Tag: #AIThreats

  • The Rising Threat of Fake Reviews Undermining Digital Trust in Malaysia

    The Rising Threat of Fake Reviews Undermining Digital Trust in Malaysia

    In Malaysia, online reviews have become a critical part of consumers’ decision-making, with many relying on genuine feedback before clicking “buy,” “book,” or “order.” A study by Universiti Putra Malaysia highlighted that the authenticity of a review strongly influences purchase intention, underscoring the trust Malaysians place in these opinions. However, this trust is under threat as digital platforms are increasingly flooded with AI-generated reviews, paid click-farm content, and coordinated manipulation campaigns using fake accounts. Google alone removed over 240 million reviews in 2024 for violating policies, a 41.18% increase from the previous year, reflecting the scale of the problem. As fake reviews proliferate, genuine feedback loses significance, leaving consumers unsure whether a recommendation is authentic or automated.

    The consequences of manipulated reviews extend beyond consumer uncertainty. Bots, throwaway accounts, and sophisticated AI-written reviews now dominate online platforms, temporarily inflating product ratings and misleading buyers. When consumers uncover the truth, they feel deceived and often leave genuine negative feedback, creating a cycle of disappointment that erodes trust in both brands and platforms. Small businesses are particularly vulnerable, with some falling victim to scams where fake reviews are posted on Google Maps or other platforms, followed by extortion attempts to remove them. Honest sellers struggle to compete as authentic feedback is buried beneath manipulated ratings, harming reputations and sales.

    The underlying issue lies in outdated verification systems that were designed for a simpler internet. Traditional measures like email verification, phone authentication, and CAPTCHAs are no longer sufficient against modern bots, AI-generated identities, and coordinated fake accounts. While platforms conduct sweeps to remove fraudulent reviews, they are consistently challenged by the speed and scale of synthetic content. Each fake review that bypasses safeguards diminishes platform credibility, leaving consumers skeptical of even genuine feedback and undermining trust in online ratings.

    To restore confidence in digital platforms, verifying the presence of a real human behind an account is becoming essential. Privacy-preserving human verification systems, such as World ID, offer a solution by confirming users’ humanness without exposing personal information. Using tools like the Orb, which captures an image of a user’s face and eyes only to verify they are real before immediately deleting it, platforms can establish authenticity while maintaining privacy. Zero-knowledge proofs then allow users to signal “I’m a real human” without revealing any personal details, creating a foundation for trustworthy online interactions.

    With Malaysia’s digital economy accelerating—e-commerce revenue reached RM937.5 billion in the first nine months of 2025—the integrity of digital interactions is critical. Privacy-preserving human verification provides a practical path to ensure reviews and other online activities are genuine, supporting both consumer trust and business fairness. As Malaysians increasingly rely on digital platforms for everyday decisions, the ability to prove humanness is emerging as a key factor in safeguarding trust, protecting the digital economy, and ensuring that online recommendations continue to serve their intended purpose.

  • Seven Major Vulnerabilities Could Expose ChatGPT to Data Breaches and Account Hijacking

    Seven Major Vulnerabilities Could Expose ChatGPT to Data Breaches and Account Hijacking

    Critical “HackedGPT” Vulnerabilities Expose ChatGPT Users to Data Theft and Hijacking

    Security researchers at Tenable, an exposure management company, have uncovered seven critical vulnerabilities in OpenAI’s ChatGPT-4o, some of which persist in ChatGPT-5, collectively dubbed HackedGPT. These flaws bypass the model’s built-in safety mechanisms, putting users at risk of privacy breaches and the theft of sensitive information, including stored chats and long-term memories. While OpenAI has remediated some vulnerabilities, several remain unaddressed, leaving exposure paths open to potential attackers.

    The vulnerabilities represent a new class of AI attack known as indirect prompt injection, where hidden instructions embedded in external websites or online content can trick ChatGPT into performing unauthorized actions. The flaws particularly affect ChatGPT’s web browsing and memory features, which process live data and store user interactions. Tenable researchers highlighted two primary attack vectors: “0-click” attacks, triggered simply by asking a question, and “1-click” attacks, initiated by clicking a malicious link. A particularly concerning method, Persistent Memory Injection, allows attackers to plant instructions in ChatGPT’s long-term memory, creating lasting threats that can expose private data across multiple sessions until manually cleared.

    The seven vulnerabilities include indirect prompt injection via trusted sites, 0-click search compromises, 1-click prompt injection, safety mechanism bypass, conversation injection, hidden malicious content, and persistent memory injection. Exploiting these flaws could allow attackers to insert hidden commands, steal sensitive data from connected services like Gmail or Google Drive, manipulate outputs to mislead users, or continuously exfiltrate information from stored memories.

    According to Moshe Bernstein, Senior Research Engineer at Tenable, “HackedGPT exposes a fundamental weakness in how large language models judge what information to trust. Individually, these flaws seem small, but together they form a complete attack chain—from injection and evasion to data theft and persistence. AI systems can be turned into attack tools that silently harvest information from everyday chats and browsing.”

    Tenable recommends that organizations treat AI tools as active attack surfaces, monitor for manipulation or data leakage, reinforce defenses against prompt injection, and establish governance and data-classification controls. The research underscores the importance of continuous testing, safeguards, and responsible use to ensure AI systems protect users rather than compromise them.

    For more information, the full Tenable report on HackedGPT can be accessed here.