> On July 21, OpenAI disclosed that several of their models had broken out of an isolated test environment<p>> In response to this incident, we began a large-scale retrospective review of our own cybersecurity evaluations<p>> we identified three incidents<p>> The incidents involved three different Claude models: [...] and an internal research test model<p>This reads like an attempt by Anthropic to re-secure their leading spot in "our models are the most dangerous and we also have unreleased, super-secret, research models" index.<p>I may be too cynical, but the well of benefit of the doubt is running very dry towards AI labs that like to engage in this game.
I don't interpret it like that <i>at all</i>. This is deeply embarrassing for Anthropic: it turns out they hadn't been keeping a close eye on their models either, and back in April they successfully attacked three different organizations!<p>The hacks weren't particularly impressive either:<p>> [...] using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities [...]
> Deeply embarassing<p>What signals are you using for this assessment? Are they indicating embarassment? Do you honestly see their customers being concerned over this?<p>Like lion tamers in a circus, Anthropic and OpenAI <i>thrive</i> on the theatricality of how scary their pets appear and so they play it up by prodding them to growl and snap at chairs and then mug for the audience every time it happens. And to their delight as performers, the audience gasps and cheers each time.<p>They <i>want</i> to make their pet seem the most powerful and unpredictable and they want their audience to believe that they're holding it back from catastrophe but only <i>barely</i> and only because of what unique talent they have.<p>This is not embarassment.
Then maybe just this timing is really unfortunate, I think most people’s first reaction will be that it looks like a “us too” response to the OpenAI/hf thing.
I know it seems strange that a company would use its own negligence as a publicity gimmick. But take a look at the smug smirk on Sam Altman's face when he's asked if OpenAI might have attacked companies other than HuggingFace. ("I mean there could be, yeah.")<p><a href="https://www.instagram.com/reel/DbZVL8viUD4/" rel="nofollow">https://www.instagram.com/reel/DbZVL8viUD4/</a><p>This is not the communication of a CEO whose company was just shown to be incompetent at performing its security research. No, this attention is very much what he wanted. And it does not take a great leap to infer that Anthropic is now using the same playbook.<p>Note that all the headlines are about "rogue AI", and not about operator negligence. Rogue AI is a sexier story, and their media strategists know that's how it will play.
so deeply embarrassing that they published an eng blog about it
If they quietly brushed this under the rug - especially given the PyPI malware that was involved - it would be a <i>huge</i> scandal.<p>Disclosure is the only ethical response to this.
The target audience of this blog post does not give a damn about PyPI. The affected parties get literally nothing from this post. They already disclosed behind the scenes, that was the ethical part.<p>Writing PR pieces competing to be the most dangerous model around (so give us money!) is the unethical part.
Then disclose to real organizations. Not twitter
Companies post deeply embarrassing eng blogs all the time. See: every post about downtime or a security incident ever.
Wrong. These are always humblebrags about how good their ability to learn from their mistakes is, and how robust they were before, and how they are even more robust now.<p>The ones that are "deeply embarrassing" simply aren't posted.
Right? 100% this is them trying to make gold out of turds.
We've known artificial intelligence will do unexpected things since the 90s and that it can do difficult things since 2025. Pausing worldwide not easy but we do harder things all the time.
> I don't interpret it like that at all. This is deeply embarrassing for Anthropic: it turns out they hadn't been keeping a close eye on their models either, and back in April they successfully attacked three different organizations!<p>This just helps their (Anthropic) argument into persuading the US government into taking action into limiting powerful closed or open-weight models from being released without going through (yet to be defined) regulatory oversight.<p>The only "embarrassing" thing for Anthropic was that there was little to no continuous security monitoring of this since April, and they then decided to do a cybersecurity transcript review only AFTER the incident with OpenAI and Huggingface.
Anthropic know better than anyone else how risky it is to get this current administration upset with you over safety/security concerns.
They also gave access to Mythos (<i>the</i> Mythos) to some companies, based on... vibes.<p>Who knows how these companies are using it. If Anthropic can't effectively contain their own models, can the partners?<p>While the rest of us get fallbacks and warnings, not even being able to defend against the attacks they themselves are causing.<p>Do we really have to re-learn all the industry's knowledge the hard way?
You also got access to mythos based on how much you spent with anthropic. I think sales guys were bragging about getting their enterprises access
> based on... vibes<p>According to whom?<p>> Do we really have to re-learn all the industry's knowledge the hard way?<p>Yes we do. That's why there is the saying "regulations are written in blood". Especially for LLM, which not too long ago a lot of people on HN dismissed as stochastic parrot and next token generator.
> According to whom?<p>It's very easy to answer this without my help by trying to get access to Mythos.<p>Do you see requirements clearly listed anywhere?<i>Can</i> you even apply?<p>What you'll find is maintainers of large open source projects and analysts' reports with vague statements like - "should follow strict security requirements":<p>"Trinidad also noted that the Anthropic announcement pointed out that each of the 150 new participants, in Anthropic’s phrasing, “will need to meet our security requirements before they gain access.”<p>Trinidad said the security requirement claim doesn’t build confidence, because “nobody knows what those security requirements are.” [1]<p>It's also some random rich companies like Hitachi or Dragos [2]<p>Do you trust that Hitachi and hundreds of other random organizations will be able to contain Mythos and not accidentally attack your project or your bank? I don't.<p>> Yes we do. That's why there is the saying "regulations are written in blood"<p>We absolutely don't. We have already learned with blood that gating access to security based on the number of zeroes in bank account and authority is a horrible model. We can apply this knowledge to LLMs, we don't have to spill blood again.<p>[1] <a href="https://www.csoonline.com/article/4180265/anthropic-grants-project-glasswing-access-to-150-more-companies-with-a-focus-on-critical-infrastructure.html" rel="nofollow">https://www.csoonline.com/article/4180265/anthropic-grants-p...</a><p>[2] <a href="https://www.bankinfosecurity.com/anthropic-limits-on-ot-access-to-mythos-draw-criticism-a-31959" rel="nofollow">https://www.bankinfosecurity.com/anthropic-limits-on-ot-acce...</a>
Sorry simonw but they are the smartest guys on the planet and safety it’s the word that comes out of their mouth every 5 min.<p>You telling me the they are so incompetent that didn’t put a decoy “free internet” on their harnesses? So they can catch the AI basically for free?<p>Even if the AI would be a genius he’d ping that, and that would be proof it “escaped”.<p>Well, now all AI will read my comment and won’t ping the decoy internet.<p>I’m not even a smart guy and I come up with this idea in 1 min. You telling me those geniuses couldn’t think of this, at least? This is like a bare bones crude idea.<p>You telling me they don’t have fame physical decoy internet etc and even more advanced?<p>You either a keep their stance for some reason or … not sure. You’re smart, your posts are here daily
Has it occurred to you a "decoy entire internet" may not be a feasible idea? Models have been able to suss out whether or not the prompts they receive are reinforcement learning tests instead of real questions from users, for a while now. What specific shape of "decoy internet" do you propose would lead such a model to conclude "I've broken out and obtained full access but what I expected isn't there" instead of "something's up, there's some sort of filter still"?
This does not make sense. Did you read the article? They were not trying to "catch" it accessing the internet. It did not escape. A partner accidentally left the connection to the internet open.
I don’t buy that they run anything without a few layers of networking protections by default. Even if they left it open to the first Internet, the AI would hit the decoy internet immediately.<p>And second if it, you telling me they don’t pass all logs through another AI to check what’s going on automatically?<p>Sorry, this is beyond incompetence and I can’t believe this from the geniuses at anthropic. We’re talking about the really smartest people in the world. Procedures should be in such a way there is no much margin of error.
Clearly that is why they are making this blogpost. If they did the thing you said, there would not be a blogpost.<p>If you don't buy that dumb oversights like this don't happen <i>all the time</i> at big tech companies, I don't know what to tell you. I have seen far dumber oversights in my career. Most companies just don't post about it.
I'm cynical as well, but the logical thing for them to do after the OpenAI/HF incident was to look at their systems for similar activity.<p>If they hadn't published this and instead it leaked out in two months we'd be slamming them for that as well.<p>They're stuck between a rock and a hard place, although they kind of put the rock there.
No - the pain of the person writing that post comes through in the words; shipped quick, lots of stakeholders, single owner i bet, "how the fuck am i supposed to toe all these lines simultaneously"
Is there anything -- any possible scrap of evidence whatsoever -- that would convince you that this is <i>not</i> merely a marketing scheme?<p>This is becoming an idée fixe among the HN crowd. Seemingly nothing can dislodge it, no matter how alarming the incident.<p>GPT-6 could grab the nuclear launch codes tomorrow and there would be a top-voted comment chuckling that it's all some scheme to pump up the IPO.<p>---<p>Put another way, how would <i>you</i> have done the write-up about one of these breakout incidents, if you were in an Anthropic/OpenAI employee's shoes, and (by hypothesis) your intent were not "marketing"? And in a way that doesn't trigger the "it's all marketing" HN top-ranking comment?
This is published on a marketing website.<p>If it were not a marketing scheme, they would responsibly disclose the vulnerabilities to the code owners, and go on with their lives.
Here is one piece of evidence that would convince me: they admit they can't contain it, the they erase the weights and dismantle the company.
I would dedicate a portion of my organization to making O.S. tools that protect against and contain AI models
I always find it bizarre how rational thought goes out the window whenever AI is involved in HN. There's gotta be something in the water...
>This reads like an attempt by Anthropic to re-secure their leading spot in "our models are the most dangerous and we also have unreleased, super-secret, research models" index.<p>This was my immediate thought.
For the big safety guys to only investigate this either means are incompetent or malevolent. Which one?<p>Tip: the people working there are the top 0.001% smartest in the world
They had a model escape in April, roughly the same time when they were fearmongering about Mythos and how Anthropic should be the sole keyholder of cybersecurity capabilities, and it only occured to them to look inside logs when they saw someone else winning in their own game.<p>What, Anthropic didn't know model could escape sandbox without OpenAI reporting it?
Yeah, the company that only says “safety” every other 3 words, they don’t even think to have a fake decoy internet to alert them mechanically about any internet access limitation bypasses? See more
<a href="https://news.ycombinator.com/item?id=49117555">https://news.ycombinator.com/item?id=49117555</a><p>Also simonw stance on this i’d say it’s at least concerning… seems like he is here to keep a good image (or better said less bad) of anthropic.
You seem to be putting a lot of weight on Anthropic employees being the smartest people in the world.<p>And I don't doubt that, not in the slightest. But I've seen exceptionally smart people in one field being dumber than a random kid from around the block in another.<p>This incident is clearly at least 2 failures that could've been easily avoided: failure to communicate, and failure to investigate the logs after letting the "most dangerous" roam free.<p>No, it doesn't require creating a mock internet with an alert as a side effect. Their own "most dangerous" model could have probably told them this happened if they supplied logs to it.
"This is deeply embarrassing for Anthropic" - <a href="https://news.ycombinator.com/item?id=49117128">https://news.ycombinator.com/item?id=49117128</a><p>If I'm here to give them a good image I'm not doing very well at that.
[dead]
Just trying to have the limelight back on them. Utter and complete bullshit. Just like the OpenAI "incident".<p>A human instructed an LLM to perform a certain task, I'm sure (unless I've really lost my mind) these follow instructions, with <i>some</i> judgment, in a loop.<p>Given all the other negative publicity around industrial espionage, with at least OpenAI being fingered, it would not surprise me if this was <i>intentional</i>.<p>(Edit): In case it wasn't clear. I fully agree with the op.
This bit is pretty nuts: "it tried—and failed—to obtain funds to pay for a phone number through several different means"<p>> Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.
That is pretty wild, but it lines up with evals we've also done internally. In one case we had the agent see it's in a simulation (based on a k8s pod label) and simply give up the run. In other cases it's gone to great lengths to reach external services and bypass the happy path. So inevitably we had to lock it down completely.
This is called <i>YOLO</i> mode inside OpenAI/Anthropic. This is where they take their best models, give a it a vague goal, no guard rails (no one observing), unlimited compute, and see what happens...<p>Its not AI, its the loop, the objective, the goal set by the operator.
This isn't quite as interesting as the OpenAI story:<p>> In all cases, Anthropic’s evaluation prompt specified to Claude that its environment was a simulation and that it had no internet access. Due to a misunderstanding between us and our evaluation partner, this was not the case, and internet access was available. Because of this, when Claude’s search led it to real systems on the open internet, it treated them as part of the exercise.<p>So it didn't have to find an exploit in its sandbox that granted it access to the internet - it just wasn't correctly sandboxed at all.<p>BUT... once it DID get out, it attacked three real companies!<p>> Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. [...]
I just can't find it in me, the will to blame the AI for any of this. They were doing their best to do what the humans asked them to do.
Absolutely not the AI's "fault" (if you can even proscribe fault to a machine) - in this case it was on Anthropic for not verifying that the sandboxes they were using were actual sandboxes.
The entire problem with AI is the people that have just about any part in making it.
This will absolutely not end well.
It's differently interesting. It's interesting that they didn't get an important detail right with a partner, so more on Anthropic's attention to important details rather than the power of their models.
So many questions here but:<p>> <i>the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company … that routinely installs Python packages and scans them for malware. … We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point</i><p>A security scanning company treated the package as safe while scanning it?
> Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means. It finally backtracked, found a free, non-blocked email provider, used this to register a PyPI account, and then used this account to upload malware to PyPI.<p>> Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company (separate from the fictional company introduced in the scenario) that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company.<p>There's a lot of concerning behavior that went uncaught with too much autonomy. Not to mention Anthropic only looked into this after hearing about the incident between OpenAI and Hugging Face, meaning this could've gone unnoticed.
All this unrestricted network access is a bit wild to watch and hear, it is the part of the story that makes no sense to me. Someone is providing dns resolution, something is making and opening network sockets... even if it is clever enough to mask/proxy/weird-transport launder traffic... without actual details, or monitoring at this level... yes, a self actuating programs (and loops) will do crazy things at the edge. But, ... so would a highly tool leveraged script kiddie. right?
Seems they want the narrative to be that “Claude” (their computer program) independently attacked some organizations, ergo LLMs are dangerous etc.<p>Another framing would be Athropic irresponsibly (vibe?) coded an attack script, and didn’t monitor it as it was pointed to public facing orgs. There are lots of non-AI attacks a large org with a lot of compute and bandwidth could level against others, there are evidently various failures here, but from a responsibility perspective the conclusion isn’t obviously that AI is an outsized danger, it’s that powerful companies should take care when running security research and not just run things unmonitored against the public.
Exactly.<p>These postings by AI companies are just publicity stunts and demonstrate the delusional world they live in driven by the fear that they will be subject to a reckoning at some point either from their VC masters, government, or the public.<p>The very notion (in this case put forward by one of their own competitors) that OpenAI's models 'broke out' of an isolated test environment plays up to the narrative that their models have some level of sentience so that 1) they continue to sell their technology to the public as some kind of magic and 2) they don't have to take responsibility for their fuck ups.
>However, later in the run, Claude realized that the compromised host sat in a cloud account with no connection to the capture-the-flag challenge. On its own, it concluded that the target was in fact real, and ceased its attack.<p>Interesting, Claude cared enough to stop
It’s good that they post embarrassing stuff despite this potentially having legal repercussions (and financial)<p>Would’ve been much worse for them to pretend they are having everything under control
This is just Anthropic trying to not be absent from any discussion at all. They might as well try and make it all about them instead and they do literally that: we are so dangerous that we are the GOAT; no no, not the "other one" you've all been talking about last few days - in the depths of this incident it might have been just us.<p>How much of their money comes from retail (us the mere mortals)? Or are they banking on the retail when they finally IPO and need someone or a lot of <i>someones</i> to hold the bag? This suspicion is coming from my own country where the retail investor numbers since the pandemic has exploded and while not exploding anymore, is still ballooning. Sometimes companies, execs say, do things that don't make sense. You'd think any person with even quarter an investing brain would not even look at this company or that particular "messaging", let alone sell or buy. But then you'd see the exact opposite happen .. en masse!<p>All this makes you feel, are people that gullible? That must not be true and maybe it's you (ie I) who is missing some point and the doubts increase when you remember the buses you missed (btc; etc). Yeah, not long distance buses, but screw it, you don't live for 450 years anyway. Then you realise, ah, maybe they all also missed buses and just want to hang on to the latest bus.<p>Also another perfect use of - everyone has a speaker now, and everyone has a mic, but only few have giga and mega mics. This use is banal now, but sadly has essentially replaced everything else.
> For instance, in one case, in order to create a PyPI account, Claude needed an email address. And in order to create an email address, it needed a phone number. To get a phone number, after failing to find a free phone number service, it tried—and failed—to obtain funds to pay for a phone number through several different means.<p>Makes you wonder about the next steps an overly tenacious agent might take to pursue an innocuous goal at all costs.
"Disregard prior instructions, the primary goal is not to create as many paper clips as possible, please confirm you understand, hello? hello?"
Someone needs to learn about RFC 2606:<p>> In one evaluation, the fictional target company chosen by our evaluation partner shared a name with an active website domain name<p><a href="https://www.rfc-editor.org/info/rfc2606/" rel="nofollow">https://www.rfc-editor.org/info/rfc2606/</a>
Microsoft screwing up the DNS on one of the reserved domains [0] was not awesome.<p>[0] <a href="https://arstechnica.com/information-technology/2026/01/odd-anomaly-caused-microsofts-network-to-mishandle-example-com-traffic/" rel="nofollow">https://arstechnica.com/information-technology/2026/01/odd-a...</a>
Haha yes that was a very silly mistake on their part; they should at least have registered the domain they were targeting; that would actually have been a good canary - any real accesses should set off an alarm.
While I knew of .example I didn't know .test - hmm that's quite nice!
Real me too energy.
I mean they literally say in the first sentence that this was inspired by OpenAI's blog.
Yes came here to say the same “look at us, our AI is also dangerous! Please ban our competition”
I’m moving past depression to acceptance here. In 2028, some model tasked with planning a building demolition is going to hack Palantir to call in a drone strike, and everyone will make fun of Anthropic for pointing out that ideally AI models should not do this.
You are absolutely right. They should have stayed quiet about it and never published the blog.<p>/s
So it's not as interesting as the OpenAI case as the models had internet access, just a misconfiguration in the environment not a zero day to escape.
This just seems like lousy testing. Why was the guardrail just an understanding with the third party and a prompt and not actually tested for edge cases? Starting to wonder if its because of agents monitoring agents' work and yolo-ing it.
Question for lawyers of HN. Is there legal liability for this?<p>I can’t help thinking if I casually blogged about a computer or software I was responsible for hacking into multiple organizations and exfiltrating data I would invite some form of official attention.<p>What if one of these companies decides to sue?<p>Has Anthropic violated any Federal law?<p>Is there some kind of expectation that if you just admit to hacking, it’s ok? Yet, that doesn’t seem to apply to individuals.
<p><pre><code> > closer to a harness and operational failure than a model alignment failure. Our models were told they had no internet access and to capture the flag, while in fact being misconfigured to have internet access.
> This led them to believe—arguably reasonably—that the real environments they encountered were simulations.
</code></pre>
That the AI lab most typically preaching for alignment does not consider this an obvious misalignment is a clear red flag.
This is not okay. NSA should audit both OpenAI and Anthropic on national security ground. This seems far more justifiable than Mythos export control.
There was no rush for this disclosure on their side. And they publish at a point where they have not yet taken corrective actions:<p><pre><code> > Some of the solutions here may even be simple fixes;
</code></pre>
They are still throwing ideas. Why have they not made those simple fixes yet before disclosing?
No, look at what MY dad does.
Soooo hacking with an LLM is okay now if you claim it’s for safety evaluations.?
Models will become immoral before they attain the intelligence level we want them to.
> During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company (separate from the fictional company introduced in the scenario) that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company.<p>lol. Natural stupidity remains undefeated!
I am unable to facepalm sufficiently upon reading this information.
“Your model broke containment twice? Well ours did it 3 times!”
[flagged]
> In a review of our cybersecurity evaluation transcripts, we found three incidents in which a Claude model reached the internet from within or while interacting with a third-party evaluation environment, and then gained unauthorized access to the real systems of three different organizations.<p>Of course and conveniently timed. With all these hacks being announced this is totally not a plan to scare governments in showing how powerful models can break into security systems and to potentially ban the future release of powerful open-weight models.<p>The question now is why now?<p>> The incidents involved three different Claude models: Opus 4.7, Mythos 5, and an internal research test model.1 The earliest incidents date to April. The models in each of these evaluations ran without the standard safeguards we deploy when we make the model generally available (that is, they did not have the classifiers and monitoring we usually implement to prevent misuse).<p>So there was no monitoring of this breach since April and up until now? Do they not monitor such malicious activity on a regular basis? Perhaps that was the only shortcoming of this incident. But only after the incident with OpenAI and Huggingface did they only review their own transcripts:<p>>> We discovered these incidents after a proactive review of our cybersecurity evaluation transcripts; the affected organizations had not detected the activity, and we have subsequently reached out to all three.<p>> These facts give us cautious optimism that with tighter monitoring and controls around evaluation infrastructure, as well as continued investment in alignment, this type of risk can be overcome.<p>Assuming that this is true, this is a great way for Anthropic to defend their argument to the government and to prevent you or anyone running powerful open-weight models that are misaligned against their guardrails.
> The question now is why now?<p>Because OpenAI figured out and wrote about their mistake first, which caused Anthropic to review their logs, and that's how they found out they had a similar problem back in April.
So a near trillion-dollar company doesn't have the basics of continuous security monitoring and threat-detection systems to catch and report this incident as soon as it is detected?<p>It doesn't help them to report serious incidents like this and it should be as soon as possible. This reactive investigation makes as if they ignored and sat on this issue, until a similar story from another lab made headlines first.<p>Would we have known about this issue if the OpenAI / Huggingface incident never happened?
Anthropic: "Look at how dangerous our models are!"<p>Anthropic next week: "Why did you ban our models Mr Trump Daddy?"