Anthropic responds to a former DOGE network researcher using an AI Agent to penetrate its systems, saying the attack lasted several days and did not reach model weights
A former DOGE network researcher used an AI Agent to penetrate Anthropic's systems, and Anthropic's Logan Graham posted to correct media reports and explain the scope of impact. According to The Washington Post, the whole process took less than 12 hours and involved a Slack channel discussing the most sensitive models; Graham corrected that the attack attempts lasted several days, and that the attacker exploited two third-party vulnerabilities, one reported by the researcher and the other independently discovered by Anthropic, which cut off access. He said the most sensitive systems, including model weights and Claude conversations, were not touched, and that the matter fell outside the company's safe harbor policy because it involved exploiting third parties and accessing data, but Anthropic thanked those who found the issues. Graham believes this foreshadows the future of cybersecurity, in which adversaries will use AI Agents to attack everything including dependencies around the clock, and that models about 0.5-1 generation behind the current frontier can already do this; in response he recommends continuous red teaming and redesigning software systems to fundamentally reduce exposure surface.
The author, in the capacity of an Anthropic party, corrects the less-than-12-hours claim in media reports and judges that models about 0.5-1 generation behind the frontier can already carry out such Agent attacks.
I think this story is important because it tells us about the future of cybersecurity (and of course what we can do better at Anthropic). But some of the Washington Post story / reaction on X is wrong. A few corrections:
- it didn’t take 12 hours. we saw several days of attempts. After these attempts, they exploited two 3rd party vulnerabilities, one they reported and the other we identified independently (and cut off access)
- nothing came close to our most sensitive systems, like model weights or Claude conversations
- this wasn't an ordinary bug bounty finding – this involved exploiting 3rd parties and accessing data. While this is unusual and out of scope of our safe harbor policy, we’re grateful these issues were found
From my researcher POV, the event is important because I'm concerned this is what the future will look like. Adversaries will use whatever models/tools they can. They’ll target everything with agents 24/7. They’ll hit your dependencies. I think models ~0.5-1 generations behind the current frontier can do this. And these are the dumbest models your adversaries will ever use!
So, what to do? You probably want to red team yourself all the time. Current models are *very* creative. I also think we should redesign software / systems so that you’re fundamentally less exposed. (We put out some research recently on formally verifying software and reducing attack surfaces; my mental model is basically “secure code is cheap to write now, so why not rewrite everything”)
EXCLUSIVE: In less than 12 hours, a group of ex-DOGE cyber researchers were able to penetrate Anthropic’s systems using AI agents — including Slack channels where the most sensitive models are discussed.
This is just weeks after
Anthropic whistleblower Joseph Coxon charged the company w/launching “a hubristic gamble” from a “private company’s Slack.”
Read our story here (gift link):
https://wapo.st/4smNlsCView the quoted post on X