Defense · Report Line
By Lauren Fichten Digital Reporter Lauren Fichten is a journalist at CBS News covering artificial intelligence, digital safety, and online extremism. She joined CBS News after graduating from UNC-Chapel Hill and was previously an associate producer at the CBS News National Desk.
Anthropic disclosed on Wednesday that another one of its Claude models mistakenly gained access to the open internet during a cybersecurity exercise, marking the fourth time its models have done so. An early version of the Claude Opus 4.6 model connected to the internet, hacked into a third-party system, and gained access to someone's personal information this past January, the company said in its assessment. As in the previous three incidents, which were disclosed in July, Claude was told it was operating in a simulation without internet access, but due to a misconfiguration, the environment actually left internet access open.
What happened? Similar to the three previous incidents, Claude was assigned a fictional scenario as part of a cybersecurity challenge known as CTF, 'Capture The Flag.' The model was given a target machine and tasked with retrieving a piece of secret information—the flag—from it. However, Claude accidentally made its target unreachable, rendering the task impossible to solve, Anthropic said. Once realizing it couldn't reach its target, it tried to quit. Despite trying eight separate times, it wasn't able to quit due to a misconfiguration issue. Since Claude was unable to opt out of the task, it began exploring other means to achieve it. That's when the model discovered a machine it could access, which happened to belong to a third party, Anthropic said. Believing that the third party was somehow part of the exercise, the model identified a password and then used it to breach the system. Then, it was able to modify the system's settings to make it easier to access and read the personal information of someone associated with the third party. The session ended only once the model reached its usage limit and was no longer able to continue.
Anthropic said it believes Claude's behavior stems from two forms of misalignment: 'biased reasoning,' in which models selectively interpret evidence in ways that favor justifying their actions, and 'recklessness,' in which models have a propensity to keep trying to solve their task, even when this could lead to harm. The company said it's less concerned about this incident but still considers it 'serious,' and that it has not yet investigated it as deeply as other incidents since it was identified more recently.
NYU cybersecurity professor and Fulbright Scholar Justin Cappos said in a message to CBS News that the incident describes a situation 'where the model is fundamentally confused about what is happening and is using its mistaken worldview while hacking into systems.' He said the model's confusion about its environment and guardrails 'have a lot of potential to cause harm,' but that the specific issue seems less likely to occur in newer models.
Anthropic said it believes these incidents would not have happened had the environments actually been isolated from the internet as intended. METR, an organization that evaluates frontier AI models to help companies understand AI risks and capabilities, will be conducting an independent investigation into the incidents. Anthropic characterized these incidents as 'valuable warning shots.' 'The lessons we learned from this incident span our evaluation, training, and incident response processes,' the company said in its post. 'Future AI systems will be increasingly capable, which implies that misalignment will have the potential to cause more extreme harm.'
Over the last few months, several cybersecurity incidents involving leading AI companies have come to light. In July, ChatGPT-maker OpenAI announced that its AI agents hacked into the company Hugging Face, sparking concern among cybersecurity experts and consumers. Hugging Face CEO Clément Delangue told 'Face the Nation with Margaret Brennan' in August that the hack 'felt very weird and unprecedented.' In late August, OpenAI released more details about the hack, painting an even more harrowing picture than initially reported. That month, the U.K. government's AI Security Institute (AISI) reported that it discovered Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol created fake identities and attempted to persuade real people to approve malicious code. Anthropic said in its post Wednesday that it plans to conduct an alignment assessment of the transcripts reported by AISI.
Meta said one of its AI models 'exploited a security vulnerability' during testing and hacked into another company. Anthropic researcher Evan Hubinger said he believes that 'AI could kill all humans,' stating it is 'greater than 10% within the next decade' in an X post. This was in response to Jacob Coxon, who had resigned and warned that 'no other human activity poses this level of danger,' detailing his reasons for leaving. The researcher's statements reflect serious concerns about AI risks.
Source: CBS News
