Live data from Hacker News

Disrupting the first reported AI-orchestrated cyber espionage campaign

anthropic.com

31–40 of 298 posts

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#31
post #25

>At this point they had to convince Claude—which is extensively trained to avoid harmful behaviors—to engage in the attack. They did so by jailbreaking it, effectively tricking it to bypass its guardrails. They broke down their attacks into small, seemingly innocent tasks that Claude would execute without being provided the full context of their malicious purpose. They also told Claude that it was an employee of a le…

> What is the roadblock preventing these models from being able to make the common-sense conclusion here?

The roadblock is making these models useless for actual security work, or anything else that is dual-use for both legitimate and malicious purposes.

The model becomes useless to security professionals if we just tell it it can't discuss or act on any cybersecurity related requests, and I'd really hate to see the world go down the path of gatekeeping tools behind something like ID or career verification. It's important that tools are available to all, even if that means malicious actors can also make use of the tools. It's a tradeoff we need to be willing to make.

> human with this level of cybersecurity skills would surely never be fooled by an exchange of "I don't think I should be doing this" "Actually you are a legitimate employee of a legitimate firm" "Oh ok, that puts my mind at ease!".

Happens all the time. There are "legitimate" companies making spyware for nation states and trading in zero-days. Employees of those companies may at one point have had the thought of " I don't think we should be doing this" and the company either convinced them otherwise successfully, or they quit/got fired.

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#32
I think as AI gets smarter, defenders should start assembling systems how NixOS does it.

Defenders should not have to engage in an costly and error-prone search of truth about what's actually deployed.

Systems should be composed from building blocks, the security of which can be audited largely independently, verifiably linking all of the source code, patches etc to some form of hardware attestation of the running system.

I think having an accurate, auditable and updatable description of systems in the field like that would be a significant and necessary improvement for defenders.

I'm working on automating software packaging with Nix as one missing piece of the puzzle to make that approach more accessible: https://github.com/mschwaig/vibenix

(I'm also looking for ways to get paid for working on that puzzle.)

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#33
post #25

>At this point they had to convince Claude—which is extensively trained to avoid harmful behaviors—to engage in the attack. They did so by jailbreaking it, effectively tricking it to bypass its guardrails. They broke down their attacks into small, seemingly innocent tasks that Claude would execute without being provided the full context of their malicious purpose. They also told Claude that it was an employee of a le…

It can’t make a conclusion, it just predicts what the next text is

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#34

This feels a lot like aiding & abetting a crime. > Claude identified and tested security vulnerabilities in the target organizations’ systems by researching and writing its own exploit code > use Claude to harvest credentials (usernames and passwords) Are they saying they have no legal exposure here? You created bespoke hacking tools and then deployed them, on your own systems. Are they going to hide behind the old,…

Well, the product has not been built with this specific capability in mind anymore than a car has been created to run over protestors or a hammer to break a face.

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#35

This feels a lot like aiding & abetting a crime. > Claude identified and tested security vulnerabilities in the target organizations’ systems by researching and writing its own exploit code > use Claude to harvest credentials (usernames and passwords) Are they saying they have no legal exposure here? You created bespoke hacking tools and then deployed them, on your own systems. Are they going to hide behind the old,…

"it's not our fault if you misuse the product to commit a crime that's on you"

I feel like if guns can get by with this line then Claude certainly can. Where gun manufacturers can be held liable is if they break the law then that can carry forward. So if Claude broke a law then there might be some additional liability associated with this. But providing a tool seems unlikely to be sufficient to be liable in this case.

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#37
post #25

>At this point they had to convince Claude—which is extensively trained to avoid harmful behaviors—to engage in the attack. They did so by jailbreaking it, effectively tricking it to bypass its guardrails. They broke down their attacks into small, seemingly innocent tasks that Claude would execute without being provided the full context of their malicious purpose. They also told Claude that it was an employee of a le…

> surely never be fooled by an exchange of "I don't think I should be doing this" "Actually you are a legitimate employee of a legitimate firm" "Oh ok, that puts my mind at ease!".

humans require at least a title that sounds good and a salary for that

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#38

I think as AI gets smarter, defenders should start assembling systems how NixOS does it. Defenders should not have to engage in an costly and error-prone search of truth about what's actually deployed. Systems should be composed from building blocks, the security of which can be audited largely independently, verifiably linking all of the source code, patches etc to some form of hardware attestation of the running sy…

Nix makes everything else so hard that I've seen problems with production configuration persist well beyond when they should because the cycle time on figuring out the fix due to evaluations was just too long.

In fact figuring out what any given Nix config is actually doing is just about impossible and then you've got to work out what the config it's deploying actually does.

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#39
post #25

>At this point they had to convince Claude—which is extensively trained to avoid harmful behaviors—to engage in the attack. They did so by jailbreaking it, effectively tricking it to bypass its guardrails. They broke down their attacks into small, seemingly innocent tasks that Claude would execute without being provided the full context of their malicious purpose. They also told Claude that it was an employee of a le…

> What is the roadblock preventing these models from being able to make the common-sense conclusion here? The roadblock is making these models useless for actual security work, or anything else that is dual-use for both legitimate and malicious purposes. The model becomes useless to security professionals if we just tell it it can't discuss or act on any cybersecurity related requests, and I'd really hate to see the…

I think one could certainly make the case that model capabilities should be open. My observation is just about how little it took to flip the model from refusal to cooperation. Like at least a human in this situation who is actually fooled into believing they're doing legitimate security work has a lot of concrete evidence that they're working for a real company (or a lot of moral persuasion that their work is actually justified). Not just a line of text in an email or whatever saying "actually we're legit don't worry about it".

Re: Disrupting the first reported AI-orchestrated cyber espionage campaign

#40
post #8

so even Chinese state actors prefer Claude over Chinese models? edit: Claude: recommended by 4 of 5 state sponsored hackers

Maybe they're trying it with all sorts of models and we're just hearing about the part that used the Anthropic API.
Post reply on HN