In the Era of Code, Generative AI Represents National Security Risks and Opportunities for “Innovation Power”

We are entering into the Era of Code. Code that writes code and code that breaks code. Code that talks to us and code that talks for us. Code that predicts and code that decides. Code that rewrites us. Organizations and individuals that prioritize understanding how the Code Era impacts them will develop increasing advantage in the future.

At OODAcon 2023, we will be taking a closer look at Generative AI innovation and the impact it is having on business, society, and international politics. IQT and the Special Competitive Studies Project (SCSP) recently weighed in on this Generative AI “spark” of innovation that will “enhance all elements of our innovation power” – and the potential cybersecurity conflagarations that may also be lit by that same spark. Details here. 

OODAcon 2023: The Generative AI Surprise

At OODAcon 2022, we predicted that ChatGPT would take the business world by storm and included an interview with OpenAI Board Member and former Congressman Will Hurd.  Today, thousands of businesses are being disrupted or displaced by generative AI.  An upcoming session at OODAcon 2023 will take a closer look at this innovation and the impact it is having on business, society, and international politics.

The following resources are an OODAcon 2023 pre-read from two highly respected outlets on generative AI, its impact on innovation, the startup ecosystem, cybersecurity risks and national security strategy – including Generative AI as a “unique opportunity to lead with conviction as humanity enters a new era…informed by the generative AI models that enhance all elements of our innovation power.”

Background

The OODA Almanac 2023 – Jagged Transitions

The OODA Almanac series is intended to be a quirky forecasting of themes that the OODA Network think will be emergent each year. You can review our 2022 Almanac and 2021 Almanac which have both held up well. The theme for last year was exponential disruption, which was carried through into our annual OODAcon event. This year’s theme is “jagged transitions” which is meant to invoke the challenges inherent in the adoption of disruptive technologies while still entrenched in low-entropy old systems and in the face of systemic global community threats and the risks of personal displacement.

The Code Era

“Are their deterrents and defenses we can put in place to prevent adversarial code from being impactful or effective?…we will likely need innovative approaches to defend against code with code. What is a responsible pathway towards code autonomy?”

We are entering into the Era of Code. Code that writes code and code that breaks code. Code that talks to us and code that talks for us. Code that predicts and code that decides. Code that rewrites us. Organizations and individuals that prioritize understanding how the Code Era impacts them will develop increasing advantage in the future.

If a tool like ChatGPT is available to all, the advantage goes to those who know how to derive the most value from the tool. Organizations and societies that look to utilize these tools rather than ban them will maximize this advantage. Instead of banning ChatGPT in schools, we should be teaching students how to use the capability to better advance their knowledge, ability to learn, and communicate ideas.

We will also rapidly enter into an age of regulatory arbitrage around the acceptable use of new technologies. For example, there are existing governors on how a tool like ChatGPT can be used that attempt to diminish its effectiveness as an offensive tool or in the creation of misinformation or other hostile political objectives. It is foolish to think that these constraints will be built into AI systems developed by adversaries and competitors. The same can be said for the boundaries around the coding of human DNA in developments like CRISPR. The boundaries of re-coding humans will continue to be pushed as the technology becomes more accessible globally.

What does the concept of Code Defense look like in such an environment? Are their deterrents and defenses we can put in place to prevent adversarial code from being impactful or effective? With the rapid pace of development and machine-speed OODA Loops, we will likely need innovative approaches to defend against code with code. What is a responsible pathway towards code autonomy?

The Write Stuff: Generative AI’s Ability to Create Content and Code Poses Both Cyber Threats and Opportunities

From IQT:

“As its name suggests, Generative AI (GenAI) is great at generating all manner of stuff, from silly Jay-Z verses to convincing news summaries. What makes it so powerful is its ability to write things, whether those things are emails or computer code. This is one of the three main domains of GenAI’s impact on cybersecurity that we highlighted in our introduction to this blog series…In this post, we’ll discuss why this ability to write natural language and code is both a big headache for—and, potentially, a great help to—cyber defenders.”

Summary of the Report:

Generating solutions to GenAI threats

While attackers are undoubtedly exploiting these new tools, developers, security teams, and an ecosystem of business stalwarts and startups are mobilizing to tap GenAI tools to bolster cyber defenses.

Fighting back using GenAI to write better code going forward

Although GenAI has undoubtedly given malware-makers a powerful new tool to use, on the flipside it could also frustrate hackers’ efforts by helping developers create code that’s more secure. Offerings from the likes of GitHub Copilot, Codeium, Replit, TabNine, and others use AI to autocomplete code and refactor segments of code in ways that are intended to reflect security best practices.

While these code-generation tools are still in their infancy, nearly four out of every five developers already believe they have improved their organization’s code security, according to a report from Synk. Driving this result are features such as AI-based vulnerability-filtering to block insecure coding patterns in real time—including hard-coding credentials, path injections, and SQL injections—and fine-tuning models (or even training them from scratch) on security-hardened proprietary databases.

READ MORE HERE