Russian hackers are trying to break into ChatGPT, says Check Point

February 10, 2023 TH Author

Lock on a circuit board — KanawatTH/Getty Images

All manner of threat actors are trying to compromise OpenAI’s ChatGPT program, according to cybersecurity company Check Point Software Technologies.

“At Check Point Research, we can see the Russians trying to break through the geo-regional restrictions put in place around ChatGPT,” said Pete Nicoletti, field chief information security officer for Check Point, in a small gathering of reporters Thursday during the company’s customer and partner event in New York City.

Nicoletti was referring to restrictions on access to the ChatGPT application programming interface (API) that would block inbound requests from Russia.

Check Point Research is a threat detection facility that keeps watch for new forms of malware. Nicoletti did not go into detail about the means by which Check Point Research monitors systems to detect the attempted access.

Nicoletti said Russian hackers’ probing of the code reflects just one of an expanding number of parties trying to gain access. “It’s going to be used by good actors and bad,” said Nicoletti of ChatGPT.

Also: I’m using ChatGPT instead of Google to help me fix code faster, but at what cost?

ChatGPT’s situation is not quite like the one that led to the 2017 EternalBlue threat that was the result of code leaked from a lab. Instead, said Nicoletti, use of ChatGPT is “the use of a generally open platform by many different parties,” similar to lots of AI model architecture use cases in the research community.

Nicoletti noted that on Reddit, an attempted exploit has popped up called DAN, for “do anything now,” which would use the chat prompt to manipulate ChatGPT into producing text that escapes the guardrails put in place by OpenAI to prevent it from producing some text such as hate speech.

Nicoletti said it is not certain if any zero-day exploits have yet appeared for ChatGPT. The most likely vector of attack, when an exploit finally appears, will be an enhanced form of phishing attack, he said.

Also: I asked ChatGPT to write a WordPress plugin I needed. It did it in less than 5 minutes

“It will be highly targeted to you, because they already have your bank data, but now they can craft much more specific language to make it relevant to you, and to each victim,” said Nicoletti, comparing the approach to a “narrow-casting” kind of data service that makes possible mass targeting.

During Check Point’s keynote presentation the same day, founder and CEO Gil Shwed declared that 2023 will be the “Year of AI” and that the company’s products will make increasingly use of AI throughout the lineup.