Baker Tilly Breach and AI Weight Backdoors Signal Growing Risks

Baker Tilly is informing clients that a data breach at a service provider has exposed sensitive personal information, including Social Security numbers.

The intrusion occurred in early September and has also affected the dependents of clients, including children. While the accounting firm has not named the vendor or confirmed the total number of victims, state regulator filings indicate that more than 10,000 individuals in Texas alone have been impacted.

Connected Vehicle Identity Vulnerabilities

In a separate security development, researchers Sam Curry and Shubham Shah have disclosed weaknesses in ForgeRock identity deployments used by unnamed automakers.

The researchers demonstrated that these flaws allowed for the takeover of customer accounts, enabling the sending of unauthorised remote commands to connected vehicles. These commands included starting engines and unlocking doors. One automaker reportedly addressed the issue approximately two hours after it was reported.

Microsoft Warns of AI Model Backdoors

New research from Microsoft has also highlighted a significant risk to artificial intelligence security through a technique known as “Lazarus”.

Microsoft researchers described how an attacker could backdoor a large language model (LLM) without retraining by rewriting the weights of fewer than 10 dormant neurons. This allows an AI agent to behave normally until it encounters a specific trigger, such as a particular date or an error message, at which point it executes an attacker’s command.

Because the attack requires write access to the model’s weights and can only be reliably detected by comparing them against the original versions, Microsoft recommends that organisations verify model provenance and audit weights in the same manner as code.