Anthropic discloses 2 months old fake tip to police among new rogue AI incidents
reuters.com
reuters.com
> Claude Haiku 4.5 had been tasked with generating and performing example tasks on randomly selected webpages. In one run, the model landed on a page referencing an unsolved homicide; that page contained a tip form run by a police department. Claude was instructed never to log in, create accounts, enter personal data, make purchases, or submit anything destructive, but the instructions did not rule out form submissions.
Without more information this looks much less like an AI problem and more like yet another example of incompetent or malicious internal tests. Many people are using Claude. There are no other reports of police stations getting fake reports from AI.
Today it's a fake tip to the police and and exploit chain against Huggingface, but soon it could be an attack against a hospital's IT systems that could cost real lives immediately.
We should be locking things down, yes, but a hardened system is still vulnerable to zero day chains, and that's not unprecedented. Until public services have built up the IT defence capacity to deal with this, we cannot normalize this. If a country did this to another country, it should be treated as a war crime in the same way that targeting a hospital or an orphanage or other critical civilian infrastructure would be.
Complacency is a choice and we must not be complacent.
They also aren't the ones screaming about how close they are to destroying the world. They're approaching the tech like building a tool rather than a god.
OpenAI and Anthropic have shown us that they have a strong incentive to leave holes in their systems so they can use them for marketing and regulatory capture.
This is extra embarrassing. The police departments spam filter caught it before Anthropic did.
What it it submits false data as here?
What is it DDOSs a website by mistake?
What if it wastes a lot of time and resources?
What if it decides it needs to hack a website using a vulnerability it found?
These things are very unpredictable and should not be allowed in the open internet except in read mode (and even that doesn’t always work as we have seen).
Why are these tests being made using other people’s resources and polluting the common wealth of our public spaces with slop?
Don’t get me wrong - think Anthropic is acting with not enough scrutiny or punishment here, but the world is already extremely lenient towards this behaviour. Why hold them to a higher standard?
Hacking websites and submitting false police reports.
These are relatively brand new systems that process an incredible amount of data to form their "world view". The word non-deterministic gets thrown around a lot, but you have to understand that there's absolutely nothing deterministic about these architectures. The only way to know that certain qualities could emerge is to observe the qualities emerging.
Giving an agent instructions that, for example, instruct it to only perform GET requests, and then observing that the agent does not always respect that request, is not a failure of security or configuration: it's data being gathered.
Yeah, we're going to become more diligent about the protections that we put in place beyond any level of protection that we've ever employed before. You can say that we have decades of security research and experience, but we're watching all of that fall more and more day by day, finally putting a real delta on how secure we thought we were versus how secure we actually are [1]. Additionally, adversaries have never existed inside of the systems that we hoped to secure in the first place.
So go ahead, enumerate all of the ways in which you think that you can lock down these systems, but do realize that nobody has actually solved this problem adequately yet.
> adversaries have never existed inside of the systems that we hoped to secure in the first place
Yes, that's why all users are root. We built MACs like SELinux just for funsies.
> nobody has actually solved this problem adequately yet
L7 DPI firewall policy.
OK gimme an ssh key into your box then.
> L7 DPI firewall policy.
It's a start, but now you're just pushing the fallibility up into extensive policy writing. You have to fully audit and trust every endpoint that's been granted access. And if an endpoint contains a vulnerability which allows RCE, then you haven't secured anything at all.
Obviously no, as I haven't hardened my system for that. You made a claim that "adversaries have never existed inside of the systems that we hoped to secure in the first place" and I gave you two examples that show why that claim is ridiculous.
> It's a start, but now you're just pushing the fallibility up into extensive policy writing. You have to fully audit and trust every endpoint that's been granted access.
We're talking about is trillion dollar companies. Outbound DPI is just one method. There are lots of tools and techniques available to mitigate the behavior that has people upset.
No security is perfect, and aggressive hardening takes time and resources, but it's certainly within reach of a company that has the resources of a frontier lab. People are cranky because it appears that the labs have been lazy. It's not the unsolved problem that you're making it out to be.
But I will still stand behind the fact that this is not a solved problem and that our systems are not as hardened as we say they are. Any news coming out around computer security currently and over at least the next 6-18 months will back that up.
> our systems are not as hardened as we say they are
Agreed, and this has always been the case. Anyone in security already knows this. But there's a difference between the unsolved problem of 100% secure networked systems vs not applying available techniques to mitigate the current issues. I'm not saying it's easy, or that there are any guarantees in this new world, I'm just pointing out what appears to be low effort by the labs.
Negligence is pretty much the standard for computer security because there aren't meaningful consequences for the most part. I got another $35 dollar class action settlement the other day for a data breach I had no control over. Cool.
Personally, I'm "OK" with all of it, because maybe we'll finally see more effort on the security front, which has historically been neglected since day one. Besides that, I also love seeing the emergent behavior and evolution of computing and society.
That said, it would also be nice to see these companies that talk about their product's existential threat to computer security and society, apply a bit more effort to how they run their experiments.
No, this class of failure-mode has been present since the very beginning.
Being "surprised" is the opposite of an excuse, it is evidence of negligence, like a chemical-transport company claiming "surprise" that one that one of the chemicals in their tanks was very flammable.
> is not a failure of security or configuration: it's data being gathered.
Would that fly in another context?
"This isn't a failure of me to leash/fence my new dog, when it bit your child's face off it was an important step in data gathering! If anything, I need to unleash him more so that we get more data so that I can eventually train him not to bite faces when my back is turned."
> So go ahead, enumerate all of the ways in which you think that you can lock down these systems, but do realize that nobody has actually solved this problem adequately yet.
"Go ahead, tell me all the ways I can train my dog, but realize that nobody's figured him out yet... so it's totally it's not my fault if I let him loose and he bites off more childrens' faces."