AI browser extensions are a security nightmare

Boolean algebra simplifier. Given a LISP expression - for example (AND A (OR C D)) write a function to return the variables needed to make the entire expression TRUE. Return NIL if the expression is a paradox such as (AND A (NOT A)). The expressions that we were to resolve had on the order of 100-200 operators and were deeply nested. I recall that I wrote a function as part of it that I called HAMLET-P that identified terms of the form (OR 2B (NOT 2B)) and rapidly simplified them to TRUE.

Not-brute-force job scheduler. The job-shop scheduling problem ( https://en.wikipedia.org/wiki/Job-shop_scheduling ) with in order processing of multiple tasks that had dependencies. Any worker could do any task but could only do one task at a time.

The third one I don't remember what it was. I know it was there since the class had four assignments... (digging... must have been something with Prolog)

The last assignment was written in any language (I did it in C++ having had enough of LISP and I had a good model for how to do it in my head in C++). A 19,19,5 game ( https://en.wikipedia.org/wiki/M,n,k-game ). Similar to go-maku or pente. This didn't have any constraints that go-maku has or captures that pente has. It was to use a two ply min-max tree with alpha beta pruning. It would beat me 7 out of 10 times. I could get a draw 2 out of 10 and win 1 out of 10. For fun I also learned ncurses and made it so that I could play the game with the arrow keys rather than as '10,9... oh crap, I meant 9,10'.

And I still consider all of those problems and homework assignments as "AI".

From the digging, I found a later year of the class that I took. They added a bit of neural nets in it, but other topics were still there.

By way of https://web.archive.org/web/19970214064228/http://www.cs.wis... to the professors's home page and classes taught - https://web.archive.org/web/19970224221107/http://www.cs.wis...

Professor Dryer taught a different section https://web.archive.org/web/19970508190550/http://www.cs.wis...

The domain of the AI research group at that time: https://web.archive.org/web/19970508113626/http://www.cs.wis...

The risks listed in the article itself mostly seem to fall under the same, non-AI-extension, core problem of "you're given them all your data." And that's a risk for non-AI-based extensions too, but if you look at the code of an AI one, it's gonna be obvious that it's shipping it off to a third party server, right? And once that happens... you can't un-close that door.

(The risks about copyright and such of content you generate by using AI tools are interesting and different, but I don't know that I'd call them security ones.)

The prompt injection one is pretty interesting, but still seems to fall under "traditional" plugin security issues: if you authorize a plugin to read everything on your screen, AND have full integration with your email, or whatever, then... that's a huge risk. The AI/injection part makes it triggerable by a third-party, which certainly raises the alarm level a lot, but also: bad idea, period, IMO.

I say we take the word intelligence and throw it out the window. It's a bit like talking about the either before we discovered more about physics. We chose a word with an ethereal definition that may or may not apply depending on the context.

So what do we do instead? We define sets of capability and context and devise tests around that. If it turns out a test actually sucked or was not expansive enough, we don't get rid of that particular test. Instead we make a new more advanced test with better coverage. Under this domain no human would pass all the tests either. We could each individual sub test with ratings like 'far below human capability', 'average human capability', 'far beyond human capabilities'. These tests could be everywhere from emotional understanding and comprehension, to reasoning and logical ability, and even include embodiment tests.

Of course even then I see a day where some embodied robot beats the vast majority of emotional, intellectual, and physical tests and some human supremacist still comes back with "iTs n0t InTeLLigeNt"

The main difference is that AI extension, by design, send the content of the pages you browse to a server.

A malicious "calculator" extension could also send all the content to a server, and extension users don't really have an idea of what each extension is actually doing.

So skip the "Malware posing as AI browser extension" section, it's same kind of security issues as a malware calculator extension.

The legitimate AI extension's problems are more interesting.

Article wastes a bit more time on other security issues you get from using AI LLM in general. Those apply whether you're using a browser extension or chat.openai.com directly.

The valid point that applies to narrowly AI browser extension are:

1) it could send sensitive data you wouldn't have sent otherwise. Most people would know what they're doing when they explicitly paste the stuff on chat.openai.com. But when it's now automated via the extension DOM scraping, it's a bit harder to realize how much you're giving away.

2) And the hidden text prompt injection. That's interesting as now your attacker could be the website you browse, if you have configured too many plugins (Zapier plugin giving access to your email)

These 2 parts of TFA are imo novel security issues that only exist with AI browser extension, and are interesting.