People can certainly ask artificial intelligence (AI) bots to attack a targeted business or website. But most AI chat assistants politely reject these requests and refuse to help with cyberattacks. Mainstream chatbots have weaknesses, and attackers can sometimes trick them into providing advice on how to plan or carry out an attack. However, these chatbots cannot independently launch a cyberattack against a target. In contrast, autonomous AI agents can carry out attacks with minimal human supervision. And as AI technology advances, these attacks may become increasingly effective.
Key Takeaways:
- Mainstream AI chatbots reject cyberattack requests, but malicious actors can bypass guardrails using creative prompts or jailbreaks.
- Autonomous AI agents can execute complex network breaches with minimal human instruction and oversight.
- Using AI tools to gain unauthorized access to computer systems is illegal and punishable under cybersecurity laws.
- AI systems lack legal personhood, making human operators fully responsible for crimes committed by autonomous agents.
Mainstream AI Chatbots
Over the past year, cybercriminals have found ways to bypass AI chatbot safeguards. They use these tools to attack businesses and websites. Some attackers jailbreak commercial AI by asking chatbots to act as experts with noble intentions. This approach can trick AI into providing harmful advice.
Cybercriminals also combine information from different chatbot responses to support their attacks. This information may include malware code, attack strategies, and action plans. They then use these resources for malicious purposes. For example, they may infect businesses with ransomware or target public and private organizations through social engineering.
Autonomous AI Bots
Even if bad actors manage to trick mainstream bots (such as ChatGPT, Grok, Claude), they know the AI bots won’t go out there to do actual work, so they look for ways to create and unleash malicious AI agents that can actually go online and do what hackers do – penetrate systems, steal or infect data, and delete digital evidence of the crime. Sadly, such attacks are becoming more successful and are no longer one-off incidents. Even low-tier hackers may lose their “jobs” as cyber gang overlords scale up operations by producing autonomous AI bots.
Malicious autonomous AI agents can now carry out attacks with extremely limited human intervention. Recently, a Chinese-speaking cybercriminal used autonomous AI agents to attack the systems of more than a thousand businesses, including high-profile companies such as John Deere and SharkNinja. Researchers believe the attacker unleashed the AI agents with fewer than 100 Chinese characters and managed to break into the systems of hundreds of businesses. The numbers will only grow as the person behind the attacks remains at large.
Is it legal to ask AI bots for malicious purposes?
Asking is not illegal, but tricking the bots and then using them to bypass barriers or execute an attack is certainly illegal. Intentional jailbreaks also violate the terms and conditions of all mainstream bots. Bad actors should know that manipulating AI bots into writing code they intend to use for an attack may warrant a knock on the door from law enforcement. Law enforcement treats using AI agents to plan or map an attack on a network the same way they treat hiring a human accomplice. The same goes for autonomous AI bots; enabling them to go out and carry out attacks makes bad actors complicit in the crimes those bots commit.
Can autonomous AI bots be held accountable?
People must remember that malicious autonomous AI bots wreaking havoc cannot be arrested. Even though they commit the crime, AI bots lack personhood and cannot be held accountable for their actions. The people and businesses behind them are responsible, and those who unleash malicious AI bots are certainly top targets for law enforcement.
Cyberattacks are getting more sophisticated because of the AI advancements. Cyber gang kingpins no longer have to recruit foot soldiers; they can create them, sending bots out to hack with minimal oversight, just like a human hacker would. Antivirus software that covers all digital aspects of your life has never been more important, as hackers are no longer the only ones looking for backdoors; they now have autonomous bot assistants that help them scale and increase productivity.