Anthropic makes its most powerful AI model available to the security team

Today's software systems are becoming more complex and have many bugs that human engineers cannot even find. AI is becoming a powerful ally in identifying these risks. The well-known AI firm Anthropic has published a ton of incredible data. In just a few months, their joint efforts helped discover more than ten thousand software vulnerabilities. AI is able to comb through mountains of code fast and precisely, finding those hidden vulnerabilities. This efficiency is far beyond what traditional manual checks can match.

Of these discovered vulnerabilities tens of thousands are marked as extremely dangerous high risk. If hackers exploit these vulnerabilities to carry out attacks, important data leakage or system paralysis may occur. The data discovered may only be the tip of the iceberg. Due to the relatively limited testing scope, the actual number of existing vulnerabilities could be five times or more than what we know currently.

In the past, to prevent AI from being exploited by bad people, the system would limit its ability to generate dangerous code. However, this restriction also tied the hands of AI in its search for vulnerabilities. To allow AI to exert its maximum troubleshooting capabilities, developers had to make a difficult decision. They chose to reduce the built-in security protection measures of the model. Anthropic decided to open the strongest models to security experts who had undergone strict review. The experts could let the AI freely attack and test software in a controlled environment.

People are worried that if AI acquires intrusion skills before adequate software protection is in place, it may bring huge risks. AI's learning ability is too strong. Once it learns how to bypass security mechanisms, it is difficult to ensure that it will not engage in boundary-crossing behavior. However, the research team believes that in the face of increasingly rampant cyber attacks, the defense side must also have equally powerful weapons.

Anthropic has launched a brand-new hierarchical management system. This system divides access permissions into three different levels. The most basic one is the defense level, mainly for ordinary security teams and open-source project maintainers. They can use AI to analyze malicious software or carry out emergency remediation after the system is attacked. The second level is the red team level. The red team is a testing team that simulates hacker attacks. This level allows for deeper authorized penetration testing, but the application must be made on behalf of the enterprise or organization, and individuals cannot obtain it at will.

The greatest authority and the least restrictive is the professional level. Only a very few institutions with special approval can enter this level. They can use the most powerful AI models to test power grids and transfer networks between banks. If these systems malfunction, they will affect the normal operation of society. Therefore, the threshold for the professional level is extremely high. Company will transfer members who previously participated in core projects to this level.

At the highest level of authority approval, Anthropic does not make the final decision on its own. The company announced that it will work with the US government to review the qualifications of each professional-level member. The government has a broad vision of security and strict standards of regulation, enterprises have the most advanced technological capabilities. By joining forces, both parties can ensure that the most powerful AI tools are only used on the right path for protecting the country's critical infrastructure.

The development of AI can not solely rely on the self-discipline of enterprises, it also requires the establishment of a multi-party participation governance framework. Through the establishment of strict entry thresholds and hierarchical authorization systems, tech giants are exploring a new path for technology to be beneficial. In the future, as AI models become increasingly intelligent, similar security verification plans may become standard practices in the industry.