Re: Do we need a new acronym?
It's not "remote code execution" but it is "remote information extraction" and (as noted in the fine article) probably something we'll be seeing a lot more of in the next few years.
Indeed. Pretty much all fictional depictions of dangerous AIs could have been very short, if only they'd been contained and constrained. But they escape, and usually bad stuff happens. Copilot doesn't seem much different. It really needs policies that can also contain and constrain who can access it, and what it can access. So maybe a Copilot chatbot could be useful on a public server. It can only 'learn' from stuff on that server, so the risk is minimised given it's knowledge base is stuff intended to be made public anyway.
But I think you really wouldn't want it talking to any back-end systems unless you can make very clear restrictions as to what it can access and how it can use it. So probably to be safe, airgap any public-facing servers and never let Copilot back into the network. Obviously that limits how it could be used, but at the moment, it seems a very risky 'feature'. I think the same is true for internal networks, how they're segmented and policies applied between those networks. I think adminstrators really need a way to ensure that Copilot is never installed or run on systems they don't want it on.
Based on my own experiences as an average user, Microsoft is just pushing it as an update, and making it very difficult to terminate with extreme prejudice. But then that's also true for a lot of unwanted 'features' forced on users.
ps.. best I can come up with for an acronym is AIE!, or Automated Industrial Espionage or Automated Information Exfiltraton
Biting the hand that feeds IT
