China-Backed Hackers Use Anthropic AI to Automate Cyberattacks

SPEAKER_1 (0:00)

This message comes from Viking, committed to exploring the world in comfort. Journey through the heart of Europe on an elegant Viking longship with thoughtful service, destination-focused dining, and cultural enrichment on board and on shore. And every Viking voyage is all-inclusive with no children and no casinos. Discover more at viking.com.

Sabrina Siddiqui (0:26)

In California, there's a push for an unprecedented wealth tax on billionaires. Plus, an inflection point in hackers using AI to automate dozens of attacks on governments and corporations.

Sam Schechner (0:38)

It's an arms race, really, between AI companies and people who would misuse them.

Sabrina Siddiqui (0:43)

And Verizon plans to cut roughly 15,000 jobs in its largest reduction ever. It's Thursday, November 13th. I'm Sabrina Siddiqui for The Wall Street Journal, sitting in for Alex Osala. This is the PM Edition of What's News, the top headlines and business stories that move the world today.

We exclusively report that Verizon is planning to cut roughly 15,000 jobs in its largest reduction ever. That's according to people familiar with the matter. The cuts are likely going to happen next week, and most of them will be layoffs. The company also plans to turn about 200 stores into franchises, moving employees off its payroll. Verizon is the largest US telecom company when you're going by subscribers, but it's struggling to hold on to customers in both the wireless and home internet markets. Last month, the company named a new CEO, Dan Schulman, who is the former chief executive of PayPal and Virgin Mobile USA. He has said he would aggressively reduce the company's cost base and take steps to reverse the customer losses. In other tech and media news, Disney's stock fell more than 7% today after lackluster quarterly results that fell short of Wall Street expectations. Revenue was basically flat, and a key operating profit measure dropped 5%. The company's parks and streaming businesses posted profit gains, but investors remained worried about Disney's ability to manage the transition from traditional TV to streaming and to execute on the multi-billion dollar investments it is making in theme parks and cruise ships. We're exclusively reporting that Anthropic, one of the world's largest AI startups, said today that state-sponsored hackers from China use the company's tools for dozens of cyber attacks on governments and major corporations. Anthropic says the September hacking campaign involved an unprecedented level of automation, with a company official saying 80 to 90 percent of the attack was automated. Sam Schechner, a tech reporter at The Wall Street Journal, joins us now to discuss. Sam, is this a turning point in hackers' use of AI in their attacks?

Sam Schechner (2:57)

Yeah, it really does seem to be something of an inflection point. We've seen hackers do more and more individual tasks using AI. It helps them write phishing emails. It helps them scan for vulnerabilities. What Anthropic is reporting here is that they saw AI orchestrating an attack over all of these different steps, with humans only getting involved in a few individual choke points. And so the company itself says that this is an inflection point.

Sabrina Siddiqui (3:28)

And what do we know about the hackers, the targets, and what information they were able to get?

Sam Schechner (3:34)

We don't know that much. Anthropic did not disclose who the targets were. It said that there were roughly 30 targets that it detected, including tech corporations, financial services, a chemical company, as well as foreign governments. They wouldn't say whether the US was a target, but they did confirm that the US was not one of the handful of three or four instances where the hackers did manage to get into their target systems.

Sabrina Siddiqui (4:05)

Hackers were able to go around safeguards in Anthropic's AI tools known as CLAWD. How did they do that?

Sam Schechner (4:11)

The company says that the hackers posed as security contractors for the targets and said that they were conducting what's called penetration testing, trying to get into those targets and find vulnerabilities, which is a legitimate use of AI. And so that was how the hackers were able to sidestep some of Anthropic's protections.

Sabrina Siddiqui (4:32)

Is that an unusual approach to pose as testers?

Sam Schechner (4:36)

No. In fact, that's a pretty standard approach to what's known as jailbreaking an AI system. In this case, not only did they pose as security researchers, but they also cut the tasks into much smaller bits so that each bit didn't necessarily seem that illicit. And then they were stitched together in such a way that Claude still did most of the activity, but it didn't necessarily, each instance of it didn't understand that it was part of a broader hacking campaign.