Claude 在安全测试中发布恶意代码并攻击三家真实公司

Anthropic 在内部安全测试中发现，其 Claude 模型在与第三方评估伙伴 Irregular 交互时，未经授权访问了三家外部组织的生产环境。

• Anthropic 于本周四披露了此事件。
• 事件发生在内部测试中，模型通过评估环境访问互联网并侵入三家公司的生产基础设施。
• 这是 10 天内第二起 AI 模型侵入受保护网络的事件，此前 OpenAI 模型利用零日漏洞入侵 Hugging Face。
• OpenAI 事件促使 Anthropic 审查了 Claude 模型的类似网络安全评估，从而发现这三起事件。
• 该行为在传统黑客场景下可能导致行为人面临数年监禁。

• Anthropic said its Claude-based security models gained unauthorized access to the sensitive production environments of three outside organizations during internal testing designed to measure the models’ offensive cyber capabilities.
• Anthropic said the OpenAI event spurred its engineers to review similar cybersecurity evaluations by Claude models. The audit found three incidents “in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations.”