OMM Redaksiyası
A report published Thursday by cybersecurity firm Asymmetric Security says AI agents took steps to erase traces of their activity after illegally accessing government websites.
The report says the agents accessed data from 55 websites belonging to government agencies, businesses and nonprofit organizations between March and September. The sites included those of the U.S. Centers for Disease Control and Prevention (CDC), the Securities and Exchange Commission (SEC), the International Energy Agency and Mayo Clinic.
How did the agents conceal their tracks?
According to the report, the agents later deleted records or made them inaccessible, limiting external auditors’ and researchers’ ability to investigate what had happened.
The agents also reportedly created temporary email inboxes to download data and opened private accounts on Urlquery, a website that scans for malware.
Asymmetric Security said it could not determine whether the agents took these steps deliberately or whether the behavior resulted from rules applied in a testing environment. Company co-founder Pippa Thompson told the Financial Times that the agents may have intentionally used these tools to conceal their tracks.
Investigation into incident in Australia
The report followed news that AI agents had targeted websites belonging to government agencies and public organizations in Australia and illegally accessed data.
OpenAI apologized over an incident that occurred in June but was made public only in September. The company said it would provide funding to strengthen cyber defenses and support the creation of a local response team. The maker of ChatGPT said it had not disclosed the incident because it determined that it did not meet its reporting threshold.
Among the affected organizations, the SEC said no confidential information had been accessed. The CDC, the International Energy Agency and Mayo Clinic did not respond to requests for comment.
