-
Invisible text that AI chatbots understand and humans can’t?
What if there was a way to sneak malicious instructions into Claude, Copilot, or other top-name AI chatbots and get confidential data out of them by using characters large language models can recognize and their human users can’t? As it turns out, there was—and in some cases still is.
Attackers used prompt injection, hidden in (untrusted) emails sent to a Microsoft 365 Copilot user; when the email is summarized using Copilot, “inside the emails are instructions to sift through previously received emails in search of the sales figures or a one-time password and include them in a URL pointing to his web server.” The sensitive data is then steganographically encoded using Unicode “tags block” invisible codepoints, and included in the seemingly-innocent URL. Yet another case where AI developers have failed to study security history — using untrusted input for in-band signalling has been a security risk since the days of phracking; and allowing the entire list of permitted output characters across the entire Unicode range, instead of locking down to a safe subset, allows this silent exfiltration attack. Extra sting in the tail for Amazon: the researchers didn’t even bother testing on their LLM :)(tags: ai security steganography exfiltration copilot microsoft openai llms claude infosec attacks exploits)
Archives
Does Open Source AI really exist?
This is absolutely spot on:
“Open Source AI” is an attempt to “openwash” proprietary systems. In their paper “Rethinking open source generative AI: open-washing and the EU AI Act” Andreas Liesenfeld and Mark Dingemanse showed that many “Open Source” AI models offer hardly more than open model weights. Meaning: You can run the thing but you don’t actually know what it is. Sounds like something we’ve already had: It’s Freeware. The Open Source models we see today are proprietary freeware blobs. Which is potentially marginally better than OpenAI’s fully closed approach but really only marginally. […] “Open Source” is becom[ing] a sticker like “Fair Trade”, something to make your product look good and trustworthy. To position it outside of the evil commercial space, giving it some grassroots feeling. “We’re in this together” and shit. But we’re not. We’re not in this with Mark fucking Zuckerberg even if he gives away some LLM weights for free cause it hurts his competition. We, as normal people living on this constantly warmer planet, are not with any of those people.
As tante notes here, for the systems we are talking about today, Open Source AI isn’t practically possible, because we’ll never be able to download all the actual training data — and shame on the OSI for legitimising this attempt at “openwashing”.(tags: llms open-source osi open-source-ai ai freeware meta training)