ChatGPT is now the fastest-growing app in history, hitting 100 million active users in just two months—way faster than the nine months it took previous record-holder TikTok to reach that mark. According to its developer OpenAI, Australia can also expect access to the subscription-based ChatGPT Plus soon.

The powerful, open-source tool can do whatever you ask, from writing school essays, drafting legal contracts to solving complex math problems. It also has the potential to revolutionise the way businesses operate. With ChatGPT, businesses can generate reports quickly and handle customer service requests efficiently, even write code for new product offerings.

But with the many potential benefits to businesses comes urgent security questions. One of the critical risks associated with this technology is the power it gives cyber criminals with no coding experience to create and deploy malicious software. With ChatGPT, anyone with bad intentions can quickly develop and unleash malware that wreaks havoc on companies.

Security firm Check Point Research reported that, within weeks of ChatGPT’s release, individuals in cybercrime forums, including those with limited coding skills, utilised it to create software and emails for espionage, ransomware attack, and malicious spamming. The cybercriminal community has demonstrated a strong interest in ChatGPT and is already using it to develop malicious code.

In one example reported by Check Point, a malware creator revealed in a cybercriminal forum that they were using ChatGPT to replicate well-known malware strains and techniques. As evidence, the individual shared the code for a Python-based information stealer that they developed using ChatGPT. The stealer searches, copies, and transfers 12 common file types from a compromised system, including Office documents, PDFs, and images.

ChatGPT increases everyone’s exposure to hacking

Bad actors can use ChatGPT and other AI writing tools to make phishing scams more effective. Traditional phishing messages are often easily recognisable because they are written in clumsy English. But ChatGPT can fix this. Mashable tested ChatGPT’s ability by asking it to edit a phishing email. Not only did it quickly improve and refine the language, but it also went a step further and blackmailed the hypothetical recipient without being prompted to do so.

While OpenAI says it has strict policies and technical measures in place to protect user data and privacy, the truth is that these may not be enough. ChatGPT scrapes data from the web—potentially data from your own company—which brings security risks. For instance, data scraping can result in sensitive information, such as trade secrets and financial data, being exposed to competitors. There can also be reputational damage if the information obtained through data scraping is inaccurate. Moreover, when data is scraped, it can open systems to vulnerabilities that malicious actors can exploit.

The attack surface has dramatically expanded due to the advent of ChatGPT as it makes it easier to create malicious code at scale, increasing everyone’s exposure to cybercrime significantly. ChatGPT demonstrates that while the number of security tools available may not be able to keep pace with emerging AI technologies that could increase vulnerability to security threats.

Measures to minimise security risks

Given the spiraling threat of cybercrime, every business needs to be aware of the potential risks posed by ChatGPT and other advanced AI systems and take steps to minimise those risks.

• Identify and fix vulnerabilities– Penetration testing, also known as pen testing, can help protect data by simulating a real-world attack on the company’s systems, networks, or applications. This exercise aims to identify security vulnerabilities that malicious actors could exploit so you can close them. By exposing weaknesses in a controlled environment, pen testing enables businesses to fix those weaknesses, improve their security posture and reduce the risk of a successful data breach or other cyberattacks. Penetration testing can play a crucial role in helping safeguard your data and ensure its confidentiality, integrity, and availability.
• Double down on data resilience– A data resilience plan outlines the steps a business should take to protect its critical data and systems and how it will restore normal operations as quickly and efficiently as possible if a data breach occurs. It also provides a roadmap for responding to cyber threats, including detailed instructions for securing systems, backing up data, and communicating with stakeholders during and after an incident. By putting a data resilience plan in place, businesses can minimise the impact of cyber threats and reduce their risk of data loss, helping to ensure their organisation’s ongoing success and survival.
• Implement immutable data storage – Immutability means data is converted to a write-once, read many times format, and can’t be deleted or altered. There isn’t any way to reverse the immutability, which ensures that all backups are secure, accessible, and recoverable. Even if attackers gain full access to the network, they will still not be able to delete the immutable copies of the data or alter the state of that data.

By putting the proper protection in place, organisations can realise the many benefits of ChatGPT while defending themselves against those who use the tool for malicious purposes.