GoKawiilIn the mad dash to deploy agentic artificial intelligence (AI) technology, developers aren't taking enough time to understand how their programs work, and they're inadvertently generating a whole lot of very old-fashioned vulnerabilities.
The universe of AI agents in the advanced economies of today's world is immeasurably large; literally, nobody has any clue how many of these things are out there. Some recent data suggests that somewhere around a third of organizations have either already adopted or will adopt, agentic AI tech soon, but even those measurements rest on self-reporting and generalized data, or loose predictions.
Contrary to popular belief, however, the agents themselves are not black boxes. In an unusually long presentation at Infosecurity Europe next month, researchers at Acronis are going to attempt to correct this unhelpful narrative by demonstrating how these bots work at a fundamental level. And by picking apart how AI agents work, they argue, an even more interesting finding emerges: that the cybersecurity vulnerabilities in this tech are not the fault of the AI; they're mostly a byproduct of traditionally bad coding.
Related:Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos
"What people don't understand is that agentic systems still rely on a lot of old world technology and a lot of old world vulnerabilities," says Acronis senior security researcher Eliad Kimhy. As agentic AI tech spreads more and more, "What we are going to see being abused are plain old vulnerabilities in software. And if you don't understand that, you're going to write bad software, and you're going to rely on your large language model (LLM) to do the rest. That's a bad approach."
The Vulnerabilities in Agentic AI
Last fall, researchers discovered a critical vulnerability in Salesforce. If an attacker planted a malicious prompt in a certain kind of Salesforce form, an AI agent interpreting it on the back end might carry out its instructions. The issue was made worse by the fact that Salesforce was still whitelisting an expired, easily purchasable domain.
Early this year, a researcher discovered a dangerous exploit chain in ServiceNow. Thanks to an overly permissive chatbot — protected only by a factory default credential — that could be authenticated as any user simply by supplying their email address, the researcher found that he could access and create powerful AI agents in any company's ServiceNow instance.
What do these stories, and so many more like it, have in common?
Since agentic AI has introduced so much new risk to organizations, one might reasonably assume that agentic AI technology is itself risky. But considering the sorts of vulnerabilities — lack of input sanitization, hardcoded credentials, insufficient access controls — what's new and "intelligent" about any of that?
... continue reading