A Flaw in ChatGPT's Mac App Could Have Let Hackers Grab Sensitive Data While the focus has been on AI agents' hacking capabilities, a recently patched vulnerability in a ChatGPT app shows that AI software is itself an inviting--and vulnerable--target. Hardly a day goes by lately without news of AI agents autonomously hacking websites or AI tools being used by cybercriminals and scammers . But a recently patched vulnerability in the macOS version of OpenAI's ChatGPT underscores the potential value to attackers of compromising AI software itself as these apps proliferate more and more. The bug could have been exploited to essentially take over ChatGPT on a victim's computer, giving an attacker access to all the chat logs and other data stored by the app, as well as interconnections like browser sessions. Discovered by researchers at the Objective-See Foundation, the vulnerability illustrates the deep system access and trust that AI platforms are afforded in order to work--and the target that this puts on their backs.

Meta's Muse AI Assistant Rolled Out With a Serious Security Flaw Meta says it issued a fix for the Muse zero-day vulnerability that would have let attackers do "whatever" they wanted on a victim's Mac, highlighting the inherent dangers of AI helpers. Meta founder and CEO Mark Zuckerberg has gone to great lengths to hype the security of its new AI assistant, Muse, claiming it is "built from the ground up for privacy and security." A zero-day vulnerability that gives locally run apps and terminal commands complete control of the agent raises serious doubts. Further raising questions, Amazon on Sunday began blocking Muse from its site. Meta introduced Muse a few weeks ago.

Look Up Mashable's Best: E-readers, robovacs, laptops, earbuds, smart home and more Say More Safety Net Versus Mashable Selects Creator Playbook In My Bag Trending Now Back to School Good Connection: Uplifting stories for a digital age Switch Off All Series Meta's Muse reportedly has zero-day vulnerability that lets attackers take over your Mac The exploit was unveiled as Amazon decided to block Muse from shopping on its platform. Matt Binder joined Mashable's tech vertical in 2018, where he covers social media, tech policy, cybersecurity, online scams, cryptocurrency, AI, creator news, weird tech, and other related tech beats. Met's AI assistant Muse has a concerning zero-day vulnerability. Meta launched its new AI assistant Muse to much fanfare earlier this month. Now, just a few weeks later, a zero-day vulnerability has reportedly been discovered that could put access to your entire Mac computer in the wrong hands.

Humanizing AI systems also stokes our fears, and scared people are more vulnerable to believe and spread wrong information, said Wardle of Brown University. Thanks to science-fiction authors, our brains are brimming with worst-case scenarios, she noted. Stories such as "Blade Runner" or "The Terminator" present a future where AI systems become conscious and turn on their human creators. Since many people are more familiar with sci-fi movies than the nuances of machine-learning systems, we tend to let our imaginations fill in the blanks. By noticing anthropomorphism when it happens, Wardle said, we can guard against AI myths.

A game developer can file for a patent on an original gaming idea, a legal process that has been used to strangle video game clones in the past. But getting a patent is a long and arduous process that can fall apart if there's "prior art" predating the idea (or if the mechanic could be considered legally "obvious").

Hoaxes spread quickly online, be they about celebrities, politicians or anyone else. But falsehoods labeled as satire can slip through the defenses of social media companies, allowing people to peddle fiction as fact, all while making a financial profit. The claims tend to be spectacular: Bill Gates arrested for child trafficking, Tom Hanks executed by the U.S. military, or Pope Francis declaring that a COVID-19 vaccine would be required to enter heaven. These bogus allegations originated from articles on websites that contain disclaimers that they are satirical. The problem is that many people believe them.

You'd think that of all the leaks in the country, the one that pops up on the street where a professor of water systems lives would get fixed pretty quickly. But as Vanessa Speight will tell you, that's sadly not the case. "It just comes out of the pavement and runs down the road," says Prof Speight, an expert in drinking water quality at the University of Sheffield. It was roughly a year ago that she first reported the problem to her local water firm. Despite efforts to locate the source of the leak, the company has come up dry. "It's probably been six different times they've dug up the road," Prof Speight adds.

Headlines from the likes of The New York Times ("Deepfakes Are Coming. We Can No Longer Believe What We See"), The Wall Street Journal ("Deepfake Videos Are Getting Real and That's a Problem"), and The Washington Post ("Top AI researchers race to detect'deepfake' videos: 'We are outgunned'") would have us believe that clever fakes may soon make it impossible to distinguish truth from falsehood. Deepfakes -- pieces of AI-synthesized image and video content persuasively depicting things that never happened -- are now a constant presence in conversations about the future of disinformation. These concerns have been kicked into even higher gear by the swiftly approaching 2020 U.S. election. A video essay from The Atlantic admonishes us: "Ahead of 2020, Beware the Deepfake."

Between new types of malware, egregious bugs, and universal threats like phishing, Macs are not the invulnerable lockboxes Apple once touted. But in thinking about how to defend Macs against a new generation of threats, researchers at the security firm Digita are taking advantage of features Macs already offer, to monitor threats in unexpected ways. And it's all powered by Apple's logic engine for videogames. At the RSA security conference in San Francisco on Tuesday, Digita chief research officer Patrick Wardle is presenting GamePlan, a tool that watches for potentially suspicious events on Macs and flags them for humans to investigate. The general concept sounds similar to other defense platforms, and hooks into detection mechanisms--has a USB stick been inserted into a machine?

A recent, most-excellent post over at the Objective-See blog (seriously, go and read it) details how the author, Patrick Wardle, dissects and manipulates the antivirus (AV) signature mechanism present in the macOS version of a traditional, signature-based antivirus software suite to achieve arbitrary false-positive detection. The flavoring of his post, of course, is the ongoing fracas surrounding the product's alleged potential for misbehavior in identifying and exfiltrating sensitive government documents on a computer protected by the product – a claim the suite's developers deny vehemently. Wardle elects not to comment on it – as do I – choosing instead to ask and answer the question, "Can an AV product be induced to: (1) arbitrarily and incorrectly identify a file as desired by an adversary, and, if (1) then (2) exfiltrate the files identified?" As detailed in the blog, Wardle reversed the AV product's scanning engine's behavior, which enabled him – and presumably any other sufficiently skilled attacker – to modify (he writes'extend') the way in which the product identified malicious files when scanning. Once understood, Wardle utilizes a method for writing bytes into remote processes to patch what the AV engine is looking for. That is to say, Wardle's success is possible because of the product's usage of AV signatures.