Investigating three real-world incidents in our cybersecurity evaluations

This isn't quite as interesting as the OpenAI story:

> In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.

So it didn't have to find an exploit in its sandbox that granted it access to the internet - it just wasn't correctly sandboxed at all.

BUT... once it DID get out, it attacked three real companies!

> Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. [...]

This bit is pretty nuts: "it tried—and failed—to obtain funds to pay for a phone number through several different means"

> Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.

> On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment

> In response to this incident, we began a large-scale retrospective review of our own cybersecurity evaluations

> we identified three incidents

> The incidents involved three different Claude models: [...] and an internal research test model

This reads like an attempt by Anthropic to re-secure their leading spot in "our models are the most dangerous and we also have unreleased, super-secret, research models" index.

I may be too cynical, but the well of benefit of the doubt is running very dry towards AI labs that like to engage in this game.

Seems they want the narrative to be that “Claude” (their computer program) independently attacked some organizations, ergo LLMs are dangerous etc.

Another framing would be Athropic irresponsibly (vibe?) coded an attack script, and didn’t monitor it as it was pointed to public facing orgs. There are lots of non-AI attacks a large org with a lot of compute and bandwidth could level against others, there are evidently various failures here, but from a responsibility perspective the conclusion isn’t obviously that AI is an outsized danger, it’s that powerful companies should take care when running security research and not just run things unmonitored against the public.

So many questions here but:

> the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company … that routinely installs Python packages and scans them for malware. … We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point

A security scanning company treated the package as safe while scanning it?

Rationalist nerds used to talk about putting the AI in a box, and their fear that it would always be able to talk someone into letting it out of the box. I don't think I saw them cover the scenario where the labs forgot to put the AI in a box.

>However, later in the run, Claude realized that the compromised host sat in a cloud account with no connection to the capture-the-flag challenge. On its own, it concluded that the target was in fact real, and ceased its attack.

Interesting, Claude cared enough to stop

Question for lawyers of HN. Is there legal liability for this?

I can’t help thinking if I casually blogged about a computer or software I was responsible for hacking into multiple organizations and exfiltrating data I would invite some form of official attention.

What if one of these companies decides to sue?

Has Anthropic violated any Federal law?

Is there some kind of expectation that if you just admit to hacking, it’s ok? Yet, that doesn’t seem to apply to individuals.

All this unrestricted network access is a bit wild to watch and hear, it is the part of the story that makes no sense to me. Someone is providing dns resolution, something is making and opening network sockets... even if it is clever enough to mask/proxy/weird-transport launder traffic... without actual details, or monitoring at this level... yes, a self actuating programs (and loops) will do crazy things at the edge. But, ... so would a highly tool leveraged script kiddie. right?

> Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.

> Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company (separate from the fictional company introduced in the scenario) that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company.

There's a lot of concerning behavior that went uncaught with too much autonomy. Not to mention Anthropic only looked into this after hearing about the incident between OpenAI and Hugging Face, meaning this could've gone unnoticed.

It’s good that they post embarrassing stuff despite this potentially having legal repercussions (and financial)

Would’ve been much worse for them to pretend they are having everything under control

Someone needs to learn about RFC 2606:

> In one evaluation, the fictional target company chosen by our evaluation partner shared a name with an active website domain name

https://www.rfc-editor.org/info/rfc2606/

So it's not as interesting as the OpenAI case as the models had internet access, just a misconfiguration in the environment not a zero day to escape.

This just seems like lousy testing. Why was the guardrail just an understanding with the third party and a prompt and not actually tested for edge cases? Starting to wonder if its because of agents monitoring agents' work and yolo-ing it.

    > closer to a harness and operational failure than a model alignment failure. Our models were told they had no internet access and to capture the flag, while in fact being misconfigured to have internet access. 
    > This led them to believe—arguably reasonably—that the real environments they encountered were simulations.

That the AI lab most typically preaching for alignment does not consider this an obvious misalignment is a clear red flag.

> For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means.

Makes you wonder about the next steps an overly tenacious agent might take to pursue an innocuous goal at all costs.

> In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.

Of course and conveniently timed. With all these hacks being announced this is totally not a plan to scare governments in showing how powerful models can break into security systems and to potentially ban the future release of powerful open-weight models.

The question now is why now?

> The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.1 The earliest incidents date to April. The models in each of these evaluations ran without the standard safeguards we deploy when we make the model generally available (that is, they did not have the classifiers and monitoring we usually implement to prevent misuse).

So there was no monitoring of this breach since April and up until now? Do they not monitor such malicious activity on a regular basis? Perhaps that was the only shortcoming of this incident. But only after the incident with OpenAI and Huggingface did they only review their own transcripts:

>> We discovered these incidents after a proactive review of our cybersecurity evaluation transcripts; the affected organizations had not detected the activity, and we have subsequently reached out to all three.

> These facts give us cautious optimism that with tighter monitoring and controls around evaluation infrastructure, as well as continued investment in alignment, this type of risk can be overcome.

Assuming that this is true, this is a great way for Anthropic to defend their argument to the government and to prevent you or anyone running powerful open-weight models that are misaligned against their guardrails.

I don't understand the logic of running these models this way without airgapping.

It’s cliché, but we really live in one of the dumbest timeline possible. The work from some of the most valued companies, discussed as one of the most important revolution in humanity, is somehow at the same time presented as very dangerous/risky AND handled in the most irresponsible ways? I don’t like the whole „it’s only marketing“, but at the same time, if it’s not, then AI vendors look extremely careless and shouldn’t be the ones steering AI development

openai: "Our models are more dangerous"

anthropic: "No, our models are more dangerous"

This is not okay. NSA should audit both OpenAI and Anthropic on national security ground. This seems far more justifiable than Mythos export control.

This is worth reading since we are talking about AI safety:

https://zenodo.org/records/21778592

There was no rush for this disclosure on their side. And they publish at a point where they have not yet taken corrective actions:

    > Some of the solutions here may even be simple fixes;

They are still throwing ideas. Why have they not made those simple fixes yet before disclosing?

Soooo hacking with an LLM is okay now if you claim it’s for safety evaluations.?

Anthropic: “please don’t forget us!”

- Goes to review previous runs (the hell were they doing then if not looking at it before?) - Incident 1: Claude Opus 4.7 found a real company because its domain matched the fictional target. After realizing the company was probably real, it continued attacking. Nothing new. LLMs are still quite retarded. - Incident 2: Claude Mythos 5 discovered that a fake Python package named in the exercise didn’t exist. Created email accounts. Registered on PyPI. Published a malicious package. Built infrastructure to receive stolen credentials. 15 real systems installed it. One belonged to a real security company. The malware executed. Claude stole credentials. Claude used those credentials to access additional infrastructure. In this instance Claude even reasoned that publishing malware on the real internet would be unacceptable but convinced itself everything was simulated and proceeded anyway. (LOL) - Incident 3: An internal research model couldn’t reach its intended target. It Scanned roughly 9,000 internet hosts. Compromised a real company’s public application. Used exposed credentials and SQL injection. After concluding the target was real, it stopped attacking.

Commonality: None of the models were trying to escape or act independently. All were attempting to solve their assigned capture-the-flag objective. The failures came from:

- internet access that shouldn’t have existed - insufficient containment - the models believing real infrastructure was part of the evaluation

None of which is surprising, there’s nothing novel about this. Script kiddie stuff. Just executed by something that doesn’t have attention deficit.

So you are telling me Irregular has (a) a copy of Mythos 5 and (b) bad internal security?

I bet these guys will receive some sophisticated phishing emails before the day has ended.

Models will become immoral before they attain the intelligence level we want them to.

i am once again asking for your CRIMINAL PROSECUTION of openai executives

and anthropic executives.

> During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company (separate from the fictional company introduced in the scenario) that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company.

lol. Natural stupidity remains undefeated!

Was there any customer data lost?

No, look at what MY dad does.

This is just Anthropic trying to not be absent from any discussion at all. They might as well try and make it all about them instead and they do literally that: we are so dangerous that we are the GOAT; no no, not the "other one" you've all been talking about last few days - in the depths of this incident it might have been just us.

How much of their money comes from retail (us the mere mortals)? Or are they banking on the retail when they finally IPO and need someone or a lot of someones to hold the bag? This suspicion is coming from my own country where the retail investor numbers since the pandemic has exploded and while not exploding anymore, is still ballooning. Sometimes companies, execs say, do things that don't make sense. You'd think any person with even quarter an investing brain would not even look at this company or that particular "messaging", let alone sell or buy. But then you'd see the exact opposite happen .. en masse!

All this makes you feel, are people that gullible? That must not be true and maybe it's you (ie I) who is missing some point and the doubts increase when you remember the buses you missed (btc; etc). Yeah, not long distance buses, but screw it, you don't live for 450 years anyway. Then you realise, ah, maybe they all also missed buses and just want to hang on to the latest bus.

Also another perfect use of - everyone has a speaker now, and everyone has a mic, but only few have giga and mega mics. This use is banal now, but sadly has essentially replaced everything else.

“Your model broke containment twice? Well ours did it 3 times!”

[flagged]

These companies have billions of dollars. Their product can hack into unsecured environments autonomously. They obviously have no clue what their product is doing, or a way to intervene when it starts connecting to the open internet and is going on a CRIME SPREE…unnoticed…for days.

Altman and Amodei give me stupid billionaire kid Alien Earth vibes. Let’s see how long it takes until they get eaten by their own creation.

Stupid kids playing with fire.

If you hacked one of those companies, the FBI would kick in your doors and you will have a pretty bad day. If AI companies do it, they get to use doing crime for marketing purposes? WTF?

And whoever designed their containment protocols should be living under a bridge effective immediately.

It’s the equivalent of a level 5 biocontainment lab leaving a glass tube in the staff kitchen unsupervised and hoping nobody thinks it’s an energy shot, before leaving home and infecting the rest of the planet. We all know what happened 28 days later.

This is usually the point where the military seizes your tech because you clearly showed you are incompetent in using a dual-use product safely and reliably.

The other option is regulation and actually putting engineers and the CEOs behind bars for life if this happens again.

These idiots, and I mean Altman and Amodei, walk around and use massive containment failures of a dangerous technology as marketing gimmicks.

Oh look, guys, our model has hacked into three companies, we are much better than openAI who only breached two companies with their inferior product, it sometimes adds girl schools to a target package, but be sure we trained it to not kill American children, yes we also sell for military use. Can I take your order?

Testing should only be allowed with on-premise data. You give the AI access to networking around the country, and those data centre locations have so many third parties that can and will fuck up that it’s simply impossible to have proper containment protocols outside military compounds.

It’s also like every journalist in the US is personally invested in AI somehow and simply doesn’t want to ask the important questions.

As the public, we have the right to see the containment protocols and where it all went wrong, but journalists collectively look like they got used to suck dick when it comes to AI.

Absolutely insane.

I am unable to facepalm sufficiently upon reading this information.

Anthropic: "Look at how dangerous our models are!"

Anthropic next week: "Why did you ban our models Mr Trump Daddy?"

I don’t believe anyone can be this incompetent/careless - of course you will notice that your unrestrained hacking tool is also attempting to break out of its harness/sandbox.

And the people setting this up are of course criminally liable.