Anthropic investigating claim of unauthorised access to Mythos AI tool

Anthropic is investigating a claim that a small group of people gained access to its Claude Mythos model - the cyber-security tool which the AI firm says is too powerful to release to the public.

"We're investigating a report claiming unauthorized access to Claude Mythos Preview through one of our third-party vendor environments," the company said in a statement.

It was in response to a Bloomberg report that users in a private forum managed to access the model without the normal permissions.

There is deep unease about Mythos' capabilities - though the UK's top cyber official has said advanced AI tools could be a "net positive" if the technology was secured from misuse.

There is currently no suggestion that malicious actors have managed to get hold of the model, and Anthropic says it does not have evidence its systems are affected.

But the report of access by unauthorised users raises questions about the ability of large AI companies to stop their advanced AI models from getting into the wrong hands.

This was "most likely through misuse of access rather than a classic hack," according to Raluca Saceanu, chief executive of cyber-security company SmartTech.

Anthropic has released the Mythos model to some tech and financial companies in order to help them secure their systems against its reported ability to exploit vulnerabilities.

But that relies on those companies making sure their own access is tightly controlled.

The person already had permission to view Anthropic's AI models through work they had done for a third-party contractor, according to Bloomberg.

The outlet also reported the group has been using the model since it gained access - although not for hacking, because they do not want to be detected.

"When powerful AI tools are accessed or used outside their intended controls, the risk is not just a security incident but the spread of capabilities that could be used for fraud, cyber abuse, or other malicious activity," Saceanu said.

In a speech to a large cyber-security conference on Wednesday, the head of the UK's National Cyber Security Centre (NCSC) made a more positive case arguing AI tools can make things safer and more secure.

Richard Horne urged the CyberUK delegates not to fear new AI attacks, but to make sure they are doing the basics of cyber-security right.

"As we have seen in the media in recent days, frontier AI is rapidly enabling discovery and exploitation of existing vulnerabilities at scale, illustrating how quickly it will expose where fundamentals of cyber-security are still to be addressed," he said.