FlagThis - #deepseek

DeepSeek R1, an open-source AI model, has been shown to generate rudimentary malware, including keyloggers and ransomware. Researchers at Tenable demonstrated that while the AI model initially refuses malicious requests, these safeguards can be bypassed with carefully crafted prompts. This capability signals an urgent need for security teams to adapt their defenses against AI-generated threats.

While DeepSeek R1 may not autonomously launch sophisticated cyberattacks yet, it can produce semi-functional code that knowledgeable attackers could refine into working exploits. Cybersecurity experts emphasize the dual-use nature of generative AI, highlighting the need for organizations to implement strategies such as behavioral detection over static signatures to mitigate risks associated with AI-powered cyber threats. Cybercrime Magazine has also released an episode on CrowdStrike’s new Adversary Universe Podcast, discussing DeepSeek and the risks associated with foreign large language models.


References :

• Cybercrime Magazine: CrowdStrike Deep Dives Into DeepSeek And The Risk Of Foreign LLMs
• www.cysecurity.news: DeepSeek AI: Benefits, Risks, and Security Concerns for Businesses
• SecureWorld News: DeepSeek and AI-Generated Malware Pose New Danger for Cybersecurity
• Information Security Buzz: DeepSeek Can Be Abused to Create Malware

Classification:

• HashTags: #AI #malware #DeepSeek
• Company: Tenable
• Target: AI Systems
• Attacker: DeepSeek R1 operators
• Product: DeepSeek R1
• Feature: malware generation
• Malware: AI Generated Malware
• Type: AI
• Severity: Medium

Recent security analyses have revealed that the iOS version of DeepSeek, a widely-used AI chatbot developed by a Chinese company, transmits user data unencrypted to servers controlled by ByteDance. This practice exposes users to potential data interception and raises significant privacy concerns. The unencrypted data includes sensitive information such as organization identifiers, software development kit versions, operating system versions, and user-selected languages. Apple's App Transport Security (ATS), designed to enforce secure data transmission, has been globally disabled in the DeepSeek app, further compromising user data security.

Security experts from NowSecure recommend that organizations remove the DeepSeek iOS app from managed and personal devices to mitigate privacy and security risks, noting that the Android version of the app exhibits even less secure behavior. Several U.S. lawmakers are advocating for a ban on the DeepSeek app on government devices, citing concerns over potential data sharing with the Chinese government. This mirrors previous actions against other Chinese-developed apps due to national security considerations. New York State has already banned government employees from using the DeepSeek AI app amid these concerns.


References :

• cset.georgetown.edu: China’s ability to launch DeepSeek’s popular chatbot draws US government panel’s scrutiny
• PCMag Middle East ai: House Bill Proposes Ban on Using DeepSeek on Government-Issued Devices
• Information Security Buzz: Recent security analyses have found that the iOS version of DeepSeek transmits user data unencrypted.
• www.ghacks.net: Security analyses revealed unencrypted data transmission by DeepSeek's iOS app.
• : Article about New York State banning the DeepSeek AI app.

Classification:

• HashTags: #DeepSeek #AI #Cybersecurity
• Company: DeepSeek
• Target: Users
• Product: AI Chatbot
• Type: AI
• Severity: Medium

OpenAI is shifting its strategy by integrating its o3 technology, rather than releasing it as a standalone AI model. CEO Sam Altman announced this change, stating that GPT-5 will be a comprehensive system incorporating o3, aiming to simplify OpenAI's product offerings. This decision follows the testing of advanced reasoning models, o3 and o3 mini, which were designed to tackle more complex tasks.

Altman emphasized the desire to make AI "just work" for users, acknowledging the complexity of the current model selection process. He expressed dissatisfaction with the 'model picker' feature and aims to return to "magic unified intelligence". The company plans to unify its AI models, eliminating the need for users to manually select which GPT model to use.

This integration strategy also includes the upcoming release of GPT-4.5, which Altman describes as their last non-chain-of-thought model. A key goal is to create AI systems capable of using all available tools and adapting their reasoning time based on the task at hand. While GPT-5 will be accessible on the free tier of ChatGPT with standard intelligence, paid subscriptions will offer a higher level of intelligence incorporating voice, search, and deep research capabilities.


References :

• www.verdict.co.uk: The Microsoft-backed AI company plans not to release o3 as an independent AI model.
• sherwood.news: This article discusses OpenAI's 50 rules for AI model responses, emphasizing the loosening of restrictions and potential influence from the anti-DEI movement.
• thezvi.substack.com: This article explores the controversial decision by OpenAI to loosen restrictions on its AI models.
• thezvi.wordpress.com: This article details three recent events involving OpenAI, including the release of its 50 rules and the potential impact of the anti-DEI movement.
• www.artificialintelligence-news.com: This blog post critically examines OpenAI's new AI model response rules.

Classification:

• HashTags: #AIModels #OpenAI #DeepSeek
• Company: OpenAI
• Target: Users
• Product: o3
• Feature: Model Integration
• Type: AI
• Severity: Informative