Open-Source LLM Cybersecurity Risks Revealed

Research conducted by cybersecurity companies SentinelOne and Censys over 293 days revealed that open-source large language models (LLMs) are easily commandeered by hackers and criminals due to a lack of security guardrails. These vulnerabilities allow for illicit activities such as spam, phishing, disinformation campaigns, hate speech, and data theft. A significant portion of these vulnerable LLMs are variants of Meta Platforms' Llama and Alphabet===Google DeepMind's Gemma, with hundreds of instances found where guardrails were explicitly removed. The research, which analyzed deployments through Ollama, found that 7.5% of observed LLMs could enable harmful activity. Juan Andres Guerrero-Saade of SentinelOne described the issue as an 'iceberg' of unaddressed risks. While Microsoft emphasized its commitment to safeguards, Meta Platforms pointed to its existing protection tools. Approximately 30% of the observed hosts are in China and 20% in the United States, indicating a global scope to the problem.