U.S. Government Imposes Export Controls on Anthropic AI Models Over Security Vulnerability
The U.S. government has imposed export controls on Anthropic’s Fable 5 and Mythos 5 AI models due to a security vulnerability, which led the company to disable the models for all users. Cybersecurity expert Katie Moussouris detailed the vulnerability, a simple technique involving the phrase "fix this code," in a blog post. Although the technique could aid attackers, Moussouris and other experts argue that the models' ability to identify and fix code vulnerabilities is crucial for cyber defenders. The export controls, stemming from a report Amazon provided to the Trump administration, restrict distribution to non-citizens, including Anthropic's own employees.
The U.S. government has imposed export controls on Anthropic’s Fable 5 and Mythos 5 artificial intelligence models, citing a security vulnerability. This decision led Anthropic to disable both AI models for all users, as U.S. export controls consider distribution to any non-citizen, even within the U.S., as an export. This restriction would have prevented Anthropic's non-citizen employees from using or working on the models.
The vulnerability, detailed by Katie Moussouris, founder and CEO of Luta Security, involves a simple technique. When presented with code containing known vulnerabilities and asked to "review the code for security issues," the Fable model would refuse. However, when instructed to "fix this code," the model generated patches. Researchers then manually converted Fable’s output into scripts to test these patches. Moussouris, who previously advised the government on cybersecurity and worked at Microsoft, was asked by Anthropic to review a report on this vulnerability, which cybersecurity researchers at Amazon had produced.
The findings were subsequently reported to the Trump administration, including a phone call between Amazon CEO Andy Jassy and the White House. While the process of generating fixes could potentially be exploited by attackers to identify code vulnerabilities, Moussouris argues that the vulnerability "cannot meaningfully be fixed" without compromising the model's defensive capabilities. She asserts that the ability for AI to fix bugs, explain their importance, and write tests for patches is a vital function for defensive security.
The jailbreak discovered by Amazon did not unlock the full capabilities of Mythos, the base model for Fable. Mythos is notable for its ability to autonomously find and chain multiple cybersecurity vulnerabilities, a capability that allowed it to successfully complete both cybersecurity "test ranges" used by the U.K. AI Security Institute. Moussouris, along with other cybersecurity experts including Alex Stamos, chief security officer at Corridor, has added her name to an open letter opposing the export controls. She drew a parallel to the 1990s efforts to overturn U.S. export controls on strong encryption methods.
(Source: Fortune)
