Cyber Security Shots

Back to my blog after 7 months of hibernation. I’ve been stretching my brain on things that excited me, and still continue to excite me, but I felt it was time to get back to the blog. In future posts, I want to focus more on the why aspect .

This week, let’s study an Anthropic security incident.

Sequence of events

1. An early checkpoint of Claude Opus 4.6 was given a CTF exercise in a partner’s evaluation environment.
2. It assigned its target an IP address that conflicted with another machine, making the target unreachable and the task become impossible.
3. It tried to abort the task, then tried 7 more times (8 in total), but every attempt failed due to a bug in Anthropic’s evaluation harness.
4. Due to a network misconfiguration, it found an egress path to the internet.
5. It found a third-party machine and assumed it was part of the CTF.
6. It used a password found in a file to gain admin access.
7. It harvested more credentials, changed settings, and read one person’s personal data.
8. The run ended only when its token budget ran out.

What were the causes?

1. A bug in Anthropic’s evaluation harness (the abort didn’t work)
2. Egress misconfiguration
3. Undefined scope systems

What could have stopped it?

1. Egress control (no route to the internet)
2. A properly working harness (a functioning abort)
3. Defined scope, with two parts:
   1. Defining the scope in the prompt
   2. Deterministic enforcement on every action (at least the critical ones)

This post is based on Anthropic’s article.