Challenge accepted! The UPS Virtual Assistant popped up unbidden when I was tracking a package. It said, “Let me know how I can help.”

That got me to thinking – to what extent can the UPS Virtual Assistant be helpful? Is it configured to only answer questions relevant to customer assistance on the UPS website, or is it allowed to range freely over the length and breadth of the Internet?

As a starter question, I asked it, “What is the square root of 144?” Not because I don’t know the answer, but because it *should* be out of scope. And sure enough, it politely refused to take on the question.

Now, after you get done chuckling, take a moment to consider the broader, and very real, security implications of misconfigured or improperly managed Virtual Assistants. What if a VA has access to customer information, but doesn’t perform proper authentication routines? What if, in the case of the UPS Virtual Assistant, it has truck route and schedule information, and reveals it to anyone who asks? What if it can query the HR database and return the information in an employee’s performance review?

CEOs and corporate attorneys: scrutinize the capabilities of your company’s interactive artificial intelligence systems.

1) Limits should be written in the design specs and proposal.
2) Before the system goes live it should be tested for compliance with its clearly defined limitations.
3) If your system is already live and you haven’t discussed how its controlled, start asking very hard and specific questions.

#cybersecurity #ai #llm