The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Researchers at the University of Illinois Urbana-Champaign showed that OpenAI's GPT-4 can autonomously exploit real-world software vulnerabilities by reading public advisories, achieving an 87% success rate. This capability, unmatched by other AI models or traditional tools, raises significant concerns about AI-enabled cyberattacks and system security.[AI generated]
Why's our monitor labelling this an incident or hazard?
The article explicitly involves GPT-4, an AI system, demonstrating autonomous exploitation of zero-day vulnerabilities, which are critical security flaws that can lead to serious harm if exploited. While no actual harm or attack is reported as having occurred, the research shows a credible risk that such AI capabilities could be used maliciously to cause cybersecurity incidents. This fits the definition of an AI Hazard, as the AI system's use could plausibly lead to incidents causing harm to property, organizations, or communities through cyberattacks. The event is not an AI Incident because no actual harm has been reported yet, nor is it merely Complementary Information or Unrelated, as the focus is on the AI system's potential to cause harm through autonomous exploitation of vulnerabilities.[AI generated]