The AI Agent Fantasy vs. The Reality of Basic Software Bugs
While VCs pitch autonomous AI agents as the future, a series of 'insanely trivial' flaws in OpenAI and Meta software suggest the industry is repeating the security failures of the nineties.
OPINION: Let’s get something straight before the next round of venture capital pitch decks arrives: the industry is currently obsessed with the idea of autonomous AI agents hacking the world. We are being sold a future of sophisticated, self-evolving digital entities. But if you look at the actual code being shipped to our desktops, the reality is far less cinematic. We aren't dealing with sci-fi threats; we are dealing with the same bloated, sloppy software failures that have plagued every major app since the nineties.
Consider the macOS version of OpenAI’s ChatGPT. As Wired first reported, a recently patched vulnerability in the app could have allowed attackers to essentially hijack the software on a victim's computer. This wasn't some complex, AI-driven breach. It was a failure of basic system architecture.
Researchers at the Objective-See Foundation discovered that while the ChatGPT app uses digital signature checks across three layers of removal to ensure requests are coming from legitimate OpenAI components, this security measure was easily bypassed. Patrick Wardle, a longtime macOS researcher and software analyst at the Objective-See Foundation, explained to Wired that a trusted script interpreter within the app would accept untrusted scripts. By simply spawning the script interpreter three times, a malicious script could satisfy the system's requirements and gain entry.
Wardle described the exploit as "insanely trivial," noting that his proof of concept required only about a dozen lines of code. The stakes, however, were high. An attacker exploiting this flaw could have accessed all of a user's chat logs and stored data, as well as browser sessions. Furthermore, the vulnerability could have been used to force ChatGPT to run commands for the attacker—such as accessing other sensitive applications—while making those requests appear as legitimate instructions from OpenAI software.
This is the fundamental paradox of the 'agent' era. For these tools to be useful, they require deep system access. As Wardle told Wired, these agents are like building managers with keys to every room; if the manager is corrupted, unprivileged code suddenly has access to everything.
On September 25, OpenAI used its system change log to acknowledge the flaw and its subsequent fix. In a statement to Wired, OpenAI spokesperson Shane Bauer admitted that while the company is evolving its security practices, there is a "need to move faster."
But this isn't an isolated incident of one company rushing a product to market. The pattern extends across the sector. Wired reports that Wardle also identified a now-patched flaw in the dictation feature of Meta’s Muse AI assistant. In that instance, a local attacker could have grabbed a mishandled authentication token to gain access to user data.
Moreover, the bleeding hasn't stopped. Wardle has already submitted a new vulnerability report to OpenAI regarding the integration between ChatGPT and the company's new Dots AI assistant, which is currently always-on. OpenAI is reportedly reviewing that finding now.
From where I sit, this is a textbook example of 'feature creep' overriding fundamental safety. Wardle summed it up perfectly in Wired: AI companies are currently fixated on adding new features, but every single addition broadens the attack surface. Security is still being treated as an afterthought. Until these companies stop prioritizing the 'magic' of the agent and start prioritizing the integrity of the software, we are just building more sophisticated ways to get hacked by a dozen lines of code.