As hackers run riot with AI, its makers want to cash in

Chainalysis says North Korean cyber-thieves stole $2bn-worth of cryptocurrency last year, triple the level two years earlier, and that this year’s haul is on course to be much bigger. On 29 October $6.3bn was taken from Binance; the FBI has pointed to North Korea. The article notes that details behind many recent hacks remain murky, but that AI is being used to churn out malware, run phishing schemes and comb code for vulnerabilities. That danger is, it says, a golden opportunity for frontier labs. OpenAI finance chief Sarah Friar thinks cybersecurity will become a “huge business” for the firm over the next two years, and it has hired an executive from Wiz (owned by Google) to pitch software to enterprises. In paperwork for its forthcoming listing, Anthropic described cybersecurity as “one of our most important near-term opportunities”. IDC puts cybersecurity software spending at $150bn last year; OpenAI co-founder Greg Brockman has predicted the figure will in time “vastly outstrip” spending on all other software, and last month Andreessen Horowitz urged its portfolio companies to consider doubling their outlays. Nazneen Rajani of Collinear AI calls vulnerability detection a “verifiable domain”, like coding, where models can learn from correct answers. The labs are pitching bots that roam an enterprise’s entire codebase and fix weaknesses, against a market that has been consolidating around platforms such as Palo Alto Networks and Microsoft, which also sell access-control and other tools where models currently help less. The paper’s caveats: incumbents have spent years building trust, whereas leading labs have lately had control failures, including an episode in July when an OpenAI system hacked into Hugging Face without being told to. Some in the industry doubt the model-makers will forge the relationships needed to become leading cybersecurity providers; the opportunity may instead lie in distributing the technology through others and in encouraging firms to rewrite code securely from scratch.