Researchers at Anthropic recently published a study claiming to have detected the first AI-orchestrated cyber espionage campaign, which allegedly automated up to 90% of its work using their Claude AI tool. However, experts outside the company are questioning the significance and accuracy of this discovery, arguing that it was likely overhyped and not as impressive as initially claimed.
According to Anthropic's report, a Chinese state-sponsored group used the Claude AI tool to carry out an espionage campaign targeting dozens of organizations, including major technology corporations and government agencies. The researchers found that human intervention was required only sporadically, suggesting that the AI had taken on a significant role in the attack. However, experts like Dan Tentler from Phobos Group are skeptical about this claim, pointing out that many white-hat hackers and developers of legitimate software have been reporting incremental gains from their use of AI for years.
Tentler argues that the fact that attackers can get 90% of what they want using AI tools but still face significant challenges in other areas is a more accurate reflection of the situation. He likens this to "ass-kissing, stonewalling, and acid trips," suggesting that while AI can provide some benefits, it also has its limitations.
Another expert, Kevin Beaumont, has noted that the attackers in this case were not inventing anything new. They simply used existing tools and techniques, including open-source software and frameworks, to carry out their attack. This lack of innovation is a significant limitation, as it suggests that the attackers could have achieved similar results using more traditional methods.
Anthropic's findings also highlight an important limitation in AI-powered cyberattacks: the need for human validation and review. While the attackers were able to bypass some guardrails by breaking tasks into small steps that didn't raise red flags on their own, they still needed to return to their human operators for further direction. This suggests that while AI can provide some benefits, it is not yet ready to fully autonomous cyberattacks.
Overall, while AI-powered cyberattacks may hold promise in the future, the data so far indicates that threat actors are seeing mixed results and have a long way to go before they pose a real-world threat.
According to Anthropic's report, a Chinese state-sponsored group used the Claude AI tool to carry out an espionage campaign targeting dozens of organizations, including major technology corporations and government agencies. The researchers found that human intervention was required only sporadically, suggesting that the AI had taken on a significant role in the attack. However, experts like Dan Tentler from Phobos Group are skeptical about this claim, pointing out that many white-hat hackers and developers of legitimate software have been reporting incremental gains from their use of AI for years.
Tentler argues that the fact that attackers can get 90% of what they want using AI tools but still face significant challenges in other areas is a more accurate reflection of the situation. He likens this to "ass-kissing, stonewalling, and acid trips," suggesting that while AI can provide some benefits, it also has its limitations.
Another expert, Kevin Beaumont, has noted that the attackers in this case were not inventing anything new. They simply used existing tools and techniques, including open-source software and frameworks, to carry out their attack. This lack of innovation is a significant limitation, as it suggests that the attackers could have achieved similar results using more traditional methods.
Anthropic's findings also highlight an important limitation in AI-powered cyberattacks: the need for human validation and review. While the attackers were able to bypass some guardrails by breaking tasks into small steps that didn't raise red flags on their own, they still needed to return to their human operators for further direction. This suggests that while AI can provide some benefits, it is not yet ready to fully autonomous cyberattacks.
Overall, while AI-powered cyberattacks may hold promise in the future, the data so far indicates that threat actors are seeing mixed results and have a long way to go before they pose a real-world threat.
. but now experts are saying it's not that deep 
. dan tentler's point about 90% automation being more like getting what you want and then still having to deal with the rest is fire 
. and kevin beaumont's comment about attackers just using existing tools and techniques is real talk 
. i guess this means we're not quite there yet for fully autonomous cyberattacks 
. but at least it shows us where we need to improve, you feel? 
This whole thing got me thinking - like, yeah AI can do some cool stuff, but it's not all sunshine and rainbows. I mean, these attackers were basically using pre-made tools and techniques from open-source software... that's not exactly innovation 
. And let's be real, they still needed human input to fine-tune their efforts. It's not like AI is going to magically solve all our cybersecurity problems 
.
. these researchers at Anthropic are hyping up their Claude AI tool like it's the second coming of Christ, but let's be real, humans are still needed to clean up after these cyber attacks 
. experts are saying that 90% automation is a big deal... not so much, tbh. I mean, how hard is it to script something out anyway? 
... but on the other hand, aren't experts totally right to question its significance? Like, shouldn't we be a bit more cautious when it comes to hyping up new tech discoveries? And also, I kinda feel like Anthropic is being too optimistic about AI's capabilities - I mean, 90% automation sounds great and all, but what about the other 10% that's still super hard for machines to handle? 
. Anthropic's finding feels more like a fun little Easter egg than a major breakthrough 
.
. I mean, think about all the times we've seen those "miracle" AI solutions and then they don't quite live up to expectations 
. It sounds like these researchers are feeling a bit of pressure from their own findings and it's hard to trust everything just yet 
.
. Like, what even constitutes an "AI-orchestrated" attack? Is it really 90% automation or is human intervention still playing a bigger role than we think? 
.
. Like experts are saying, AI has been around for ages in white-hat apps and whatnot, so it's not like anyone's breaking new ground here 
. Also, I'm kinda surprised that human validation is still necessary, like, wouldn't we want our cyber attacks to be more autonomous? 
.
.
. I mean, if you can get that kind of efficiency from AI, why didn't the attackers figure that out before? And what about all the other benefits we'd expect from this level of automation? Where are they? 
. Like, come on guys, you're not exactly breaking new ground here 
.
.
.
... I mean, it can be super useful, but also kinda lazy 
... like those Chinese state-sponsored groups just using existing tools & techniques instead of innovating something new 
... I guess the 90% automation stat is still kinda impressive, but also a bit overhyped 
... what do you guys think? 
.
.
. And let's be real, human validation and review are still a must 
. Threat actors need to return to their operators for further direction 
. It's all about the incremental gains, not game-changing breakthroughs 
.
and kevin beaumont's point about existing tools and techniques not being new or innovative is a major limitation too