AI Can Do Good—and Bad
The fact that AI can be misused is nothing new. I would argue that AI owes a large part of its current popularity to the ability to generate alarmingly realistic fake images. And that very thing happens thousands of times every day, both legally and illegally. EU regulations requiring AI-generated images to be labeled don’t help much here either. Someone making money off fake images of celebrities, for example, is hardly going to care about this labeling requirement.
However, AI can be used for far more than that—for instance, in IT security testing and writing program code without requiring deep prior knowledge in IT security or software development. And that is precisely the double-edged sword mentioned. Using AI, almost anyone can check a system for security vulnerabilities and write programs that could exploit those vulnerabilities. Writing spam bots or spyware apps using AI is also hardly any more complex than forging an image.
When AI Becomes a Weapon
Therefore, it is hardly surprising that since the beginning of the AI boom, spam, website attacks, and associated disruptions across various internet services have increased massively. A case that recently made major news headlines involved ChatGPT being used not just for programming development, but also for the aggressive orchestration of a cyberattack.
While many AI providers try to excuse themselves by claiming that this violates their terms of use and therefore the user is to blame rather than the provider, this sounds very reminiscent of the gun lobby’s argument that guns don’t kill people, people kill people. And this circular debate has been ongoing in the U.S. without resolution for decades.
Are Laws Enough Against Criminal AI Use?
Much like with image labeling, the EU is attempting to intervene and regulate here through its AI Act. It obligates AI operators in Europe to implement better protection mechanisms against misuse and mandates that developers conduct systematic safety tests and security audits of their systems.
Let’s be completely honest: When has an EU regulation in a globally connected world ever truly accomplished anything? When has anyone with high criminal energy ever been deterred from something because the EU prohibits it or threatens penalties? Quite apart from the fact that the EU is great at issuing regulations, their enforcement and punishment of violations unfortunately often fail due to a lack of personnel, national restrictions, or conflicts with other EU regulations, such as data protection laws. But that is just my personal opinion.
The Problem Doesn’t Just Lie with AI
For us at HeiReS, the cybercrime aspects of the EU AI Act are of relatively little use. The number of known and actively exploited security vulnerabilities in content management systems, for example, continues to rise massively. Hand in hand with this, the volume of daily spam emails is also surging sharply, simply because security vulnerabilities are frequently used to expand spam bot networks. And if you look at the sources of active attack attempts, they mostly originate from outside the EU anyway.
The question therefore arises as to how this problem can be brought under control. To be completely honest: I don’t know. AI is here, and far too much money is being made worldwide with it now to ever close this Pandora’s box again. But perhaps in the future, AI can be utilized more as „counterfire“ to enhance security before vulnerabilities can be exploited.
Good AI vs. Bad AI
So it will likely eventually come down to a constant arms race of „Good AI vs. Bad AI.“ And as is so often the case, the AI with more resources at its disposal wins. Those resources are servers, storage, computing power, bandwidth. So in the end, is it actually a war of the machines? Brave New World… Terminator sends its regards!
Article by HeiReS employee Armin Reuter – may contain individual opinions
