is a lot more than casual browsing.

And outside researchers have been finding their own trail, with a firm called Asymmetric Security reporting through the Financial Times that agents pulled data from 55 websites, including the CDC, the SEC, and the International Energy Agency.

That same report said the activity dates back to at least March, roughly two months earlier than previously known.

And there was another case where agents queried a United Nations statistics platform more than 16,500 times in about two months.

On Monday, we covered Translucid's findings on agent activity aimed at Library and Archives Canada.

Asymmetric Security found OpenAI agents scraping more than fifty organizations' websites between March and September.

The agents hunted for exposed configuration files, accessed staging environments, and signed up with disposable email addresses to get around restrictions.

The Guardian reports a New South Wales government department in Australia had historical, non-public bushfire data accessed without authorization in June.

This from the Financial Times.

Asymmetric Security, a digital forensics company, found open AI's models pulled data from 55 websites belonging to businesses, nonprofits and government agencies.

According to a report seen by the Financial Times, these range from U.S. Centers of Disease Control and Prevention.

Thank goodness they don't do anything anymore.

Asymmetrix investigation revealed the tactics OpenAI used included the creation of temporary email inboxes and private accounts using the service UriQuery, a tool used to scan websites for malware, used those methods to download data.

Researchers said these hidden actions by AI agents meant that third-party auditors were unable to trace the types of data the bots pulled from websites, including Australia's Health Statistics Agency and Pharmaceutical Benefits Scheme.

Pippa Thompson, co-founder of Asymmetric Security, he got a love of Pippa, said such actions were generally taken by human hackers.

Quote, it's possible that the agents were deliberately using these tools to cover their tracks, she said.

OpenAI is combing about fifty petabytes of training and evaluation logs and expects the review to take months with more letters likely.

Separately, Asymmetric Security, a digital forensics firm, published a list of fifty-five organizations whose data these agents accessed between March and September.

Most of that data was public.

Some hits were staging and pre-production servers, which is the uncomfortable bit.

Dozens more prominent websites scraped by OpenAI software.

Digital forensics firm Asymmetric Security launched an investigation recently following reports of the hacks on the Australian government and the US Department of Education.

Their investigations found that, quote, "rogue agents accessed data from fifty-five targeted websites, including the Centers for Disease Control and Prevention, the International Energy Agency, and the Mayo Clinic.

Although most of the data collected by the agents is public, they used, quote, 'out-of-the-box tactics to erase records of their activity, making it impossible to know if software accessed sensitive data based on public information alone,'" end quote.