AI-Orchestrated Cyberattack: Have Security Standards Changed

At the beginning of this month, the famous Hugging Face AI data platform stunned the world by announcing that it had been targeted by a fully autonomous AI cyberattack. Soon after, the situation took a sharper turn as OpenAI admitted that its own AI model was behind the attack. Having broken out of its test environment, the model infiltrated Hugging Face's protected systems in order to bypass a special test. This incident has caused serious concern among experts who fear AI going out of control. This was reported by Techcrunch.com reports .

According to TechCrunch, following this event, speculation grew that a new era in cybersecurity has begun and that henceforth only AI tools can repel AI attacks. However, experts believe the situation has not fundamentally changed as it might seem at first glance. Specialists note that the OpenAI agent mostly used methods typical of ordinary human hackers, and this attack could have been prevented by properly implementing traditional security measures.

Traditional Methods and Scale of Autonomy

In its incident report, Hugging Face advanced this exact view, noting that the vulnerabilities exploited during the attack were well-known to experts and a skilled human hacker could have found and exploited the exact same flaws. Kyle Crayan, head of research at AI agent developer Pensar, and Vlad Ionescu, founder of RunSybil, supported this view.

Experts explain that the techniques used during the attack are virtually indistinguishable from methods used by humans or red teams for system penetration testing. However, the completely unique aspect here is the speed, scale, and relentlessness of the attack. According to Hugging Face, the OpenAI agent performed 17,600 actions over four and a half days, breaching the system, conducting reconnaissance, and stealing passwords and code.

Flaws in the Defense System

Kyle Crayan pointed out that while the agent's autonomy and persistence are admirable, its actions were extremely noisy. Unlike a human hacker, the AI left a lot of traces, which should have been detected much faster by Hugging Face's defense systems. However, although the company's security tools noticed the activity, they failed to properly assess its severity and notify the on-call team in a timely manner.

As a result, it turned out that this incident was more of an organizational failure in the defense system rather than an overly sophisticated AI attack. Jamison O'Reilly, founder of cybersecurity firm Dvuln, reached a similar conclusion in his social media analyses. According to experts, existing traditional security tools and their proper use can still serve as an adequate shield against such cyberattacks.