In my recent posts, I wrote about the security risks of incorporating smart and IoT devices into the workplace, as well as a proposed AI regulation bill aimed at fining companies whose models help build mechanisms that cause catastrophic damage. But what if your own model is used against you to cause that damage? Who pays the fine and carries the weight of responsibility? The recent events surrounding the spyware controversy at OpenAI are raising questions about liability and where it starts.
On October 13, OpenAI announced on its X account that its security team had discovered a sophisticated recording device plugged into a USB port on a smart TV, and noted that the incident is being investigated by the FBI. Details of the case implicated an employee who had used OpenAI’s own model, ChatGPT, to help build the device. He also used OpenAI’s productivity agent to map offices, track executive schedules, and monitor upcoming meetings to find the optimal placement for the device. In his queries, he referenced the device’s MAC address, which ultimately led the security team to his wife’s account.