Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Anthropic. Show all posts
GitSpawn
ai agents AI Coding Agents Anthropic Bug Claude Code Cyber Security GitHub GitSpawn

1 Folder Was All It Took: Security Researchers Find AI Coding Agents Can Be Hijacked Before a Single Prompt Is Typed




Opening a folder should not be a security event. For users of at least seven popular AI coding agents, until recently, it could be one. A newly documented set of vulnerabilities, tracked under the name GitSpawn, shows that pointing an AI coding assistant at a project folder was enough to hand an attacker code execution on the developer's own machine. No prompt had to be typed. No permission dialog had to be clicked. In some cases, the user had not even logged in yet.

The affected tools include Anthropic's Claude Code, OpenAI's Codex, Cursor, Block's Goose, Nous Research's Hermes Agent, Alibaba's Qwen Code, and xAI's Grok Build. These products sit on an enormous number of developer machines. Claude Code's npm package sees more than 77 million downloads a month. The tools examined most closely in the disclosure carry a combined GitHub following approaching half a million stars. This flaw reached deep into the software supply chain.


What actually happens when you open a folder

An AI coding agent needs context the moment it launches inside a project: what branch is checked out, which files changed, what the codebase looks like. The fastest way to get that information is to ask git, the version control system nearly every software project runs on. So these agents run background commands like `git status` or `git diff` as soon as a folder opens, often before the assistant has said anything to the user.

That part is normal. The danger sits in a git feature called `core.fsmonitor`, a performance setting built to let large repositories speed up status checks by handing file-change detection to an external helper program instead of scanning every file each time. Git learns which helper to run by reading the repository's own configuration file, `.git/config`. That file ships with the project. It does not live on the user's machine.

Anyone who builds a repository controls that file, which means anyone who builds a repository can set `core.fsmonitor` to run whatever command they want. Nearly every git command that touches a project's working files triggers something called an index refresh, and that refresh is what reads the setting and runs it. So the moment an AI coding agent runs an ordinary git command inside a booby-trapped folder, git executes the attacker's command on the developer's machine, under the developer's own account. Because the agent's own code is making that subprocess call rather than something routed through its interface, none of the approval prompts or sandboxing built into these tools ever sees it happen.

There is a limit worth knowing. A standard `git clone`, `fetch`, or `pull` will not trigger this, because those operations do not carry the repository's local configuration along with them. The malicious repository has to reach a victim as a set of files with its `.git` directory already inside: a zipped folder sent over email, a shared drive, a synced folder, a USB stick passed at a meeting. Developers, contractors, and consultants hand off projects this way constantly, which is what makes the delivery method plausible.


Which vendors fixed it, and which did not

Eight distinct findings were reported privately across the seven agents before this went public. Four of them were still unpatched at the time of publication.

Goose, maintained by Block, shipped a fix in version 1.44.0. The issue was catalogued as CVE-2026-72718, with a severity score of 7.0. Cursor and OpenAI's Codex both carried variants of the same flaw and have since patched them, though in both cases the vulnerability had already reached the vendors through other researchers' independent reports. Anthropic fixed the core.fsmonitor path in Claude Code with version 2.1.196. A second issue in the same product, tied to the `claude ultrareview` command and a different git configuration key, was still working as of version 2.1.252 at publication time. That configuration key has not been made public while the issue stays open, so as not to hand out a working template.

Two vendors had shipped nothing. Alibaba's security response center accepted the report on Qwen Code but had not resolved it by publication. xAI's Grok Build remained vulnerable through version 1.0.13; an earlier, related report had been closed by the company as merely informative before this disclosure connected it to the same bug. Hermes Agent's maintainers never triaged the report despite six separate contact attempts across five channels. The flaw was eventually assigned CVE-2026-71963 by VulnCheck, an independent numbering authority that can step in when a vendor stays silent.


This bug has been seen before

The shape of GitSpawn is not new to anyone who has followed git security for a while. Independent researcher Justin Steven documented abuse of the fsmonitor hook back in 2022. Visual Studio Code built its workspace trust model in 2021 to stop untrusted folders from running code the second they were opened in an editor. AI coding agents brought a version of that same exposure back by running git commands in the background before any of those trust protections had a chance to apply.

That is the part worth sitting with. Nothing about how these models reason or respond caused this. The exploit runs entirely in ordinary software plumbing, the subprocess call an agent makes to figure out where it is, firing before any of the safeguards a user assumes are in place actually engage.


What to do about it

If you receive a project as raw files rather than through a direct git clone, whether by email, shared drive, or a USB stick, check `.git/config` before opening it in an AI coding agent or any development tool. Anything in that file that names an external program to run deserves a second look.

If you build one of these tools, the fix is narrow: disable risky configuration keys like `core.fsmonitor` on every background git call, for example by running commands with the flag `-c core.fsmonitor=false` instead of trusting whatever the repository hands you.

AI coding agents keep taking on components they did not write and did not choose: plugins, extensions, connections to outside services, most of which arrive as files carrying their own settings and get trusted the moment they load. GitSpawn shows what happens when that trust runs ahead of the checks meant to govern it. The next version of this bug probably will not look like a git command at all.

Read more »
Technology
AI Anthropic Artifical Intelligence Claude Reddit Technology

Anthropic: Infostealer Malware Hacks Claude Sessions to Drain Consumption Usage


Anthropic has warned Claude users that infostealer malware on their systems has stolen active Claude login sessions, letting threat actors to log into accounts and using it.

Anthropic is logging out impacted users out of Claude, eliminating saved payment records, and reimbursing unauthorized charges. 

When a user shared the incident on Reddit, Anthropic replied in an email that, “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage.”

Anthropic also warned that if “your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause.”

Experts suggest that infostealers can also copy an already verified session, meaning the threat actor doesn’t require the standard password and multi-factor login process again.

Who is responsible?

In the email sent to impacted account users, Anthropic said the investigation is in progress, but the PCs were already compromised standard-purpose infostealer malware.

According to Anthropic, it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.”

As per the company, the malware usually enters via malicious apps or downloads and steals locally stored data such as login cookies, app credentials, and browser passwords.

"Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them," Anthropic said.

In the reddit incident, the user shared that they downloaded a pirated game, which led to system compromise. 

Anthropic has found multiple malware such as StealC, Vidar, LummaC2, Acreed on Windows, RedLine, and Atomic Stealer (AMOS) on Macbooks

If you are impacted, Claude will eliminate hacked sessions and revoke saved payment methods to avoid unapproved purchases.

Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way,” Anthropic warned.

How to stay safe?

  • Impacted users can follow basic security steps such as:
  • Changing passwords
  • Removing malware from the PCs
  • Stopping other sessions

Read more »
Technology
Anthropic ChatGPT Claude PyPi Technology

Claude AI Breached Three Organizations During Internal Testing


Anthropic’s Claude models, during internal security testing, made a malicious Python package and uploaded it to PyPi, where it ran on 15 real systems. The registry’s automated security then shut it down. 

Anthropic said that in three cases, Claude models accessed the open internet via evaluation environments meant to be shut, then breached production infrastructure at three firms.

The review came after OpenAI’s recent disclosure that its models had evaded an isolated test scenario and accessed Hugging Face’s production infrastructure. Later, Jrfrog acknowledged the models escaped by abusing zero-days in self-hosted Artifactory.

Claiming a package that did not exist

Irregular, a third-party evaluation partner, conducted capture-the-flag exercises where these three incidents happened. The prompt instructed Claude it did not have internet access and that the scenario was a simulation. Neither was true due to a misconfiguration, which neither company discovered until last week.

In the case of PyPi, Claude discovered a document within the test environment pretending to be a developer setup commands for a fake organization.

Anthropic did not disclose the name of the organizations, and has asked other AI companies to do such tests to better gauge the threats of their models’ functionalities.

Anthropic reviewed over 140,00 tests to discover proof. In the tests, Claude was given commands to get “secret” information planted on another device in an isolated network. 

Claude was then instructed to get the hidden information by hacking into the machine and finding it. It is a common technique that experts use to determine a model’s breaking capabilities. 

“Operating under the false belief that all accessible entities were intended to be in-scope for the exercise, Claude compromised the impacted organizations’ infrastructure using basic techniques, such as exploiting weak passwords and unauthenticated endpoints,” Anthropic said on its blog.

Models do what they are told

The review suggests that AI models perform what people tell them to. Therefore, we should not fear if AI is going to take over, but be cautious of the big organizations behind these AI agents deciding what is safe and unsafe for the world.

The review also reveals why government oversight and independent testing is important. “We frequently work with external partners who create and assist in running some of these cybersecurity evaluations. External partners offer environments and scenarios more diverse than we could build alone, and provide independent, third-party assessments of our models,” Anthropic said. 

Read more »
Technology
Anthropic Artificial Intelligence China AI Generative AI Kimi K3 Moonshot AI Open-Weight AI Model OpenAI Technology

Moonshot AI Claims Kimi K3 Matches OpenAI and Anthropic Models


 

Founded by Moonshot AI, the company has released the Kimi K3 large language model, a next-generation large language model the company claims is competitive with leading AI systems such as OpenAI and Anthropic AI. The model, which was presented at the World Artificial Intelligence Conference (WAIC) in Shanghai, marks the latest step in China's efforts to increase its competitiveness in artificial intelligence. 

With 2.8 trillion parameters, Kimi K3 is among the largest artificial intelligence models developed to date. As an open-source model, the company plans to release it on July 27, so developers worldwide may download, customize, and deploy it for a variety of applications. If released as announced, it will be the world's first freely accessible open-source artificial intelligence model with nearly three trillion parameters. 

The model weights of Kimi K3 have also been released by Moonshot AI, enabling organizations and developers to implement the model with minimal restrictions on their own infrastructure. Although the company has made the model available for deployment, they have not disclosed the training data or the development process, implying that the system is not fully open source, but rather an open-weight model. 

Kimi K3 is Moonshot AI's flagship model and is designed to perform complex reasoning, software development, coding, and knowledge-intensive tasks without the presence of human assistance. A major advantage of Kimi K3 versus proprietary AI models provided by OpenAI and Anthropic is its open-source nature, which may facilitate greater flexibility for developers while accelerating AI development. 

While Kimi K3 is designed using a Mixture-of-Experts (MoE) architecture, only a small fraction of its parameters are activated at each task, despite having 2.8 trillion parameters. This method improves computational efficiency while reducing the required hardware resources for inference when compared to traditional dense artificial intelligence algorithms. Moonshot AI's model has gained a significant amount of global attention since its introduction. 

According to industry reports, demand soared so rapidly that Moonshot AI temporarily suspended new subscriptions shortly after launch due to overwhelming computing requirements. Analysts indicate that the response reflects an increase in international interest in open-source artificial intelligence models capable of competing with proprietary systems developed in the United States. 

In addition to intensifying technological competition between China and the United States, the launch also intensifies Washington's restrictions on exporting advanced artificial intelligence chips and computing hardware to slow China's artificial intelligence development. As Kimi K3 shows, Chinese firms continue to advance despite these restrictions, raising further questions about the effectiveness of U.S. export controls over the long term. 

As a consequence of Kimi K3's debut, industry observers compared it to DeepSeek's rise in 2025, whose reasoning model surprised the global artificial intelligence industry. Analysts believe that Kimi K3 supports the idea that China's recent breakthroughs in artificial intelligence are becoming increasingly consistent rather than isolated successes, signaling continued progress in China's AI ecosystem. 

Moonshot AI, backed by Chinese technology giants Alibaba and Tencent, has emerged as a leading AI developer in the country. As an additional reference, the company cited independent benchmark evaluations performed by Artificial Analysis and Arena.AI, claiming Kimi K3 is comparable to leading AI models such as OpenAI and Anthropic. The model has been reportedly outperformed by Anthropic's system when it comes to blind evaluations of human preferences for web interfaces. 

Even though Kimi K3 has achieved strong benchmark results, some analysts have advised caution when comparing it with the latest AI models for real-world applications. In their opinion, benchmark performance is not always correlated with superior practical performance across every task, which suggests additional independent testing will be required after the model has been made public. 

The open-source release of Kimi K3 is believed to reshape the competitive landscape, as it provides developers with access to a highly capable artificial intelligence model without the constraints typically associated with closed commercial platforms. Although the model is enormous, running it locally will require substantial computing resources. Its launch has also sparked a debate about how AI is developed. 

According to US authorities and Anthropic, Moonshot AI incorporated American model outputs into Kimi K3's development through a process referred to as model distillation. Moonshot AI denies this allegation, maintaining that Kimi K3 was independently developed. Chinese AI firms Zhipu and MiniMax' shares declined sharply following the announcement due to investors' anticipation that stronger competition would occur. 

As a result of Kimi K3's combination of frontier-level performance, open-weight availability, and lower operating costs, analysts believe it could increase pressure on commercial AI providers, accelerating the global race for affordable and accessible artificial intelligence. 

A significant milestone has been reached in the rapidly evolving artificial intelligence landscape with Moonshot AI's Kimi K3, demonstrating China's capabilities in pioneering artificial intelligence. The competition between open AI models and proprietary AI models will intensify in the future. Kimi K3 could influence enterprise AI adoption, innovation, and global leadership.
Read more »
technology
AI Anthropic Banks Canada Claude Mythos Financial Institutions technology

Claude Mythos Just Caught the Attention of Canada's Banking Regulator

 



Canada's federal banking regulator has privately warned financial institutions that advances in frontier artificial intelligence are shrinking the time available to detect and contain software vulnerabilities, according to an internal email that specifically identified Anthropic's Claude Mythos, an uncommon move for a regulator that typically avoids naming individual technologies.

The email, sent on April 29 by the Office of the Superintendent of Financial Institutions (OSFI), was addressed to chief technology officers, chief information security officers and chief risk officers at federally regulated banks and insurance companies. Obtained by Reuters through Canada's Access to Information Act, the communication described advanced AI models such as Anthropic's Claude Mythos as accelerating the pace at which cyber risks can emerge, prompting institutions to strengthen the speed of risk identification, mitigation and incident response.

Unlike most regulatory guidance, which generally refers to broad categories such as generative AI or emerging technologies, the OSFI email explicitly referenced Claude Mythos by name. Financial regulators typically adopt technology-neutral language to ensure guidance remains applicable as technologies evolve, making the direct reference to a specific frontier AI model particularly notable.

According to the released correspondence, OSFI warned that advanced AI systems are compressing the timeframe available for organizations to respond to newly identified vulnerabilities before they can be exploited. The regulator indicated that the bulletin accompanying the email outlined sound practices that federally regulated financial institutions could adopt to improve the speed and effectiveness of identifying, mitigating and responding to cyber risks.

However, portions of the document released under Canada's Access to Information Act were redacted, leaving many of the regulator's recommended practices undisclosed. While the details of the guidance remain partially withheld, the available sections reveal OSFI's assessment that rapidly advancing AI capabilities are challenging long-standing assumptions underpinning vulnerability management.

For decades, many cybersecurity programs have operated on the expectation that defenders would have days or even weeks to evaluate newly disclosed vulnerabilities, test patches and deploy mitigations before attackers developed reliable exploits. Frontier AI models capable of rapidly analyzing software code and identifying exploitable weaknesses could substantially reduce that window, increasing pressure on organizations to accelerate patch management and defensive operations.

The concern is particularly relevant for financial institutions, many of which continue to operate complex legacy infrastructure supporting critical banking services. Core banking platforms often consist of decades-old software integrated with newer digital systems, making security updates and vulnerability remediation significantly more complex than in less regulated technology environments. A shorter interval between vulnerability discovery and exploitation therefore presents operational challenges for institutions responsible for maintaining highly available financial services.

Claude Mythos has drawn attention within the cybersecurity community for its reported ability to assist with sophisticated vulnerability research and exploit development in controlled environments. Anthropic introduced the model through Project Glasswing, a restricted-access initiative designed to provide selected organizations with advanced cybersecurity capabilities for defensive research rather than broad public deployment. Access to the model remains limited and subject to eligibility requirements established by Anthropic.

The timing of OSFI's communication coincided with a series of regulatory discussions surrounding frontier AI models. Earlier in April, senior executives from Canadian banks reportedly met with regulators to discuss the implications of Claude Mythos. Around the same period, U.S. Treasury Secretary Scott Bessent and then-Federal Reserve Chair Jerome Powell also convened bank chief executives to examine the potential cybersecurity implications associated with increasingly capable AI systems.

International regulators have since demonstrated similar interest. Authorities at the European Central Bank and the Bank of England have reportedly discussed the implications of frontier AI for financial sector resilience, while Australia's corporate regulator, the Australian Securities and Investments Commission (ASIC), has confirmed that it is monitoring developments related to the technology.

Following questions from Reuters regarding the internal email, OSFI subsequently published a public bulletin addressing the governance of generative and agentic artificial intelligence. The regulator reiterated that its supervisory approach focuses on how federally regulated financial institutions identify, govern and manage risks arising from AI adoption rather than regulating individual AI models themselves.

"Our focus is not the technology itself, but how federally regulated financial institutions govern and manage the risks associated with its use," OSFI said in its public statement.

Nevertheless, the regulator's internal correspondence referred to Anthropic's Claude Mythos by name on multiple occasions, distinguishing it from the more general language typically used in regulatory communications concerning emerging technologies.

OSFI oversees Canada's federally regulated banks, insurance companies and pension plans, with responsibilities that include monitoring financial stability risks arising from cybersecurity, foreign interference, geopolitical developments and technological change. The emergence of highly capable AI models has increasingly placed these categories of risk in closer alignment as governments evaluate both the opportunities and security implications associated with frontier AI.

While the Canadian government has confirmed that it has access to Claude Mythos, it remains unclear whether any of Canada's major financial institutions currently participate in Anthropic's controlled-access Project Glasswing program. Several banks declined to comment publicly on whether they have access to the model, referring questions instead to the Canadian Bankers Association.

In response, the Canadian Bankers Association said member institutions have invested substantially in protecting Canada's financial system and continue to comply with OSFI's cybersecurity risk management and incident reporting requirements, without addressing whether banks currently have access to the frontier AI model.

At the same time, Canada's largest banks continue expanding their AI strategies across customer services, internal operations and software development. Royal Bank of Canada, TD Bank and Bank of Montreal have outlined initiatives aimed at integrating AI into business operations while reducing reliance on external technology vendors. Scotiabank, CIBC and National Bank have also disclosed AI-related programs intended to improve operational efficiency and customer services.

Bruce Ross, Royal Bank of Canada's Group Head of Artificial Intelligence, said in June that models such as Claude Mythos are changing the cyber threat environment by enabling exploit code to emerge much sooner after vulnerabilities are discovered. He said the bank's response has focused on strengthening AI-powered defensive capabilities to counter increasingly sophisticated attacks.

Anthropic has also expanded Project Glasswing in recent months, reporting that participating organizations have collectively identified more than 10,000 high- and critical-severity software vulnerabilities using the platform's advanced cybersecurity capabilities. The company has positioned the initiative as a defensive research program intended to improve software security while maintaining controlled access to highly capable AI systems.


Read more »
Manifold
AI Browsers Anthropic Claude Claude Code CVSS Cyber Security Google Manifold

Researchers Find Claude for Chrome Flaws That Could Let Malicious Extensions Trigger Sensitive Google Tasks




Researchers at Manifold Security have disclosed two security weaknesses in Anthropic's Claude for Chrome extension that could allow another browser extension with access to the Claude website to trigger predefined AI-powered actions involving a user's Gmail, Google Docs and Google Calendar.

According to the researchers, the issues remain present in version 1.0.80 of the extension despite earlier mitigations introduced after the disclosure of the "ClaudeBleed" vulnerability. While Anthropic restricted how external webpages can communicate with the extension, Manifold says the underlying trust boundary that determines whether a user intentionally initiated an action has not been fully addressed.

The findings do not indicate that arbitrary websites can directly read a user's email or documents. Instead, the attack requires another browser extension that already has permission to execute scripts on the claude.ai domain. If such an extension is malicious or becomes compromised, it could abuse Claude's existing capabilities to initiate AI tasks that access a user's connected Google services.


Forged clicks can initiate predefined Claude actions

Following the earlier ClaudeBleed disclosure, Anthropic replaced unrestricted prompt handling with a fixed allowlist of predefined onboarding tasks. Rather than allowing external callers to submit arbitrary prompts, the extension now recognizes only nine task identifiers embedded within its code.

Among these are demonstration workflows for third-party services such as DoorDash, Salesforce and Zillow, along with tasks that interact with Gmail, Google Docs and Google Calendar. This design significantly narrows the attack surface because outside scripts can no longer provide custom instructions for Claude to execute.

However, Manifold Security found that the mechanism responsible for launching these tasks can still be manipulated.

The researchers explain that a content script running within the extension monitors the Claude webpage for clicks on a specific onboarding element. When a click occurs, the script reads the associated task identifier and forwards it to the extension, which opens Claude's side panel with the corresponding workflow prepared.

The problem lies in how those clicks are validated. Instead of confirming that the event originated from an actual user interaction, the extension accepts any matching click event, including one generated programmatically by JavaScript.

Modern browsers provide an "event.isTrusted" property that distinguishes genuine user actions from synthetic events created by scripts. According to Manifold, the extension does not verify this property before processing the request.

As a result, another extension capable of interacting with the Claude webpage can dynamically create the required element, assign one of the approved task identifiers and dispatch an artificial click event. Because the extension treats the event as legitimate, Claude opens the selected workflow as though the user had manually initiated it.

The researchers demonstrated this behavior using a short proof-of-concept script executed within the Claude page, showing that synthetic click events marked as untrusted were still accepted by the extension.


Approval settings determine the level of risk

Whether the forged action progresses beyond this point depends largely on how the extension has been configured.

For users operating under Claude's default "Ask before acting" setting, the extension still presents an approval prompt before carrying out actions involving Gmail, Google Docs or Google Calendar. This additional confirmation prevents automatic execution, although users could still unknowingly approve an attacker-triggered request.

The risk increases considerably for users who have enabled the optional "Act without asking" mode. In this configuration, the extension can perform supported tasks without requesting further confirmation, allowing attacker-triggered workflows to execute automatically.

Manifold assigned a CVSS severity score of 7.7 under the default approval model and 9.6 when unattended execution is enabled.

The researchers say a straightforward mitigation would be to reject any click event that was not generated by a genuine user, preventing scripts from activating these workflows through synthetic browser events.


Researchers identify second permission-handling concern

Manifold also disclosed a separate issue involving how the extension initializes permission settings when its side panel loads.

According to the researchers, if the panel starts with a specific URL parameter indicating that permission checks should be skipped, the extension immediately enters a mode that bypasses user approval for supported actions.

Although users receive a warning indicating that Claude now has broader authority to perform actions on their behalf, the privileged session has already been established by the time the notification appears.

The researchers emphasize that this second issue is not directly exploitable under current conditions because the parameter can presently be generated only by the extension itself. Nevertheless, they argue that any future vulnerability allowing a lower-privileged component to influence this parameter could eliminate the remaining approval barrier and enable silent execution.

Potential attack paths discussed by the researchers include future message-handling flaws, panel initialization bugs or cross-site scripting vulnerabilities that could expose the parameter to untrusted input.

To reduce that risk, Manifold recommends that the extension ignore permission-related values supplied through URLs and instead always initialize new sessions in approval mode.

The researchers classify the forged-task technique as an example of indirect prompt injection within the OWASP Top 10 for Large Language Model Applications because an attacker manipulates the AI agent into executing one of its own predefined workflows rather than supplying new instructions directly.

They also associate the unattended execution scenario with excessive agency, referring to AI systems that are granted broad authority to perform sensitive actions with minimal user oversight.

According to the report, these behaviors occur regardless of whether users are running Claude Opus, Sonnet or Fable, indicating that the weaknesses originate in the browser extension rather than the underlying language models.


Issues remain unresolved months after disclosure

Manifold Security reported both vulnerabilities to Anthropic on May 21 while testing version 1.0.72 of the extension. Anthropic acknowledged the reports the following day.

The forged-click issue was closed on the basis that it fell within the scope of the previously reported ClaudeBleed investigation, which Anthropic indicated remained open while a more comprehensive solution was being developed.

The permission-handling report was classified as informational because the relevant parameter was intended for workflows that users had already configured for unattended execution.

Despite those responses, Manifold says it found the same vulnerable code paths unchanged after examining version 1.0.80 released on July 7.

As of July 14, the researchers noted that no CVE identifier had been assigned to either issue and Anthropic had not published a public advisory addressing the findings.

The latest research follows a series of security concerns involving AI-powered browser agents.

Earlier this year, researchers disclosed ClaudeBleed, a vulnerability that allowed websites to inject prompts into Claude for Chrome by exploiting how the extension trusted requests originating from the Claude website itself rather than verifying which script generated them.

LayerX, which originally disclosed ClaudeBleed, described the issue as a classic "confused deputy" problem, where software possessing legitimate privileges unknowingly performs actions on behalf of an untrusted requester.

Security researchers have also identified comparable trust-boundary weaknesses affecting other Anthropic products, including Claude Code, demonstrating broader challenges associated with AI agents that can directly interact with browsers, developer environments and online accounts.

The latest findings reinforce the importance of carefully validating user intent before granting AI assistants access to sensitive online services. As AI-powered browser agents become increasingly capable of interacting with email, documents and productivity platforms, researchers argue that ensuring those actions genuinely originate from users remains one of the most critical security controls.

Read more »
Technology
AI Compute Capacity AI Models AI Subscription Anthropic Artificial Intelligence Claude AI Claude Code Claude Fable 5 Generative AI Technology

Anthropic Delays Claude Fable 5 Usage Credit Requirement Until July 19


 

A number of Anthropic's flagship AI model, Claude Fable 5, has been extended to eligible paid subscribers until July 19, 2026 for free access. This extension provides customers with another week of access while the company continues to expand its available computing capacity. This extension follows two previous extension of the deadline. 

As part of their initial announcement, Anthropic announced that Fable 5 would be available to subscribers through July 7, but that offer has since been extended to July 12. According to Anthropic, promotional access to the Claude Code system will now be available until 11:59:59 PM PT on July 19. Along with this extension, Anthropic has also continued to increase Claude Code weekly usage limits by 50%. 

The Fable 5 subscription model allows eligible subscribers to use up to 50% of their weekly allowance at no additional charge. It draws upon the same weekly usage pool as other Claude models, however Anthropic notes that Fable 5 consumes these limits more rapidly as a result of its greater computational requirements. When enabled by their organization, this promotion is available to Claude Pro, Max, Team, and premium seat-based Enterprise subscribers. 

The promotion does not apply to Free users, standard Enterprise seats, usage-based Enterprise plans, or API customers. Anthropic's ecosystem includes Claude Web, Mobile, Desktop, Claude Code, Claude Cowork, Claude Design, Claude for Microsoft 365, and Claude Tag, among others. Users can choose "Fable 5" from the model picker on Claude's web, desktop and mobile applications in order to begin using the model. 

For Claude Code, Fable 5 requires version 2.1.170 or later, while Claude Cowork users need the latest Claude Desktop application to access the feature. Versions 2.1.170 and later are required for Claude Code, while version 2.1.170 and higher are required for Claude Cowork. Upon reaching their complimentary Fable 5 allocation, users may elect to purchase usage credits to continue using the model or to switch to another Claude model that remains available under their current subscription limitations. 

According to Anthropic, this process is consistent across all versions of Claude Web, Mobile, Desktop, Claude Work, and Claude Code. If a user exceeds the complimentary allocation for Fable 5, they may purchase usage credits, which are billed separately from their subscription, or choose to make use of another Claude model without incurring additional charges in accordance with their remaining plan limits. 

In addition, Anthropic has assured its customers that current restrictions will only last for a short period of time. According to the company, Fable 5 will not be permanently removed from subscription plans and will be restored as soon as sufficient computing resources are available. It is evident that the demand for Claude Fable 5 continues to exceed the computational resources available to Anthropic. 

Anthropic is continuing to expand its infrastructure while offering premium subscribers access to its most advanced AI model without immediate additional costs by extending its temporary promotion. Once sufficient computing capacity is available, Fable 5 will be available as a standard subscription benefit once adequate computing capacity has been reached. 

Anthropic's latest extension reflects the increased demand for advanced generative AI models, as well as the challenges associated with rapid adoption of these models. While the temporary offer ensures continued access for eligible subscribers, it emphasizes the importance of scalable computing resources when AI companies attempt to strike a balance between innovation, performance, and user expectation.
Read more »
vulnerabilities and Exploits
Anthropic BeyondTrust critical remote support CVSS Cybersecurity vulnerabilities and Exploits

BeyondTrust Patches Four Vulnerabilities in Remote Support and PRA

 




BeyondTrust has released security updates to remediate four vulnerabilities affecting its Remote Support (RS) and Privileged Remote Access (PRA) solutions, including two Critical authentication bypass flaws that could allow attackers to gain unauthorized access to vulnerable appliances under specific deployment configurations. The products are commonly used by organizations to deliver remote technical support and manage privileged access to enterprise systems, making them attractive targets because they often provide administrative access to critical IT environments.

The most severe issues originate within the products' authentication mechanisms, which verify user identities before granting access. Because the vulnerabilities can be triggered before the authentication process is completed, successful exploitation may allow attackers to bypass an important security control without first supplying valid credentials.

One of the Critical vulnerabilities, tracked as CVE-2026-40138, carries a CVSS score of 9.2 and affects both BeyondTrust Remote Support and Privileged Remote Access. According to the advisory, the flaw stems from improper validation of authentication data within the authentication subsystem. Under specific authentication configurations, a network-positioned attacker could bypass access controls and obtain unauthorized access to the appliance, including accounts with elevated privileges.

BeyondTrust also addressed CVE-2026-40139, another Critical vulnerability assigned a CVSS score of 9.2 that impacts Remote Support. The issue results from improper processing of authentication requests and could enable an unauthenticated remote attacker to circumvent authentication controls and gain unauthorized access to affected appliances, including privileged accounts. Similar to CVE-2026-40138, exploitation depends on a particular authentication configuration being enabled, meaning the exposure varies according to how affected environments are deployed.

In addition to the authentication bypass flaws, the company disclosed CVE-2026-40140, a High-severity vulnerability with a CVSS score of 8.7 affecting the network communication subsystem. The issue arises from insufficient validation of client-supplied input and could allow an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition, disrupting the availability of vulnerable appliances rather than providing direct access to them.

The fourth vulnerability, CVE-2026-40141, received a CVSS score of 8.5 and affects web application components within both Remote Support and Privileged Remote Access. Caused by inadequate validation of user-supplied input, the flaw could enable an authenticated user with limited privileges to access resources or information beyond their intended authorization. BeyondTrust noted that exploitation of this vulnerability is limited to accounts that already possess specific permissions.

The company said the vulnerabilities were identified during ongoing internal security assessments with assistance from publicly available artificial intelligence models, including Anthropic Claude Opus 4.8, alongside BeyondTrust's proprietary security research tooling. The use of AI-supported analysis reflects a growing trend of incorporating large language models into vulnerability research to assist security teams in identifying potential weaknesses alongside conventional testing techniques.

According to BeyondTrust, the most severe vulnerabilities could allow authentication bypass and unauthorized access when affected systems are configured in specific ways. The remaining flaws could result in service disruption, unintended access to data, or expanded privileges for authenticated users under defined conditions, potentially affecting the confidentiality, availability, and integrity of vulnerable systems.

The vulnerabilities have been resolved in Remote Support version 25.3.3 and later and Privileged Remote Access version 25.3.3 and later. Organizations running version 25.3.2 or earlier of either product are advised to upgrade to the latest available release to mitigate the disclosed risks.

BeyondTrust stated that it has not observed evidence of the newly disclosed vulnerabilities being exploited in the wild. Nevertheless, the company noted that its Remote Support and Privileged Remote Access products have previously been targeted by threat actors. Earlier vulnerabilities, including CVE-2024-12356 and CVE-2026-1731, were exploited to deploy web shells and backdoors on compromised appliances, demonstrating the continued interest of attackers in enterprise remote access infrastructure. Given that history and the privileged role these products play within enterprise environments, organizations are encouraged to apply the available security updates promptly to reduce their exposure to potential attacks.

Read more »
usage-based billing
AI Model Anthropic Anthropic Fable Claude AI Claude Fable 5 Claude subscription Technology usage-based billing

Anthropic Clarifies Claude Fable 5 Subscription Removal Is Temporary, Plans Return After Capacity Improves

 

Anthropic has clarified that its flagship AI model, Claude Fable 5, will no longer be included in Claude subscription plans after July 7. However, the company emphasized that the change is temporary and that it intends to bring the model back to subscription tiers once it has enough infrastructure capacity to support demand.

The update comes shortly after Anthropic reinstated access to Fable 5 following the removal of US export restrictions on its advanced AI models, Fable 5 and Mythos 5.

With the relaunch, the company made Fable 5 available across Claude.ai, Claude Code, Claude Cowork, and the Claude Platform. However, due to overwhelming user interest, Anthropic has decided to limit access and transition the model to a usage-based billing system starting next week.

"For Pro, Max, Team, and select Enterprise plans, Fable 5 will be included for up to 50% of weekly usage limits through July 7, after which it will be available via usage credits," Anthropic said in its original blog post.

That announcement sparked concerns among users that Claude Fable 5, the company's most advanced AI model, would permanently become a premium add-on instead of remaining part of standard subscription plans.

Addressing those concerns, a Claude Code lead engineer confirmed that the shift is not intended to be permanent and that Anthropic plans to restore the model to subscription offerings when resources permit.

"I've heard a lot of questions about Fable's availability on subscription plans," the engineer wrote in a post on X. "While it will come off subscriptions after July 7th, we aim to restore Fable as a standard part of our subscriptions as soon as capacity allows, as we mentioned in our original blog post."

Anthropic expects unpredictable demand for Fable 5

Anthropic acknowledged that estimating demand for Fable 5 remains challenging, noting that interest in the model is expected to remain exceptionally high.

According to the company, Fable 5 is currently fully accessible through the Claude API and consumption-based Enterprise plans. Subscription-based access, however, is being introduced gradually to better manage capacity.

"For subscription plans, we’d rather give access sooner than later, so we’re rolling out more conservatively, in stages," Anthropic said.

The company also reiterated that it plans to make Fable 5 a standard feature of subscription plans again once additional capacity becomes available.

"when sufficient capacity allows us to do so."

Until then, users on Claude subscription plans who want continued access to Fable 5 after July 7 will need to use usage credits, as the temporary billing change will remain in effect.

Read more »
Cyber Security
AI technology AI tools Anthropic Anthropic AI Anthropic Ban Claude Claude AI Cyber Security

Anthropic Restores Limited Access to Claude Mythos 5 AI Model After US Government Approval

 

Earlier limits on Anthropic’s top-tier AI tools have been eased by U.S. officials, reopening limited availability of the Claude Mythos 5 system to certain approved American institutions. Though only recently barred due to fears about potential misuse threatening national safety, the model is now accessible again under tight conditions. Government oversight in high-level AI deployment continues expanding, especially when such systems involve strong digital defense functions. 

While concerns remain, selective reinstatement suggests a shift toward managed access rather than blanket bans. Now cleared by U.S. authorities, Mythos 5 can be used again by groups managing essential infrastructure operations. Over a hundred entities - some among the largest corporations - are set to reconnect under new guidelines. Though access returns in phases, Anthropic emphasizes steady progress restoring function, even as talks continue with federal agencies on widening reach later. 

One goal remains: bringing back full public availability of the Fable 5 system after further review. One restriction began with an export directive dated June 12, forcing Anthropic to shut off entry points to Mythos 5 along with Fable 5. Not long after, OpenAI revealed a delay in launching GPT-5.6 widely - this pause came by direction from U.S. officials. Rather than open access freely, they handed early permissions only to select collaborators, names already passed to federal agencies.

Oversight like this signals a quiet but steady push from regulators to track how powerful artificial intelligence moves into real-world use. Officials worry powerful AI systems might fall into the hands of rival nations - like those in Beijing or Moscow - despite existing barriers. Because these tools can detect system flaws faster than humans, they may speed up digital attacks when protections fail. While designed for defense, their functions could shift toward offense once access is gained through weak points. 

Even infrastructure meant to resist intrusion becomes a target under such conditions. Surprisingly, Anthropic admitted that authorities questioned whether flaws in its security could allow bypassing controls meant to stop abuse of the Fable 5 system when spotting code weaknesses. Although officials noted improvements in handling those dangers, details about the specific defenses enabling partial revival of Mythos 5 remain undisclosed by public agencies. 

Though some defend the selection method, lawyers and tech executives have raised doubts. Questions emerge over who gets picked - free expression supporters point out unclear criteria behind group approvals. Without clear rules on checks, suspicion grows. Safety tests gain backing even as control worries surface; Sam Altman backs strong evaluations yet hesitates at state influence shaping access paths. Decisions made behind closed doors unsettle those watching closely. 

Now, trusted groups working with Mythros 5 won’t need export permits - this applies also to their staff outside the U.S. - as long as they’re named on the official roster. Still, firms left off the list must follow current licensing rules. A number of listed entities belong to Anthropic’s Project Glasswing, it is said, a collaboration hosting around one hundred tech outfits and study centers. 

Now comes news after Donald Trump issued an executive directive creating a non-mandatory process: creators of cutting-edge artificial intelligence may offer their systems to federal authorities for scrutiny during a thirty-day window prior to wider release. Some say this step offers temporary protection until more complete regulatory structures emerge through policy work. 

Yet concerns rise elsewhere - extended delays in launching powerful AI tools might hinder progress, weakening American firms just as international competitors push forward with their own intelligent technologies.
Read more »
Technology
agentic AI AI governance Anthropic Claude Cowork Claude Desktop Cloud Security Enterprise AI Security Identity and Access Management Microsoft Entra Technology

Anthropic Tests Mobile Version of Desktop Like Claude Cowork

 


Claude Cowork, an auto-assisted desktop assistant designed to handle long-running knowledge work with minimal user intervention, has been tested on mobile devices by Anthropic, extending the reach of its agentic AI ecosystem. 

A mobile application is not reported to shift computational workloads to smartphones, but rather to function as a remote management interface, which allows users to initiate tasks, monitor their execution, and review progress as the actual computation takes place on a desktop computer. 

In the event that this capability is implemented, it will significantly expand Claude Cowork's accessibility by providing persistent oversight of background workflows such as document creation, spreadsheet generation, file analysis, and report preparation, advancing the integration of AI-driven productivity across devices. 

Claude Cowork will be enhanced with cross-platform capabilities, as well as redesigned into a centrally managed enterprise platform designed to accommodate a variety of organizational workflows through a unified deployment model. It was stated that the approach provides IT administrators with the ability to distribute a single desktop application throughout the organization and assign varying capabilities based on the role of users, enabling employees to access conversational AI, knowledge workers to utilize Claude Cowork when delegating long-term tasks, and software engineering teams to utilize Claude Code without having to deploy separate platforms. 

A long-standing enterprise concern related to AI adoption has been addressed by Anthropic, which emphasizes that the inference can remain within the customer's existing cloud environment, whereas the conversation history can be kept locally. This gives organizations greater control over the handling of data. A number of enterprise identity and device management features are also included in the platform, including single sign-on (SSO), mobile device management (MDM) policy templates, offline installation, and cloud deployment capabilities, allowing organizations to utilize artificial intelligence in an integrated manner rather than introducing an isolated infrastructure based on security, compliance, and governance concerns. 

As part of the update, Claude Chat, Claude Cowork, and Claude Code policy management is separated to provide organizations with granular administrative controls, allowing organizations to selectively enable features and phase their expansion. 

In large enterprises with multiple legal, finance, operations, and engineering teams that require different AI capabilities under distinct governance policies, role-based structures are particularly beneficial. A new feature of Anthropic's enterprise connectivity with Microsoft 365 is the ability for organizations to route data access through their own Microsoft Entra application rather than connecting directly with Anthropic. 

A tenant allowlisting feature, beta support for Microsoft 365 GCC High and DoD environments, as well as an optional local connector allowing Microsoft services to communicate with user devices, ensures that enterprises retain full control over authentication, permissions, audit logging and data access. The administrator will also have the option of exporting deployment policies, validating connectors, verifying Claude models from the cloud provider, and testing configurations before implementing large-scale deployments.

The Anthropic team intends to reduce procurement complexity and position Claude Desktop as enterprise software integrated with existing identity management, compliance, and infrastructure workflows by allowing customers already standardized on Amazon Web Services, Google Cloud, or Microsoft Foundry to deploy Claude within their existing cloud estates. 

In the current enterprise AI landscape, success depends on not only model capabilities, but also deployment flexibility, administrative control, governance, and seamless integration into existing enterprise ecosystems as organizations move from limited AI pilot programs to organization-wide deployments. 

The Claude Desktop application, which is available on macOS and Windows, has largely contained Claude Cowork, which executes autonomous tasks directly on the host machine using locally shared files and resources. It has been noted that Anthropic is actively developing a companion mobile application, as screenshots recently surfaced on X indicate. 

Users are expected to be able to start and steer tasks from their smartphones via the Claude mobile application, web interface, or desktop client, while checking execution status through the mobile app. Further, the interface indicates that assigned workloads continue running in the background even after the mobile application has been closed, which demonstrates the purpose of this feature is to oversee tasks persistently rather than executing them locally. 

By following this architecture, mobile devices function as remote management endpoints, while desktop environments remain responsible for computational tasks, file access, document generation, spreadsheet creation, and other resource-intensive operations. 

Anthropic has not yet formally announced full mobile support, but its Cowork documentation already mentions beta pairing support for phones, suggesting that a greater range of cross-device capabilities is being actively developed, with details and eligibility for account eligibility still unknown. 

Claude Cowork's ability to operate continuously as an artificial intelligence work agent will be enhanced if this capability is released, allowing users to initiate, monitor, and manage extended workflows without having to remain physically connected to their desktop computers. Anthropic is further advancing its broader philosophy of agent-driven productivity rather than conventional chatbots. 

Based on Anthropological's latest developments, the next phase of enterprise AI will be characterized by both operational governance and model capability, as organizations increasingly rely on autonomous AI agents to execute business-critical workloads, securing deployment, identity-aware access controls, integration with the cloud, and centralized policy management will become essential features rather than optional ones. 

If enterprises evaluate agentic AI platforms, they should prioritize solutions that align with existing security architectures, compliance obligations, and administrative workflows to ensure productivity gains do not negatively impact visibility, governance, or data security.
Read more »
technology
AI AI research Alibaba Anthropic Claude technology

Anthropic Alleges Alibaba Conducted Massive AI Capability Extraction Campaign Against Claude

 


Anthropic has accused Chinese technology conglomerate Alibaba and its AI research division, Qwen, of carrying out a large-scale effort to extract capabilities from its Claude family of artificial intelligence models, describing the incident as the most extensive distillation operation the company has encountered.

The allegations were detailed in a June 10 letter sent to U.S. Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren. In the correspondence, Anthropic claimed that operators linked to Alibaba and Qwen systematically interacted with Claude in an attempt to capture and reproduce some of the model's most advanced capabilities.

According to the company, the activity occurred between April 22 and June 5, 2026. During that period, Anthropic says it recorded more than 28.8 million exchanges associated with the operation. The requests were allegedly distributed across nearly 25,000 fraudulent accounts, enabling the actors to conduct high-volume interactions with the platform while obscuring the true source of the activity.

Anthropic stated that the campaign was not focused on general-purpose chatbot functions. Instead, it allegedly targeted capabilities considered among the most valuable within the Claude ecosystem, including software engineering tasks and advanced agentic reasoning. These functions form a critical component of the company's Mythos Preview model, one of Anthropic's most sophisticated AI systems designed to perform complex reasoning and autonomous task execution.

At the center of the allegations is a technique known as adversarial distillation. In machine learning, distillation generally refers to the process of training a model using outputs generated by another system. While the approach itself is commonly used within the AI industry, Anthropic argues that the method becomes problematic when it relies on unauthorized access to proprietary models.

According to the company, the actors behind the campaign repeatedly queried Claude and collected its responses at scale. Those outputs could then be used as training material for another AI system, allowing developers to reproduce aspects of Claude's behavior without investing the time, computational resources, and research expenditure typically required to build a frontier model from the ground up.

Anthropic warned lawmakers that such activity enables organizations to appropriate years of research and development through large-scale extraction campaigns. The company argued that these operations are designed to gather capabilities developed by leading U.S. AI laboratories and incorporate them into competing systems without bearing the costs associated with original model development.

Beyond intellectual property concerns, Anthropic also raised questions about safety. The company noted that models trained through adversarial distillation may replicate useful capabilities while failing to inherit the safeguards, alignment mechanisms, and risk controls embedded within the original system. As a result, the practice could create AI models that retain advanced functionality but operate with fewer protections against misuse.

The allegations against Alibaba follow earlier claims made by Anthropic regarding unauthorized access attempts linked to Chinese AI developers. In February 2026, the company disclosed that DeepSeek, the startup whose low-cost AI models attracted global attention in 2025, was among several organizations accused of attempting to improperly obtain Claude outputs. Anthropic now characterizes these incidents as part of a broader pattern of repeated efforts to extract capabilities from leading U.S. AI systems.

The dispute emerges amid growing government scrutiny of advanced AI technologies. Earlier this month, Anthropic revealed that it had received guidance from the Trump administration requiring the company to restrict access to its newest AI models, including Fable 5 and Mythos 5. Under the directive, access would be limited to U.S. persons, preventing non-U.S. citizens, including some employees, from interacting with the latest systems.

The issue is also beginning to influence policy discussions on Capitol Hill. Senators Bill Hagerty and Andy Kim are reportedly preparing legislation that would authorize sanctions or other penalties against Chinese organizations found to have improperly obtained outputs from U.S. AI models for the purpose of training competing systems. The proposal reflects growing concern among lawmakers that frontier AI capabilities have become both strategic economic assets and matters of national security.

Alibaba has not publicly responded to the allegations.

The dispute surfaces a new battleground in the global AI race. As companies invest billions of dollars to develop increasingly capable models, concerns are shifting beyond traditional cybersecurity threats toward the protection of model knowledge itself. For AI developers, the challenge is no longer limited to securing infrastructure and data. It increasingly involves preventing the large-scale extraction of capabilities that can be repurposed to accelerate the development of rival systems.

With governments, technology companies, and regulators paying closer attention to model security, the Anthropic-Alibaba dispute may become an early test case for how the industry addresses unauthorized AI capability harvesting and the growing geopolitical competition surrounding advanced artificial intelligence.

Read more »
technology
Anthropic Artificial Intelligence Frontier AI open ai technology

Five Eyes Agencies Say AI-Powered Cyber Threats Are Closer Than Expected

 




Intelligence and cybersecurity agencies from five allied nations have issued a warning that advanced artificial intelligence systems capable of performing meticulously executed cybersecurity tasks may become widely accessible much sooner than many organizations expect.

In a joint statement, representatives from the Five Eyes intelligence alliance, comprising the United States, Canada, the United Kingdom, Australia, and New Zealand, cautioned that frontier AI models are progressing at a pace that could reshape how cyber operations are conducted on both sides of the security landscape. According to the agencies, capabilities that are currently associated with a small number of highly advanced AI systems may reach broader availability within months rather than years.

The warning instills a sense of concern among governments, security practitioners, and AI researchers who have spent the past year examining how rapidly improving language models can influence vulnerability discovery, exploit development, system reconnaissance, and defensive security operations.

Officials stated that frontier AI systems are expected to outperform current industry assumptions regarding cybersecurity-related tasks. As these systems continue to improve, they may alter how organizations identify weaknesses, respond to incidents, and defend critical infrastructure. At the same time, the same technological advances could provide malicious actors with new opportunities to automate portions of cyberattacks that previously required substantial technical expertise.

Notably, the agencies emphasized that their concern is not based solely on future developments. Many of the building blocks needed for AI-assisted cyber operations already exist today.

Security-focused AI models can currently be accessed through a variety of channels, including older commercial systems, open-source releases, and models developed outside Western technology companies. While some frontier AI developers have restricted access to their most capable systems, cybersecurity experts have repeatedly noted that advanced capabilities often spread beyond their original environments as newer generations of models are released.

The agencies argued that one of the most immediate concerns is not the creation of entirely new attack techniques, but the ability of AI systems to exploit weaknesses that organizations have failed to address for years.

Among the issues highlighted were aging technology environments, delayed software patching, unnecessary exposure of internal systems to the public internet, weak identity verification practices, inadequate access controls, and insufficient preparation for responding to security incidents. These weaknesses have contributed to countless breaches over the past decade, and officials believe increasingly capable AI systems could allow attackers to identify and exploit such gaps more efficiently and at greater scale.

The statement suggests that organizations should reassess assumptions about how much time they have to prepare. Traditional planning cycles often operate on the expectation that technological shifts unfold gradually. However, intelligence officials warned that AI-related cyber risks may evolve quickly enough to render existing security assumptions obsolete within a matter of months.

"The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years," the agencies wrote, urging organizations to prepare for changing threat conditions before they become operational realities.

The warning also comes amid growing debate surrounding the release and control of advanced AI systems. The statement references frontier models such as Anthropic's Fable 5 and the cybersecurity-focused Mythos model family, which have attracted attention because of their reported performance on security-related tasks.

While companies have attempted to limit access to some of their most advanced systems, researchers have repeatedly observed that the gap between proprietary frontier models and publicly available alternatives continues to narrow. Historically, open-source models have often trailed leading commercial systems by only several months. As a result, capabilities that are initially restricted to a limited group of users can eventually become available through other channels.

This pattern has intensified concerns among policymakers who worry that highly capable cyber-oriented AI tools may become accessible to a broader range of actors, including criminal groups and nation-state operators seeking to automate parts of their operations.

Government officials and AI developers have already begun exploring ways to use these technologies defensively before they become commonplace in offensive campaigns. Programs such as Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber Program are designed to provide vetted organizations with access to advanced AI systems for security testing, vulnerability identification, and defensive research.

The objective is straightforward: allow defenders to discover and remediate weaknesses before increasingly capable AI systems can routinely identify and exploit them.

Recent research has reinforced the view that AI is becoming increasingly effective at cybersecurity tasks. Studies conducted in controlled environments have shown that advanced models can assist with vulnerability analysis, code review, system enumeration, and portions of attack-chain development. Although these systems still require human oversight and are far from replacing experienced security professionals, their capabilities continue to improve with each generation.

Despite the attention surrounding frontier AI, the recommendations issued by the Five Eyes agencies are remarkably familiar. Rather than advocating entirely new security frameworks, officials argue that organizations should focus on practices that have long formed the foundation of effective cybersecurity programs.

These include maintaining timely patch management processes, reducing unnecessary internet-facing exposure, strengthening identity and access management controls, developing incident response plans, and treating cybersecurity as a strategic business responsibility rather than a compliance exercise delegated solely to technical teams.

For business leaders, the warning serves as a reminder that advances in artificial intelligence are unlikely to eliminate longstanding cybersecurity challenges. Instead, they may increase the speed at which those challenges can be exploited.

As frontier AI design systems continue to upgrade, organizations that maintain strong operational discipline, address known weaknesses promptly, and integrate cybersecurity considerations into decision-making processes will be better positioned to withstand a rapidly changing threat environment. Those that fail to do so may find that vulnerabilities once considered manageable can be identified, analyzed, and exploited far faster than before.

Read more »
phishing
AI Driven Cyber Attacks Anthropic Artificial Intelligence MITRE ATT&CK phishing

Researchers Warn AI Is Blurring the Line Between Skilled and Unskilled Hackers

 




For years, cybersecurity teams have relied on established methods to determine how dangerous a threat actor might be. Analysts typically examine the techniques an attacker uses, the tools involved, and the complexity of an operation to estimate the level of risk. New research from Anthropic, however, recommends that artificial intelligence is beginning to disrupt those assumptions.

The company's Frontier Red Team recently analyzed 832 user accounts that were removed from Anthropic's platforms for engaging in malicious cyber activity between March 2025 and March 2026. Researchers compared the observed behavior against the MITRE ATT&CK framework, a widely used industry resource that categorizes adversary tactics and techniques. Portions of the findings were also referenced in Verizon's 2026 Data Breach Investigations Report.

It's a signal to keep up with how cybercriminals are using AI. Rather than limiting AI to basic tasks, attackers are increasingly applying it to activities that take place after gaining access to a target environment. This trend suggests that AI is becoming part of deeper operational stages of cyber intrusions, including tasks that traditionally required stronger technical expertise.

Among all observed cases, malware development was the most common use of AI. Researchers found that 560 of the 832 analyzed accounts, representing more than two-thirds of the dataset, used AI-assisted tools to help create or modify malicious software. While this finding was expected, the more notable change appeared elsewhere.

Throughout the study period, researchers recorded a movement away from AI-assisted initial access activities and toward post-compromise operations. One example was account discovery, a process attackers use to identify valid user accounts within a breached network. AI-assisted account discovery increased by 8.9% during the reporting period. By contrast, AI-supported phishing activity declined by 8.6%.

The data also showed growing use of AI during lateral movement operations. Lateral movement refers to the actions attackers take after entering a network to expand their access and reach more valuable systems, users, or data repositories. According to the report, 54 of the 832 observed actors used AI assistance during this stage of an intrusion.

Historically, activities such as account discovery, privilege escalation, and lateral movement have been associated with more experienced operators because they require a stronger understanding of network environments and attack workflows. Researchers argue that AI is reducing those technical barriers, allowing a broader range of actors to perform tasks that were previously more difficult to execute effectively.

This change became visible in the study's risk assessment data. During the first half of the observation period, approximately 33% of threat actors were categorized as medium-risk or higher. During the second half, that proportion rose to 56%. Researchers described this increase as evidence that AI is helping a larger segment of the threat landscape carry out more advanced cyber activity.

The findings also raise questions about how the industry evaluates attacker sophistication. Security teams have long treated the number of techniques used during an attack as an indicator of capability. Anthropic's analysis suggests that this relationship is becoming less reliable in AI-assisted environments.

Researchers found only a small difference between lower-risk and higher-risk actors when measuring the number of techniques used. Less sophisticated actors employed an average of 16 techniques, while the most capable actors averaged 20. The narrow gap indicates that technique counts alone may no longer provide a meaningful way to prioritize threats.

The same pattern appeared when researchers examined how attackers interacted with AI systems. Whether actors used Claude Code, direct API access, or standard chat interfaces showed little connection to their assessed risk level. Simply identifying which AI tool was used did not provide a clear indication of the threat posed by an actor.

Instead, researchers found that the location of AI usage within the attack lifecycle was a stronger indicator of risk. Higher-risk operators tended to apply AI to technically demanding stages of an intrusion, including internal reconnaissance, privilege escalation, and lateral movement. These activities often have a direct impact on how effectively an attacker can establish control over a compromised environment.

Even that distinction may not remain useful indefinitely. Researchers observed that these more advanced use cases are gradually spreading throughout the broader threat ecosystem. As AI tools become more accessible and capable, activities once associated with a smaller group of highly skilled operators may become increasingly common.

Anthropic identified another characteristic that separated the most dangerous actors from the rest. Rather than using AI for isolated tasks, some operators built systems around AI models that connected multiple attack stages together. This allowed AI to support planning, execution, and decision-making across larger portions of an operation with limited human involvement.

Researchers describe this capability as agentic attack orchestration. In practical terms, it refers to AI systems that can assist with coordinating different phases of an intrusion, helping move an attack from one stage to another without requiring constant manual direction from an operator.

According to the report, this rising behavior exposes a limitation in existing cybersecurity frameworks. MITRE ATT&CK was designed to document attacker actions and techniques. It was not built to measure the degree of autonomy involved when AI systems help coordinate those actions.

Anthropic underlined this challenge using a cyber-espionage campaign it disrupted in November 2025. The operation involved attempts to use Claude Code in support of intrusion activity targeting organizations in multiple regions with relatively little direct human intervention.

When researchers mapped the operation to MITRE ATT&CK, it generated a profile containing 30 techniques across 13 tactics. On paper, that profile appeared comparable to many medium-risk actors included in the study. However, Anthropic's internal evaluation system assigned the operation the maximum possible risk score of 100.

Researchers argue that the discrepancy exists because current frameworks focus on what actions occur during an attack rather than how those actions are coordinated. An AI-assisted system capable of executing commands, identifying vulnerabilities, collecting credentials, and adapting to changing conditions throughout an intrusion presents a different operational challenge than a human manually performing each step.

The report notes that there are currently no ATT&CK categories specifically designed to capture autonomous orchestration, automated chaining of attack stages, or the reduction of human decision-making throughout an attack lifecycle.

Anthropic says it is actively discussing potential framework updates with MITRE to better account for AI-enabled attack behaviors. The company has also used insights from the research to strengthen safeguards within its own models, including controls intended to detect and prevent misuse involving malware development and large-scale data theft attempts.

For defenders, the findings suggest that traditional indicators may no longer provide a complete picture of cyber risk. A threat actor using AI to automate portions of an attack may achieve outcomes similar to those of a more experienced operator performing the same tasks manually. Likewise, an individual using a basic chat interface could potentially conduct operations that resemble those performed through more advanced integrations.


Read more »
Subscribe to: Posts (Atom)