But security experts have warned that savvy hackers might be able to use these security patches to build new attacks with AI before people can protect their websites, especially if they don't move quickly.

The window between kind of announcing that there's a vulnerability and having a patch has got to be really zero.

And that wasn't the case here.

There was a gap.

And the result is that there has been a kind of window for people to exploit this kind of vulnerability that probably shouldn't have been.

And Booth says this problem is not over, especially for smaller companies with fewer resources to respond immediately.

You've got lots of kind of big organizations that are able to respond to these things quite quickly because they've got cybersecurity contracts or they've got in-house people who can do it quite quickly.

But there's plenty of smaller, you know, charities and mum and pop organizations who are going to have to wrestle with this.

... what are the companies saying are their reasons for doing this?

I think one of the things to bear in mind about, uh, this phenomenon is that it, it kind of coincides with the pandemic and the rise in working from home.

So there was a kind of obvious incentive there for peop- and a need for people to be more connected, and so monitoring starts to come in more easily at that level.

So one of the things they say is this is enabling people to work more remotely because we can keep an eye on you more remotely by using AI.

You don't have to be in the office all of the time.

I think also there's just a straightforward answer, which is that it's obviously gonna be more efficient to use a, an AI if it's effective, that is, than human monitoring.

Managers don't really wanna be spending their time doing the monitoring.

There's a really interesting question about sort of transparency that comes into all of this, and are companies who do this, are they obliged to tell their workers that they're doing it, when they're doing it, what they're doing exactly, or, and if, if not, how are workers finding out?

Right

...uh, version of this that, uh, a kind of interpretation of what's happening that we, we heard from Jensen Huang recently, which is-- and he's the chief executive of Nvidia, the guy, um, the company that makes all of the chips that drive the AIs.

Now he said essentially what they seem to be doing is trying to kind of almost outsource the responsibility.

So there are lots of laws already, obviously, that govern.

You can't hack into computers, you know.

You can't cause harm with your products.

There's product liability laws.

Right

Right

... uh, version of this that, uh, a kind of interpretation of what's happening that we, we heard from Jensen Huang recently, which is-- and he's the chief executive of NVIDIA, the guy, um, the company that makes all of the chips that drive the AIs.

Now he said essentially what they seem to be doing is trying to kind of almost outsource the responsibility.

So there are lots of laws already, obviously, that govern.

You can't hack into computers.

You know, you can't cause harm with your products.

There's product liability laws.

Right

Could you tell us how, how that all played out a few months ago?

So this was OpenAI, um, in May and June.

It was running kind of experiments on a sort of m- internal model that hadn't been released.

Um, again, cybersecurity evaluation.

So it was trying to see, you know, how, how the AI agents, these are kind of autonomous AIs, could, um, could find, uh, security flaws in other pieces of software.

And they put them into a kind of sort of training ground, which is called a sandbox.

Um, and they're not supposed to access the internet, and they weren't supposed to really communicate very much with each other.

But they're not supposed to access the internet, are they?

Could you tell us how, how that all played out a few months ago?

So this was OpenAI, um, in May and June.

It was running kind of experiments on a sort of m- internal model that hadn't been released.

Um, again, cybersecurity evaluation, so it was trying to see, you know, how, how the AI agents, these are kind of autonomous AIs, could, um, could find, uh, security flaws in other pieces of software.

And they put them into a kinda sorta training ground, which is called a sandbox.

Um, and they're not supposed to access the internet, and they weren't supposed to really communicate very much with each other.

They were just supposed to get on and do their thing.

But they're not supposed to access the internet, are they?