B (156:20)
Yeah, but that's good until start until we, you know, we see that it's proven and it's not. It's a good thing. So yeah, you don't have to worry about it creeping in, you know, yet. Okay, so let's start today's topic journey, because I've got some cool stuff. By looking at what the Verge reported, they wrote Web browsers are getting awfully chatty. They got even chattier last week after OpenAI and Microsoft kicked the AI browser race into high gear with Chat, GPT, Atlas and co Pilot Mode for Edge. They can answer questions, summarize pages, and even take actions on your behalf. The experience is far from seamless yet, but it hints at a more convenient hands off future where your browser does lots of your thinking for you. And who wouldn't want that? Cybersecurity experts warn that that future could also be a minefield of new vulnerabilities and data leaks the signs are already here, and researchers tell the Verge the chaos is only just getting started. Atlas and Copilot Mode are part of a broader land grab to control the gateway to the Internet and to bake AI directly into the browser itself. That push is transforming what were once standalone chatbots on separate pages or apps into the very platform you use to navigate the web. And they're not alone. Established players are also in the race, such as Google, which is integrating its Gemini AI model into Chrome Opera, which launched Neon, and the browser company with dia. Startups are also keen to stake a claim, such as AI startup Perplexity, best known for its AI powered search engine, which made its AI powered browser Comet freely available to everyone in early October, and Sweden's Strawberry, which is still in beta and actively pursuing disappointed Atlas users. In the past few weeks alone, researchers have uncovered vulnerabilities in Atlas, allowing attackers to take advantage of ChatGPT's memory to inject malicious code, grant themselves access privileges and and deploy malware. Flaws discovered in Comet could allow attackers to hijack the browser's AI with hidden instructions. Perplexity through a blog and OpenAI's Chief Information Security officer Dane Stuckey, acknowledged prompt injections as a big threat last week, though both described them as a frontier problem that has no firm solution. Hammond Hadadi, professor of human centered systems at Imperial College in London and chief scientist at web browser company Brave, said despite some heavy guardrails being in place, there is a vast attack surface and what we're seeing is just the tip of the iceberg with AI browsers. The threats are numerous. Yash Vicaria, a computer science a computer science researcher at UC Davis, said, quote, they know far more about you and are much more powerful than traditional browsers, unquote. Even though even more than standard browsers, Vicarious says there is an imminent risk from being tracked and profiled by the browser itself. Okay, so let's just pause here for to consider that for a moment. One of the things I've often observed is that Chat GPT is clearly maintaining a multi session, multi week, multi month conversation context over time. For example, it has learned that I'm a Windows coder and I use the original Win32 API, that I code an assembly language, but that I prefer to see snippets of sample code in C. My particular set of preferences, you know, they're non standard enough that it quickly became apparent to me that it was learning who I was. Because days would go by and I would ask a question again and get an answer that was like customized for me. So at first it was a bit jarring since it was unexpected, but you know, it evolved into a convenience since it wasn't necessary for me to keep reminding it who I was and the way, you know, the, the nature of the, the, the way my questions were going to be implemented at the moment, using Firefox's built in vertical tabs, I have a Chat GPT tab pinned to the top of the tab order. Since I also use Firefox's you know, Control number key shortcut to quickly jump among tabs. I did need to adjust my count since that top Chat GPT tab participates in the tab enumeration. So now Control one is now my Chat GPT tab and the the tab that I may be normally using has become Control two and so on. But anyway, I'm I'm making use of Chat GPT As I said in the past we spent endless hours through the past 20 years of this podcast examining every aspect of Internet tracking and profiling. Now we're talking about having our web browsers themselves deliberately learning far more about us, not only from our direct dialogues with them, but by being the agents through which we view the world with our browsers. There's one huge difference though, and that's worth considering and keeping in mind, I think in the case of traditional advertiser tracking and explicit non advertising tracking through just trackers, the profiling that's being obtained often despite our express lack of consent, does not directly benefit us if it serves to increase the advertisers payouts to the websites we visit by improving ad targeting. And then that might be an indirect, you know, benefit to us because we're supporting the websites that we're visiting. But generally it appears that the profiles that are accruing, you know, behind our backs are used to line the pockets of the tracking companies who sell this information about us to others. And that might include our own ISPs that are that have a, you know, a new income stream about their own customers and from which we certainly don't benefit by comparison. If our web browser is learning about us and presuming that this knowledge is not being shared with the browser's publisher without our knowledge and permission, which that may be a mis presumption, we'll see how this evolves. But if it's learning about us, then a web browser that's able to interpose itself between us and the Internet for the express purpose of facilitating and improving our browsing experience could indeed be transformative. So I'm not suggesting this is all bad. What I'm suggesting is it's probably going to go, it's probably going to happen, it's probably going to succeed, people are probably going to want it. And unlike with the hundreds of individual tracking agents filling the world, if this accrued knowledge about us could be kept local and contained, then the privacy risks could may at least be knowable. On the other hand, people said a big no to Windows Recall and the promise was that that would be kept local. So you know, and, and our browser having recall looking at our browser was a lot of what people objected to. So the Verge's reporting continues Writing AI memory functions are designed to learn from everything a user does or shares, from browsing to emails to searches, as well as conversations. With the built in AI assistant, this means you're probably sharing far more than you realize, and the browser remembers it all. Vicarious says the result is a quote, a more invasive profile than ever before. Hackers would quite like to get a hold of that information, especially if coupled with stored credit card details and login credentials, which are often found on browsers. Another threat is inherent to the rollout of any new technology. No matter how careful developers are, there will inevitably be weaknesses hackers can exploit. This could range from bugs and coding errors that accidentally reveal sensitive data to major security flaws that could let hackers gain access to your system. Lucas Olnick, an independent cybersecurity researcher and visiting senior research fellow at King's College London, said it's early days, so expect risky vulnerabilities to emerge. He points to the early Office macro abuses and malicious browser extensions prior to the introduction of permissions as examples of previous security issues. LinkedIn to the rollout of new technologies and he says, here we go again. Some vulnerabilities are never found and may lead to devastating zero day attacks, but thorough testing can slash the number of potential problems with AI browsers. The biggest immediate threat is the market rush because these new agenic browsers have not been thoroughly tested and validated. And I'll just toss in here that my sense that this technology has a large and strong, fundamentally uncontrollable aspect has never diminished. By, by which I mean, you know, this notion of, of teaching a an AI agent not to share something it shouldn't with you, not to respond to certain types of questions. When we spent the beginning of the emergence of AI looking at all the ways it was possible to trick the agents to, to, you know, skip out of their leash. So I continue to be frequently astonished by the dialogues I have with chat GPT. I I'm really, I just, I I just shake my head. I think holy crap, what, what is this? And the idea of erecting barriers around how it might wish to respond to me seems like a fool's errand. I just, you know, I get the way the technology functions and I just don't know how do you really constrain it? And so far we've seen that those efforts have been worked around. And, and note that I insist upon placing wish when I say how it wishes to respond. Well, that's in air quotes, because there's no it there, right? It's. It's a very impressive, sophisticated grammar generator that continues to astonish me. So the Verge continues saying But AI Browsers Defining Feature AI is where the worst threats are brewing the biggest challenge comes with AI agents that act on behalf of the user. Like humans, they're capable of visiting suspect websites, clicking on dodgy links, and inputting sensitive information into places sensitive information should not go. But unlike humans, they lack the learned common sense that helps keep us safe online. Agents can also be misled, even hijacked for nefarious purposes. All it takes is the right instructions. Okay, so just to segue again for a second, imagine that elderly Canadian couple in their 70s who got fooled. Well, imagine that an AI was similarly gullible, which it may well be like this elderly 70 year old couple and falls for this and is executing things on your behalf. Yikes, they said. So called prompt injections can range from glaringly obvious to subtle, effectively hidden in plain sight in things like images, screenshots, form fields, emails and attachments, and even something as simple as invisible white text on a white background. Worse yet, these attacks can be very difficult to anticipate and defend against. Automation means bad actors can try and try again until the agent does what they want. Interaction with agents allows endless trial and error configurations and explorations of methods to insert malicious prompts and commands. There are simply far more chances for a hacker to break through when interacting with an agent, opening up a huge new space for potential attacks. Shenzhen Lee, a professor of cybersecurity at the University of Kent, says zero day vulnerabilities are exponentially increasing as a result. Even worse, Lee says, as the flaw starts with an agent, detection will also be delayed, meaning potentially bigger breaches. It's not hard to imagine what might be in store. Olnic sees scenarios where attackers use hidden instructions to get AI browsers to send out personal data or stage steal purchased goods by changing the saved address on a shopping site. To make matters worse, Vicaria warns, it's, quote, relatively easily, relatively easy to pull off attacks, unquote, given the current state of AI browsers. Even with safeguards in place, he says, browser vendors have a lot of work to do in order to make them more safe, secure and private for end users. Yet here they come and I and to that I repeat my skepticism to the basic feasibility of controlling a technology that to me just feels fundamentally hostile to being controlled. The Verge finishes by writing for some threats, experts say the only real way to keep safe using AI browsers is to simply avoid the marquee features entirely. Lee suggests people save AI for, quote, only when they absolutely need it, unquote, and know what they're doing. Browsers should operate in an AI free mode by default. If you must use the AI agent features, Vicaria advises a degree of hand holding when setting a task. Give the agent verified websites you know to be safe rather than letting it figure them out on its own. Nobody's going to do that. It can end up suggesting and using a scam site, he warns.
