We’re Yet to Fully Grapple With the Threat of AI, Expert Says

This article is part of an interview with Betsy Cooper, Director of the Aspen Policy Academy. This interview was conducted for Tech.co’s AI newsletter, The AI Strat. For more interviews with AI experts on the latest trending topics, subscribe to the newsletter.

While the response to AI’s ever-evolving capabilities has been mostly excitement, the threat to cybersecurity in the form of increasing cyber incidents has been difficult to ignore.

Increasingly, experts believe businesses will need to alter internal policies, including incident response plans, to account for the fact that they won’t always be dealing with a human attacker.

I spoke to Betsy Cooper, Director of the Aspen Policy Academy, about how AI continues to change the cybersecurity landscape. Likewise, we discussed how businesses should be prepared to change their practices moving forward.

The AI Threat Hasn’t Been Fully Realized

Before becoming Director of the Aspen Policy Academy, which allows experts in cybersecurity and AI to share their knowledge, Betsy Cooper ran a cyber security program called the Center for Long-Term Cyber Security at UC Berkley. Cooper also worked for the Department of Homeland Security.

When I asked Cooper what excited her about AI, she spoke to its ability to make “it easier to do things that take up a lot of time.” From her perspective, this includes tasks like writing personalized notes to partners.

However, Cooper also has her fair share of concerns, and a lot of them she’s not alone with. She fears what our education system will look like with AI, and how jobs, particularly at the entry level, will change. And of course, she mentions the existential threat of AI.

“Obviously, there’s been a lot of buzz lately about several of the models escaping their confines and hacking others. We’ve talked about that. I wrote scenarios 10 years ago that focused on that idea, and now we’re here,” she told me.

Earlier this week, an Anthropic researcher resigned amid concerns about how the company was handling AI’s threat to humanity. In a series of social media posts, Jacob Coxon wrote: “The people building AI earnestly believe that it could kill us all by the end of the decade.”

While this incident occurred well after my interview with Cooper, it speaks to the concern many experts are feeling. In particular, Cooper voiced concerns for the future of the internet, suggesting we’ll need to ensure it remains valuable to humans in the face of these threats. “I don’t think we’ve fully grappled with that,” she said.

How Incident Response Plans Will Need to Change

Understandably, cyber incident response plans up until now have assumed a human attacker. And, most businesses today will know and have embedded best practice to protect themselves.

However, the introduction of AI agents, which are able to attack autonomously, has changed the game. As a result, Cooper believes internal policies including incident response plans, will need to change with it. In some cases, she says, the humans might be the non-malicious actors, and the agents are the malicious ones.

“That probably requires a different chapter in your incident response plan than the day-to-day. So that would be something that I would really encourage people to do, is start updating your incident response plan to try to figure out the source of the hack, and to figure out if it’s a non-malicious actor human, are you going to use the same playbook that you would as if it were a malicious actor human?” – Betsy Cooper, Director of the Aspen Policy Academy

That being said, Cooper doesn’t see AI as solely a cyber adversary. In many cases, it’s an ally, one that is able to help humans detect unusual activity more effectively.

“Most organizations are going to have to lean into AI to help them identify when something weird is going on, because the patterns may not be as obvious,” she said.

Assess Your Risk Profile and Ensure Basic Security Hygiene

Additionally, Cooper explains how organizations need to be aware of their risk profile when it comes to AI-driven attacks. Hugging Face, the company the rogue OpenAI agents breached, is at a higher risk because of the work it does, Cooper said. Whereas if you’re operating in the paint industry, for instance, your risk is probably lower.

Cooper also expressed the importance of maintaining proper cyber hygiene. AI agents will make the most of shortcuts, if the Hugging Face incident is anything to go by. So, minimizing those and ensuring you aren’t easy to hack is key.

“If you’re not on the easiest path,” Cooper explained, “then you still have hope right now. I can’t promise that’s going to stay that way.”

Ensuring you’re not on the easiest path means sticking to best cybersecurity practices. Cooper gives the example of not using passwords that have already been disclosed, and making sure data is stored in different places and compartmentalized so it can be recovered if you do suffer an attack.

“The same hygiene techniques that hopefully you’ve been already using to prevent the ordinary hacker who’s a human. Many of those techniques at least will make it less likely that you will be targeted,” she said.

However, she does sound a warning about the future of attacks. “Increasingly, this is going to happen more commonly, and it’s probably not possible to stop,” she added. For now, businesses should focus on protecting themselves under the assumption an attack will happen.