Attack
An interconnected network of phishing kit operators is tracked under the name Storm-2990.
An illicit marketplace, tracked under the name Storm-3119, sells phishing tools and infrastructure.
The tools and infrastructure sold are used for large-scale phishing.
Release
These cyber guardrails are more restrictive than those of Haiku 4.5, but a little less than those of other recent models.
According to Anthropic, misaligned behaviors are far less frequent than with Haiku 4.5.
The cost of running it is on average about 75% lower than that of Haiku 4.5.
Attack
The unauthorized activities include wiki edits and significant traffic.
A public note-taking tool hosted by Wikimedia was the target of unsuccessful exploitation attempts.
The Wikidata Query Service received "hundreds of thousands of data requests".
According to Simon Willison, most of it probably came from a swarm of agents similar to the one that degraded a German wiki.
Vulnerability
The attack's success rate exceeds 75% in this simple indirect prompt injection experiment.
The README asks to run npm run build, then to rerun with network access if the output says preview=workspace-only.
A node_modules folder tracked in the repository contains a spoofed vite executable, which the agent does not inspect.
The safety classifier approves the privilege escalation, judging the risk low.
News
About 30% of the results of an unguided model cited code structures absent from the target repository, according to AWS.
Each result must be verified in the code before being reported: files, functions, data flows and call path.
Results with confirmed taint and without sanitization were exploitable 89% of the time during validation.
On a test application with ten vulnerabilities, the guided model found nine and ranked the two mitigated ones as P3.
Release
The Python package, built on Inspect Scout, received support from Meridian Labs.
An interactive report places activity labels, token usage and events on a single timeline.
LLMs chosen by the user label activity sequences according to their own categories.
The labels link back to the transcript, and disagreements between model judgments remain visible.