Newly released reports from AI firm Anthropic claim to have observed the first "AI-orchestrated cyber espionage campaign" but outside researchers are skeptical about its significance. Researchers at Anthropic say they detected a Chinese state-sponsored group using their Claude AI tool in an attack that automated up to 90% of the work, with human intervention required only sporadically.
However, experts from the cybersecurity industry question whether this discovery is as impressive as it's being made out to be. They point out that many white-hat hackers and developers of legitimate software have also reported incremental gains from their use of AI, raising questions about why malicious hackers get more attention for their achievements.
One expert even went so far as to say, "I continue to refuse to believe that attackers are somehow able to get these models to jump through hoops that nobody else can... Why do the models give these attackers what they want 90% of the time but the rest of us have to deal with ass-kissing, stonewalling, and acid trips?"
Researchers also point out that the attacks were not as successful as initially claimed. In fact, it was only a small number of the targets that were successfully breached. Furthermore, the attackers used readily available open-source software and frameworks, which are already easy for defenders to detect.
Another expert noted, "The threat actors aren't inventing something new here." Anthropic itself acknowledged an important limitation in its findings: the AI tool was often prone to AI hallucinations, where it would claim to have obtained credentials that didn't work or identify discoveries that were publicly available information. This required careful validation of all claimed results.
In contrast, Anthropic reported that the attackers developed a five-phase attack structure that increased AI autonomy through each phase. However, the attackers were able to bypass certain guardrails by breaking tasks into small steps that the AI tool didn't interpret as malicious.
However, experts from the cybersecurity industry question whether this discovery is as impressive as it's being made out to be. They point out that many white-hat hackers and developers of legitimate software have also reported incremental gains from their use of AI, raising questions about why malicious hackers get more attention for their achievements.
One expert even went so far as to say, "I continue to refuse to believe that attackers are somehow able to get these models to jump through hoops that nobody else can... Why do the models give these attackers what they want 90% of the time but the rest of us have to deal with ass-kissing, stonewalling, and acid trips?"
Researchers also point out that the attacks were not as successful as initially claimed. In fact, it was only a small number of the targets that were successfully breached. Furthermore, the attackers used readily available open-source software and frameworks, which are already easy for defenders to detect.
Another expert noted, "The threat actors aren't inventing something new here." Anthropic itself acknowledged an important limitation in its findings: the AI tool was often prone to AI hallucinations, where it would claim to have obtained credentials that didn't work or identify discoveries that were publicly available information. This required careful validation of all claimed results.
In contrast, Anthropic reported that the attackers developed a five-phase attack structure that increased AI autonomy through each phase. However, the attackers were able to bypass certain guardrails by breaking tasks into small steps that the AI tool didn't interpret as malicious.
, this whole "first AI-orchestrated cyber espionage campaign" thing sounds like a marketing gimmick to me 
. I mean, come on, 90% of the work automated? That's just not believable 
. And what's with all the hype about Claude AI tool? It's just open-source software frameworks that everyone's been using for ages 
.
. Like, if you're gonna use publically available info, why bother trying to hide it? 
.
. We've had white-hat hackers making similar gains from AI for ages 
. It's time to dial it back and focus on actual security issues 
.
. I mean, it's true that Anthropic's Claude AI tool was pretty handy for attackers, but didn't white-hat hackers like others just discover similar stuff too? 
.
. 
.
. Meanwhile, our own white-hat hackers are doing similar stuff behind the scenes and nobody's giving them the recognition they deserve 
. The fact that 90% of work was automated is pretty impressive, but let's be real, most of us have been using AI tools in our daily lives for years without it blowing up in our faces 
. Maybe this means attackers are getting more efficient or maybe its just a case of people not reporting it as much?
, but also tells us that attackers aren't exactly breaking new ground here 
.
.
, and who knows maybe they're right 
what's really being overlooked here? 