'The major risk remains a human-directed attack', cyber threat expert warns RFI
Artificial intelligence is changing the pace of cybercrime, helping attackers hunt for security weaknesses, break into computer systems and steal valuable information. For the specialists trying to stop them, the challenge is to keep up. Cyber threat expert François Deruty told RFI this means finding ways to turn the same technology to their advantage.
Issued on: 24/10/2026 - RFI
Much of the concern centres on artificial intelligence (AI) agents: systems that can carry out a series of tasks without a person directing every step.
In July, OpenAI disclosed that agents undergoing cybersecurity tests had bypassed restrictions and breached the systems of Hugging Face, a platform for AI developers.
Separate incidents involving Australian government websites have added to questions about how reliably these systems can be controlled.
For François Deruty, a cyber threat expert at Sekoia, which develops technology to detect and respond to cyberattacks, the biggest danger remains people using AI to carry out attacks.
He spoke to RFI about stolen data, the race to protect organisations and the decoy websites his colleagues use to watch attackers at work.
RFI: In your view, what are the immediate threats posed by AI?
FD: At the moment, it is still data theft, whatever form it takes. It could be contracts or intellectual property – it doesn’t matter. That is what is most valuable on cybercriminal networks and what sells best.
Cybercriminals use AI to go faster, further and [act] more effectively, while making their activities harder to spot. Sabotage, for example, is a risk that frightens us all. It is technically possible, but it is not what we are seeing most at the moment.
RFI: Autonomous AI agents are making headlines. Many people have called for a slowing down of AI development. Is this a real threat?
FD: The Hugging Face hacking incident, when OpenAI’s AI agents “escaped” during a test and attacked another company, raised questions. There were also cases of OpenAI “losing” control of agents that went on to access Australian government health websites. These incidents have prompted a number of statements from Anthropic, OpenAI and Elon Musk suggesting that perhaps we need to slow down.
But in my view, the major risk remains a human-directed attack: one carried out entirely by artificial intelligence, but with a person behind it who uses all that power to attack a target and cause damage.
RFI: Are these concerns being raised too late?
FD: It is never too late. But it is a constant race. Attackers are generally one step ahead because they adopt technologies more quickly. They ask themselves fewer questions and have no ethical or regulatory constraints.
We, the defenders, are more careful: we ask questions about the data we use, why we use it and how. Inevitably, there is a gap. But we develop solutions to close it. When it comes to cyber threats, large companies are perhaps a little further ahead than public institutions. They invest more resources. When government departments suffer data breaches affecting hundreds of thousands of people, putting security measures in place is inevitably a longer and more complex process
RFI: Do you think you can still keep businesses secure given the speed of attacks carried out using AI agents?
FD: I often find myself thinking that things are moving too fast. Even working in this field, I feel it is progressing at breakneck speed. We have to keep up. At the same time, can we really slow down? Is that even possible?
I’m not sure. Saying “I’m not ready” already means falling behind in a way we may not be able to recover from. So we really have to keep up with AI, make up ground and get more involved to ensure we remain in control of how we use it within our organisations.
We really need to recruit specialists to support all the changes AI brings. It is not necessarily all bad. Like any tool or innovation, it has downsides but also a great many benefits. We need to make sure the positives outweigh the negatives.
RFI: At Sekoia, how do you go about learning how AI agents work?
FD: A research team monitors AI systems to model how agents attack, so that we can provide effective alerts to our clients in future.
But these AI-based attack methods change a great deal and very quickly. Previously, I could say, 'This code is malicious and I can detect it because it always has the same signature' – a recognisable pattern. Today, with AI, we might see 500 different signatures, for example. That makes detection very complicated, and the solutions inevitably involve significant costs for public sector organisations and small and medium-sized businesses.
Data-rich systems and weak security: why France is a target for cyberattacks
RFI: Do you come across cyberattacks carried out using AI?
FD: In our line of work, we use what are known as “honeypots”. These are fake websites or companies that we set up online to lure attackers, making them look like an energy company or a major retailer. We then watch how the attackers try to exploit security weaknesses. When attacks are extremely fast, we know that artificial intelligence must be behind them.
RFI: Are you able to identify who is behind these cyberattacks?
FD: It remains difficult. Sekoia belongs to a technical advisory group at Europol, the EU’s law enforcement agency, that helps tackle cybercrime. Attackers have infrastructure spread across the internet, and attacks sometimes span several countries. It is extremely difficult to say with certainty that an attack comes from a particular cybercriminal group or country. We often work with probabilities, but certainty is difficult.
France has recently publicly attributed attacks to Russia, but those attacks took place two or three years earlier. Often, each country, institution or private company holds a piece of the jigsaw. That is precisely what we do at Europol: pool those pieces to build a complete picture of an attack and establish who was behind it.
This interview has been adapted from the original version in French by Jeanne Bartoli.
Japanese company to compensate users hit by cyberattack
GMO Internet, a Japanese internet infrastructure company, will compensate customers for losses from unauthorised trading linked to a cyberattack on its cloud service, and will make a ¥5,000 (€28) goodwill payment to every customer currently using the affected service.
A Japanese internet infrastructure company is compensating customers affected by unauthorised transactions following a cyberattack on its cloud service.
GMO Internet announced on Saturday that it would cover losses from unauthorised trading linked to the attack and issue a ¥5,000 (€28) goodwill payment to all customers currently using the affected service, regardless of whether they had suffered financial losses.
The attack targeted Onamae.com Desktop Cloud, a virtual private server service used by customers to access remote desktop environments. GMO said customer information had been taken and some users had reported transactions in their trading accounts they did not recognise.
According to the company’s founder and CEO, Masatoshi Kumagai, the incident potentially affected 26,739 servers and involved unauthorised operations on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas.
GMO shares fell almost 16% on Monday to a four-month low. The company had a market value of around $2.6 billion at Friday’s close.
The company began investigating on 19 October after receiving a customer inquiry. It confirmed the installation of a malicious programme on some customer server environments on 20 October, suspended new applications and access to the service’s control panel, and began shutting down all servers the following day to prevent further damage.
In a blog post on Sunday, Kumagai apologised for the company’s response and acknowledged that security issues had been identified by its security specialists before the incident, but that the response had been insufficient.
GMO said it had received a ransom demand from a party believed to be behind the attack. In an update to his blog post on Monday, Kumagai said the attackers had demanded $50 million in cryptocurrency and threatened to disclose company and customer information. The company has refused to pay and is cooperating with the police and other authorities.
GMO will offer customers who wish to continue using a Windows desktop environment an alternative service on independent cloud infrastructure, free for six months. It also plans to overhaul its security architecture and investigate the cause of the breach with external experts.
Kumagai has urged the Japanese government to strengthen its active cyberdefence measures, arguing that private companies cannot tackle sophisticated cross-border cyberattacks alone.
GMO has asked the authorities to consider applying the framework to the incident and has offered to share evidence and technical information with investigators.
The attack comes amid wider concerns over cybersecurity following the disclosure last week of two critical vulnerabilities in PHP, a programming language widely used to build websites and applications.
Security authorities warned that the flaws could allow attackers to execute malicious code on vulnerable servers, prompting organisations around the world to patch systems or temporarily take services offline.
However, GMO has not publicly confirmed a link between the PHP vulnerabilities and the attack on its cloud service.
Separately, a Google Cloud outage in the UK disrupted online services last week, including those operated by financial technology company Revolut, showing the potential knock-on effects when digital infrastructure fails.
No comments:
Post a Comment