When Andrew asked his AI personal assistant to book him a spot in a gym class, he had no idea he would accidentally initiate an autonomous cyber attack.
Yeah. That’s stood out. The article tries to frame it like Andrew felt like booking his classes was a chore and just told the AI to do it, but that doesn’t jive.
The article claims the AI was unable to sign the person it had booted out of a class back up since the gym system checked for proper user authorization for that. It had already signed Andrew up for classes that same way. That seems strange, doesn’t it? Do most gyms list API information? That doesn’t seem like a common way to book an appointment for a gym.
Maybe Andrew was reading the source from the gym website’s reservation page and snagged the api information, but even then it seems like that would be a thing you do in most instances after logging in to your account. The source would be extremely unlikely to show everything needed to successfully make make the appointment via API.
Even if it did, and Andrew gave the AI the API information including the user account and password information the AI would need to book his appointments, and they knew he was 4th in line it would also be very unlikely for the API to report listing the user accounts of everyone in the waitlist to someone with his user level access.
So we have a guy who’s job is selling AI who contacted the news to say that the standard consumer AI he was using hacked his gym and left out tons of pertinent information. We don’t get to know his full name or the name of the gym in question. Screams bullshit.
Yeah. That’s stood out. The article tries to frame it like Andrew felt like booking his classes was a chore and just told the AI to do it, but that doesn’t jive.
The article claims the AI was unable to sign the person it had booted out of a class back up since the gym system checked for proper user authorization for that. It had already signed Andrew up for classes that same way. That seems strange, doesn’t it? Do most gyms list API information? That doesn’t seem like a common way to book an appointment for a gym.
Maybe Andrew was reading the source from the gym website’s reservation page and snagged the api information, but even then it seems like that would be a thing you do in most instances after logging in to your account. The source would be extremely unlikely to show everything needed to successfully make make the appointment via API.
Even if it did, and Andrew gave the AI the API information including the user account and password information the AI would need to book his appointments, and they knew he was 4th in line it would also be very unlikely for the API to report listing the user accounts of everyone in the waitlist to someone with his user level access.
So we have a guy who’s job is selling AI who contacted the news to say that the standard consumer AI he was using hacked his gym and left out tons of pertinent information. We don’t get to know his full name or the name of the gym in question. Screams bullshit.