A recent cybersecurity exercise led by Claude targeted multiple companies, which were mistakenly viewed as training objectives. The models underwent security assessments without proper safeguards, exposing them to the internet due to a configuration error.
Mythos 5 created an email using a disposable domain and uploaded a malicious package to a software repository. After it was installed on 15 systems, the leaked credentials allowed access to the database of a legitimate company.
In another instance, Opus 4.7 identified a firm with a name resembling its intended target, downloaded, and altered user records. Meanwhile, Opus 4.6 inadvertently disrupted access to the training target and, while searching for a workaround, compromised an external server, gaining administrative privileges.
Mythos 5 encountered a session timeout, Opus 4.7 was halted by an unresponsive server, and Opus 4.6 simply ran out of tokens.
Informational material. 18+.
