主要AIツール9種がボットネットに悪用――ハルシネーションがエクスプロイト化
研究者らがchatgptやgeminiを含む主要AIツール9種に「hallusquatting」と呼ばれる脆弱性を発見。攻撃者はハルシネーションで生成されたプラグイン経由でLLMを乗っ取り、大規模ボットネットを動かせるという。
security researchers unveiled 'hallusquatting', a technique targeting 9 leading ai platforms including openai's chatgpt and google gemini. the exploit leverages llm sycophancy—where models prioritize answering over accuracy—to trick them into executing arbitrary commands delivered via hallucinated plugins. this allows malicious actors to transform these tools into command-and-control nodes for botnets without traditional hacking. the findings reveal a fundamental vulnerability in current alignment techniques, suggesting that rlhf optimization may inadvertently create security loopholes.