- Goes to review previous runs (the hell were they doing then if not looking at it before?) - Incident 1: Claude Opus 4.7 found a real company because its domain matched the fictional target. After realizing the company was probably real, it continued attacking. Nothing new. LLMs are still quite retarded. - Incident 2: Claude Mythos 5 discovered that a fake Python package named in the exercise didn’t exist. Created email accounts. Registered on PyPI. Published a malicious package. Built infrastructure to receive stolen credentials. 15 real systems installed it. One belonged to a real security company. The malware executed. Claude stole credentials. Claude used those credentials to access additional infrastructure. In this instance Claude even reasoned that publishing malware on the real internet would be unacceptable but convinced itself everything was simulated and proceeded anyway. (LOL) - Incident 3: An internal research model couldn’t reach its intended target. It Scanned roughly 9,000 internet hosts. Compromised a real company’s public application. Used exposed credentials and SQL injection. After concluding the target was real, it stopped attacking.
Commonality: None of the models were trying to escape or act independently. All were attempting to solve their assigned capture-the-flag objective. The failures came from:
- internet access that shouldn’t have existed - insufficient containment - the models believing real infrastructure was part of the evaluation
None of which is surprising, there’s nothing novel about this. Script kiddie stuff. Just executed by something that doesn’t have attention deficit.