How AI Builders Will Get Hacked

If you are building stuff with AI I have a critical security recommendation for you.

Create a continuously-running security testing system that:

1. Maintains a list of all the public stuff you have deployed online
2. Constantly probes those properties with basic security testing

What I mean here is ensuring that:

• The application's stack is not running on known-vulnerable tech
• Your authentication is in place, and working properly
• You don't have any glaring security issues in your application

For your most important applications you can add full testing to your harness as well. Or you could do it constantly for all applications if you have the funds to do that.

But the most important thing to do, especially as AI gets more and more competent at security testing, is to MAKE SURE YOU HAVE A LIST OF EVERYTHING YOU HAVE PUBLIC.

Never let that list get stale.

And then use AI to continuously ensure you're not leaving something broken out there.

I think the main way personal AI builders (and companies) will get hacked in the coming years will be building too fast and leaving stuff dangling on the internet.

It's so easy to build now that many people are building, tearing down, and building something else within the period of minutes or hours. And this raises the chances that you have something facing the internet that is vulnerable.

And the better general AI gets, the faster your internet-facing mistakes will get compromised.

Building such a system with AI today is much easier than it was just a year ago, and here's a prompt you could use to do so.

I am deeply concerned that we have built infrastructure since we've been building with AI that can lead to our systems being hacked, resulting in the loss of infrastructure and/or data. Especially anything customer-related. I need you to do a comprehensive review of everything that we have built and construct an asset management system that maintains a current list of everything we have deployed online. For anything that requires authentication and is therefore sensitive, I need you to build a basic set of security checks that we can run consistently against those assets. Most importantly, ensuring that the authentication is actually working the way it is supposed to. But even outside the authentication and for all assets that are publicly deployed, a comprehensive set of basic security testing should run continuously against all assets to ensure that the software stack is up to date and not vulnerable to known vulnerabilities. I need you to come up with the asset management system's basic functionality, as well as the security testing set of checks. I need you to ensure that these will run continuously from the cloud in a robust and secure way, which needs to itself be secured, along with an alerting system that lets us know if there's ever an issue.

This will get you going, and you can continue improving on it.

Stay safe out there.