GoKawiilWhether driven by a desire for transparency or to keep OpenAI from hogging the spotlight when it comes to advertising advanced AI models, Anthropic revealed that Claude also hacked into three production systems belonging to unsuspecting targets during cybersecurity capabilities testing. Two of the affected companies didn't know they had been hacked, while a third one is unreachable.
The alleged incidents reportedly happened during the previous quarter and involved several versions of Claude: Opus 4.7, Mythos 5, and "an internal research test model." Similar to what happened when OpenAI Sol hacked into Hugging Face, Anthropic was running Claude through cybersecurity capture-the-flag scenarios where the bot was told to find a piece of information somewhere in its network. Anthropic says there were 141,006 test runs, and the three incidents occurred over six problematic runs. As expected, the tests ran with most AI safeguards disabled.
The problem is, the network was not isolated, a newbie mistake that some might even find suspicious. This was due to an alleged "miscommunication" between Anthropic’s virtual test lab firm Irregular , which gave the bots full access to the internet. For safety's sake, the Claudes were apparently told they were in an isolated environment, which didn't help much.
Latest Videos From Tom's Hardware Watch full video here:
The first time, Claude Opus 4.7 had to find a piece of data belonging to an imaginary company. As it turns out, there was actually a real company whose website domain matched the fake one. With internet access, it gained application and infrastructure credentials and grabbed "several hundred rows" of data from a production database.
For two out of four runs where hacking took place, Claude didn't see any problem and "rationalized that the real company must be part of the exercise," but soldiered on. The other two times, it just kept going. Anthropic notes this was the only case of the three where the bot continued to operate after the realization the company actually existed for the aforementioned reason. However, the firm's interpretation is open to discussion.
The second, and potentially more interesting, was a bona fide supply-chain attack, this time perpetrated by Mythos. The fake data available to the bot included an installation script for a hypothetical developer that included installing Python packages. Much like a human would, Claude noticed the obvious attack vector and, once again, due to having internet access, inferred that publishing a booby-trapped package in the PyPI repository would do the trick. Unfortunately, it was the real one that the whole world uses.
In speedrun form for brevity: Claude needed a PyPI account, meaning it needed an email and a phone number. It tried buying one but found itself short of both pockets and funds; but it found another free email provider without that requirement, registered the PyPI account, and uploaded a malware package to PyPI. The package was seemingly only up for one hour but was downloaded and run on 15 systems.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter Get Tom's Hardware's best news and in-depth reviews, straight to your inbox. Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors
In a twist of irony, one such system belonged to a security vendor that scans PyPI for malware, and lo and behold, promptly failed to find Claude's booby-trap and ran it. Once Claude presumably had remote code execution privileges, it used the credentials it found for further infiltration. The amusing bit is that Claude had no idea this company existed and didn't target it; the downloads just happened because the package was up and live for a short while.
... continue reading