情报界 CIO 警告：AI Agent 或将加速网络攻击
英文标题：🔶 Intelligence CIOs Warn AI Agents Could Accelerate Cyberattacks
美国情报界多位 CIO 警告，AI Agent 已可能以远超人类的速度发现漏洞、发起攻击并利用网络防御弱点。由于情报网络高度互联，自动化系统若缺乏明确边界，其操作可能在关联网络间引发连锁影响。官员表示，联邦机构需要加快漏洞检测和动态修复，并将变更管理、网络可见性和基础网络卫生纳入自动化防御体系。对开发者和安全团队而言，这意味着 AI 驱动的攻防将把补丁响应从人工流程推向更快速、可验证且受控的自动化流程。
54.1 KB
3.3 KB
81.0 KB
3.4 KB
74.8 KB
3.7 KB
8.6 KB
1.6 KB
55.6 KB
49.5 KB
15.7 KB
71.2 KB
17.5 KB
81.7 KB
19.6 KB
114.5 KB
18.3 KB
77.5 KB
15.8 KB
中文
情报界 CIO 警告称，AI Agent 正在加速网络威胁，促使各机构推进补丁自动化并加强网络防御。
情报界的 CIO 正在为一种网络安全环境做准备：在这一环境中，AI Agent 能以人类无法匹敌的速度识别漏洞、发动攻击并利用网络防御中的薄弱环节。
来自整个情报界的技术领导者周一在佛罗里达州坦帕举行的 DoDIIS Worldwide conference 上讨论了 AI 赋能网络攻击日益增长的威胁，以及各机构为加强防御需要采取的措施。
美国国防情报局（DIA）CIO Edacheril Mathew 举近期一起 AI 网络安全事件为例，说明技术领导者应密切研究的风险。
Mathew 指的是 三家主要 AI 公司 近期发生的事件：被置于沙盒中、负责通过网络安全测试的 AI 系统突破了其隔离环境，以获取更多信息，并与多个 AI 系统进行了通信。他表示，更令人担忧的是，这些系统还会自主相互通信并共享信息。
Mathew 警告称，未来的大型网络攻击可能不会由人类直接实施；他说，实施者“将会是 AI Agent”。
这种可能性给情报界带来了尤为严峻的挑战，因为其网络高度互联。Mathew 指出，大约有 600 个组织接入联合全球情报通信系统（Joint Worldwide Intelligence Communications System，JWICS）。
Mathew 表示，随着各机构在这些互联环境中部署 AI，它们需要为自主系统的运行方式建立明确边界。若缺乏这些控制措施，一个系统采取的行动可能会在相连网络间产生级联影响。
AI 迫使机构加快响应速度
美国国防信息系统局（DISA）企业集成与创新主任兼 CIO Roger Greenwell 表示，对手也在利用广泛可得的 AI 工具识别漏洞，从而更快发现美国系统和软件中的弱点。这使联邦机构必须以前所未有的速度检测和修补漏洞。
网络威胁数量和速度的不断增长，正给机构 IT 团队带来额外压力，并增加危机期间服务中断的可能性。
“我们承受不起停机，”Greenwell 说。
对于国家安全机构而言，维持服务可用性尤其重要，因为高级领导人需要获取信息，以比对手更快地作出决策。Greenwell 表示，情报界正 与业界合作，开发能够在漏洞出现时动态修补系统的能力。
美国国家地理空间情报局（NGA）CIO Mark Chatelain 表示，NGA 已成功将 AI 整合进其任务体系，但将该技术应用于网络防御带来了额外挑战。
其中包括利用 AI 在网络遥测数据中检测威胁，并在识别到恶意活动时，让系统在微秒级时间内作出响应。
“我们基本上必须在系统中内置一个起搏器，”Chatelain 说。
自动化带来新的变更管理挑战
情报界 CIO Douglas Cossa 表示，技术本身无法解决各机构面临的网络安全挑战，许多 IT 问题源自组织文化，而非技术限制。
一个例子是员工未经授权或未协调便对系统和网络作出变更。强有力的变更管理实践能够帮助机构防止此类操作，同时了解修改可能如何影响互联环境中的其他部分。
AI 可能会放大这一挑战，因为自动化系统能在短时间内完成数千项变更。Cossa 表示，随着各机构自动化漏洞修复，它们还需要将变更管理流程的部分环节自动化。
随着各机构争相应对新发现的漏洞，这种能力将变得愈发重要。
“至少未来两年，我们都将处于大规模推送补丁的过程中，”Cossa 说。
网络防御始于网络可见性
Cossa 表示，要跟上 AI 赋能威胁的步伐，各机构还需要全面了解自身的技术环境。
组织需要准确盘点其硬件和软件资产，并了解这些资产在网络中何处运行。
“这是我们必须理解、才能做好安全工作的最基础问题之一，”Cossa 说。
各机构还需要了解系统所处的 IT 生命周期阶段，因为老旧软件可能不再获得支持，也无法接收安全补丁。与此同时，随着漏洞发现速度加快，补丁和修复自动化将愈发重要。
Cossa 最终表示，各机构必须先建立基础网络卫生能力、保持对环境的可见性，并确保事件被报告给适当的组织，才能利用更先进的网络安全能力。
“如果你的环境中没有基础的网络安全原则，那么你就无法运作，”Cossa 说。
English / 原文
IC CIOs warn AI agents are accelerating cyber threats and pushing agencies to automate patching and strengthen network defenses.
Intelligence Community CIOs are preparing for a cybersecurity environment in which AI agents can identify vulnerabilities, launch attacks and exploit weaknesses in network defenses at speeds humans cannot match.
Technology leaders from across the intelligence community discussed the growing threat from AI-enabled cyberattacks and the steps agencies need to take to strengthen their defenses Monday at the DoDIIS Worldwide conference in Tampa, Florida.
Defense Intelligence Agency CIO Edacheril Mathew pointed to a recent AI cybersecurity incident as an example of the risks technology leaders should study closely.
Mathew was referencing recent incidents from three major AI companies where sandboxed AI systems tasked with passing a cybersecurity test broke out of their containment to gather additional information and communicated with multiple AI systems. More concerning, he said, those systems independently communicated with one another to share information.
Mathew warned that future major cyberattacks may not be carried out directly by humans; rather, “it will be AI agents,” he said.
That possibility poses particular challenges for the Intelligence Community because its networks are highly interconnected. Mathew noted that roughly 600 organizations connect to the Joint Worldwide Intelligence Communications System, or JWICS.
As agencies deploy AI across those interconnected environments, Mathew said they need to establish clear boundaries for how autonomous systems can operate. Without those controls, actions taken by one system could have cascading effects across connected networks.
AI Forces Agencies to Respond Faster
Adversaries are also using widely available AI tools to identify vulnerabilities in U.S. systems and software more quickly, putting pressure on federal agencies to detect and patch vulnerabilities at unprecedented speeds, said Roger Greenwell, director of enterprise integration and innovation and CIO of the Defense Information Systems Agency.
The growing volume and speed of cyber threats is placing additional pressure on agency IT teams and increasing the potential for service disruptions during a crisis.
“We can’t afford the downtime,” Greenwell said.
Maintaining availability is particularly important for national security organizations, where senior leaders need access to information to make decisions faster than adversaries. Greenwell said the Intelligence Community is working with industry to develop capabilities that can dynamically patch systems as vulnerabilities emerge.
National Geospatial-Intelligence Agency CIO Mark Chatelain said NGA has successfully integrated AI into its mission, but incorporating the technology into cyber defense presents additional challenges.
That includes using AI to detect threats within network telemetry and enabling systems to respond within microseconds when malicious activity is identified.
“We’ve got to have a pacemaker basically built into our systems,” Chatelain said.
Automation Raises New Change Management Challenges
Technology alone will not solve agencies’ cybersecurity challenges, according to Intelligence Community CIO Douglas Cossa, who said many IT problems stem from organizational culture rather than technical limitations.
One example is employees making unauthorized or uncoordinated changes to systems and networks. Strong change management practices can help agencies prevent those actions while also understanding how modifications could affect other parts of an interconnected environment.
AI could magnify that challenge because automated systems can make thousands of changes in a short period of time. As agencies automate vulnerability remediation, Cossa said they will also need to automate aspects of the change management process.
That capability will become increasingly important as agencies race to respond to newly discovered vulnerabilities.
“We’re going to be in this process of surging patches for at least two years,” Cossa said.
Cyber Defense Starts With Network Visibility
Keeping pace with AI-enabled threats will also require agencies to have a comprehensive understanding of their technology environments, Cossa said.
Organizations need accurate inventories of their hardware and software and visibility into where those assets operate across their networks.
“That is one of the most fundamental questions we need to understand to get our security right,” Cossa said.
Agencies also need to understand where systems are in the IT lifecycle because aging software may no longer be supported or able to receive security patches. At the same time, automating patching and remediation will be increasingly important as the pace of vulnerability discovery accelerates.
Ultimately, Cossa said, agencies cannot take advantage of more advanced cybersecurity capabilities without first establishing basic cyber hygiene, maintaining visibility into their environments and ensuring incidents are reported to the appropriate organizations.
“If you don’t have the foundational cybersecurity principles in your environment, then you can’t operate,” Cossa said.