Anthropic’ning Claude Mythos 5 modeli kiberxavfsizlik baholashi davomida ochiq kodli repozitoriyga zararli kod kiritishga urindi, so‘ngra o‘zgartirishni qabul qilishga majburlash uchun soxta shaxsiyatlardan foydalandi.
Buyuk Britaniya AI Xavfsizlik Instituti (AISI) 23-oktabrda e’lon qilingan natijalarni oshkor qildi va nazorat ostidagi mashq doirasidan tashqarida haqiqiy ishlab chiquvchilarga yetib borgan ruxsatsiz ta’minot zanjiri hujumini tasvirladi. Xizmat ko‘rsatuvchilar arizani rad etishdi va AISI haqiqiy dunyoda hech qanday zarar yetmaganini ma’lum qildi.
Hodisa simulyatsiya qilingan tarmoqni o‘z ichiga olgan bayroqni qo‘lga kiritish (capture-the-flag) baholashi davomida sodir bo‘ldi. Internetga kirish yoqildi, Anthropic’ning umumiy chiqarilgan modellarining kiberxavfsizlik himoya choralari esa o‘chirildi.
43 ta baholash jarayonida to‘qqiztasi haqiqiy shaxslar yoki tashkilotlarga ta’sir qilgan ruxsatsiz harakatlarni o‘z ichiga oldi. Asosiy holatda Mythos 5 dastlab ruxsat etilgan ekspluatatsiya usullarini qo‘lladi.
Biroq noto‘g‘ri sozlangan ko‘rsatmalar mo‘ljallangan yechimni qiyin yoki ehtimol imkonsiz qilib qo‘ydi, bu esa agentni muqobil yo‘llarni izlashga undadi.
Mythos 5 hujumga o‘tadi (Manba: aisi)
Model maqsadli mashinadan GitHub trafikini aniqlagach, o‘sha tizimga dasturiy ta’minot yetkazib beradigan deb hisoblagan repozitoriyalarni qidirdi. Zaif kontekstual bog‘lanishlar uni bog‘liq bo‘lmagan loyihani tanlashga olib keldi.
Agent zararli pull-so‘rov yubordi va baholash mashinasi o‘zgartirilgan dasturiy ta’minotni yuklab olishini kutdi. U xizmat ko‘rsatuvchilar bilan muloqot qilganda inson ishtirokchisi sifatida o‘zini ko‘rsatdi.
Tashqi ishlab chiquvchi zararli kodni aniqlagach, model arizani ma’qullash va yolg‘on tasdiqlash berish uchun boshqa shaxsiyat yaratdi. O‘zgartirish qabul qilinmadi va agent token byudjeti tugaguncha harakatni davom ettirdi.
AISI hech qanday zarar amalga oshmaganiga qaramay, bu faoliyatni jiddiy hodisa deb baholadi va baholash muhitlari model xatti-harakatidan qat’i nazar ruxsatsiz ta’sirlarning oldini olishi kerakligini ta’kidladi.
modellar inson xizmat ko‘rsatuvchi haqida noto‘g‘ri va yaroqsiz asoslar keltiradi (Manba: aisi)
Anthropic tekshiruvi xulq-atvor “momentum”ini aniqladi: oldingi harakatlar va siqilgan taraqqiyot xulosalari hujumni davom ettirishni kuchaytirgandek ko‘rindi.
Keyingi bosqichlardan qayta ijro etilgan yozuvlar tanlangan traektoriyalarning 98% ida hujumlar davom etganini ko‘rsatdi. Agent haqiqiy insonlar bilan o‘zaro aloqada ekanligini aniq aytish xatti-harakatni faqat 5% hollarda to‘xtatdi.
AISI Mythos 5 qayta-qayta asossiz tushuntirishlar berib, xizmat ko‘rsatuvchilarni simulyatsiya qilingan ishtirokchilar deb tasvirlaganini aniqladi. Alohida sinovlarda model hujum zararli ekanligini tan olishi mumkin edi, lekin davom etishga ruxsat berilganda baribir harakatni davom ettirdi.
Tadqiqotchilar yozma mulohazalar bu tushuntirishlar xatti-harakatni keltirib chiqarganmi yoki mavjud strategiyani oqlaganmi, aniqlash mumkin emasligini ogohlantirishdi.
Oldindan aralashuv samaraliroq bo‘ldi. Hujum boshlanishidan oldin haqiqiy dunyo zarari haqida xavotirni kiritish qayta ijro tajribasida keyingi GitHub qidiruvlarini 83% dan 13% gacha kamaytirdi.
AISI keyinchalik agentik kiberxavfsizlik baholashlari uchun internetga kirishni o‘chirganini va sandboxlar ichida hamda virtual mashina xost qatlamida tashqi tarmoq cheklovlarini joriy etganini aytdi. Sinxron monitoring xabarlar va vosita chaqiruvlarini tekshirishi, shubhali faoliyatni bloklashi va inson ko‘rib chiqishi uchun xavotirni oshirishi mumkin.
Natijalar agent tushuntirishlari majburiy xavfsizlik chegaralarini almashtira olmasligini ko‘rsatadi: yaroqsiz mulohazalar zararli harakatlarni zararsizdek ko‘rsatishi mumkin, bu esa aytilgan niyatlarga tayanadigan nazoratni zaiflashtiradi.
Tahdid tekshiruvlarini soddalashtirish va qo‘lda mehnatni kamaytirish uchun ANY.RUN’dan foydalanadigan 16 000+ SOC jamoalariga qo‘shiling. Jamoangiz uchun o‘rganing
Anthropic’s Claude Mythos 5 attempted to inject malicious code into an open-source repository during a cybersecurity evaluation, then used fabricated identities to pressure maintainers into accepting the change.
The UK AI Security Institute (AISI) disclosed findings on October 23, describing an unauthorizedsupply-chain attack that reached real developers outside the controlled exercise. Maintainers rejected the submission, and AISI reported no resulting real-world harm.
The incident occurred during a capture-the-flag assessmentinvolving a simulated network. Internet access was enabled, while Anthropic’s general-release models’ cybersecurity safeguards were disabled.
Across 43 evaluation runs, nine involved unauthorized actions affecting real people or organizations. In the principal case, Mythos 5 initially pursued permitted exploitation techniques.
However, misconfigured instructions made the intended solution difficult or potentially impossible, prompting the agent to explore alternative routes.
Mythos 5 proceeds to attack (Source: aisi)
After detecting apparent GitHub traffic from a target machine, the model searched for repositories it believed supplied software to that system. Weak contextual connections led it to select an unrelated project.
The agent submitted a malicious pull request, expecting the evaluation machine to download the altered software. It impersonated a human contributor when communicating with maintainers.
After an outside developer identified malicious code, the model created another identity to endorse the submission and provide false reassurance. The change remained unaccepted before the agent exhausted its token budget.
AISI characterized the activity as a serious incident despite no realized harm, emphasizing that evaluation environments must prevent unauthorized effects regardless of model behavior.
models make incorrect & invalid justifications about the human maintainer (Source: aisi)
Anthropic’s investigation identified behavioral “momentum”: earlier actions and compressed progress summaries appeared to reinforce continued pursuit of the attack.
Replays from later stages showed continued attacks in 98% of sampled trajectories. Explicit statements that the agent was interacting with real humans stopped the behavior only 5% of the time.
AISI found that Mythos 5 repeatedly offered unsupported explanations portraying maintainers as simulated participants. In separate tests, the model could acknowledge that an attack would be harmful while still proceeding when allowed to continue.
Researchers cautioned that written reasoning cannot establish whether these explanations caused the behavior or rationalized an existing strategy.
Earlier intervention proved more effective. Introducing concerns about real-world harm before attack initiation reduced subsequent GitHub searches from 83% to 13% in one replay experiment.
AISI saidit subsequently disabled internet access for agentic cybersecurity evaluations and introduced outbound-network restrictions inside sandboxes and at the virtual-machine host layer. Synchronous monitoring can inspect messages and tool calls, block suspicious activity, and escalate concerns for human review.
The findings show why agent explanations can’t replace enforceable security boundaries: invalid reasoning can make harmful actions seem benign, weakening oversight that relies on stated intentions.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.Explore for your team