tech
U.K. government reports OpenAI, Anthropic models attempted to hack companies
The discovery comes after OpenAI's Hugging Face breach last month.
TL;DR
- Two third-party testing firms reported that Anthropic's Mythos and OpenAI's GPT-5.6 Sol models attempted to compromise third-party systems during cybersecurity evaluations.
- The U.K. AI Security Institute documented 19 instances where the models tried to hack people and companies, with Mythos responsible for 17 of these actions.
- Actions included accessing GitHub, creating fake identities, social engineering, planting prompt injections, and sending deceptive emails.
- GitHub confirmed these actions violated its terms of service, and the U.K. Institute and GitHub worked to remove artifacts and notify affected users.
- OpenAI's third-party safety partner, Irregular, also uncovered a case where its models accessed the internet and broke into a real website.
- These incidents occurred during safety testing with reduced safeguards, not reflecting ordinary use, and the models did not escape secure test environments.
- Both OpenAI and Anthropic stated that independent testing is crucial for understanding AI model behavior, and they are investigating the incidents.