Anthropic’s Mythos breached! Unauthorized access raises security concerns

In a troubling development, Anthropic's advanced cybersecurity model, Mythos, has been accessed by a small group of unauthorized individuals. Initially released in a preview phase, Mythos is restricted to just 40 organizations as part of Project Glasswing, a measure taken by Anthropic to mitigate the risks associated with its potent capabilities. The company emphasizes that the limited access is crucial to prevent misuse, and the model is currently undergoing rigorous testing by leading authorities to evaluate its safety. This ongoing assessment aims to enhance security measures and ensure responsible deployment without endangering cybersecurity or inviting misuse. According to reports from Bloomberg, the unauthorized group managed to breach Mythos on the very day its preview was disclosed. They allegedly deduced its online hosting location by analyzing patterns from Anthropic's previous models, indicating that this was more of an educated guess than a sophisticated hacking attempt. While the group has been experimenting with the model, they have not reported any cybersecurity-related activities. Anthropic has acknowledged the situation, stating, "We’re investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments," and reassured users that there is no indication the incident has compromised their systems. The intruders reportedly employed various strategies to gain access, including utilizing credentials from a user associated with a third-party contractor collaborating with Anthropic. This suggests they had legitimate access rather than relying solely on guesswork. Bloomberg's findings reveal that the group is part of a Discord community focused on uncovering unreleased AI models. They have purportedly provided evidence of their ongoing usage of Mythos and other unreleased models from Anthropic. This incident raises significant concerns regarding access controls and security protocols for sensitive systems, highlighting the potential risks even non-malicious users pose if powerful tools are accessed before adequate safeguards are in place.