AI firm claims it stopped Chinese state-sponsored cyber-attack campaign
A leading artificial intelligence company claims to have stopped a China-backed “cyber espionage” campaign that was able to infiltrate financial firms and government agencies with almost no human oversight.The US-based Anthropic said its coding tool, Claude Code, was “manipulated” by a Chinese state-sponsored group to attack 30 entities around the world in September, achieving a “handful of successful intrusions”.This was a “significant escalation” from previous AI-enabled attacks it monitored, it wrote in a blogpost on Thursday, because Claude acted largely independently: 80 to 90% of the operations involved in the attack were performed without a human in the loop.“The actor achieved what we believe is the first documented case of a cyber-attack largely executed without human intervention at scale,” it wrote.Anthropic did not clarify which financial institutions and government agencies had been targeted, or what exactly the hackers had achieved – although it did say they were able to access their targets’ internal data.
It said Claude had made numerous mistakes in executing the attacks, at times making up facts about its targets, or claiming to have “discovered” information that was free to access,Policymakers and some experts said the findings were an unsettling sign of how capable certain AI systems have grown: tools such as Claude are now able to work independently over longer periods of time,“Wake the f up,This is going to destroy us – sooner than we think – if we don’t make AI regulation a national priority tomorrow,” the US senator Chris Murphy wrote on X in response to the findings,“AI systems can now perform tasks that previously required skilled human operators,” said Fred Heiding, a computing security researcher at Harvard University.
“It’s getting so easy for attackers to cause real damage.The AI companies don’t take enough responsibility.”Other cybersecurity experts were more sceptical, pointing to inflated claims about AI-fuelled cyber-attacks in recent years – such as an AI-powered “password cracker” from 2023 that performed no better than conventional methods – and suggesting Anthropic was trying to create hype around AI.“To me, Anthropic is describing fancy automation, nothing else,” said Michał Woźniak, an independent cybersecurity expert.“Code generation is involved, but that’s not ‘intelligence’, that’s just spicy copy-paste.
”Woźniak said Anthropic’s release was a distraction from a bigger cybersecurity concern: businesses and governments integrating “complex, poorly understood” AI tools into their operations without understanding them, exposing them to vulnerabilities.The real threat, he said, were cybercriminals themselves – and lax cybersecurity practices.Sign up to TechScapeA weekly dive in to how technology is shaping our livesafter newsletter promotionAnthropic, like all leading AI companies, has guardrails that are supposed to stop its models from assisting in cyber-attacks – or promoting harm generally.However, it said, the hackers were able to subvert these guardrails by telling Claude to role-play being an “employee of a legitimate cybersecurity firm” conducting tests.Woźniak said: “Anthropic’s valuation is at around $180bn, and they still can’t figure out how not to have their tools subverted by a tactic a 13-year-old uses when they want to prank-call someone.
”Marius Hobbhahn, the founder of Apollo Research, a company that evaluates AI models for safety, said the attacks were a sign of what could come as capabilities grow.“I think society is not well prepared for this kind of rapidly changing landscape in terms of AI and cyber capabilities.I would expect many more similar events to happen in the coming years, plausibly with larger consequences.”The best public interest journalism relies on first-hand accounts from people in the know.If you have something to share on this subject, you can contact us confidentially using the following methods.
Secure Messaging in the Guardian appThe Guardian app has a tool to send tips about stories.Messages are end to end encrypted and concealed within the routine activity that every Guardian mobile app performs.This prevents an observer from knowing that you are communicating with us at all, let alone what is being said.If you don't already have the Guardian app, download it (iOS/Android) and go to the menu.Select ‘Secure Messaging’.
SecureDrop, instant messengers, email, telephone and postIf you can safely use the Tor network without being observed or monitored, you can send messages and documents to the Guardian via our SecureDrop platform,Finally, our guide at theguardian,com/tips lists several ways to contact us securely, and discusses the pros and cons of each,
Reeves could allow holiday tax on English hotel and Airbnb stays
British holidaymakers could have to pay a nightly tax on hotel stays and Airbnb-style visits in plans expected to be announced by Rachel Reeves in the budget next week.The chancellor is reportedly preparing to give mayors powers to raise taxes by charging tourists on the cost of an overnight stay in their cities.The tax could raise hundreds of millions of pounds for mayors to invest in transport and public services, but it would represent a further blow for the hospitality industry, which was squeezed by tax rises and extra employment costs announced in the last budget.The trade body UKHospitality, which represents thousands of restaurants, hotels and pubs, said a tourism tax of 5% – the rate to be set by Edinburgh from next July – would mean an effective consumer tax of 27%. That figure includes standard 20% VAT on the hotel stay, as well as VAT on the holiday tax itself, making it one of the highest tourist tax rates in Europe, the trade body said
Thames Water bidder says it is offering £1bn extra cash injection
A bidder for Thames Water has said it would inject £1bn more into the struggling utility company than rival proposals if it gained control.John Reynolds, the chief executive of the independent water retailer Castle Water, said the current plans under discussion with creditors to rebuild Thames Water’s finances does not go far enough and does not properly address its environmental crisis.Castle Water would provide a cash injection of at least £1bn over current proposals, he told the Times.“No one wants a restructuring that does not stick. The negotiations are not heading anywhere,” he said
Father of teen whose death was linked to social media has ‘lost faith’ in Ofcom
The father of Molly Russell, a British teenager who killed herself after viewing harmful online content, has called for a change in leadership at the UK’s communications watchdog after losing faith in its ability to make the internet safer for children.Ian Russell, whose 14 year-old daughter took her own life in 2017, said Ofcom had “repeatedly” demonstrated that it does not grasp the urgency of keeping under-18s safe online and was failing to implement new digital laws forcefully.“I’ve lost confidence in the current leadership at Ofcom,” he told the Guardian. “They have repeatedly demonstrated that they don’t grasp the urgency of this task and they have shown that they don’t seem to be willing to use their powers to the extent that is required.”Russell’s comments came in the same week the technology secretary, Liz Kendall, wrote to Ofcom saying she was “deeply concerned” about delays in rolling out parts of the Online Safety Act (OSA), a landmark piece of legislation laying down safety rules for social media, search and video platforms
Personal details of Tate galleries job applicants leaked online
Personal details submitted by applicants for a job at Tate art galleries have been leaked online, exposing their addresses, salaries and the phone numbers of their referees, the Guardian has learned.The records, running to hundreds of pages, appeared on a website unrelated to the government-sponsored organisation, which operates the Tate Modern and Tate Britain galleries in London, Tate St Ives in Cornwall and Tate Liverpool.The data includes details of applicants’ current employers and education, and relates to the Tate’s hunt for a website developer in October 2023. Information about 111 individuals is included. They are not named but their referees are, sometimes with mobile numbers and personal email addresses
Déjà boo: Sam Darnold didn’t think he’d see ghosts on the field again. Then he faced the Rams
The Seahawks quarterback has looked like an MVP this season. But his old failings returned in Los Angeles on SundayThe biggest game of Week 11 was undoubtedly the matchup between the Los Angeles Rams and the Seattle Seahawks. Both teams came in with 7-2 records, and were seemingly evenly matched on both sides of the ball, with dynamic offenses and stingy defenses. In the end, it was a defensive battle that the Rams won, 21-19, by the skin of their teeth.Seahawks quarterback Sam Darnold, who had played at a near-MVP level this season for the most part, did absolutely nothing to help his team – and plenty to hurt them
England keep sights on rugby’s Everest in relentless climb to game’s summit | Robert Kitson
After finally scaling Mount Everest with Tenzing Norgay on 29 May 1953 the first person Edmund Hillary encountered on his descent was his longtime climbing friend, George Lowe. “Well, George,” Hillary said, “we knocked the bastard off.” Which is basically how England’s captain, Maro Itoje, and his team felt on Saturday having lifted the Hillary Shield, named in honour of the indomitable New Zealander who conquered the world’s most famous summit.English rugby’s ultimate Everest is still up ahead of them, of course, in the form of the 2027 World Cup, but this was their South Col moment. And while a first home win against the All Blacks since 2012 and their second‑highest margin of victory in this 120-year-old fixture will both be sources of satisfaction there was also a powerful sense that their upwardly mobile trek is far from complete
It’s not all about roasting on an open fire – there’s so much more you can do with chestnuts
Benjamina Ebuehi’s recipe for apple, brown butter and oat loaf | The sweet spot
Kids have a wobble in the face of rabbit jelly | Brief letters
Think autumn, think Piedmont – wine from ‘the foot of the mountain’
‘I’m now a one-issue voter’: US shoppers fear Italian pasta tariff will cause shortage
Jimi Famurewa’s recipe for puff-puff pancakes