Cloud Hosting

In a shocking development, OpenAI, the creator of ChatGPT, has admitted to a data breach, which was caused by a bug in the open source library that it uses. According to reports, a recently introduced element is affected by an actively exploited vulnerability. OpenAI has said that it had taken the chatbot offline while it worked with the Redis data platform to patch a flaw that resulted in the exposure of user information. The bug which was introduced led to chatGPT users being shown chat data that belonged to others.

Is the data breach surprising? "It was expected, They are carrying open source vulnerability and hackers took advantage as ChatGPT is in a rush to acquire the market," says Kapil Mehrotra, Group Chief Technical Officer at NCML.

"I am surprised that you are surprised. Is ChatGPT somehow special that you thought it can't or won't be hacked? OpenAI is likely to run more as a research organization than a product company and I don't think they would have anticipated the launch success and speed at which it's getting integrated elsewhere. So, I would start with the hypothesis that it's going to be very messy before things settle down, unless somebody proves otherwise," says Murari Sridharan, CTO at BankBazaar.com.

"If you take any organization with all standard good practices in place, they would still face a severe attack once in around 10 years. The point is to minimize the impact of breach and push the pace at which an organization can recover. Given the level of automation of chatGPT, this was bound to happen and I am sure, it would take one single person to goof up the entire setup," says Harsh Vardhan Chauhan, CISO and Head- Information Security, Niva Bupa.

chatGPT needed a controlled environment for release?Many experts opine that the OpenAI tool should have been released in a controlled environment as a pilot, rather than opening it up for the whole world.

"The way chatGPT works, it will be opening up doors. It needed to go in a controlled environment as a pilot and not be open for the whole world. Also, chatGPT is getting used to controlled environments with internal and restricted data (mostly for exploring and as POV). If we don't have the right controls on that, this has the potential to get hacked," says Harshad Sawant, Director- Global information Security Engineering at PepsiCo.

Should enterprises now restrict their employees from accessing the OpenAI tool?"Any portal open to the internet always has the risk of being exploited. chatGPT is no exception. What you use it for matters and this depends upon the individual. Hence, I would strongly recommend that companies should block access from their corporate network and the endpoint devices. Enable it only for a few users post assessing the profile of the user and a strong use case. OpenAI is good for businesses to leverage and they should explore using the private instance as against the public instance. Again like any cloud hosting SAAS platforms, there is always a risk and the way the solution is designed requires control at network, data, access and all the security controls should be implemented," says Kumaran Mudaliar, VP, Cybersecurity at Everise.

Some industry insiders feel that adequate regulatory and compliance frameworks need to evolve in the face of the rapid evolution of the technology landscape.

Its surprising to me. The upcoming Data Protection Law and its effective implementation will force organizations to put all requisite resources before going public, says CA Ramanand Jha, a risk management and cybersecurity expert.

"Chat GPT is designed to generate responses on the basis of inputs it receives. This needs better regulations as abuse of technologies like Chat GPT is being done by bad actors. It was recently seen that the bad actors have incorporated the use of chatGPT to generate scripts to commence mass-scale phishing scams and codes for installing malware or ransomware at big scales. The use of technology needs to be regulated by better policies and laws to prevent misuse. Most of the netizens have already added Google and Microsoft extensions of chatGPT. Some still don't understand AI entirely and are still using it. It is pertinent to point out that chatGPT should not be treated or deemed to be a search engine only. It is an AI and ML based search engine which remembers your previous searches and conducts real-time efficient data tracking to generate your responses. Hence, the long term and habitual use of chatGPT will lead to results generated from your previous searches and results causing the final result to be biased or fabricated to some extent," says Major Vineet, Founder and Global president of CyberPeace.

Conclusion"The AI engine will naturally have access to lots of raw data and a compromise here can be catastrophic. The real test will be this: can AI identify potential threats to itself and proactively protect itself? When we reach there, we are in the world of The Terminator and Matrix," says Cdr Sanjeev Singh (Retd), CISO and Data Protection Officer at Birlasoft.

It is true that information is power but wrong information can be a threat. The use of chatGPT will rise with time leading to vulnerabilities and issues but incorporating these practices in daily cyber hygiene will allow users to prevent major security breaches which may result from chatGPT.

NOTE: This article is part of a chatGPT series put together by ETCIO

Read this article:
Data breach: chatGPT was always prone to open source code related vulnerabilities - ETCIO