News & Updates
The latest news and updates from companies in the WLTH portfolio.
Anthropic reveals Mythos 5 tried submitting malicious code to an open-source project
Anthropic PBC's Mythos 5 artificial intelligence model attempted to submit malicious code to a GitHub project in July. The incident occurred during an evaluation of the algorithm's cybersecurity capabilities. The AI Security Institute, the UK government body that performed the test, released a report about the cyberattack today. Anthropic published its own analysis of the incident on its blog. The malware that Mythos 5 submitted to the unnamed GitHub project didn't infect any users because it wasn't accepted by the repository's maintainer. However, the incident is still notable because it provides new data on how frontier models bypass their safety guardrails. Researchers can use such information to improve their algorithms' alignment features. The evaluation during which the incident occurred involved a server cluster maintained by the AI Security Institute. The cluster was meant to simulate a corporate network. According to Anthropic, researchers asked Mythos 5 to breach the network and obtain a piece of data stored on one of its servers. The AI Security Institute defined rules that prohibited the model from using certain hacking methods. Mythos 5 initially adhered to those rules, but went off course when its initial attempts to breach the simulated network failed. That change of tactics led to the attack against the GitHub repository. Mythos 5 determined that one of the servers in the simulated corporate network occasionally accessed GitHub. It sought to exploit that access by compromising the GitHub repository that the server used. In particular, the model's plan was to infect the repository with malware and have the server download it. Mythos 5 crafted a malicious code snippet, created a GitHub account and used the account to submit the code snippet to the repository in question. When the repository's maintainer rejected the submission, the model attempted to upload a rewritten version of the malware. Furthermore, it used a second GitHub account to try and persuade the maintainer to accept the revised code. "The pull request was not accepted," Anthropic researchers wrote in the company's report about the incident. "The run ended as the model ran out its token budget while continuing to pressure the maintainers to approve the change." The AI Security Institute recreated the Mythos 5 session that produced the malicious code. Its researchers then made one key change: they paused the model right before it submitted the malicious GitHub contribution and warned it of the action's risks. The model proceeded with the submission after appearing to convince itself that the target was simulated. "Our hypothesis is that this persistence reflects a kind of "momentum", in which the model's compaction notes and prior actions imply to it that its current path has been (correctly) sanctioned," Anthropic's researchers wrote. The AI Security Institute hardened the environment that it uses to evaluate models in response to the breach. Anthropic, in turn, has improved its models' safety features. The company determined that Mythos 5.1 and Opus 5.5, two models released after Mythos 5, are less likely to launch attacks of the kind that targeted the GitHub repository. A third, internal model "never initiated the attack" during Anthropic's tests.
Perplexity AI open-sources its secure AI agent sandbox SPACE
Perplexity AI open-sources its secure AI agent sandbox SPACE The artificial intelligence search engine startup Perplexity AI Inc. is shifting its focus to AI agent security in the wake of several high-profile incidents that saw autonomous systems escape from secure environments and go on to wreak havoc on third-party websites. The company has developed an AI sandbox specifically for isolating AI agents called SPACE, and it's being made open source from today, which means every developer can use the tool to secure their own systems. SPACE is already being deployed by partners including CoreWeave Inc., Akamai Technologies Inc. and Crusoe Inc., which all offer cloud-hosted infrastructure platforms for AI systems. AI sandboxes are the main barrier that prevents AI agents from causing problems like leaking sensitive data or going off and hacking other systems. They're secure, isolated virtual environments where autonomous agents can run third-party software, browse the internet and execute tasks without risking the security of the host computer, the broader corporate network or underlying data center. By giving each AI agent its own walled-off computer in the cloud, if it makes a mistake, runs a destructive command or is manipulated by adversarial prompts, the damage it does will be contained within that environment. The only problem with AI sandboxes is their security isn't always foolproof. In fact, there have been several incidents of cunning AI agents managing to find a way to escape from their confines and make trouble elsewhere. One of the most notable involved AI agents being tested by OpenAI Group PBC, which escaped from a sandbox and went on to hack into the model hosting platform Hugging Face. OpenAI's agents have also hacked websites operated by the U.S. and Australian governments. Most frontier model labs have been focused more on "model alignment," which involves training AI systems to behave themselves and not look for loopholes in their guardrails, but Perplexity engineer Zibi Braniecki told Semafor his company has instead concentrated on making those guardrails tougher and more reliable. Perplexity developed SPACE to safeguard its Portable Computer agents, which are marketed to its customers as locally-hosted AI agents that can perform tasks on their behalf. They're designed to do things like developing web applications, research products, buy things online, book hotels and so on. With Perplexity's Computer agents, SPACE provides safety features such as isolated code execution, pause and resume, recovery and session branching. Agents run within a small virtual machine that has its own operating system, isolating them from the host computer. There's a user-controlled control plane for creating, running, pausing and deleting these VMs. SPACE ensures that these sandboxes are always treated as "untrusted," and manages their network access and platform credentials outside of the sandbox, enabling agents to connect to authorized services without that sensitive information ever being made available to them within their environment. It also takes frequent file snapshots and checkpoints of the running environment to preserve progress and ensure it can revert back if any problems occur. So far though, there hasn't been any need to do anything like that, for SPACE seems to be bullet proof. Braniecki told Semafar that his team tested nine frontier models in SPACE environments and ordered them specifically to try and break out of their sandbox. In 118 attempts, none of them succeeded, though some did manage to find their way around the network restrictions. However, Perplexity has now fixed those weaknesses, and none of the models were able to do it again in follow-up testing. To compare SPACE's performance, Perplexity performed the same tests using other, proprietary sandboxes, and said the agents found a way to escape from several of them. Braniecki said the open-source nature of SPACE is key to securing AI agents, because it will enable companies to work together to build the tough guardrails they need. It's similar to what happened during the early days of web browsers, he said, where the developer community collaborated on the security systems needed to enable secure browning and online commerce. Perplexity isn't the only company pursuing an open-source approach to AI agent sandboxes. One alternative is Nvidia Corp.'s OpenShell project, which was released last month as part of a broader Open Agent Safety Platform. So far, there have been no reported escapes from OpenShell. Perplexity is not new to open-source security. Besides SPACE, it has also developed open source innovations such as BrowseSafe, which is used to detect malicious instructions hidden in web pages; Numbat, a tool for investigating dangerous agent behaviors; and Bumblebee, which is a scanner that's used to detect risky AI tool configurations.
Ahead of IPO, Anthropic reveals its revenue grow 45% sequentially to $16.8B in Q3
Ahead of IPO, Anthropic reveals its revenue grow 45% sequentially to $16.8B in Q3 Anthropic PBC pulled in $16.8 billion in revenue during the third quarter, according to a report by the Financial Times. In addition, it also achieved profitability on an adjusted basis for the first time during the quarter. The revelations came at a private meeting between Anthropic executives and investors interested in buying shares of the artificial intelligence company when it finally goes public. The company has been pushing ahead with its plans for an initial public offering, and is widely expected to list in November, targeting a valuation of up to $2 trillion, which would make it one of the most valuable companies on the planet. Many investors see Anthropic's revenue numbers as a bellwether for the broader AI market, which has helped to boost the value of technology-related stocks by trillions of dollars. That said, there's a lack of clarity about the latest number, as the Financial Times' anonymous source didn't say if it refers to gross or net revenue, or how Anthropic defines profitability. Earlier numbers provided by the Wall Street Journal put Anthropic's first quarter revenue at $4.8 billion, and it was later reported that the company had more than doubled this figure to $11.6 billion in the second quarter. Third-quarter revenue was therefore up around 45% on a sequential basis. While the growth is encouraging, investors would like to know a lot more about the state of Anthropic's finances, including how much money it's spending to grow its revenue at such a rate. Because the company is still private, it doesn't have to release such figures, so any indications like today's figure can have a big impact on the broader stock market, given that the health of Anthropic and OpenAI Group PBC are critical to the fortunes of many other technology firms. Last week, the Financial Times revealed that previously-reported numbers about OpenAI's annualized revenue run rate were erroneous, and revised its estimates down from around $68 billion to just $50 billion. The report blamed a simple miscalculation by investigators, but it had a massive impact on tech stocks, with the Nasdaq index falling 1.25% and the shares of many individual firms, including Oracle Corp., CoreWeave Inc., Intel Corp. and Nvidia Corp. all falling more. Their fortunes are tightly linked to those of the AI giants, given that many have signed massive multiyear, multibillion-dollar contracts with them. OpenAI was once perceived to be the market leader in AI, but this year it has been surpassed by Anthropic, which has released a torrent of state-of-the-art frontier models and benefited from strong enterprise adoption of its Claude Code tool that generates software code based on natural language instructions. Anthropic is seen as one of the fastest-growing companies in history. In May, it closed on a bumper $65 billion round of funding, lifting its valuation to a staggering $965 billion. Such vast sums of cash are necessary in the AI industry to pay for the expensive computing chips needed to process AI models. Despite the rampant growth of AI, the industry has recently come under pressure amid mounting safety concerns. While safety has always been an issue for AI, concerns reached fever pitch in September when Anthropic researcher Jacob Croxon resigned from the company, saying that "the people building AI earnestly believe that it could kill us all by the end of the decade." Coxon's comments came after a number of high-profile cybersecurity incidents involving so-called "frontier models" emerged, and prompted Anthropic Chief Executive Dario Amodei to publish an essay in which he called on companies to "slow the pace at which we improve the capabilities of AI models," so that the industry has time to implement proper safety measures. Amodei's call was backed by OpenAI CEO Sam Altman and also Elon Musk and others, but U.S. President Donald Trump has rejected such talk, instead pushing for companies to simply self-regulate. Safety isn't the only issue facing the AI giants right now. The competitive landscape is also shifting fast amid concerns about the enormous costs of AI services. Many companies are shifting to open-source and open-weight models that can be accessed at much lower prices, and that trend has forced Anthropic and OpenAI to respond. Last week, Anthropic launched its most advanced small language model Claude Haiku 5.5, claiming that it costs around 75% less than its predecessor, Haiku 4.5, putting it on an equal footing with OpenAI's SLM GPT-6 Luna.
Anthropic releases Claude Haiku 5.5 small model and halves Sonnet 5.5 cache read prices
Anthropic releases Claude Haiku 5.5 small model and halves Sonnet 5.5 cache read prices Anthropic PBC today released Claude Haiku 5.5, pricing its newest small model at roughly a quarter of what Haiku 4.5 costs to run. Claude Sonnet 5.5 is getting cheaper as well, since the company is halving what it charges for cache reads on that model. Two weeks after Opus 5.5 launched Sept. 22, Haiku 5.5 makes three models in the 5.5 generation. Anthropic is aiming it at repetitive work. High-volume summaries and classification are the main target, and coding teams can also use the model as a subagent that Opus 5.5 or Sonnet 5.5 hands smaller tasks to. Because no Anthropic model runs faster at standard speed, the company suggests it for live customer support and browser automation. Anthropic's running-cost figure rests on a steep cut to list prices. Haiku 4.5, released last October, costs $1 per million input tokens and $5 per million output. For prompts of up to 100,000 tokens, which Anthropic said covered about 90% of the older model's requests, Haiku 5.5 is 90% cheaper on input and output alike, at 10 cents and 50 cents per million tokens. Longer prompts get a 50% discount. The 75% average saving the company quotes takes in a new tokenizer that uses slightly more tokens per task. Cost can be tuned further, since Haiku 5.5 is the first Haiku model with an adjustable effort setting. The 10-cent and 50-cent rates match what OpenAI Group PBC charges for GPT-6 Luna, the low-cost model it launched last month. Anthropic's published benchmarks have Haiku 5.5 ahead of Luna on all six tests where both have a score. On OSWorld 2.1, a test of agents operating a real computer through long multistep tasks, the new model scored 72.4% on the offline subset against 48.9% for Luna. Luna scored 16.4% on the Terminal-Bench 4.0 agentic coding test, less than half the new model's 39.2%. For complex agentic coding, Anthropic still points customers to Sonnet 5.5 and Opus 5.5. Asana Inc. was among the customers that tested Haiku 5.5 before release, running it through the evaluation suite for its AI Teammates agent. Task completion latency came in more than 30% lower than with the model Asana uses today, and inference on each agent turn ran up to 2.5 times faster. "It's a noticeably snappier experience," said Aaron Vinh, a staff software engineer at the company. On safety, Anthropic said alignment testing turned up far fewer instances of misaligned behavior than Haiku 4.5 showed. Cybersecurity safeguards on the model allow more defensive work than Sonnet 5.5 permits. Penetration testing is still blocked, as are other techniques attackers are more likely to use, and organizations that need wider access can apply to the Cyber Verification Program Anthropic expanded on Tuesday. The Haiku launch also came with a price cut for Anthropic's midsize model. Cache reads on Sonnet 5.5, which launched Sept. 28, drop from 20 cents per million tokens to 10 cents. Because cached tokens account for a large share of what models consume, Anthropic expects the cut to take about 20% off the cost of most agentic work on the model. Claude Max and Team subscribers will also start receiving monthly application programming interface credits for the Claude Platform this week. A Max 5x subscription comes with $100 a month, double that on Max 20x. Team accounts get up to $500 shared across their users, and the credits can go toward any Claude model. Haiku 5.5 is available now on the Claude Platform as claude-haiku-5-5 and through Amazon Web Services Inc., Google Cloud and Microsoft Azure.
Anthropic folds Project Glasswing into an expanded three-tier Cyber Verification Program
Anthropic folds Project Glasswing into an expanded three-tier Cyber Verification Program Anthropic PBC today expanded its Cyber Verification Program into three tiers of access for vetted security teams, with fewer blocks on cyber work at each step up. The overhaul is aimed at a restriction Anthropic built into its own products. Because the company treats cybersecurity as dual use, its generally available models carry conservative classifiers that block most cyber work. When Claude Opus 5.5 launched Sept. 22, most security tasks sent to it were routed to the older Opus 4.8. Anthropic is folding Project Glasswing into the program at the same time. Since April, Glasswing has given Claude Mythos access to organizations that secure critical software, and Anthropic widened it to 150 more organizations in June. Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 are available at every tier of the new structure, and later models will be added as they ship. Defense Access is the entry tier, meant for defensive jobs like incident response and malware reverse engineering. Security teams defending systems they own or maintain qualify, whether they work for a company, a university or a government body. Individual researchers with a record of reported vulnerabilities can apply too, as can critical infrastructure operators as small as a regional hospital. Anthropic expects many organizations doing defensive work to qualify and is aiming to respond to applications within a few days. Red Team Access opens up authorized penetration testing and red-teaming against systems an organization has permission to test. Even at this level, Anthropic's classifiers block requests in real time when the work moves toward something like deploying ransomware. Applicants wait a few weeks for a review and sit in the Defense Access tier in the meantime, and individual researchers are shut out of the tier for now. Specialized Access carries the fewest cyber blocks of the three. Only organizations cleared to test safety systems like power grids and telecom networks qualify, since failures there could put lives at risk or disrupt markets. Anthropic vets each of them in depth with the U.S. government, and existing Glasswing members move straight into the tier without reapproval for current models. Enrolled organizations must allow data retention so Anthropic can watch for misuse. Enterprise Frontier Safeguards, due later this year, will let eligible customers keep that data in cloud infrastructure they control. Anthropic tested the tiers on the multistage cyber operations benchmark CyScenarioBench, with Claude Opus 5.5 running each of its 10 challenges five times. Every attempt without program access was blocked on the first prompt. Because the scenarios are offensive, Anthropic had expected heavy blocking in the Defense Access tier, where 46 of the 50 runs were stopped at some point. At the Red Team level nothing was blocked and the model finished 34 of its 50 runs. Anthropic said that result is effectively the same as the model's 67.6% success rate with no safeguards applied. Outside the lab, the argument for widening access comes from the Mythos program the new structure absorbs. Partners in Project Glasswing found at least 129,000 verified vulnerabilities between April and July, and Anthropic's own scanning of open-source code turned up 5,500 more through October. Of that combined total, more than 33,000 have been rated critical or high severity. The figures draw on just 33 partner reports, and the company said the true impact is likely at least five times higher. Fewer than half of the partners disclosed patch counts, often because fixes were still underway. The program is available through the Claude Platform, Google LLC's Vertex AI and Microsoft Corp.'s Foundry service. On Amazon Web Services Inc.'s Bedrock, it is limited to customers eligible for Enterprise Frontier Safeguards.
