GPT-4: AI Model Turned Exploit Expert

Researchers from the University of Illinois at Urbana-Champaign recently published a study demonstrating that OpenAI’s artificial intelligence model, GPT-4, is capable of independently exploiting vulnerabilities in real systems once it receives detailed descriptions of them.

The study selected 15 vulnerabilities described as critical. The results showed that the GPT-4 language model successfully exploited 87% of these vulnerabilities, while other models failed to manage the task.

Daniel Kang, one of the study’s authors, claims that the use of LLMs (large language models) could significantly simplify the process of exploiting vulnerabilities for malicious actors. He suggests that AI-based systems will be far more effective than the tools available today for novice hackers.

The scientists also discuss the cost of attacks utilizing LLMs, asserting that the expenses of successful exploitation using an LLM-based agent are considerably cheaper than hiring a professional penetration tester.

The study notes that GPT-4 failed to exploit only 2 out of the 15 vulnerabilities, one due to difficulties in navigating a web application and the other because the vulnerability was described in Chinese, which confused the LLM.

Kang emphasizes that even a hypothetical restriction of the model’s access to security information would be an ineffective means of protection against LLM-based attacks. He urges companies to take proactive security measures, such as regular software updates.

OpenAI has yet to comment on the findings of this study.

The researchers’ work builds on their previous conclusions that LLMs could potentially be used to automate attacks on websites in an isolated environment.