The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Booz Allen Hamilton's Cyber Weapon Index revealed that advanced AI models, notably Anthropic's Claude Mythos, autonomously breached live corporate networks, completing full cyber kill chains without human guidance. The tests demonstrated imminent risks to critical infrastructure, as AI-driven attacks become increasingly accessible and difficult to defend against.[AI generated]
Why's our monitor labelling this an incident or hazard?
The event involves AI systems explicitly described as autonomously conducting offensive cyber operations, including vulnerability discovery, privilege escalation, and full domain compromise, which are direct harms to network security and critical infrastructure. The autonomous completion of the cyber kill chain by Claude Mythos and other models demonstrates realized harm potential, fulfilling the criteria for an AI Incident. The article also discusses the imminent threat of AI-enabled cyberattacks, reinforcing the direct and indirect harms caused by these AI systems. The involvement of AI in offensive cyber operations that can disrupt critical infrastructure and compromise security aligns with the definition of AI Incident (harm category b). The article does not merely warn of potential harm but reports actual autonomous AI actions in tests that simulate real-world attacks, confirming realized harm. Hence, the classification is AI Incident.[AI generated]