Latest / Elon Musk Podcast / Anthropic Claude Mythos Hacked Global Infrastructure

Transcript

Anthropic Claude Mythos Hacked Global Infrastructure · Elon Musk Podcast

• 0:00
  Anthropic built an artificial intelligence model so dangerous
• 0:03
  it autonomously hacked into software infrastructure that had
• 0:06
  been secure for decades, prompting the company to lock
• 0:10
  the technology away from the public entirely.
• 0:12
  Yeah, that model is Claude Mythos.
• 0:14
  It actually uncovered a hidden vulnerability in the open BSD
• 0:17
  operating system that had sat completely undetected for a
• 0:21
  really, really long time. We are essentially looking at a
• 0:25
  fundamental tension here between these incredible technological
• 0:29
  capabilities and just a complete loss of control over how those
• 0:32
  capabilities operate out in the wild.
• 0:34
  So how did a technology deemed too dangerous to release, spark
• 0:38
  a legal war with the military, prompt this highly exclusive
• 0:41
  corporate alliance, and get breached by a random discord
• 0:44
  group all at the exact same time?
• 0:46
  To understand how all these threads connect, we have to, you
• 0:49
  know, look at what this model actually is internally.
• 0:52
  Anthropic called this the Capybarrateer.
• 0:54
  And The thing is, Anthropic did not explicitly train this model
• 0:57
  to execute cyberattacks, right? Like it wasn't fed endless
• 1:01
  databases of malicious code with instructions to just break
• 1:04
  things. What totally blows my mind here
• 1:06
  is the origin of these offensive skills.
• 1:08
  They emerged entirely as a byproduct of its advanced
• 1:11
  reasoning and coding capabilities.
• 1:13
  Like when an artificial intelligence gets exceptionally
• 1:16
  good at understanding what a piece of code is supposed to do,
• 1:19
  and then it compares that to what the code actually does.
• 1:22
  It spots the difference. Exactly.
• 1:23
  It recognizes the gap between those two states, and that gap
• 1:26
  is where vulnerabilities live. So the model essentially learned
• 1:30
  to just reason its way through complex software logic.
• 1:33
  And the results from that reasoning process are just
• 1:35
  staggering. I mean, Mythos found a bug in
• 1:38
  FFM PEG code. And for context for you
• 1:41
  listening, FFM PEG is the underlying technology used for
• 1:44
  video encoding and decoding all over the Internet.
• 1:46
  Yeah, it's everywhere. Pretty much every time you watch
• 1:49
  a video online, FFM PEG is involved in making sure those
• 1:52
  pixels actually render correctly on your screen.
• 1:55
  If an attacker controls an FFM PEG vulnerability, they could
• 1:59
  theoretically compromise your device just by having you stream
• 2:02
  a video. Yeah, a maliciously crafted
• 2:04
  video file could execute code on your laptop while you just sit
• 2:08
  there thinking you're watching a standard clip.
• 2:10
  And that specific bug had been missed by 5 million automated
• 2:14
  fuzz tests. And fuzz testing is where
• 2:18
  developers basically just throw massive amounts of random data
• 2:21
  at a program to see if it crashes.
• 2:24
  If you are testing the structural integrity of a house,
• 2:27
  fuzz testing is like driving a bulldozer into the living room.
• 2:30
  You know, throwing rocks at the windows and blasting the roof
• 2:34
  with a fire hose just to see what breaks.
• 2:36
  Right, it's pure brute force, and millions of those tests just
• 2:39
  missed the flaw. But Mythos didn't do that.
• 2:42
  It read the architectural blueprints, noticed a load
• 2:45
  bearing pillar was missing a single bolt, and realized a
• 2:48
  slight breeze from a specific angle would collapse the whole
• 2:51
  structure. That is.
• 2:52
  Wild it reasoned its way to the flaw without firing a single
• 2:55
  random test. But it goes far beyond just
• 2:57
  finding single bugs, right? Because Mythos autonomously
• 3:00
  chained multiple vulnerabilities together to achieve complete
• 3:04
  Linux kernel privilege escalation.
• 3:06
  And normally, if you access a computer, you are just a guest
• 3:10
  user. You can browse the Internet,
• 3:11
  maybe open a document, but you obviously can't delete system
• 3:14
  files or install malware. Privilege escalation is well,
• 3:18
  it's like walking into an office building as a visitor, finding a
• 3:21
  janitor's closet left unlocked, grabbing a master key from that
• 3:24
  closet, using that key to enter the security room.
• 3:27
  And suddenly you own the building.
• 3:28
  Yes, suddenly you can disable all the cameras and unlock the
• 3:32
  main vault. It found a tiny flaw, used that
• 3:35
  to access another system, found a flaw there, and Justice KET
• 3:38
  climbing the ladder until it went from having basic user
• 3:42
  access to total root control of the machine.
• 3:45
  And it did all of this without human guidance.
• 3:48
  Well, let me reset the pace for a second.
• 3:49
  Here, we're talking about a machine moving from a basic
• 3:53
  level of access to total control entirely on its own.
• 3:56
  The window between vulnerability discovery and exploitation
• 3:59
  shrinks to practically 0. It fundamentally alters how
• 4:03
  defenders must respond to cyber threats, because if an attacker
• 4:06
  has this capability, human defenders simply cannot type
• 4:10
  fast enough to patch systems and keep up with machine speed
• 4:12
  attacks. And that exact realization LED
• 4:16
  directly to Project Glass Wing. Recognizing the extreme danger,
• 4:20
  Anthropic restricted access to this model, limiting it to a 40
• 4:24
  company alliance. We're talking about heavyweights
• 4:27
  here, Apple, Google, Microsoft and Crowdstrike.
• 4:31
  The big players. Exactly.
• 4:33
  Anthropic also backed this initiative with a $100 million
• 4:37
  credit pool for these companies to run intensive scans on their
• 4:40
  infrastructure to find and fix bugs before adversaries could
• 4:44
  exploit them. I have to push back on the
• 4:45
  setup, though. I mean, is this like giving the
• 4:47
  world's smartest guard dog exclusively to billionaires
• 4:50
  while everyone else just has to leave their doors unlocked?
• 4:52
  But keeping this tool within an exclusive circle?
• 4:55
  You create massive antitrust risks.
• 4:57
  Smaller cybersecurity firms are totally excluded, right?
• 5:00
  They get nothing. And major operational technology
• 5:02
  and industrial control system vendors are entirely left out of
• 5:05
  the alliance. Companies like Siemens and
• 5:07
  Rockwell, they build the actual software that runs physical
• 5:11
  infrastructure. We are talking water treatment
• 5:14
  plants, power grids, factory floors.
• 5:17
  If they don't get the artificial intelligence to patch their
• 5:20
  flaws, our physical infrastructure remains totally
• 5:23
  exposed while tech monopolies secure their search engines and
• 5:26
  cloud servers. It creates a huge transparency
• 5:29
  vacuum. This arrangement concentrates
• 5:31
  security advantages among existing monopolies.
• 5:35
  Section 1 of the Sherman Antitrust Act prohibits
• 5:37
  combinations and restraint of trade, and that includes certain
• 5:41
  types of information sharing. When forty of the most powerful
• 5:44
  firms share technical data and best practices in a private
• 5:47
  circle, it risks aligning their market behavior in ways that
• 5:51
  suppress competition. Smaller competitors are simply
• 5:54
  denied the opportunity to safety proof their systems at the exact
• 5:57
  same speed. So the most advanced security
• 5:59
  tool ever created is essentially locked in this corporate
• 6:02
  fortress to prevent a global catastrophe.
• 6:04
  But that exclusive fortress was bypassed almost immediately by a
• 6:08
  private Discord group. Wait, back up.
• 6:10
  Stop right there. How does a group of random
• 6:13
  Discord users access the most guarded artificial intelligence
• 6:17
  code on Earth? What fascinates me here is that
• 6:20
  this wasn't some like Mission Impossible style heist.
• 6:24
  Nobody shattered complex encryption algorithms.
• 6:26
  They didn't crack AES 256 encryption or anything.
• 6:30
  It was a cascading chain of human errors across a supply
• 6:33
  chain. They basically just walked
• 6:35
  through a side door that someone left propped to open first.
• 6:38
  Anthropic had a misconfigured content management system.
• 6:42
  Assets published there were set to public by default unless
• 6:46
  explicitly changed. Yeah, that error alone exposed
• 6:50
  thousands of internal assets. And then a packaging error
• 6:53
  leaked the architecture for a related tool, specifically an
• 6:57
  NPM packaging error. That's Node package manager.
• 7:01
  When developers build software they pull in pre written bundles
• 7:03
  of code called packages so they don't have to write everything
• 7:06
  from scratch. Makes sense, but if a developer
• 7:08
  accidentally publishes an internal package to the public
• 7:11
  registry instead of their private one, anyone can download
• 7:13
  it. So a developer might be rushing
• 7:15
  to meet a deadline, they push an update, and they accidentally
• 7:18
  type the command to publish to the public and PM registry
• 7:21
  instead of the internal company server.
• 7:23
  Just one typo and that package contained references to the
• 7:27
  internal architecture, but the real fatal blow was a breach at
• 7:31
  a third party training contractor named Mercker.
• 7:34
  Right, because training contractors hire thousands of
• 7:37
  people to rate artificial intelligence outputs and they
• 7:40
  need access to company systems to do their jobs.
• 7:44
  So you end up with a massive surface area of human workers
• 7:47
  and literally any one of them might reuse a password or fall
• 7:50
  for a phishing scam. Which is exactly what happened.
• 7:53
  They lost terabytes of data, Slack Communications internal
• 7:56
  tickets, and, crucially, Anthropics internal naming
• 7:59
  conventions for unreleased models.
• 8:01
  The Discord group found out that the Mythos project followed a
• 8:04
  specific alphanumeric formatting pattern for its web addresses.
• 8:07
  So the group used a technique called location guessing because
• 8:12
  they knew the internal code name was Capybara and they understood
• 8:15
  the semantic structure Anthropic used for their URLs.
• 8:18
  From that Mercury leak they knew the addresses probably look
• 8:21
  something like model Capybara V1 internal.
• 8:24
  They just iterated through potential web addresses until
• 8:27
  they found the specific Capybara endpoint on Anthropics
• 8:31
  interface. But finding the door is one
• 8:33
  thing. They still needed a way to get
• 8:34
  inside. Exactly.
• 8:36
  And one member of this discord group happened to be a third
• 8:39
  party contractor for Anthropic. They had valid API credentials.
• 8:43
  While those credentials were not explicitly authorized for
• 8:46
  Mythos, they remained functional within the broader environment
• 8:49
  because of excessive permissions granted to contractors.
• 8:53
  It's like figuring out a hotel's room numbering system, wandering
• 8:56
  the halls until you find the hidden VIP suite, and then
• 8:59
  realizing your generic cleaning staff key card hasn't been
• 9:03
  deactivated yet. And for some bizarre reason, it
• 9:05
  opens the penthouse door, right. They plug their valid
• 9:08
  credentials into the hidden URL they guessed and they were in.
• 9:12
  This exposes the extreme fragility of the artificial
• 9:15
  intelligence supply chain. The security of this world
• 9:18
  altering technology is only as strong as the absolute weakest
• 9:23
  third party contractor. It opens up entirely new vectors
• 9:27
  for cyber criminals. You don't need to hack the
• 9:29
  heavily fortified central servers if you can just find an
• 9:32
  external vendor with sloppy access controls and a leaky
• 9:36
  communication channel. So if a private company cannot
• 9:39
  keep hobbyists out of their most dangerous systems, who should be
• 9:42
  managing this technology? The United States government
• 9:45
  observed these capabilities and demanded Anthropic amend its
• 9:48
  defense contracts to allow any lawful use of their artificial
• 9:52
  intelligence. But Anthropic refused.
• 9:54
  They maintained 2 absolute red lines in their negotiations.
• 9:58
  First, they explicitly banned the use of their models for mass
• 10:01
  domestic surveillance of citizens.
• 10:03
  And second, they prohibited their technology from powering
• 10:06
  fully autonomous weapons without human oversight over targeting
• 10:10
  and firing decisions. And the government retaliated
• 10:12
  aggressively. The Pentagon actually designated
• 10:14
  Anthropic a supply chain risk. Yeah, that is a highly specific
• 10:19
  label normally used for foreign adversaries capable of covert
• 10:23
  sabotage. Putting that label on a domestic
• 10:26
  tech company is an extraordinary escalation.
• 10:28
  The president then issued A directive ordering all federal
• 10:32
  agencies to immediately cease using Anthropic technology.
• 10:36
  The General Services Administration even terminated
• 10:39
  the contract that made the company's services available
• 10:42
  across the federal government. But Anthropic fought back.
• 10:45
  They sued the government, alleging First Amendment
• 10:47
  retaliation and due process violations.
• 10:50
  They argued they were being punished for their public
• 10:52
  advocacy regarding safety guardrails.
• 10:55
  They also pointed out the government failed to follow the
• 10:57
  procedural steps required by law before excluding A vendor from
• 11:00
  federal supply chains. And a federal judge actually
• 11:03
  agreed with him, securing A preliminary injunction and
• 11:06
  calling the government's motives pretextual.
• 11:09
  This changes the power dynamic in military contract and
• 11:12
  completely it forces society to ask whether a private tech
• 11:15
  corporation can legally dictate operational constraints to the
• 11:19
  armed forces. Well, the military argues a
• 11:21
  private contractor should not hold veto power over lawful
• 11:25
  operational decisions. But the tech company argues
• 11:29
  their systems are simply not reliable enough for lethal
• 11:32
  environments and can make totally inexplicable, reckless
• 11:35
  decisions. Yet despite the federal ban and
• 11:38
  the supply chain risk designation, the National
• 11:41
  Security Agency confirmed they are still actively deploying
• 11:45
  Mythos. The irony is just wild.
• 11:47
  The intelligence community is relying heavily on the exact
• 11:49
  tool the military blacklisted, right?
• 11:52
  The NSA operates in the realm of signals intelligence and cyber
• 11:55
  espionage. They collect zero day
• 11:57
  vulnerabilities. They don't care about the red
• 11:59
  line regarding autonomous weapons because they aren't
• 12:01
  flying drones. They are infiltrating networks.
• 12:04
  So they just quietly keep using the tool while the rest of the
• 12:07
  federal government publicly bans it.
• 12:09
  It creates A deeply confusing compliance environment for
• 12:12
  federal agencies and defense contractors who were told to
• 12:15
  literally cease commercial activity with the company while
• 12:18
  a major intelligence agency continues to run the most
• 12:21
  restricted version of the platform.
• 12:23
  Meanwhile, Open AI struck a deal with the Pentagon by agreeing to
• 12:26
  their terms. Instead of imposing new
• 12:28
  technical red lines, they just relied on existing legal
• 12:31
  frameworks. They launched GPT 5.4 cyber with
• 12:35
  a much wider, way less restricted roll out.
• 12:38
  Their whole philosophy is that no one should be picking winners
• 12:41
  and losers in cybersecurity and that wider access to the taste,
• 12:44
  faster defense. But some experts argue the
• 12:47
  apocalyptic narrative around mythos is overblown.
• 12:50
  The Artificial Intelligence Security Institute analyzed the
• 12:53
  model and noted it struggles significantly when actual
• 12:56
  security alerts and active defenses are running in the test
• 12:59
  environment. I really have to highlight the
• 13:01
  critique from researchers in investigating the actual data
• 13:04
  here. The flagship demonstration of
• 13:06
  the models power involved finding vulnerabilities in a web
• 13:09
  browser. But critics pointed out the
• 13:11
  model exploited bugs that an older model had already found
• 13:14
  inside a patched browser in a test harness, where the
• 13:16
  sandboxing and basic defenses were entirely stripped out.
• 13:20
  Yeah, let me explain why stripping out the sandbox
• 13:22
  matters. A sandbox and software is an
• 13:24
  isolated environment. It restricts what a program can
• 13:27
  do so that if a piece of code goes rogue, it cannot infect the
• 13:31
  rest of your computer. Taking the sandbox away for the
• 13:34
  test is like bragging about picking a lock but conveniently
• 13:38
  omitting that the door was already taken off its hinges.
• 13:40
  Right. And when you remove those
• 13:42
  artificial advantages, the Exploits accessory plummets from
• 13:45
  over 70% down to roughly 4%. So critics suggest Anthropics
• 13:50
  too dangerous to release stands might just be marketing a
• 13:54
  corporate strategy designed to avoid open sourcing the
• 13:56
  technology or sharing it more widely, all under the guise of
• 14:00
  an existential security threat. Wait, hold on, Even if the
• 14:03
  success rate drops to 4%, is that actually comforting?
• 14:06
  If a machine can execute 10,000 exploit attempts in a minute, a
• 14:10
  4% success rate still means it is breaching your system 400
• 14:13
  times. That is exactly the counter
• 14:16
  argument. A low success rate at machine
• 14:18
  speed, still a huge volume of successful hacks.
• 14:22
  But if safety warnings are perceived as just another
• 14:25
  corporate strategy to maintain market dominance, actual
• 14:28
  existential threats might just be ignored by regulators and the
• 14:32
  public when they finally do arrive.
• 14:34
  The emergence of autonomous cyber capabilities forces
• 14:38
  society to rethink security entirely, basically pitting
• 14:42
  private corporate alliances against government demands and
• 14:44
  rogue hackers. And it really leaves us
• 14:46
  wondering who ultimately gets to decide the rules of engagement
• 14:49
  in this new era of automated warfare?
• 14:52
  Elected governments or private techs?
• 14:54
  Executives. If you're not subscribed yet,
• 14:56
  take a second and hit follow on whatever app you're using.
• 14:58
  It helps us keep making this. We appreciate you being here.
• 15:01
  Also, check out our YouTube channel for more business and
• 15:03
  tech updates. There's a link in the
• 15:04
  description.