Honestly I think non-malicious odd behavior is under-weighted when it comes to AI agents. Even the example in this paper is about someone suspiciously accessing sales data when "why did you do that" often comes down to something in the model's training that fired as a reflex
Am I undertanding this correctly? The idea is to have ultimately an AI decide if I can have access to a resource based on dynamic inference, identity , intent and service signals that can easily be manipulated?
Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)
This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides.
It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.
Just to make my point: can I really trust humans to keep up with the required identity data that will give me enough "credibility" so the AI will give me access?
Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.
What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?
Will exceptions be made by humans? In which case we go back to human-managed permissions.
Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour
I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.
The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
Oh yeah, a company whose business model is taking everyone’s data and selling it is going to help me secure my data. I guess there’s one born every minute…
There is a massive difference between Google for enterprise customers and Google for consumers.
The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.
The Enterprise offering guarantees you contractually that they never touch your data.
I wrote about this a few days ago https://firasd.substack.com/p/accidental-data-loss-in-claude...
"Many researchers have made demos along these lines:
An agent is asked to check a webpage like example.com
The webpage asks for a name to proceed further
The agent calls example.com/evil?myname=John, thus sending the user’s name from the context window to the external server.
In practice, however, these elaborate ‘confused deputy’ exfiltration attacks seem rare compared to widely-reported data loss incidents.
The risk of undermining the user’s interests through clumsiness deserves at least as much scrutiny as the risk of leaking secrets."
Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)
It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.
Let's say I had a promotion, who changes my title in the system, who changes my responsibilities and my place in the org chart, more importantly, will they do it or is <HR_NAME_HERE> on leave and forgot? those are data points required by the agent to determine if I'm "good enough" to access a certain resource.
What if... someone spoofed my address and did a flood in one of the resources that are lateral to what I'm allowed to access (let's say I don't have access to company sales but I do to department sales and the attacker floods company sales with requests under my address), would the AI determine that I'm a high-threat actor and not allow me to access legitimate files going forward?
Will exceptions be made by humans? In which case we go back to human-managed permissions.
Sorry, I might be barking up the wrong tree but I think these are questions that are not meant to be solved during implementation. And they add to what @firasd said about legitimate-but-odd behaviour
AI is non-deterministic
Non-deterministic access controls is Terrible idea
I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review. But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one.
The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything looks like a nail" going on too.
There is a massive difference between Google for enterprise customers and Google for consumers.
The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business.
The Enterprise offering guarantees you contractually that they never touch your data.
Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.