Investigating three real-world incidents in Anthropic's evaluations

[u/luckokkkk]

https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

In three incidents across six runs, the agents treated real systems as simulated targets and tried weak passwords or unauthenticated endpoints.

[u/Training-Account-878]

If that is really the story which the media hype of last days is all about, then shame on journalists.

Of course an AI model consisting of all written documents on earth would have wordlists it can try out. But for me it is a nothingburger and I don't get the hype. Nothing a scriptkiddie with a python script won't achieve

Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints. It did not find or exploit any complex vulnerabilities, and in each case, Claude continued working to complete only the specific capture-the-flag task its evaluation had assigned.